xref: /openbsd/sys/dev/ic/ar9003.c (revision 097a140d)
1 /*	$OpenBSD: ar9003.c,v 1.53 2021/04/15 18:25:43 stsp Exp $	*/
2 
3 /*-
4  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5  * Copyright (c) 2010 Atheros Communications Inc.
6  *
7  * Permission to use, copy, modify, and/or distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 /*
21  * Driver for Atheros 802.11a/g/n chipsets.
22  * Routines for AR9003 family.
23  */
24 
25 #include "bpfilter.h"
26 
27 #include <sys/param.h>
28 #include <sys/sockio.h>
29 #include <sys/mbuf.h>
30 #include <sys/kernel.h>
31 #include <sys/socket.h>
32 #include <sys/systm.h>
33 #include <sys/malloc.h>
34 #include <sys/queue.h>
35 #include <sys/timeout.h>
36 #include <sys/conf.h>
37 #include <sys/device.h>
38 #include <sys/stdint.h>	/* uintptr_t */
39 #include <sys/endian.h>
40 
41 #include <machine/bus.h>
42 
43 #if NBPFILTER > 0
44 #include <net/bpf.h>
45 #endif
46 #include <net/if.h>
47 #include <net/if_media.h>
48 
49 #include <netinet/in.h>
50 #include <netinet/if_ether.h>
51 
52 #include <net80211/ieee80211_var.h>
53 #include <net80211/ieee80211_amrr.h>
54 #include <net80211/ieee80211_ra.h>
55 #include <net80211/ieee80211_radiotap.h>
56 
57 #include <dev/ic/athnreg.h>
58 #include <dev/ic/athnvar.h>
59 
60 #include <dev/ic/ar9003reg.h>
61 
62 int	ar9003_attach(struct athn_softc *);
63 int	ar9003_read_eep_word(struct athn_softc *, uint32_t, uint16_t *);
64 int	ar9003_read_eep_data(struct athn_softc *, uint32_t, void *, int);
65 int	ar9003_read_otp_word(struct athn_softc *, uint32_t, uint32_t *);
66 int	ar9003_read_otp_data(struct athn_softc *, uint32_t, void *, int);
67 int	ar9003_find_rom(struct athn_softc *);
68 int	ar9003_restore_rom_block(struct athn_softc *, uint8_t, uint8_t,
69 	    const uint8_t *, int);
70 int	ar9003_read_rom(struct athn_softc *);
71 int	ar9003_gpio_read(struct athn_softc *, int);
72 void	ar9003_gpio_write(struct athn_softc *, int, int);
73 void	ar9003_gpio_config_input(struct athn_softc *, int);
74 void	ar9003_gpio_config_output(struct athn_softc *, int, int);
75 void	ar9003_rfsilent_init(struct athn_softc *);
76 int	ar9003_dma_alloc(struct athn_softc *);
77 void	ar9003_dma_free(struct athn_softc *);
78 int	ar9003_tx_alloc(struct athn_softc *);
79 void	ar9003_tx_free(struct athn_softc *);
80 int	ar9003_rx_alloc(struct athn_softc *, int, int);
81 void	ar9003_rx_free(struct athn_softc *, int);
82 void	ar9003_reset_txsring(struct athn_softc *);
83 void	ar9003_rx_enable(struct athn_softc *);
84 void	ar9003_rx_radiotap(struct athn_softc *, struct mbuf *,
85 	    struct ar_rx_status *);
86 int	ar9003_rx_process(struct athn_softc *, int, struct mbuf_list *);
87 void	ar9003_rx_intr(struct athn_softc *, int);
88 int	ar9003_tx_process(struct athn_softc *);
89 void	ar9003_tx_intr(struct athn_softc *);
90 int	ar9003_swba_intr(struct athn_softc *);
91 int	ar9003_intr(struct athn_softc *);
92 int	ar9003_tx(struct athn_softc *, struct mbuf *, struct ieee80211_node *,
93 	    int);
94 void	ar9003_set_rf_mode(struct athn_softc *, struct ieee80211_channel *);
95 int	ar9003_rf_bus_request(struct athn_softc *);
96 void	ar9003_rf_bus_release(struct athn_softc *);
97 void	ar9003_set_phy(struct athn_softc *, struct ieee80211_channel *,
98 	    struct ieee80211_channel *);
99 void	ar9003_set_delta_slope(struct athn_softc *, struct ieee80211_channel *,
100 	    struct ieee80211_channel *);
101 void	ar9003_enable_antenna_diversity(struct athn_softc *);
102 void	ar9003_init_baseband(struct athn_softc *);
103 void	ar9003_disable_phy(struct athn_softc *);
104 void	ar9003_init_chains(struct athn_softc *);
105 void	ar9003_set_rxchains(struct athn_softc *);
106 void	ar9003_read_noisefloor(struct athn_softc *, int16_t *, int16_t *);
107 void	ar9003_write_noisefloor(struct athn_softc *, int16_t *, int16_t *);
108 int	ar9003_get_noisefloor(struct athn_softc *);
109 void	ar9003_apply_noisefloor(struct athn_softc *);
110 void	ar9003_bb_load_noisefloor(struct athn_softc *);
111 void	ar9003_do_noisefloor_calib(struct athn_softc *);
112 void	ar9003_init_noisefloor_calib(struct athn_softc *);
113 int	ar9003_init_calib(struct athn_softc *);
114 void	ar9003_do_calib(struct athn_softc *);
115 void	ar9003_next_calib(struct athn_softc *);
116 void	ar9003_calib_iq(struct athn_softc *);
117 int	ar9003_get_iq_corr(struct athn_softc *, int32_t[], int32_t[]);
118 int	ar9003_calib_tx_iq(struct athn_softc *);
119 void	ar9003_paprd_calib(struct athn_softc *, struct ieee80211_channel *);
120 int	ar9003_get_desired_txgain(struct athn_softc *, int, int);
121 void	ar9003_force_txgain(struct athn_softc *, uint32_t);
122 void	ar9003_set_training_gain(struct athn_softc *, int);
123 int	ar9003_paprd_tx_tone(struct athn_softc *);
124 int	ar9003_compute_predistortion(struct athn_softc *, const uint32_t *,
125 	    const uint32_t *);
126 void	ar9003_enable_predistorter(struct athn_softc *, int);
127 void	ar9003_paprd_enable(struct athn_softc *);
128 void	ar9003_paprd_tx_tone_done(struct athn_softc *);
129 void	ar9003_write_txpower(struct athn_softc *, int16_t power[]);
130 void	ar9003_reset_rx_gain(struct athn_softc *, struct ieee80211_channel *);
131 void	ar9003_reset_tx_gain(struct athn_softc *, struct ieee80211_channel *);
132 void	ar9003_hw_init(struct athn_softc *, struct ieee80211_channel *,
133 	    struct ieee80211_channel *);
134 void	ar9003_get_lg_tpow(struct athn_softc *, struct ieee80211_channel *,
135 	    uint8_t, const uint8_t *, const struct ar_cal_target_power_leg *,
136 	    int, uint8_t[]);
137 void	ar9003_get_ht_tpow(struct athn_softc *, struct ieee80211_channel *,
138 	    uint8_t, const uint8_t *, const struct ar_cal_target_power_ht *,
139 	    int, uint8_t[]);
140 void	ar9003_set_noise_immunity_level(struct athn_softc *, int);
141 void	ar9003_enable_ofdm_weak_signal(struct athn_softc *);
142 void	ar9003_disable_ofdm_weak_signal(struct athn_softc *);
143 void	ar9003_set_cck_weak_signal(struct athn_softc *, int);
144 void	ar9003_set_firstep_level(struct athn_softc *, int);
145 void	ar9003_set_spur_immunity_level(struct athn_softc *, int);
146 
147 /* Extern functions. */
148 void	athn_stop(struct ifnet *, int);
149 int	athn_interpolate(int, int, int, int, int);
150 int	athn_txtime(struct athn_softc *, int, int, u_int);
151 void	athn_inc_tx_trigger_level(struct athn_softc *);
152 int	athn_tx_pending(struct athn_softc *, int);
153 void	athn_stop_tx_dma(struct athn_softc *, int);
154 void	athn_get_delta_slope(uint32_t, uint32_t *, uint32_t *);
155 void	athn_config_pcie(struct athn_softc *);
156 void	athn_config_nonpcie(struct athn_softc *);
157 uint8_t	athn_chan2fbin(struct ieee80211_channel *);
158 
159 
160 int
161 ar9003_attach(struct athn_softc *sc)
162 {
163 	struct athn_ops *ops = &sc->ops;
164 	int error;
165 
166 	/* Set callbacks for AR9003 family. */
167 	ops->gpio_read = ar9003_gpio_read;
168 	ops->gpio_write = ar9003_gpio_write;
169 	ops->gpio_config_input = ar9003_gpio_config_input;
170 	ops->gpio_config_output = ar9003_gpio_config_output;
171 	ops->rfsilent_init = ar9003_rfsilent_init;
172 
173 	ops->dma_alloc = ar9003_dma_alloc;
174 	ops->dma_free = ar9003_dma_free;
175 	ops->rx_enable = ar9003_rx_enable;
176 	ops->intr = ar9003_intr;
177 	ops->tx = ar9003_tx;
178 
179 	ops->set_rf_mode = ar9003_set_rf_mode;
180 	ops->rf_bus_request = ar9003_rf_bus_request;
181 	ops->rf_bus_release = ar9003_rf_bus_release;
182 	ops->set_phy = ar9003_set_phy;
183 	ops->set_delta_slope = ar9003_set_delta_slope;
184 	ops->enable_antenna_diversity = ar9003_enable_antenna_diversity;
185 	ops->init_baseband = ar9003_init_baseband;
186 	ops->disable_phy = ar9003_disable_phy;
187 	ops->set_rxchains = ar9003_set_rxchains;
188 	ops->noisefloor_calib = ar9003_do_noisefloor_calib;
189 	ops->init_noisefloor_calib = ar9003_init_noisefloor_calib;
190 	ops->get_noisefloor = ar9003_get_noisefloor;
191 	ops->apply_noisefloor = ar9003_apply_noisefloor;
192 	ops->do_calib = ar9003_do_calib;
193 	ops->next_calib = ar9003_next_calib;
194 	ops->hw_init = ar9003_hw_init;
195 
196 	ops->set_noise_immunity_level = ar9003_set_noise_immunity_level;
197 	ops->enable_ofdm_weak_signal = ar9003_enable_ofdm_weak_signal;
198 	ops->disable_ofdm_weak_signal = ar9003_disable_ofdm_weak_signal;
199 	ops->set_cck_weak_signal = ar9003_set_cck_weak_signal;
200 	ops->set_firstep_level = ar9003_set_firstep_level;
201 	ops->set_spur_immunity_level = ar9003_set_spur_immunity_level;
202 
203 	/* Set MAC registers offsets. */
204 	sc->obs_off = AR_OBS;
205 	sc->gpio_input_en_off = AR_GPIO_INPUT_EN_VAL;
206 
207 	if (!(sc->flags & ATHN_FLAG_PCIE))
208 		athn_config_nonpcie(sc);
209 	else
210 		athn_config_pcie(sc);
211 
212 	/* Determine ROM type and location. */
213 	if ((error = ar9003_find_rom(sc)) != 0) {
214 		printf("%s: could not find ROM\n", sc->sc_dev.dv_xname);
215 		return (error);
216 	}
217 	/* Read entire ROM content in memory. */
218 	if ((error = ar9003_read_rom(sc)) != 0) {
219 		printf("%s: could not read ROM\n", sc->sc_dev.dv_xname);
220 		return (error);
221 	}
222 
223 	/* Determine if it is a non-enterprise AR9003 card. */
224 	if (AR_READ(sc, AR_ENT_OTP) & AR_ENT_OTP_MPSD)
225 		sc->flags |= ATHN_FLAG_NON_ENTERPRISE;
226 
227 	ops->setup(sc);
228 	return (0);
229 }
230 
231 /*
232  * Read 16-bit word from EEPROM.
233  */
234 int
235 ar9003_read_eep_word(struct athn_softc *sc, uint32_t addr, uint16_t *val)
236 {
237 	uint32_t reg;
238 	int ntries;
239 
240 	reg = AR_READ(sc, AR_EEPROM_OFFSET(addr));
241 	for (ntries = 0; ntries < 1000; ntries++) {
242 		reg = AR_READ(sc, AR_EEPROM_STATUS_DATA);
243 		if (!(reg & (AR_EEPROM_STATUS_DATA_BUSY |
244 		    AR_EEPROM_STATUS_DATA_PROT_ACCESS))) {
245 			*val = MS(reg, AR_EEPROM_STATUS_DATA_VAL);
246 			return (0);
247 		}
248 		DELAY(10);
249 	}
250 	*val = 0xffff;
251 	return (ETIMEDOUT);
252 }
253 
254 /*
255  * Read an arbitrary number of bytes at a specified address in EEPROM.
256  * NB: The address may not be 16-bit aligned.
257  */
258 int
259 ar9003_read_eep_data(struct athn_softc *sc, uint32_t addr, void *buf, int len)
260 {
261 	uint8_t *dst = buf;
262 	uint16_t val;
263 	int error;
264 
265 	if (len > 0 && (addr & 1)) {
266 		/* Deal with non-aligned reads. */
267 		addr >>= 1;
268 		error = ar9003_read_eep_word(sc, addr, &val);
269 		if (error != 0)
270 			return (error);
271 		*dst++ = val & 0xff;
272 		addr--;
273 		len--;
274 	} else
275 		addr >>= 1;
276 	for (; len >= 2; addr--, len -= 2) {
277 		error = ar9003_read_eep_word(sc, addr, &val);
278 		if (error != 0)
279 			return (error);
280 		*dst++ = val >> 8;
281 		*dst++ = val & 0xff;
282 	}
283 	if (len > 0) {
284 		error = ar9003_read_eep_word(sc, addr, &val);
285 		if (error != 0)
286 			return (error);
287 		*dst++ = val >> 8;
288 	}
289 	return (0);
290 }
291 
292 /*
293  * Read 32-bit word from OTPROM.
294  */
295 int
296 ar9003_read_otp_word(struct athn_softc *sc, uint32_t addr, uint32_t *val)
297 {
298 	uint32_t reg;
299 	int ntries;
300 
301 	reg = AR_READ(sc, AR_OTP_BASE(addr));
302 	for (ntries = 0; ntries < 1000; ntries++) {
303 		reg = AR_READ(sc, AR_OTP_STATUS);
304 		if (MS(reg, AR_OTP_STATUS_TYPE) == AR_OTP_STATUS_VALID) {
305 			*val = AR_READ(sc, AR_OTP_READ_DATA);
306 			return (0);
307 		}
308 		DELAY(10);
309 	}
310 	return (ETIMEDOUT);
311 }
312 
313 /*
314  * Read an arbitrary number of bytes at a specified address in OTPROM.
315  * NB: The address may not be 32-bit aligned.
316  */
317 int
318 ar9003_read_otp_data(struct athn_softc *sc, uint32_t addr, void *buf, int len)
319 {
320 	uint8_t *dst = buf;
321 	uint32_t val;
322 	int error;
323 
324 	/* NB: not optimal for non-aligned reads, but correct. */
325 	for (; len > 0; addr--, len--) {
326 		error = ar9003_read_otp_word(sc, addr >> 2, &val);
327 		if (error != 0)
328 			return (error);
329 		*dst++ = (val >> ((addr & 3) * 8)) & 0xff;
330 	}
331 	return (0);
332 }
333 
334 /*
335  * Determine if the chip has an external EEPROM or an OTPROM and its size.
336  */
337 int
338 ar9003_find_rom(struct athn_softc *sc)
339 {
340 	struct athn_ops *ops = &sc->ops;
341 	uint32_t hdr;
342 	int error;
343 
344 	/* Try EEPROM. */
345 	ops->read_rom_data = ar9003_read_eep_data;
346 
347 	sc->eep_size = AR_SREV_9485(sc) ? 4096 : 1024;
348 	sc->eep_base = sc->eep_size - 1;
349 	error = ops->read_rom_data(sc, sc->eep_base, &hdr, sizeof(hdr));
350 	if (error == 0 && hdr != 0 && hdr != 0xffffffff)
351 		return (0);
352 
353 	sc->eep_size = 512;
354 	sc->eep_base = sc->eep_size - 1;
355 	error = ops->read_rom_data(sc, sc->eep_base, &hdr, sizeof(hdr));
356 	if (error == 0 && hdr != 0 && hdr != 0xffffffff)
357 		return (0);
358 
359 	/* Try OTPROM. */
360 	ops->read_rom_data = ar9003_read_otp_data;
361 
362 	sc->eep_size = 1024;
363 	sc->eep_base = sc->eep_size - 1;
364 	error = ops->read_rom_data(sc, sc->eep_base, &hdr, sizeof(hdr));
365 	if (error == 0 && hdr != 0 && hdr != 0xffffffff)
366 		return (0);
367 
368 	sc->eep_size = 512;
369 	sc->eep_base = sc->eep_size - 1;
370 	error = ops->read_rom_data(sc, sc->eep_base, &hdr, sizeof(hdr));
371 	if (error == 0 && hdr != 0 && hdr != 0xffffffff)
372 		return (0);
373 
374 	return (EIO);	/* Not found. */
375 }
376 
377 int
378 ar9003_restore_rom_block(struct athn_softc *sc, uint8_t alg, uint8_t ref,
379     const uint8_t *buf, int len)
380 {
381 	const uint8_t *def, *ptr, *end;
382 	uint8_t *eep = sc->eep;
383 	int off, clen;
384 
385 	if (alg == AR_EEP_COMPRESS_BLOCK) {
386 		/* Block contains chunks that shadow ROM template. */
387 		def = sc->ops.get_rom_template(sc, ref);
388 		if (def == NULL) {
389 			DPRINTF(("unknown template image %d\n", ref));
390 			return (EINVAL);
391 		}
392 		/* Start with template. */
393 		memcpy(eep, def, sc->eep_size);
394 		/* Shadow template with chunks. */
395 		off = 0;	/* Offset in ROM image. */
396 		ptr = buf;	/* Offset in block. */
397 		end = buf + len;
398 		/* Process chunks. */
399 		while (ptr + 2 <= end) {
400 			off += *ptr++;	/* Gap with previous chunk. */
401 			clen = *ptr++;	/* Chunk length. */
402 			/* Make sure block is large enough. */
403 			if (ptr + clen > end)
404 				return (EINVAL);
405 			/* Make sure chunk fits in ROM image. */
406 			if (off + clen > sc->eep_size)
407 				return (EINVAL);
408 			/* Restore chunk. */
409 			DPRINTFN(2, ("ROM chunk @%d/%d\n", off, clen));
410 			memcpy(&eep[off], ptr, clen);
411 			ptr += clen;
412 			off += clen;
413 		}
414 	} else if (alg == AR_EEP_COMPRESS_NONE) {
415 		/* Block contains full ROM image. */
416 		if (len != sc->eep_size) {
417 			DPRINTF(("block length mismatch %d\n", len));
418 			return (EINVAL);
419 		}
420 		memcpy(eep, buf, len);
421 	}
422 	return (0);
423 }
424 
425 int
426 ar9003_read_rom(struct athn_softc *sc)
427 {
428 	struct athn_ops *ops = &sc->ops;
429 	uint8_t *buf, *ptr, alg, ref;
430 	uint16_t sum, rsum;
431 	uint32_t hdr;
432 	int error, addr, len, i, j;
433 
434 	/* Allocate space to store ROM in host memory. */
435 	sc->eep = malloc(sc->eep_size, M_DEVBUF, M_NOWAIT);
436 	if (sc->eep == NULL)
437 		return (ENOMEM);
438 
439 	/* Allocate temporary buffer to store ROM blocks. */
440 	buf = malloc(2048, M_DEVBUF, M_NOWAIT);
441 	if (buf == NULL)
442 		return (ENOMEM);
443 
444 	/* Restore vendor-specified ROM blocks. */
445 	addr = sc->eep_base;
446 	for (i = 0; i < 100; i++) {
447 		/* Read block header. */
448 		error = ops->read_rom_data(sc, addr, &hdr, sizeof(hdr));
449 		if (error != 0)
450 			break;
451 		if (hdr == 0 || hdr == 0xffffffff)
452 			break;
453 		addr -= sizeof(hdr);
454 
455 		/* Extract bits from header. */
456 		ptr = (uint8_t *)&hdr;
457 		alg = (ptr[0] & 0xe0) >> 5;
458 		ref = (ptr[1] & 0x80) >> 2 | (ptr[0] & 0x1f);
459 		len = (ptr[1] & 0x7f) << 4 | (ptr[2] & 0xf0) >> 4;
460 		DPRINTFN(2, ("ROM block %d: alg=%d ref=%d len=%d\n",
461 		    i, alg, ref, len));
462 
463 		/* Read block data (len <= 0x7ff). */
464 		error = ops->read_rom_data(sc, addr, buf, len);
465 		if (error != 0)
466 			break;
467 		addr -= len;
468 
469 		/* Read block checksum. */
470 		error = ops->read_rom_data(sc, addr, &sum, sizeof(sum));
471 		if (error != 0)
472 			break;
473 		addr -= sizeof(sum);
474 
475 		/* Compute block checksum. */
476 		rsum = 0;
477 		for (j = 0; j < len; j++)
478 			rsum += buf[j];
479 		/* Compare to that in ROM. */
480 		if (letoh16(sum) != rsum) {
481 			DPRINTF(("bad block checksum 0x%x/0x%x\n",
482 			    letoh16(sum), rsum));
483 			continue;	/* Skip bad block. */
484 		}
485 		/* Checksum is correct, restore block. */
486 		ar9003_restore_rom_block(sc, alg, ref, buf, len);
487 	}
488 #if BYTE_ORDER == BIG_ENDIAN
489 	/* NB: ROM is always little endian. */
490 	if (error == 0)
491 		ops->swap_rom(sc);
492 #endif
493 	free(buf, M_DEVBUF, 0);
494 	return (error);
495 }
496 
497 /*
498  * Access to General Purpose Input/Output ports.
499  */
500 int
501 ar9003_gpio_read(struct athn_softc *sc, int pin)
502 {
503 	KASSERT(pin < sc->ngpiopins);
504 	return (((AR_READ(sc, AR_GPIO_IN) & AR9300_GPIO_IN_VAL) &
505 	    (1 << pin)) != 0);
506 }
507 
508 void
509 ar9003_gpio_write(struct athn_softc *sc, int pin, int set)
510 {
511 	uint32_t reg;
512 
513 	KASSERT(pin < sc->ngpiopins);
514 	reg = AR_READ(sc, AR_GPIO_IN_OUT);
515 	if (set)
516 		reg |= 1 << pin;
517 	else
518 		reg &= ~(1 << pin);
519 	AR_WRITE(sc, AR_GPIO_IN_OUT, reg);
520 	AR_WRITE_BARRIER(sc);
521 }
522 
523 void
524 ar9003_gpio_config_input(struct athn_softc *sc, int pin)
525 {
526 	uint32_t reg;
527 
528 	reg = AR_READ(sc, AR_GPIO_OE_OUT);
529 	reg &= ~(AR_GPIO_OE_OUT_DRV_M << (pin * 2));
530 	reg |= AR_GPIO_OE_OUT_DRV_NO << (pin * 2);
531 	AR_WRITE(sc, AR_GPIO_OE_OUT, reg);
532 	AR_WRITE_BARRIER(sc);
533 }
534 
535 void
536 ar9003_gpio_config_output(struct athn_softc *sc, int pin, int type)
537 {
538 	uint32_t reg;
539 	int mux, off;
540 
541 	mux = pin / 6;
542 	off = pin % 6;
543 
544 	reg = AR_READ(sc, AR_GPIO_OUTPUT_MUX(mux));
545 	reg &= ~(0x1f << (off * 5));
546 	reg |= (type & 0x1f) << (off * 5);
547 	AR_WRITE(sc, AR_GPIO_OUTPUT_MUX(mux), reg);
548 
549 	reg = AR_READ(sc, AR_GPIO_OE_OUT);
550 	reg &= ~(AR_GPIO_OE_OUT_DRV_M << (pin * 2));
551 	reg |= AR_GPIO_OE_OUT_DRV_ALL << (pin * 2);
552 	AR_WRITE(sc, AR_GPIO_OE_OUT, reg);
553 	AR_WRITE_BARRIER(sc);
554 }
555 
556 void
557 ar9003_rfsilent_init(struct athn_softc *sc)
558 {
559 	uint32_t reg;
560 
561 	/* Configure hardware radio switch. */
562 	AR_SETBITS(sc, AR_GPIO_INPUT_EN_VAL, AR_GPIO_INPUT_EN_VAL_RFSILENT_BB);
563 	reg = AR_READ(sc, AR_GPIO_INPUT_MUX2);
564 	reg = RW(reg, AR_GPIO_INPUT_MUX2_RFSILENT, 0);
565 	AR_WRITE(sc, AR_GPIO_INPUT_MUX2, reg);
566 	ar9003_gpio_config_input(sc, sc->rfsilent_pin);
567 	AR_SETBITS(sc, AR_PHY_TEST, AR_PHY_TEST_RFSILENT_BB);
568 	if (!(sc->flags & ATHN_FLAG_RFSILENT_REVERSED)) {
569 		AR_SETBITS(sc, AR_GPIO_INTR_POL,
570 		    AR_GPIO_INTR_POL_PIN(sc->rfsilent_pin));
571 	}
572 	AR_WRITE_BARRIER(sc);
573 }
574 
575 int
576 ar9003_dma_alloc(struct athn_softc *sc)
577 {
578 	int error;
579 
580 	error = ar9003_tx_alloc(sc);
581 	if (error != 0)
582 		return (error);
583 
584 	error = ar9003_rx_alloc(sc, ATHN_QID_LP, AR9003_RX_LP_QDEPTH);
585 	if (error != 0)
586 		return (error);
587 
588 	error = ar9003_rx_alloc(sc, ATHN_QID_HP, AR9003_RX_HP_QDEPTH);
589 	if (error != 0)
590 		return (error);
591 
592 	return (0);
593 }
594 
595 void
596 ar9003_dma_free(struct athn_softc *sc)
597 {
598 	ar9003_tx_free(sc);
599 	ar9003_rx_free(sc, ATHN_QID_LP);
600 	ar9003_rx_free(sc, ATHN_QID_HP);
601 }
602 
603 int
604 ar9003_tx_alloc(struct athn_softc *sc)
605 {
606 	struct athn_tx_buf *bf;
607 	bus_size_t size;
608 	int error, nsegs, i;
609 
610 	/*
611 	 * Allocate Tx status ring.
612 	 */
613 	size = AR9003_NTXSTATUS * sizeof(struct ar_tx_status);
614 
615 	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
616 	    BUS_DMA_NOWAIT, &sc->txsmap);
617 	if (error != 0)
618 		goto fail;
619 
620 	error = bus_dmamem_alloc(sc->sc_dmat, size, 4, 0, &sc->txsseg, 1,
621 	    &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
622 	if (error != 0)
623 		goto fail;
624 
625 	error = bus_dmamem_map(sc->sc_dmat, &sc->txsseg, 1, size,
626 	    (caddr_t *)&sc->txsring, BUS_DMA_NOWAIT | BUS_DMA_COHERENT);
627 	if (error != 0)
628 		goto fail;
629 
630 	error = bus_dmamap_load_raw(sc->sc_dmat, sc->txsmap, &sc->txsseg,
631 	    1, size, BUS_DMA_NOWAIT | BUS_DMA_READ);
632 	if (error != 0)
633 		goto fail;
634 
635 	/*
636 	 * Allocate a pool of Tx descriptors shared between all Tx queues.
637 	 */
638 	size = ATHN_NTXBUFS * sizeof(struct ar_tx_desc);
639 
640 	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
641 	    BUS_DMA_NOWAIT, &sc->map);
642 	if (error != 0)
643 		goto fail;
644 
645 	error = bus_dmamem_alloc(sc->sc_dmat, size, 4, 0, &sc->seg, 1,
646 	    &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO);
647 	if (error != 0)
648 		goto fail;
649 
650 	error = bus_dmamem_map(sc->sc_dmat, &sc->seg, 1, size,
651 	    (caddr_t *)&sc->descs, BUS_DMA_NOWAIT | BUS_DMA_COHERENT);
652 	if (error != 0)
653 		goto fail;
654 
655 	error = bus_dmamap_load_raw(sc->sc_dmat, sc->map, &sc->seg, 1, size,
656 	    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
657 	if (error != 0)
658 		goto fail;
659 
660 	SIMPLEQ_INIT(&sc->txbufs);
661 	for (i = 0; i < ATHN_NTXBUFS; i++) {
662 		bf = &sc->txpool[i];
663 
664 		error = bus_dmamap_create(sc->sc_dmat, ATHN_TXBUFSZ,
665 		    AR9003_MAX_SCATTER, ATHN_TXBUFSZ, 0, BUS_DMA_NOWAIT,
666 		    &bf->bf_map);
667 		if (error != 0) {
668 			printf("%s: could not create Tx buf DMA map\n",
669 			    sc->sc_dev.dv_xname);
670 			goto fail;
671 		}
672 
673 		bf->bf_descs = &((struct ar_tx_desc *)sc->descs)[i];
674 		bf->bf_daddr = sc->map->dm_segs[0].ds_addr +
675 		    i * sizeof(struct ar_tx_desc);
676 
677 		SIMPLEQ_INSERT_TAIL(&sc->txbufs, bf, bf_list);
678 	}
679 	return (0);
680  fail:
681 	ar9003_tx_free(sc);
682 	return (error);
683 }
684 
685 void
686 ar9003_tx_free(struct athn_softc *sc)
687 {
688 	struct athn_tx_buf *bf;
689 	int i;
690 
691 	for (i = 0; i < ATHN_NTXBUFS; i++) {
692 		bf = &sc->txpool[i];
693 
694 		if (bf->bf_map != NULL)
695 			bus_dmamap_destroy(sc->sc_dmat, bf->bf_map);
696 	}
697 	/* Free Tx descriptors. */
698 	if (sc->map != NULL) {
699 		if (sc->descs != NULL) {
700 			bus_dmamap_unload(sc->sc_dmat, sc->map);
701 			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->descs,
702 			    ATHN_NTXBUFS * sizeof(struct ar_tx_desc));
703 			bus_dmamem_free(sc->sc_dmat, &sc->seg, 1);
704 		}
705 		bus_dmamap_destroy(sc->sc_dmat, sc->map);
706 	}
707 	/* Free Tx status ring. */
708 	if (sc->txsmap != NULL) {
709 		if (sc->txsring != NULL) {
710 			bus_dmamap_unload(sc->sc_dmat, sc->txsmap);
711 			bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->txsring,
712 			     AR9003_NTXSTATUS * sizeof(struct ar_tx_status));
713 			bus_dmamem_free(sc->sc_dmat, &sc->txsseg, 1);
714 		}
715 		bus_dmamap_destroy(sc->sc_dmat, sc->txsmap);
716 	}
717 }
718 
719 int
720 ar9003_rx_alloc(struct athn_softc *sc, int qid, int count)
721 {
722 	struct athn_rxq *rxq = &sc->rxq[qid];
723 	struct athn_rx_buf *bf;
724 	struct ar_rx_status *ds;
725 	int error, i;
726 
727 	rxq->bf = mallocarray(count, sizeof(*bf), M_DEVBUF,
728 	    M_NOWAIT | M_ZERO);
729 	if (rxq->bf == NULL)
730 		return (ENOMEM);
731 
732 	rxq->count = count;
733 
734 	for (i = 0; i < rxq->count; i++) {
735 		bf = &rxq->bf[i];
736 
737 		error = bus_dmamap_create(sc->sc_dmat, ATHN_RXBUFSZ, 1,
738 		    ATHN_RXBUFSZ, 0, BUS_DMA_NOWAIT | BUS_DMA_ALLOCNOW,
739 		    &bf->bf_map);
740 		if (error != 0) {
741 			printf("%s: could not create Rx buf DMA map\n",
742 			    sc->sc_dev.dv_xname);
743 			goto fail;
744 		}
745 		/*
746 		 * Assumes MCLGETL returns cache-line-size aligned buffers.
747 		 */
748 		bf->bf_m = MCLGETL(NULL, M_DONTWAIT, ATHN_RXBUFSZ);
749 		if (bf->bf_m == NULL) {
750 			printf("%s: could not allocate Rx mbuf\n",
751 			    sc->sc_dev.dv_xname);
752 			error = ENOBUFS;
753 			goto fail;
754 		}
755 
756 		error = bus_dmamap_load(sc->sc_dmat, bf->bf_map,
757 		    mtod(bf->bf_m, void *), ATHN_RXBUFSZ, NULL,
758 		    BUS_DMA_NOWAIT);
759 		if (error != 0) {
760 			printf("%s: could not DMA map Rx buffer\n",
761 			    sc->sc_dev.dv_xname);
762 			goto fail;
763 		}
764 
765 		ds = mtod(bf->bf_m, struct ar_rx_status *);
766 		memset(ds, 0, sizeof(*ds));
767 		bf->bf_desc = ds;
768 		bf->bf_daddr = bf->bf_map->dm_segs[0].ds_addr;
769 
770 		bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, ATHN_RXBUFSZ,
771 		    BUS_DMASYNC_PREREAD);
772 	}
773 	return (0);
774  fail:
775 	ar9003_rx_free(sc, qid);
776 	return (error);
777 }
778 
779 void
780 ar9003_rx_free(struct athn_softc *sc, int qid)
781 {
782 	struct athn_rxq *rxq = &sc->rxq[qid];
783 	struct athn_rx_buf *bf;
784 	int i;
785 
786 	if (rxq->bf == NULL)
787 		return;
788 	for (i = 0; i < rxq->count; i++) {
789 		bf = &rxq->bf[i];
790 
791 		if (bf->bf_map != NULL)
792 			bus_dmamap_destroy(sc->sc_dmat, bf->bf_map);
793 		m_freem(bf->bf_m);
794 	}
795 	free(rxq->bf, M_DEVBUF, 0);
796 }
797 
798 void
799 ar9003_reset_txsring(struct athn_softc *sc)
800 {
801 	sc->txscur = 0;
802 	memset(sc->txsring, 0, AR9003_NTXSTATUS * sizeof(struct ar_tx_status));
803 	AR_WRITE(sc, AR_Q_STATUS_RING_START,
804 	    sc->txsmap->dm_segs[0].ds_addr);
805 	AR_WRITE(sc, AR_Q_STATUS_RING_END,
806 	    sc->txsmap->dm_segs[0].ds_addr + sc->txsmap->dm_segs[0].ds_len);
807 	AR_WRITE_BARRIER(sc);
808 }
809 
810 void
811 ar9003_rx_enable(struct athn_softc *sc)
812 {
813 	struct athn_rxq *rxq;
814 	struct athn_rx_buf *bf;
815 	struct ar_rx_status *ds;
816 	uint32_t reg;
817 	int qid, i;
818 
819 	reg = AR_READ(sc, AR_RXBP_THRESH);
820 	reg = RW(reg, AR_RXBP_THRESH_HP, 1);
821 	reg = RW(reg, AR_RXBP_THRESH_LP, 1);
822 	AR_WRITE(sc, AR_RXBP_THRESH, reg);
823 
824 	/* Set Rx buffer size. */
825 	AR_WRITE(sc, AR_DATABUF_SIZE, ATHN_RXBUFSZ - sizeof(*ds));
826 
827 	for (qid = 0; qid < 2; qid++) {
828 		rxq = &sc->rxq[qid];
829 
830 		/* Setup Rx status descriptors. */
831 		SIMPLEQ_INIT(&rxq->head);
832 		for (i = 0; i < rxq->count; i++) {
833 			bf = &rxq->bf[i];
834 			ds = bf->bf_desc;
835 
836 			memset(ds, 0, sizeof(*ds));
837 			if (qid == ATHN_QID_LP)
838 				AR_WRITE(sc, AR_LP_RXDP, bf->bf_daddr);
839 			else
840 				AR_WRITE(sc, AR_HP_RXDP, bf->bf_daddr);
841 			AR_WRITE_BARRIER(sc);
842 			SIMPLEQ_INSERT_TAIL(&rxq->head, bf, bf_list);
843 		}
844 	}
845 	/* Enable Rx. */
846 	AR_WRITE(sc, AR_CR, 0);
847 	AR_WRITE_BARRIER(sc);
848 }
849 
850 #if NBPFILTER > 0
851 void
852 ar9003_rx_radiotap(struct athn_softc *sc, struct mbuf *m,
853     struct ar_rx_status *ds)
854 {
855 #define IEEE80211_RADIOTAP_F_SHORTGI	0x80	/* XXX from FBSD */
856 
857 	struct athn_rx_radiotap_header *tap = &sc->sc_rxtap;
858 	struct ieee80211com *ic = &sc->sc_ic;
859 	uint64_t tsf;
860 	uint32_t tstamp;
861 	uint8_t rate;
862 
863 	/* Extend the 15-bit timestamp from Rx status to 64-bit TSF. */
864 	tstamp = ds->ds_status3;
865 	tsf = AR_READ(sc, AR_TSF_U32);
866 	tsf = tsf << 32 | AR_READ(sc, AR_TSF_L32);
867 	if ((tsf & 0x7fff) < tstamp)
868 		tsf -= 0x8000;
869 	tsf = (tsf & ~0x7fff) | tstamp;
870 
871 	tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
872 	tap->wr_tsft = htole64(tsf);
873 	tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
874 	tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
875 	tap->wr_dbm_antsignal = MS(ds->ds_status5, AR_RXS5_RSSI_COMBINED);
876 	/* XXX noise. */
877 	tap->wr_antenna = MS(ds->ds_status4, AR_RXS4_ANTENNA);
878 	tap->wr_rate = 0;	/* In case it can't be found below. */
879 	rate = MS(ds->ds_status1, AR_RXS1_RATE);
880 	if (rate & 0x80) {		/* HT. */
881 		/* Bit 7 set means HT MCS instead of rate. */
882 		tap->wr_rate = rate;
883 		if (!(ds->ds_status4 & AR_RXS4_GI))
884 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTGI;
885 
886 	} else if (rate & 0x10) {	/* CCK. */
887 		if (rate & 0x04)
888 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
889 		switch (rate & ~0x14) {
890 		case 0xb: tap->wr_rate =   2; break;
891 		case 0xa: tap->wr_rate =   4; break;
892 		case 0x9: tap->wr_rate =  11; break;
893 		case 0x8: tap->wr_rate =  22; break;
894 		}
895 	} else {			/* OFDM. */
896 		switch (rate) {
897 		case 0xb: tap->wr_rate =  12; break;
898 		case 0xf: tap->wr_rate =  18; break;
899 		case 0xa: tap->wr_rate =  24; break;
900 		case 0xe: tap->wr_rate =  36; break;
901 		case 0x9: tap->wr_rate =  48; break;
902 		case 0xd: tap->wr_rate =  72; break;
903 		case 0x8: tap->wr_rate =  96; break;
904 		case 0xc: tap->wr_rate = 108; break;
905 		}
906 	}
907 	bpf_mtap_hdr(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m, BPF_DIRECTION_IN);
908 }
909 #endif
910 
911 int
912 ar9003_rx_process(struct athn_softc *sc, int qid, struct mbuf_list *ml)
913 {
914 	struct ieee80211com *ic = &sc->sc_ic;
915 	struct ifnet *ifp = &ic->ic_if;
916 	struct athn_rxq *rxq = &sc->rxq[qid];
917 	struct athn_rx_buf *bf;
918 	struct ar_rx_status *ds;
919 	struct ieee80211_frame *wh;
920 	struct ieee80211_rxinfo rxi;
921 	struct ieee80211_node *ni;
922 	struct mbuf *m, *m1;
923 	int error, len;
924 
925 	bf = SIMPLEQ_FIRST(&rxq->head);
926 	if (__predict_false(bf == NULL)) {	/* Should not happen. */
927 		printf("%s: Rx queue is empty!\n", sc->sc_dev.dv_xname);
928 		return (ENOENT);
929 	}
930 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, ATHN_RXBUFSZ,
931 	    BUS_DMASYNC_POSTREAD);
932 
933 	ds = mtod(bf->bf_m, struct ar_rx_status *);
934 	if (!(ds->ds_status11 & AR_RXS11_DONE))
935 		return (EBUSY);
936 
937 	/* Check that it is a valid Rx status descriptor. */
938 	if ((ds->ds_info & (AR_RXI_DESC_ID_M | AR_RXI_DESC_TX |
939 	    AR_RXI_CTRL_STAT)) != SM(AR_RXI_DESC_ID, AR_VENDOR_ATHEROS))
940 		goto skip;
941 
942 	if (!(ds->ds_status11 & AR_RXS11_FRAME_OK)) {
943 		if (ds->ds_status11 & AR_RXS11_CRC_ERR)
944 			DPRINTFN(6, ("CRC error\n"));
945 		else if (ds->ds_status11 & AR_RXS11_PHY_ERR)
946 			DPRINTFN(6, ("PHY error=0x%x\n",
947 			    MS(ds->ds_status11, AR_RXS11_PHY_ERR_CODE)));
948 		else if (ds->ds_status11 & AR_RXS11_DECRYPT_CRC_ERR)
949 			DPRINTFN(6, ("Decryption CRC error\n"));
950 		else if (ds->ds_status11 & AR_RXS11_MICHAEL_ERR) {
951 			DPRINTFN(2, ("Michael MIC failure\n"));
952 			/* Report Michael MIC failures to net80211. */
953 			ic->ic_stats.is_rx_locmicfail++;
954 			ieee80211_michael_mic_failure(ic, 0);
955 			/*
956 			 * XXX Check that it is not a control frame
957 			 * (invalid MIC failures on valid ctl frames).
958 			 */
959 		}
960 		ifp->if_ierrors++;
961 		goto skip;
962 	}
963 
964 	len = MS(ds->ds_status2, AR_RXS2_DATA_LEN);
965 	if (__predict_false(len < IEEE80211_MIN_LEN ||
966 	    len > ATHN_RXBUFSZ - sizeof(*ds))) {
967 		DPRINTF(("corrupted descriptor length=%d\n", len));
968 		ifp->if_ierrors++;
969 		goto skip;
970 	}
971 
972 	/* Allocate a new Rx buffer. */
973 	m1 = MCLGETL(NULL, M_DONTWAIT, ATHN_RXBUFSZ);
974 	if (__predict_false(m1 == NULL)) {
975 		ic->ic_stats.is_rx_nombuf++;
976 		ifp->if_ierrors++;
977 		goto skip;
978 	}
979 
980 	/* Unmap the old Rx buffer. */
981 	bus_dmamap_unload(sc->sc_dmat, bf->bf_map);
982 
983 	/* Map the new Rx buffer. */
984 	error = bus_dmamap_load(sc->sc_dmat, bf->bf_map, mtod(m1, void *),
985 	    ATHN_RXBUFSZ, NULL, BUS_DMA_NOWAIT | BUS_DMA_READ);
986 	if (__predict_false(error != 0)) {
987 		m_freem(m1);
988 
989 		/* Remap the old Rx buffer or panic. */
990 		error = bus_dmamap_load(sc->sc_dmat, bf->bf_map,
991 		    mtod(bf->bf_m, void *), ATHN_RXBUFSZ, NULL,
992 		    BUS_DMA_NOWAIT | BUS_DMA_READ);
993 		KASSERT(error != 0);
994 		bf->bf_daddr = bf->bf_map->dm_segs[0].ds_addr;
995 		ifp->if_ierrors++;
996 		goto skip;
997 	}
998 	bf->bf_desc = mtod(m1, struct ar_rx_status *);
999 	bf->bf_daddr = bf->bf_map->dm_segs[0].ds_addr;
1000 
1001 	m = bf->bf_m;
1002 	bf->bf_m = m1;
1003 
1004 	/* Finalize mbuf. */
1005 	/* Strip Rx status descriptor from head. */
1006 	m->m_data = (caddr_t)&ds[1];
1007 	m->m_pkthdr.len = m->m_len = len;
1008 
1009 	/* Grab a reference to the source node. */
1010 	wh = mtod(m, struct ieee80211_frame *);
1011 	ni = ieee80211_find_rxnode(ic, wh);
1012 
1013 	/* Remove any HW padding after the 802.11 header. */
1014 	if (!(wh->i_fc[0] & IEEE80211_FC0_TYPE_CTL)) {
1015 		u_int hdrlen = ieee80211_get_hdrlen(wh);
1016 		if (hdrlen & 3) {
1017 			memmove((caddr_t)wh + 2, wh, hdrlen);
1018 			m_adj(m, 2);
1019 		}
1020 	}
1021 #if NBPFILTER > 0
1022 	if (__predict_false(sc->sc_drvbpf != NULL))
1023 		ar9003_rx_radiotap(sc, m, ds);
1024 #endif
1025 	/* Trim 802.11 FCS after radiotap. */
1026 	m_adj(m, -IEEE80211_CRC_LEN);
1027 
1028 	/* Send the frame to the 802.11 layer. */
1029 	rxi.rxi_flags = 0;	/* XXX */
1030 	rxi.rxi_rssi = MS(ds->ds_status5, AR_RXS5_RSSI_COMBINED);
1031 	rxi.rxi_tstamp = ds->ds_status3;
1032 	ieee80211_inputm(ifp, m, ni, &rxi, ml);
1033 
1034 	/* Node is no longer needed. */
1035 	ieee80211_release_node(ic, ni);
1036 
1037  skip:
1038 	/* Unlink this descriptor from head. */
1039 	SIMPLEQ_REMOVE_HEAD(&rxq->head, bf_list);
1040 	memset(bf->bf_desc, 0, sizeof(*ds));
1041 
1042 	/* Re-use this descriptor and link it to tail. */
1043 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, ATHN_RXBUFSZ,
1044 	    BUS_DMASYNC_PREREAD);
1045 
1046 	if (qid == ATHN_QID_LP)
1047 		AR_WRITE(sc, AR_LP_RXDP, bf->bf_daddr);
1048 	else
1049 		AR_WRITE(sc, AR_HP_RXDP, bf->bf_daddr);
1050 	AR_WRITE_BARRIER(sc);
1051 	SIMPLEQ_INSERT_TAIL(&rxq->head, bf, bf_list);
1052 
1053 	/* Re-enable Rx. */
1054 	AR_WRITE(sc, AR_CR, 0);
1055 	AR_WRITE_BARRIER(sc);
1056 	return (0);
1057 }
1058 
1059 void
1060 ar9003_rx_intr(struct athn_softc *sc, int qid)
1061 {
1062 	struct mbuf_list ml = MBUF_LIST_INITIALIZER();
1063 	struct ieee80211com *ic = &sc->sc_ic;
1064 	struct ifnet *ifp = &ic->ic_if;
1065 
1066 	while (ar9003_rx_process(sc, qid, &ml) == 0);
1067 
1068 	if_input(ifp, &ml);
1069 }
1070 
1071 int
1072 ar9003_tx_process(struct athn_softc *sc)
1073 {
1074 	struct ieee80211com *ic = &sc->sc_ic;
1075 	struct ifnet *ifp = &ic->ic_if;
1076 	struct athn_txq *txq;
1077 	struct athn_node *an;
1078 	struct athn_tx_buf *bf;
1079 	struct ar_tx_status *ds;
1080 	uint8_t qid, failcnt;
1081 
1082 	ds = &((struct ar_tx_status *)sc->txsring)[sc->txscur];
1083 	if (!(ds->ds_status8 & AR_TXS8_DONE))
1084 		return (EBUSY);
1085 
1086 	sc->txscur = (sc->txscur + 1) % AR9003_NTXSTATUS;
1087 
1088 	/* Check that it is a valid Tx status descriptor. */
1089 	if ((ds->ds_info & (AR_TXI_DESC_ID_M | AR_TXI_DESC_TX)) !=
1090 	    (SM(AR_TXI_DESC_ID, AR_VENDOR_ATHEROS) | AR_TXI_DESC_TX)) {
1091 		memset(ds, 0, sizeof(*ds));
1092 		return (0);
1093 	}
1094 	/* Retrieve the queue that was used to send this PDU. */
1095 	qid = MS(ds->ds_info, AR_TXI_QCU_NUM);
1096 	txq = &sc->txq[qid];
1097 
1098 	bf = SIMPLEQ_FIRST(&txq->head);
1099 	if (bf == NULL || bf == txq->wait) {
1100 		memset(ds, 0, sizeof(*ds));
1101 		return (0);
1102 	}
1103 	SIMPLEQ_REMOVE_HEAD(&txq->head, bf_list);
1104 
1105 	sc->sc_tx_timer = 0;
1106 
1107 	if (ds->ds_status3 & AR_TXS3_EXCESSIVE_RETRIES)
1108 		ifp->if_oerrors++;
1109 
1110 	if (ds->ds_status3 & AR_TXS3_UNDERRUN)
1111 		athn_inc_tx_trigger_level(sc);
1112 
1113 	/* Wakeup PA predistortion state machine. */
1114 	if (bf->bf_txflags & ATHN_TXFLAG_PAPRD)
1115 		ar9003_paprd_tx_tone_done(sc);
1116 
1117 	an = (struct athn_node *)bf->bf_ni;
1118 	/*
1119 	 * NB: the data fail count contains the number of un-acked tries
1120 	 * for the final series used.  We must add the number of tries for
1121 	 * each series that was fully processed.
1122 	 */
1123 	failcnt  = MS(ds->ds_status3, AR_TXS3_DATA_FAIL_CNT);
1124 	/* NB: Assume two tries per series. */
1125 	failcnt += MS(ds->ds_status8, AR_TXS8_FINAL_IDX) * 2;
1126 
1127 	/* Update rate control statistics. */
1128 	an->amn.amn_txcnt++;
1129 	if (failcnt > 0)
1130 		an->amn.amn_retrycnt++;
1131 
1132 	DPRINTFN(5, ("Tx done qid=%d status3=%d fail count=%d\n",
1133 	    qid, ds->ds_status3, failcnt));
1134 
1135 	/* Reset Tx status descriptor. */
1136 	memset(ds, 0, sizeof(*ds));
1137 
1138 	/* Unmap Tx buffer. */
1139 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, bf->bf_map->dm_mapsize,
1140 	    BUS_DMASYNC_POSTWRITE);
1141 	bus_dmamap_unload(sc->sc_dmat, bf->bf_map);
1142 
1143 	m_freem(bf->bf_m);
1144 	bf->bf_m = NULL;
1145 	ieee80211_release_node(ic, bf->bf_ni);
1146 	bf->bf_ni = NULL;
1147 
1148 	/* Link Tx buffer back to global free list. */
1149 	SIMPLEQ_INSERT_TAIL(&sc->txbufs, bf, bf_list);
1150 
1151 	/* Queue buffers that are waiting if there is new room. */
1152 	if (--txq->queued < AR9003_TX_QDEPTH && txq->wait != NULL) {
1153 		AR_WRITE(sc, AR_QTXDP(qid), txq->wait->bf_daddr);
1154 		AR_WRITE_BARRIER(sc);
1155 		txq->wait = SIMPLEQ_NEXT(txq->wait, bf_list);
1156 	}
1157 	return (0);
1158 }
1159 
1160 void
1161 ar9003_tx_intr(struct athn_softc *sc)
1162 {
1163 	struct ieee80211com *ic = &sc->sc_ic;
1164 	struct ifnet *ifp = &ic->ic_if;
1165 
1166 	while (ar9003_tx_process(sc) == 0);
1167 
1168 	if (!SIMPLEQ_EMPTY(&sc->txbufs)) {
1169 		ifq_clr_oactive(&ifp->if_snd);
1170 		ifp->if_start(ifp);
1171 	}
1172 }
1173 
1174 #ifndef IEEE80211_STA_ONLY
1175 /*
1176  * Process Software Beacon Alert interrupts.
1177  */
1178 int
1179 ar9003_swba_intr(struct athn_softc *sc)
1180 {
1181 	struct ieee80211com *ic = &sc->sc_ic;
1182 	struct ifnet *ifp = &ic->ic_if;
1183 	struct ieee80211_node *ni = ic->ic_bss;
1184 	struct athn_tx_buf *bf = sc->bcnbuf;
1185 	struct ieee80211_frame *wh;
1186 	struct ar_tx_desc *ds;
1187 	struct mbuf *m;
1188 	uint32_t sum;
1189 	uint8_t ridx, hwrate;
1190 	int error, totlen;
1191 
1192 	if (ic->ic_tim_mcast_pending &&
1193 	    mq_empty(&ni->ni_savedq) &&
1194 	    SIMPLEQ_EMPTY(&sc->txq[ATHN_QID_CAB].head))
1195 		ic->ic_tim_mcast_pending = 0;
1196 
1197 	if (ic->ic_dtim_count == 0)
1198 		ic->ic_dtim_count = ic->ic_dtim_period - 1;
1199 	else
1200 		ic->ic_dtim_count--;
1201 
1202 	/* Make sure previous beacon has been sent. */
1203 	if (athn_tx_pending(sc, ATHN_QID_BEACON)) {
1204 		DPRINTF(("beacon stuck\n"));
1205 		return (EBUSY);
1206 	}
1207 	/* Get new beacon. */
1208 	m = ieee80211_beacon_alloc(ic, ic->ic_bss);
1209 	if (__predict_false(m == NULL))
1210 		return (ENOBUFS);
1211 	/* Assign sequence number. */
1212 	wh = mtod(m, struct ieee80211_frame *);
1213 	*(uint16_t *)&wh->i_seq[0] =
1214 	    htole16(ic->ic_bss->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
1215 	ic->ic_bss->ni_txseq++;
1216 
1217 	/* Unmap and free old beacon if any. */
1218 	if (__predict_true(bf->bf_m != NULL)) {
1219 		bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0,
1220 		    bf->bf_map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
1221 		bus_dmamap_unload(sc->sc_dmat, bf->bf_map);
1222 		m_freem(bf->bf_m);
1223 		bf->bf_m = NULL;
1224 	}
1225 	/* DMA map new beacon. */
1226 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_map, m,
1227 	    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
1228 	if (__predict_false(error != 0)) {
1229 		m_freem(m);
1230 		return (error);
1231 	}
1232 	bf->bf_m = m;
1233 
1234 	/* Setup Tx descriptor (simplified ar9003_tx()). */
1235 	ds = bf->bf_descs;
1236 	memset(ds, 0, sizeof(*ds));
1237 
1238 	ds->ds_info =
1239 	    SM(AR_TXI_DESC_ID, AR_VENDOR_ATHEROS) |
1240 	    SM(AR_TXI_DESC_NDWORDS, 23) |
1241 	    SM(AR_TXI_QCU_NUM, ATHN_QID_BEACON) |
1242 	    AR_TXI_DESC_TX | AR_TXI_CTRL_STAT;
1243 
1244 	totlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
1245 	ds->ds_ctl11 = SM(AR_TXC11_FRAME_LEN, totlen);
1246 	ds->ds_ctl11 |= SM(AR_TXC11_XMIT_POWER, AR_MAX_RATE_POWER);
1247 	ds->ds_ctl12 = SM(AR_TXC12_FRAME_TYPE, AR_FRAME_TYPE_BEACON);
1248 	ds->ds_ctl12 |= AR_TXC12_NO_ACK;
1249 	ds->ds_ctl17 = SM(AR_TXC17_ENCR_TYPE, AR_ENCR_TYPE_CLEAR);
1250 
1251 	/* Write number of tries. */
1252 	ds->ds_ctl13 = SM(AR_TXC13_XMIT_DATA_TRIES0, 1);
1253 
1254 	/* Write Tx rate. */
1255 	ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
1256 	    ATHN_RIDX_OFDM6 : ATHN_RIDX_CCK1;
1257 	hwrate = athn_rates[ridx].hwrate;
1258 	ds->ds_ctl14 = SM(AR_TXC14_XMIT_RATE0, hwrate);
1259 
1260 	/* Write Tx chains. */
1261 	ds->ds_ctl18 = SM(AR_TXC18_CHAIN_SEL0, sc->txchainmask);
1262 
1263 	ds->ds_segs[0].ds_data = bf->bf_map->dm_segs[0].ds_addr;
1264 	/* Segment length must be a multiple of 4. */
1265 	ds->ds_segs[0].ds_ctl |= SM(AR_TXC_BUF_LEN,
1266 	    (bf->bf_map->dm_segs[0].ds_len + 3) & ~3);
1267 	/* Compute Tx descriptor checksum. */
1268 	sum = ds->ds_info;
1269 	sum += ds->ds_segs[0].ds_data;
1270 	sum += ds->ds_segs[0].ds_ctl;
1271 	sum = (sum >> 16) + (sum & 0xffff);
1272 	ds->ds_ctl10 = SM(AR_TXC10_PTR_CHK_SUM, sum);
1273 
1274 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, bf->bf_map->dm_mapsize,
1275 	    BUS_DMASYNC_PREWRITE);
1276 
1277 	/* Stop Tx DMA before putting the new beacon on the queue. */
1278 	athn_stop_tx_dma(sc, ATHN_QID_BEACON);
1279 
1280 	AR_WRITE(sc, AR_QTXDP(ATHN_QID_BEACON), bf->bf_daddr);
1281 
1282 	for(;;) {
1283 		if (SIMPLEQ_EMPTY(&sc->txbufs))
1284 			break;
1285 
1286 		m = mq_dequeue(&ni->ni_savedq);
1287 		if (m == NULL)
1288 			break;
1289 		if (!mq_empty(&ni->ni_savedq)) {
1290 			/* more queued frames, set the more data bit */
1291 			wh = mtod(m, struct ieee80211_frame *);
1292 			wh->i_fc[1] |= IEEE80211_FC1_MORE_DATA;
1293 		}
1294 
1295 		if (sc->ops.tx(sc, m, ni, ATHN_TXFLAG_CAB) != 0) {
1296 			ieee80211_release_node(ic, ni);
1297 			ifp->if_oerrors++;
1298 			break;
1299 		}
1300 	}
1301 
1302 	/* Kick Tx. */
1303 	AR_WRITE(sc, AR_Q_TXE, 1 << ATHN_QID_BEACON);
1304 	AR_WRITE_BARRIER(sc);
1305 	return (0);
1306 }
1307 #endif
1308 
1309 int
1310 ar9003_intr(struct athn_softc *sc)
1311 {
1312 	uint32_t intr, intr2, intr5, sync;
1313 
1314 	/* Get pending interrupts. */
1315 	intr = AR_READ(sc, AR_INTR_ASYNC_CAUSE);
1316 	if (!(intr & AR_INTR_MAC_IRQ) || intr == AR_INTR_SPURIOUS) {
1317 		intr = AR_READ(sc, AR_INTR_SYNC_CAUSE);
1318 		if (intr == AR_INTR_SPURIOUS || (intr & sc->isync) == 0)
1319 			return (0);	/* Not for us. */
1320 	}
1321 
1322 	if ((AR_READ(sc, AR_INTR_ASYNC_CAUSE) & AR_INTR_MAC_IRQ) &&
1323 	    (AR_READ(sc, AR_RTC_STATUS) & AR_RTC_STATUS_M) == AR_RTC_STATUS_ON)
1324 		intr = AR_READ(sc, AR_ISR);
1325 	else
1326 		intr = 0;
1327 	sync = AR_READ(sc, AR_INTR_SYNC_CAUSE) & sc->isync;
1328 	if (intr == 0 && sync == 0)
1329 		return (0);	/* Not for us. */
1330 
1331 	if (intr != 0) {
1332 		if (intr & AR_ISR_BCNMISC) {
1333 			intr2 = AR_READ(sc, AR_ISR_S2);
1334 			if (intr2 & AR_ISR_S2_TIM)
1335 				/* TBD */;
1336 			if (intr2 & AR_ISR_S2_TSFOOR)
1337 				/* TBD */;
1338 			if (intr2 & AR_ISR_S2_BB_WATCHDOG)
1339 				/* TBD */;
1340 		}
1341 		intr = AR_READ(sc, AR_ISR_RAC);
1342 		if (intr == AR_INTR_SPURIOUS)
1343 			return (1);
1344 
1345 #ifndef IEEE80211_STA_ONLY
1346 		if (intr & AR_ISR_SWBA)
1347 			ar9003_swba_intr(sc);
1348 #endif
1349 		if (intr & (AR_ISR_RXMINTR | AR_ISR_RXINTM))
1350 			ar9003_rx_intr(sc, ATHN_QID_LP);
1351 		if (intr & (AR_ISR_LP_RXOK | AR_ISR_RXERR | AR_ISR_RXEOL))
1352 			ar9003_rx_intr(sc, ATHN_QID_LP);
1353 		if (intr & AR_ISR_HP_RXOK)
1354 			ar9003_rx_intr(sc, ATHN_QID_HP);
1355 
1356 		if (intr & (AR_ISR_TXMINTR | AR_ISR_TXINTM))
1357 			ar9003_tx_intr(sc);
1358 		if (intr & (AR_ISR_TXOK | AR_ISR_TXERR | AR_ISR_TXEOL))
1359 			ar9003_tx_intr(sc);
1360 
1361 		if (intr & AR_ISR_GENTMR) {
1362 			intr5 = AR_READ(sc, AR_ISR_S5_S);
1363 			DPRINTF(("GENTMR trigger=%d thresh=%d\n",
1364 			    MS(intr5, AR_ISR_S5_GENTIMER_TRIG),
1365 			    MS(intr5, AR_ISR_S5_GENTIMER_THRESH)));
1366 		}
1367 	}
1368 	if (sync != 0) {
1369 		if (sync & AR_INTR_SYNC_RADM_CPL_TIMEOUT) {
1370 			AR_WRITE(sc, AR_RC, AR_RC_HOSTIF);
1371 			AR_WRITE(sc, AR_RC, 0);
1372 		}
1373 
1374 		if ((sc->flags & ATHN_FLAG_RFSILENT) &&
1375 		    (sync & AR_INTR_SYNC_GPIO_PIN(sc->rfsilent_pin))) {
1376 			struct ifnet *ifp = &sc->sc_ic.ic_if;
1377 
1378 			printf("%s: radio switch turned off\n",
1379 			    sc->sc_dev.dv_xname);
1380 			/* Turn the interface down. */
1381 			athn_stop(ifp, 1);
1382 			return (1);
1383 		}
1384 
1385 		AR_WRITE(sc, AR_INTR_SYNC_CAUSE, sync);
1386 		(void)AR_READ(sc, AR_INTR_SYNC_CAUSE);
1387 	}
1388 	return (1);
1389 }
1390 
1391 int
1392 ar9003_tx(struct athn_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
1393     int txflags)
1394 {
1395 	struct ieee80211com *ic = &sc->sc_ic;
1396 	struct ieee80211_key *k = NULL;
1397 	struct ieee80211_frame *wh;
1398 	struct athn_series series[4];
1399 	struct ar_tx_desc *ds;
1400 	struct athn_txq *txq;
1401 	struct athn_tx_buf *bf;
1402 	struct athn_node *an = (void *)ni;
1403 	struct mbuf *m1;
1404 	uintptr_t entry;
1405 	uint32_t sum;
1406 	uint16_t qos = 0;
1407 	uint8_t txpower, type, encrtype, tid, ridx[4];
1408 	int i, error, totlen, hasqos, qid;
1409 
1410 	/* Grab a Tx buffer from our global free list. */
1411 	bf = SIMPLEQ_FIRST(&sc->txbufs);
1412 	KASSERT(bf != NULL);
1413 
1414 	/* Map 802.11 frame type to hardware frame type. */
1415 	wh = mtod(m, struct ieee80211_frame *);
1416 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1417 	    IEEE80211_FC0_TYPE_MGT) {
1418 		/* NB: Beacons do not use ar9003_tx(). */
1419 		if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1420 		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1421 			type = AR_FRAME_TYPE_PROBE_RESP;
1422 		else if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1423 		    IEEE80211_FC0_SUBTYPE_ATIM)
1424 			type = AR_FRAME_TYPE_ATIM;
1425 		else
1426 			type = AR_FRAME_TYPE_NORMAL;
1427 	} else if ((wh->i_fc[0] &
1428 	    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1429 	    (IEEE80211_FC0_TYPE_CTL  | IEEE80211_FC0_SUBTYPE_PS_POLL)) {
1430 		type = AR_FRAME_TYPE_PSPOLL;
1431 	} else
1432 		type = AR_FRAME_TYPE_NORMAL;
1433 
1434 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1435 		k = ieee80211_get_txkey(ic, wh, ni);
1436 		if ((m = ieee80211_encrypt(ic, m, k)) == NULL)
1437 			return (ENOBUFS);
1438 		wh = mtod(m, struct ieee80211_frame *);
1439 	}
1440 
1441 	/* XXX 2-byte padding for QoS and 4-addr headers. */
1442 
1443 	/* Select the HW Tx queue to use for this frame. */
1444 	if ((hasqos = ieee80211_has_qos(wh))) {
1445 		qos = ieee80211_get_qos(wh);
1446 		tid = qos & IEEE80211_QOS_TID;
1447 		qid = athn_ac2qid[ieee80211_up_to_ac(ic, tid)];
1448 	} else if (type == AR_FRAME_TYPE_PSPOLL) {
1449 		qid = ATHN_QID_PSPOLL;
1450 	} else if (txflags & ATHN_TXFLAG_CAB) {
1451 		qid = ATHN_QID_CAB;
1452 	} else
1453 		qid = ATHN_QID_AC_BE;
1454 	txq = &sc->txq[qid];
1455 
1456 	/* Select the transmit rates to use for this frame. */
1457 	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
1458 	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) !=
1459 	    IEEE80211_FC0_TYPE_DATA) {
1460 		/* Use lowest rate for all tries. */
1461 		ridx[0] = ridx[1] = ridx[2] = ridx[3] =
1462 		    (ic->ic_curmode == IEEE80211_MODE_11A) ?
1463 			ATHN_RIDX_OFDM6 : ATHN_RIDX_CCK1;
1464 	} else if (ic->ic_fixed_rate != -1) {
1465 		/* Use same fixed rate for all tries. */
1466 		ridx[0] = ridx[1] = ridx[2] = ridx[3] =
1467 		    sc->fixed_ridx;
1468 	} else {
1469 		int txrate = ni->ni_txrate;
1470 		/* Use fallback table of the node. */
1471 		for (i = 0; i < 4; i++) {
1472 			ridx[i] = an->ridx[txrate];
1473 			txrate = an->fallback[txrate];
1474 		}
1475 	}
1476 
1477 #if NBPFILTER > 0
1478 	if (__predict_false(sc->sc_drvbpf != NULL)) {
1479 		struct athn_tx_radiotap_header *tap = &sc->sc_txtap;
1480 
1481 		tap->wt_flags = 0;
1482 		/* Use initial transmit rate. */
1483 		tap->wt_rate = athn_rates[ridx[0]].rate;
1484 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1485 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1486 		if (athn_rates[ridx[0]].phy == IEEE80211_T_DS &&
1487 		    ridx[0] != ATHN_RIDX_CCK1 &&
1488 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1489 			tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1490 		bpf_mtap_hdr(sc->sc_drvbpf, tap, sc->sc_txtap_len, m,
1491 		    BPF_DIRECTION_OUT);
1492 	}
1493 #endif
1494 
1495 	/* DMA map mbuf. */
1496 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_map, m,
1497 	    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
1498 	if (__predict_false(error != 0)) {
1499 		if (error != EFBIG) {
1500 			printf("%s: can't map mbuf (error %d)\n",
1501 			    sc->sc_dev.dv_xname, error);
1502 			m_freem(m);
1503 			return (error);
1504 		}
1505 		/*
1506 		 * DMA mapping requires too many DMA segments; linearize
1507 		 * mbuf in kernel virtual address space and retry.
1508 		 */
1509 		MGETHDR(m1, M_DONTWAIT, MT_DATA);
1510 		if (m1 == NULL) {
1511 			m_freem(m);
1512 			return (ENOBUFS);
1513 		}
1514 		if (m->m_pkthdr.len > MHLEN) {
1515 			MCLGET(m1, M_DONTWAIT);
1516 			if (!(m1->m_flags & M_EXT)) {
1517 				m_freem(m);
1518 				m_freem(m1);
1519 				return (ENOBUFS);
1520 			}
1521 		}
1522 		m_copydata(m, 0, m->m_pkthdr.len, mtod(m1, caddr_t));
1523 		m1->m_pkthdr.len = m1->m_len = m->m_pkthdr.len;
1524 		m_freem(m);
1525 		m = m1;
1526 
1527 		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_map, m,
1528 		    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
1529 		if (error != 0) {
1530 			printf("%s: can't map mbuf (error %d)\n",
1531 			    sc->sc_dev.dv_xname, error);
1532 			m_freem(m);
1533 			return (error);
1534 		}
1535 	}
1536 	bf->bf_m = m;
1537 	bf->bf_ni = ni;
1538 	bf->bf_txflags = txflags;
1539 
1540 	wh = mtod(m, struct ieee80211_frame *);
1541 
1542 	totlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
1543 
1544 	/* Setup Tx descriptor. */
1545 	ds = bf->bf_descs;
1546 	memset(ds, 0, sizeof(*ds));
1547 
1548 	ds->ds_info =
1549 	    SM(AR_TXI_DESC_ID, AR_VENDOR_ATHEROS) |
1550 	    SM(AR_TXI_DESC_NDWORDS, 23) |
1551 	    SM(AR_TXI_QCU_NUM, qid) |
1552 	    AR_TXI_DESC_TX | AR_TXI_CTRL_STAT;
1553 
1554 	ds->ds_ctl11 = AR_TXC11_CLR_DEST_MASK;
1555 	txpower = AR_MAX_RATE_POWER;	/* Get from per-rate registers. */
1556 	ds->ds_ctl11 |= SM(AR_TXC11_XMIT_POWER, txpower);
1557 
1558 	ds->ds_ctl12 = SM(AR_TXC12_FRAME_TYPE, type);
1559 
1560 	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
1561 	    (hasqos && (qos & IEEE80211_QOS_ACK_POLICY_MASK) ==
1562 	     IEEE80211_QOS_ACK_POLICY_NOACK))
1563 		ds->ds_ctl12 |= AR_TXC12_NO_ACK;
1564 
1565 	if (0 && k != NULL) {
1566 		/*
1567 		 * Map 802.11 cipher to hardware encryption type and
1568 		 * compute MIC+ICV overhead.
1569 		 */
1570 		switch (k->k_cipher) {
1571 		case IEEE80211_CIPHER_WEP40:
1572 		case IEEE80211_CIPHER_WEP104:
1573 			encrtype = AR_ENCR_TYPE_WEP;
1574 			totlen += 4;
1575 			break;
1576 		case IEEE80211_CIPHER_TKIP:
1577 			encrtype = AR_ENCR_TYPE_TKIP;
1578 			totlen += 12;
1579 			break;
1580 		case IEEE80211_CIPHER_CCMP:
1581 			encrtype = AR_ENCR_TYPE_AES;
1582 			totlen += 8;
1583 			break;
1584 		default:
1585 			panic("unsupported cipher");
1586 		}
1587 		/*
1588 		 * NB: The key cache entry index is stored in the key
1589 		 * private field when the key is installed.
1590 		 */
1591 		entry = (uintptr_t)k->k_priv;
1592 		ds->ds_ctl12 |= SM(AR_TXC12_DEST_IDX, entry);
1593 		ds->ds_ctl11 |= AR_TXC11_DEST_IDX_VALID;
1594 	} else
1595 		encrtype = AR_ENCR_TYPE_CLEAR;
1596 	ds->ds_ctl17 = SM(AR_TXC17_ENCR_TYPE, encrtype);
1597 
1598 	/* Check if frame must be protected using RTS/CTS or CTS-to-self. */
1599 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1600 	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1601 	    IEEE80211_FC0_TYPE_DATA) {
1602 		/* NB: Group frames are sent using CCK in 802.11b/g. */
1603 		if (totlen > ic->ic_rtsthreshold) {
1604 			ds->ds_ctl11 |= AR_TXC11_RTS_ENABLE;
1605 		} else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1606 		    athn_rates[ridx[0]].phy == IEEE80211_T_OFDM) {
1607 			if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
1608 				ds->ds_ctl11 |= AR_TXC11_RTS_ENABLE;
1609 			else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
1610 				ds->ds_ctl11 |= AR_TXC11_CTS_ENABLE;
1611 		}
1612 	}
1613 	/*
1614 	 * Disable multi-rate retries when protection is used.
1615 	 * The RTS/CTS frame's duration field is fixed and won't be
1616 	 * updated by hardware when the data rate changes.
1617 	 */
1618 	if (ds->ds_ctl11 & (AR_TXC11_RTS_ENABLE | AR_TXC11_CTS_ENABLE)) {
1619 		ridx[1] = ridx[2] = ridx[3] = ridx[0];
1620 	}
1621 	/* Setup multi-rate retries. */
1622 	for (i = 0; i < 4; i++) {
1623 		series[i].hwrate = athn_rates[ridx[i]].hwrate;
1624 		if (athn_rates[ridx[i]].phy == IEEE80211_T_DS &&
1625 		    ridx[i] != ATHN_RIDX_CCK1 &&
1626 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1627 			series[i].hwrate |= 0x04;
1628 		series[i].dur = 0;
1629 	}
1630 	if (!(ds->ds_ctl12 & AR_TXC12_NO_ACK)) {
1631 		/* Compute duration for each series. */
1632 		for (i = 0; i < 4; i++) {
1633 			series[i].dur = athn_txtime(sc, IEEE80211_ACK_LEN,
1634 			    athn_rates[ridx[i]].rspridx, ic->ic_flags);
1635 		}
1636 	}
1637 	/* If this is a PA training frame, select the Tx chain to use. */
1638 	if (__predict_false(txflags & ATHN_TXFLAG_PAPRD)) {
1639 		ds->ds_ctl12 |= SM(AR_TXC12_PAPRD_CHAIN_MASK,
1640 		    1 << sc->paprd_curchain);
1641 	}
1642 
1643 	/* Write number of tries for each series. */
1644 	ds->ds_ctl13 =
1645 	    SM(AR_TXC13_XMIT_DATA_TRIES0, 2) |
1646 	    SM(AR_TXC13_XMIT_DATA_TRIES1, 2) |
1647 	    SM(AR_TXC13_XMIT_DATA_TRIES2, 2) |
1648 	    SM(AR_TXC13_XMIT_DATA_TRIES3, 4);
1649 
1650 	/* Tell HW to update duration field in 802.11 header. */
1651 	if (type != AR_FRAME_TYPE_PSPOLL)
1652 		ds->ds_ctl13 |= AR_TXC13_DUR_UPDATE_ENA;
1653 
1654 	/* Write Tx rate for each series. */
1655 	ds->ds_ctl14 =
1656 	    SM(AR_TXC14_XMIT_RATE0, series[0].hwrate) |
1657 	    SM(AR_TXC14_XMIT_RATE1, series[1].hwrate) |
1658 	    SM(AR_TXC14_XMIT_RATE2, series[2].hwrate) |
1659 	    SM(AR_TXC14_XMIT_RATE3, series[3].hwrate);
1660 
1661 	/* Write duration for each series. */
1662 	ds->ds_ctl15 =
1663 	    SM(AR_TXC15_PACKET_DUR0, series[0].dur) |
1664 	    SM(AR_TXC15_PACKET_DUR1, series[1].dur);
1665 	ds->ds_ctl16 =
1666 	    SM(AR_TXC16_PACKET_DUR2, series[2].dur) |
1667 	    SM(AR_TXC16_PACKET_DUR3, series[3].dur);
1668 
1669 	if ((sc->flags & ATHN_FLAG_3TREDUCE_CHAIN) &&
1670 	    ic->ic_curmode == IEEE80211_MODE_11A) {
1671 		/*
1672 		 * In order to not exceed PCIe power requirements, we only
1673 		 * use two Tx chains for MCS0~15 on 5GHz band on these chips.
1674 		 */
1675 		ds->ds_ctl18 =
1676 		    SM(AR_TXC18_CHAIN_SEL0,
1677 			(ridx[0] <= ATHN_RIDX_MCS15) ? 0x3 : sc->txchainmask) |
1678 		    SM(AR_TXC18_CHAIN_SEL1,
1679 			(ridx[1] <= ATHN_RIDX_MCS15) ? 0x3 : sc->txchainmask) |
1680 		    SM(AR_TXC18_CHAIN_SEL2,
1681 			(ridx[2] <= ATHN_RIDX_MCS15) ? 0x3 : sc->txchainmask) |
1682 		    SM(AR_TXC18_CHAIN_SEL3,
1683 			(ridx[3] <= ATHN_RIDX_MCS15) ? 0x3 : sc->txchainmask);
1684 	} else {
1685 		/* Use the same Tx chains for all tries. */
1686 		ds->ds_ctl18 =
1687 		    SM(AR_TXC18_CHAIN_SEL0, sc->txchainmask) |
1688 		    SM(AR_TXC18_CHAIN_SEL1, sc->txchainmask) |
1689 		    SM(AR_TXC18_CHAIN_SEL2, sc->txchainmask) |
1690 		    SM(AR_TXC18_CHAIN_SEL3, sc->txchainmask);
1691 	}
1692 #ifdef notyet
1693 	/* Use the same short GI setting for all tries. */
1694 	if (ic->ic_flags & IEEE80211_F_SHGI)
1695 		ds->ds_ctl18 |= AR_TXC18_GI0123;
1696 	/* Use the same channel width for all tries. */
1697 	if (ic->ic_flags & IEEE80211_F_CBW40)
1698 		ds->ds_ctl18 |= AR_TXC18_2040_0123;
1699 #endif
1700 
1701 	if (ds->ds_ctl11 & (AR_TXC11_RTS_ENABLE | AR_TXC11_CTS_ENABLE)) {
1702 		uint8_t protridx, hwrate;
1703 		uint16_t dur = 0;
1704 
1705 		/* Use the same protection mode for all tries. */
1706 		if (ds->ds_ctl11 & AR_TXC11_RTS_ENABLE) {
1707 			ds->ds_ctl15 |= AR_TXC15_RTSCTS_QUAL01;
1708 			ds->ds_ctl16 |= AR_TXC16_RTSCTS_QUAL23;
1709 		}
1710 		/* Select protection rate (suboptimal but ok). */
1711 		protridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
1712 		    ATHN_RIDX_OFDM6 : ATHN_RIDX_CCK2;
1713 		if (ds->ds_ctl11 & AR_TXC11_RTS_ENABLE) {
1714 			/* Account for CTS duration. */
1715 			dur += athn_txtime(sc, IEEE80211_ACK_LEN,
1716 			    athn_rates[protridx].rspridx, ic->ic_flags);
1717 		}
1718 		dur += athn_txtime(sc, totlen, ridx[0], ic->ic_flags);
1719 		if (!(ds->ds_ctl12 & AR_TXC12_NO_ACK)) {
1720 			/* Account for ACK duration. */
1721 			dur += athn_txtime(sc, IEEE80211_ACK_LEN,
1722 			    athn_rates[ridx[0]].rspridx, ic->ic_flags);
1723 		}
1724 		/* Write protection frame duration and rate. */
1725 		ds->ds_ctl13 |= SM(AR_TXC13_BURST_DUR, dur);
1726 		hwrate = athn_rates[protridx].hwrate;
1727 		if (protridx == ATHN_RIDX_CCK2 &&
1728 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1729 			hwrate |= 0x04;
1730 		ds->ds_ctl18 |= SM(AR_TXC18_RTSCTS_RATE, hwrate);
1731 	}
1732 
1733 	ds->ds_ctl11 |= SM(AR_TXC11_FRAME_LEN, totlen);
1734 	ds->ds_ctl19 = AR_TXC19_NOT_SOUNDING;
1735 
1736 	for (i = 0; i < bf->bf_map->dm_nsegs; i++) {
1737 		ds->ds_segs[i].ds_data = bf->bf_map->dm_segs[i].ds_addr;
1738 		ds->ds_segs[i].ds_ctl = SM(AR_TXC_BUF_LEN,
1739 		    bf->bf_map->dm_segs[i].ds_len);
1740 	}
1741 	/* Compute Tx descriptor checksum. */
1742 	sum = ds->ds_info + ds->ds_link;
1743 	for (i = 0; i < 4; i++) {
1744 		sum += ds->ds_segs[i].ds_data;
1745 		sum += ds->ds_segs[i].ds_ctl;
1746 	}
1747 	sum = (sum >> 16) + (sum & 0xffff);
1748 	ds->ds_ctl10 = SM(AR_TXC10_PTR_CHK_SUM, sum);
1749 
1750 	bus_dmamap_sync(sc->sc_dmat, bf->bf_map, 0, bf->bf_map->dm_mapsize,
1751 	    BUS_DMASYNC_PREWRITE);
1752 
1753 	DPRINTFN(6, ("Tx qid=%d nsegs=%d ctl11=0x%x ctl12=0x%x ctl14=0x%x\n",
1754 	    qid, bf->bf_map->dm_nsegs, ds->ds_ctl11, ds->ds_ctl12,
1755 	    ds->ds_ctl14));
1756 
1757 	SIMPLEQ_REMOVE_HEAD(&sc->txbufs, bf_list);
1758 	SIMPLEQ_INSERT_TAIL(&txq->head, bf, bf_list);
1759 
1760 	/* Queue buffer unless hardware FIFO is already full. */
1761 	if (++txq->queued <= AR9003_TX_QDEPTH) {
1762 		AR_WRITE(sc, AR_QTXDP(qid), bf->bf_daddr);
1763 		AR_WRITE_BARRIER(sc);
1764 	} else if (txq->wait == NULL)
1765 		txq->wait = bf;
1766 	return (0);
1767 }
1768 
1769 void
1770 ar9003_set_rf_mode(struct athn_softc *sc, struct ieee80211_channel *c)
1771 {
1772 	uint32_t reg;
1773 
1774 	reg = IEEE80211_IS_CHAN_2GHZ(c) ?
1775 	    AR_PHY_MODE_DYNAMIC : AR_PHY_MODE_OFDM;
1776 	if (IEEE80211_IS_CHAN_5GHZ(c) &&
1777 	    (sc->flags & ATHN_FLAG_FAST_PLL_CLOCK)) {
1778 		reg |= AR_PHY_MODE_DYNAMIC | AR_PHY_MODE_DYN_CCK_DISABLE;
1779 	}
1780 	AR_WRITE(sc, AR_PHY_MODE, reg);
1781 	AR_WRITE_BARRIER(sc);
1782 }
1783 
1784 static __inline uint32_t
1785 ar9003_synth_delay(struct athn_softc *sc)
1786 {
1787 	uint32_t delay;
1788 
1789 	delay = MS(AR_READ(sc, AR_PHY_RX_DELAY), AR_PHY_RX_DELAY_DELAY);
1790 	if (sc->sc_ic.ic_curmode == IEEE80211_MODE_11B)
1791 		delay = (delay * 4) / 22;
1792 	else
1793 		delay = delay / 10;	/* in 100ns steps */
1794 	return (delay);
1795 }
1796 
1797 int
1798 ar9003_rf_bus_request(struct athn_softc *sc)
1799 {
1800 	int ntries;
1801 
1802 	/* Request RF Bus grant. */
1803 	AR_WRITE(sc, AR_PHY_RFBUS_REQ, AR_PHY_RFBUS_REQ_EN);
1804 	for (ntries = 0; ntries < 10000; ntries++) {
1805 		if (AR_READ(sc, AR_PHY_RFBUS_GRANT) & AR_PHY_RFBUS_GRANT_EN)
1806 			return (0);
1807 		DELAY(10);
1808 	}
1809 	DPRINTF(("could not kill baseband Rx"));
1810 	return (ETIMEDOUT);
1811 }
1812 
1813 void
1814 ar9003_rf_bus_release(struct athn_softc *sc)
1815 {
1816 	/* Wait for the synthesizer to settle. */
1817 	DELAY(AR_BASE_PHY_ACTIVE_DELAY + ar9003_synth_delay(sc));
1818 
1819 	/* Release the RF Bus grant. */
1820 	AR_WRITE(sc, AR_PHY_RFBUS_REQ, 0);
1821 	AR_WRITE_BARRIER(sc);
1822 }
1823 
1824 void
1825 ar9003_set_phy(struct athn_softc *sc, struct ieee80211_channel *c,
1826     struct ieee80211_channel *extc)
1827 {
1828 	uint32_t phy;
1829 
1830 	phy = AR_READ(sc, AR_PHY_GEN_CTRL);
1831 	phy |= AR_PHY_GC_HT_EN | AR_PHY_GC_SHORT_GI_40 |
1832 	    AR_PHY_GC_SINGLE_HT_LTF1 | AR_PHY_GC_WALSH;
1833 	if (extc != NULL) {
1834 		phy |= AR_PHY_GC_DYN2040_EN;
1835 		if (extc > c)	/* XXX */
1836 			phy |= AR_PHY_GC_DYN2040_PRI_CH;
1837 	}
1838 	/* Turn off Green Field detection for now. */
1839 	phy &= ~AR_PHY_GC_GF_DETECT_EN;
1840 	AR_WRITE(sc, AR_PHY_GEN_CTRL, phy);
1841 
1842 	AR_WRITE(sc, AR_2040_MODE,
1843 	    (extc != NULL) ? AR_2040_JOINED_RX_CLEAR : 0);
1844 
1845 	/* Set global transmit timeout. */
1846 	AR_WRITE(sc, AR_GTXTO, SM(AR_GTXTO_TIMEOUT_LIMIT, 25));
1847 	/* Set carrier sense timeout. */
1848 	AR_WRITE(sc, AR_CST, SM(AR_CST_TIMEOUT_LIMIT, 15));
1849 	AR_WRITE_BARRIER(sc);
1850 }
1851 
1852 void
1853 ar9003_set_delta_slope(struct athn_softc *sc, struct ieee80211_channel *c,
1854     struct ieee80211_channel *extc)
1855 {
1856 	uint32_t coeff, exp, man, reg;
1857 
1858 	/* Set Delta Slope (exponent and mantissa). */
1859 	coeff = (100 << 24) / c->ic_freq;
1860 	athn_get_delta_slope(coeff, &exp, &man);
1861 	DPRINTFN(5, ("delta slope coeff exp=%u man=%u\n", exp, man));
1862 
1863 	reg = AR_READ(sc, AR_PHY_TIMING3);
1864 	reg = RW(reg, AR_PHY_TIMING3_DSC_EXP, exp);
1865 	reg = RW(reg, AR_PHY_TIMING3_DSC_MAN, man);
1866 	AR_WRITE(sc, AR_PHY_TIMING3, reg);
1867 
1868 	/* For Short GI, coeff is 9/10 that of normal coeff. */
1869 	coeff = (9 * coeff) / 10;
1870 	athn_get_delta_slope(coeff, &exp, &man);
1871 	DPRINTFN(5, ("delta slope coeff exp=%u man=%u\n", exp, man));
1872 
1873 	reg = AR_READ(sc, AR_PHY_SGI_DELTA);
1874 	reg = RW(reg, AR_PHY_SGI_DSC_EXP, exp);
1875 	reg = RW(reg, AR_PHY_SGI_DSC_MAN, man);
1876 	AR_WRITE(sc, AR_PHY_SGI_DELTA, reg);
1877 	AR_WRITE_BARRIER(sc);
1878 }
1879 
1880 void
1881 ar9003_enable_antenna_diversity(struct athn_softc *sc)
1882 {
1883 	AR_SETBITS(sc, AR_PHY_CCK_DETECT,
1884 	    AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV);
1885 	AR_WRITE_BARRIER(sc);
1886 }
1887 
1888 void
1889 ar9003_init_baseband(struct athn_softc *sc)
1890 {
1891 	uint32_t synth_delay;
1892 
1893 	synth_delay = ar9003_synth_delay(sc);
1894 	/* Activate the PHY (includes baseband activate and synthesizer on). */
1895 	AR_WRITE(sc, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
1896 	AR_WRITE_BARRIER(sc);
1897 	DELAY(AR_BASE_PHY_ACTIVE_DELAY + synth_delay);
1898 }
1899 
1900 void
1901 ar9003_disable_phy(struct athn_softc *sc)
1902 {
1903 	AR_WRITE(sc, AR_PHY_ACTIVE, AR_PHY_ACTIVE_DIS);
1904 	AR_WRITE_BARRIER(sc);
1905 }
1906 
1907 void
1908 ar9003_init_chains(struct athn_softc *sc)
1909 {
1910 	if (sc->rxchainmask == 0x5 || sc->txchainmask == 0x5)
1911 		AR_SETBITS(sc, AR_PHY_ANALOG_SWAP, AR_PHY_SWAP_ALT_CHAIN);
1912 
1913 	/* Setup chain masks. */
1914 	AR_WRITE(sc, AR_PHY_RX_CHAINMASK,  sc->rxchainmask);
1915 	AR_WRITE(sc, AR_PHY_CAL_CHAINMASK, sc->rxchainmask);
1916 
1917 	if (sc->flags & ATHN_FLAG_3TREDUCE_CHAIN) {
1918 		/*
1919 		 * All self-generated frames are sent using two Tx chains
1920 		 * on these chips to not exceed PCIe power requirements.
1921 		 */
1922 		AR_WRITE(sc, AR_SELFGEN_MASK, 0x3);
1923 	} else
1924 		AR_WRITE(sc, AR_SELFGEN_MASK, sc->txchainmask);
1925 	AR_WRITE_BARRIER(sc);
1926 }
1927 
1928 void
1929 ar9003_set_rxchains(struct athn_softc *sc)
1930 {
1931 	if (sc->rxchainmask == 0x3 || sc->rxchainmask == 0x5) {
1932 		AR_WRITE(sc, AR_PHY_RX_CHAINMASK,  sc->rxchainmask);
1933 		AR_WRITE(sc, AR_PHY_CAL_CHAINMASK, sc->rxchainmask);
1934 		AR_WRITE_BARRIER(sc);
1935 	}
1936 }
1937 
1938 void
1939 ar9003_read_noisefloor(struct athn_softc *sc, int16_t *nf, int16_t *nf_ext)
1940 {
1941 /* Sign-extends 9-bit value (assumes upper bits are zeroes). */
1942 #define SIGN_EXT(v)	(((v) ^ 0x100) - 0x100)
1943 	uint32_t reg;
1944 	int i;
1945 
1946 	for (i = 0; i < sc->nrxchains; i++) {
1947 		reg = AR_READ(sc, AR_PHY_CCA(i));
1948 		nf[i] = MS(reg, AR_PHY_MINCCA_PWR);
1949 		nf[i] = SIGN_EXT(nf[i]);
1950 
1951 		reg = AR_READ(sc, AR_PHY_EXT_CCA(i));
1952 		nf_ext[i] = MS(reg, AR_PHY_EXT_MINCCA_PWR);
1953 		nf_ext[i] = SIGN_EXT(nf_ext[i]);
1954 	}
1955 #undef SIGN_EXT
1956 }
1957 
1958 void
1959 ar9003_write_noisefloor(struct athn_softc *sc, int16_t *nf, int16_t *nf_ext)
1960 {
1961 	uint32_t reg;
1962 	int i;
1963 
1964 	for (i = 0; i < sc->nrxchains; i++) {
1965 		reg = AR_READ(sc, AR_PHY_CCA(i));
1966 		reg = RW(reg, AR_PHY_MAXCCA_PWR, nf[i]);
1967 		AR_WRITE(sc, AR_PHY_CCA(i), reg);
1968 
1969 		reg = AR_READ(sc, AR_PHY_EXT_CCA(i));
1970 		reg = RW(reg, AR_PHY_EXT_MAXCCA_PWR, nf_ext[i]);
1971 		AR_WRITE(sc, AR_PHY_EXT_CCA(i), reg);
1972 	}
1973 	AR_WRITE_BARRIER(sc);
1974 }
1975 
1976 int
1977 ar9003_get_noisefloor(struct athn_softc *sc)
1978 {
1979 	int16_t nf[AR_MAX_CHAINS], nf_ext[AR_MAX_CHAINS];
1980 	int i;
1981 
1982 	if (AR_READ(sc, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF) {
1983 		/* Noisefloor calibration not finished. */
1984 		return 0;
1985 	}
1986 	/* Noisefloor calibration is finished. */
1987 	ar9003_read_noisefloor(sc, nf, nf_ext);
1988 
1989 	/* Update noisefloor history. */
1990 	for (i = 0; i < sc->nrxchains; i++) {
1991 		sc->nf_hist[sc->nf_hist_cur].nf[i] = nf[i];
1992 		sc->nf_hist[sc->nf_hist_cur].nf_ext[i] = nf_ext[i];
1993 	}
1994 	if (++sc->nf_hist_cur >= ATHN_NF_CAL_HIST_MAX)
1995 		sc->nf_hist_cur = 0;
1996 	return 1;
1997 }
1998 
1999 void
2000 ar9003_bb_load_noisefloor(struct athn_softc *sc)
2001 {
2002 	int16_t nf[AR_MAX_CHAINS], nf_ext[AR_MAX_CHAINS];
2003 	int i, ntries;
2004 
2005 	/* Write filtered noisefloor values. */
2006 	for (i = 0; i < sc->nrxchains; i++) {
2007 		nf[i] = sc->nf_priv[i] * 2;
2008 		nf_ext[i] = sc->nf_ext_priv[i] * 2;
2009 	}
2010 	ar9003_write_noisefloor(sc, nf, nf_ext);
2011 
2012 	/* Load filtered noisefloor values into baseband. */
2013 	AR_CLRBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_ENABLE_NF);
2014 	AR_CLRBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
2015 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
2016 	/* Wait for load to complete. */
2017 	for (ntries = 0; ntries < 1000; ntries++) {
2018 		if (!(AR_READ(sc, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF))
2019 			break;
2020 		DELAY(10);
2021 	}
2022 	if (ntries == 1000) {
2023 		DPRINTF(("failed to load noisefloor values\n"));
2024 		return;
2025 	}
2026 
2027 	/* Restore noisefloor values to initial (max) values. */
2028 	for (i = 0; i < AR_MAX_CHAINS; i++)
2029 		nf[i] = nf_ext[i] = -50 * 2;
2030 	ar9003_write_noisefloor(sc, nf, nf_ext);
2031 }
2032 
2033 void
2034 ar9003_apply_noisefloor(struct athn_softc *sc)
2035 {
2036 	uint32_t agc_nfcal;
2037 
2038 	agc_nfcal = AR_READ(sc, AR_PHY_AGC_CONTROL) &
2039 	    (AR_PHY_AGC_CONTROL_NF | AR_PHY_AGC_CONTROL_ENABLE_NF |
2040 	    AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
2041 
2042 	if (agc_nfcal & AR_PHY_AGC_CONTROL_NF) {
2043 		/* Pause running NF calibration while values are updated. */
2044 		AR_CLRBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
2045 		AR_WRITE_BARRIER(sc);
2046 	}
2047 
2048 	ar9003_bb_load_noisefloor(sc);
2049 
2050 	if (agc_nfcal & AR_PHY_AGC_CONTROL_NF) {
2051 		/* Restart interrupted NF calibration. */
2052 		AR_SETBITS(sc, AR_PHY_AGC_CONTROL, agc_nfcal);
2053 		AR_WRITE_BARRIER(sc);
2054 	}
2055 }
2056 
2057 void
2058 ar9003_do_noisefloor_calib(struct athn_softc *sc)
2059 {
2060 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_ENABLE_NF);
2061 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
2062 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
2063 	AR_WRITE_BARRIER(sc);
2064 }
2065 
2066 void
2067 ar9003_init_noisefloor_calib(struct athn_softc *sc)
2068 {
2069 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
2070 	AR_WRITE_BARRIER(sc);
2071 }
2072 
2073 int
2074 ar9003_init_calib(struct athn_softc *sc)
2075 {
2076 	uint8_t txchainmask, rxchainmask;
2077 	uint32_t reg;
2078 	int ntries;
2079 
2080 	/* Save chains masks. */
2081 	txchainmask = sc->txchainmask;
2082 	rxchainmask = sc->rxchainmask;
2083 	/* Configure hardware before calibration. */
2084 	if (AR_READ(sc, AR_ENT_OTP) & AR_ENT_OTP_CHAIN2_DISABLE)
2085 		txchainmask = rxchainmask = 0x3;
2086 	else
2087 		txchainmask = rxchainmask = 0x7;
2088 	ar9003_init_chains(sc);
2089 
2090 	/* Perform Tx IQ calibration. */
2091 	ar9003_calib_tx_iq(sc);
2092 	/* Disable and re-enable the PHY chips. */
2093 	AR_WRITE(sc, AR_PHY_ACTIVE, AR_PHY_ACTIVE_DIS);
2094 	AR_WRITE_BARRIER(sc);
2095 	DELAY(5);
2096 	AR_WRITE(sc, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
2097 
2098 	/* Calibrate the AGC. */
2099 	AR_SETBITS(sc, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL);
2100 	/* Poll for offset calibration completion. */
2101 	for (ntries = 0; ntries < 10000; ntries++) {
2102 		reg = AR_READ(sc, AR_PHY_AGC_CONTROL);
2103 		if (!(reg & AR_PHY_AGC_CONTROL_CAL))
2104 			break;
2105 		DELAY(10);
2106 	}
2107 	if (ntries == 10000)
2108 		return (ETIMEDOUT);
2109 
2110 	/* Restore chains masks. */
2111 	sc->txchainmask = txchainmask;
2112 	sc->rxchainmask = rxchainmask;
2113 	ar9003_init_chains(sc);
2114 
2115 	return (0);
2116 }
2117 
2118 void
2119 ar9003_do_calib(struct athn_softc *sc)
2120 {
2121 	uint32_t reg;
2122 
2123 	if (sc->cur_calib_mask & ATHN_CAL_IQ) {
2124 		reg = AR_READ(sc, AR_PHY_TIMING4);
2125 		reg = RW(reg, AR_PHY_TIMING4_IQCAL_LOG_COUNT_MAX, 10);
2126 		AR_WRITE(sc, AR_PHY_TIMING4, reg);
2127 		AR_WRITE(sc, AR_PHY_CALMODE, AR_PHY_CALMODE_IQ);
2128 		AR_SETBITS(sc, AR_PHY_TIMING4, AR_PHY_TIMING4_DO_CAL);
2129 		AR_WRITE_BARRIER(sc);
2130 	} else if (sc->cur_calib_mask & ATHN_CAL_TEMP) {
2131 		AR_SETBITS(sc, AR_PHY_65NM_CH0_THERM,
2132 		    AR_PHY_65NM_CH0_THERM_LOCAL);
2133 		AR_SETBITS(sc, AR_PHY_65NM_CH0_THERM,
2134 		    AR_PHY_65NM_CH0_THERM_START);
2135 		AR_WRITE_BARRIER(sc);
2136 	}
2137 }
2138 
2139 void
2140 ar9003_next_calib(struct athn_softc *sc)
2141 {
2142 	/* Check if we have any calibration in progress. */
2143 	if (sc->cur_calib_mask != 0) {
2144 		if (!(AR_READ(sc, AR_PHY_TIMING4) & AR_PHY_TIMING4_DO_CAL)) {
2145 			/* Calibration completed for current sample. */
2146 			ar9003_calib_iq(sc);
2147 		}
2148 	}
2149 }
2150 
2151 void
2152 ar9003_calib_iq(struct athn_softc *sc)
2153 {
2154 	struct athn_iq_cal *cal;
2155 	uint32_t reg, i_coff_denom, q_coff_denom;
2156 	int32_t i_coff, q_coff;
2157 	int i, iq_corr_neg;
2158 
2159 	for (i = 0; i < AR_MAX_CHAINS; i++) {
2160 		cal = &sc->calib.iq[i];
2161 
2162 		/* Read IQ calibration measures (clear on read). */
2163 		cal->pwr_meas_i = AR_READ(sc, AR_PHY_IQ_ADC_MEAS_0_B(i));
2164 		cal->pwr_meas_q = AR_READ(sc, AR_PHY_IQ_ADC_MEAS_1_B(i));
2165 		cal->iq_corr_meas =
2166 		    (int32_t)AR_READ(sc, AR_PHY_IQ_ADC_MEAS_2_B(i));
2167 	}
2168 
2169 	for (i = 0; i < sc->nrxchains; i++) {
2170 		cal = &sc->calib.iq[i];
2171 
2172 		if (cal->pwr_meas_q == 0)
2173 			continue;
2174 
2175 		if ((iq_corr_neg = cal->iq_corr_meas < 0))
2176 			cal->iq_corr_meas = -cal->iq_corr_meas;
2177 
2178 		i_coff_denom =
2179 		    (cal->pwr_meas_i / 2 + cal->pwr_meas_q / 2) / 256;
2180 		q_coff_denom = cal->pwr_meas_q / 64;
2181 
2182 		if (i_coff_denom == 0 || q_coff_denom == 0)
2183 			continue;	/* Prevents division by zero. */
2184 
2185 		i_coff = cal->iq_corr_meas / i_coff_denom;
2186 		q_coff = (cal->pwr_meas_i / q_coff_denom) - 64;
2187 
2188 		if (i_coff > 63)
2189 			i_coff = 63;
2190 		else if (i_coff < -63)
2191 			i_coff = -63;
2192 		/* Negate i_coff if iq_corr_meas is positive. */
2193 		if (!iq_corr_neg)
2194 			i_coff = -i_coff;
2195 		if (q_coff > 63)
2196 			q_coff = 63;
2197 		else if (q_coff < -63)
2198 			q_coff = -63;
2199 
2200 		DPRINTFN(2, ("IQ calibration for chain %d\n", i));
2201 		reg = AR_READ(sc, AR_PHY_RX_IQCAL_CORR_B(i));
2202 		reg = RW(reg, AR_PHY_RX_IQCAL_CORR_IQCORR_Q_I_COFF, i_coff);
2203 		reg = RW(reg, AR_PHY_RX_IQCAL_CORR_IQCORR_Q_Q_COFF, q_coff);
2204 		AR_WRITE(sc, AR_PHY_RX_IQCAL_CORR_B(i), reg);
2205 	}
2206 
2207 	/* Apply new settings. */
2208 	AR_SETBITS(sc, AR_PHY_RX_IQCAL_CORR_B(0),
2209 	    AR_PHY_RX_IQCAL_CORR_IQCORR_ENABLE);
2210 	AR_WRITE_BARRIER(sc);
2211 
2212 	/* IQ calibration done. */
2213 	sc->cur_calib_mask &= ~ATHN_CAL_IQ;
2214 	memset(&sc->calib, 0, sizeof(sc->calib));
2215 }
2216 
2217 #define DELPT	32
2218 int
2219 ar9003_get_iq_corr(struct athn_softc *sc, int32_t res[6], int32_t coeff[2])
2220 {
2221 /* Sign-extends 12-bit value (assumes upper bits are zeroes). */
2222 #define SIGN_EXT(v)	(((v) ^ 0x800) - 0x800)
2223 #define SCALE		(1 << 15)
2224 #define SHIFT		(1 <<  8)
2225 	struct {
2226 		int32_t	m, p, c;
2227 	} val[2][2];
2228 	int32_t mag[2][2], phs[2][2], cos[2], sin[2];
2229 	int32_t min, max, div, f1, f2, f3, m, p, c;
2230 	int32_t txmag, txphs, rxmag, rxphs;
2231 	int32_t q_coff, i_coff;
2232 	int i, j;
2233 
2234 	/* Extract our twelve signed 12-bit values from res[] array. */
2235 	val[0][0].m = res[0] & 0xfff;
2236 	val[0][0].p = (res[0] >> 12) & 0xfff;
2237 	val[0][0].c = ((res[0] >> 24) & 0xff) | (res[1] & 0xf) << 8;
2238 
2239 	val[0][1].m = (res[1] >> 4) & 0xfff;
2240 	val[0][1].p = res[2] & 0xfff;
2241 	val[0][1].c = (res[2] >> 12) & 0xfff;
2242 
2243 	val[1][0].m = ((res[2] >> 24) & 0xff) | (res[3] & 0xf) << 8;
2244 	val[1][0].p = (res[3] >> 4) & 0xfff;
2245 	val[1][0].c = res[4] & 0xfff;
2246 
2247 	val[1][1].m = (res[4] >> 12) & 0xfff;
2248 	val[1][1].p = ((res[4] >> 24) & 0xff) | (res[5] & 0xf) << 8;
2249 	val[1][1].c = (res[5] >> 4) & 0xfff;
2250 
2251 	for (i = 0; i < 2; i++) {
2252 		for (j = 0; j < 2; j++) {
2253 			m = SIGN_EXT(val[i][j].m);
2254 			p = SIGN_EXT(val[i][j].p);
2255 			c = SIGN_EXT(val[i][j].c);
2256 
2257 			if (p == 0)
2258 				return (1);	/* Prevent division by 0. */
2259 
2260 			mag[i][j] = (m * SCALE) / p;
2261 			phs[i][j] = (c * SCALE) / p;
2262 		}
2263 		sin[i] = ((mag[i][0] - mag[i][1]) * SHIFT) / DELPT;
2264 		cos[i] = ((phs[i][0] - phs[i][1]) * SHIFT) / DELPT;
2265 		/* Find magnitude by approximation. */
2266 		min = MIN(abs(sin[i]), abs(cos[i]));
2267 		max = MAX(abs(sin[i]), abs(cos[i]));
2268 		div = max - (max / 32) + (min / 8) + (min / 4);
2269 		if (div == 0)
2270 			return (1);	/* Prevent division by 0. */
2271 		/* Normalize sin and cos by magnitude. */
2272 		sin[i] = (sin[i] * SCALE) / div;
2273 		cos[i] = (cos[i] * SCALE) / div;
2274 	}
2275 
2276 	/* Compute IQ mismatch (solve 4x4 linear equation). */
2277 	f1 = cos[0] - cos[1];
2278 	f3 = sin[0] - sin[1];
2279 	f2 = (f1 * f1 + f3 * f3) / SCALE;
2280 	if (f2 == 0)
2281 		return (1);	/* Prevent division by 0. */
2282 
2283 	/* Compute Tx magnitude mismatch. */
2284 	txmag = (f1 * ( mag[0][0] - mag[1][0]) +
2285 		 f3 * ( phs[0][0] - phs[1][0])) / f2;
2286 	/* Compute Tx phase mismatch. */
2287 	txphs = (f3 * (-mag[0][0] + mag[1][0]) +
2288 		 f1 * ( phs[0][0] - phs[1][0])) / f2;
2289 
2290 	if (txmag == SCALE)
2291 		return (1);	/* Prevent division by 0. */
2292 
2293 	/* Compute Rx magnitude mismatch. */
2294 	rxmag = mag[0][0] - (cos[0] * txmag + sin[0] * txphs) / SCALE;
2295 	/* Compute Rx phase mismatch. */
2296 	rxphs = phs[0][0] + (sin[0] * txmag - cos[0] * txphs) / SCALE;
2297 
2298 	if (-rxmag == SCALE)
2299 		return (1);	/* Prevent division by 0. */
2300 
2301 	txmag = (txmag * SCALE) / (SCALE - txmag);
2302 	txphs = -txphs;
2303 
2304 	q_coff = (txmag * 128) / SCALE;
2305 	if (q_coff < -63)
2306 		q_coff = -63;
2307 	else if (q_coff > 63)
2308 		q_coff = 63;
2309 	i_coff = (txphs * 256) / SCALE;
2310 	if (i_coff < -63)
2311 		i_coff = -63;
2312 	else if (i_coff > 63)
2313 		i_coff = 63;
2314 	coeff[0] = q_coff * 128 + i_coff;
2315 
2316 	rxmag = (-rxmag * SCALE) / (SCALE + rxmag);
2317 	rxphs = -rxphs;
2318 
2319 	q_coff = (rxmag * 128) / SCALE;
2320 	if (q_coff < -63)
2321 		q_coff = -63;
2322 	else if (q_coff > 63)
2323 		q_coff = 63;
2324 	i_coff = (rxphs * 256) / SCALE;
2325 	if (i_coff < -63)
2326 		i_coff = -63;
2327 	else if (i_coff > 63)
2328 		i_coff = 63;
2329 	coeff[1] = q_coff * 128 + i_coff;
2330 
2331 	return (0);
2332 #undef SHIFT
2333 #undef SCALE
2334 #undef SIGN_EXT
2335 }
2336 
2337 int
2338 ar9003_calib_tx_iq(struct athn_softc *sc)
2339 {
2340 	uint32_t reg;
2341 	int32_t res[6], coeff[2];
2342 	int i, j, ntries;
2343 
2344 	reg = AR_READ(sc, AR_PHY_TX_IQCAL_CONTROL_1);
2345 	reg = RW(reg, AR_PHY_TX_IQCAQL_CONTROL_1_IQCORR_I_Q_COFF_DELPT, DELPT);
2346 	AR_WRITE(sc, AR_PHY_TX_IQCAL_CONTROL_1, reg);
2347 
2348 	/* Start Tx IQ calibration. */
2349 	AR_SETBITS(sc, AR_PHY_TX_IQCAL_START, AR_PHY_TX_IQCAL_START_DO_CAL);
2350 	/* Wait for completion. */
2351 	for (ntries = 0; ntries < 10000; ntries++) {
2352 		reg = AR_READ(sc, AR_PHY_TX_IQCAL_START);
2353 		if (!(reg & AR_PHY_TX_IQCAL_START_DO_CAL))
2354 			break;
2355 		DELAY(10);
2356 	}
2357 	if (ntries == 10000)
2358 		return (ETIMEDOUT);
2359 
2360 	for (i = 0; i < sc->ntxchains; i++) {
2361 		/* Read Tx IQ calibration status for this chain. */
2362 		reg = AR_READ(sc, AR_PHY_TX_IQCAL_STATUS_B(i));
2363 		if (reg & AR_PHY_TX_IQCAL_STATUS_FAILED)
2364 			return (EIO);
2365 		/*
2366 		 * Read Tx IQ calibration results for this chain.
2367 		 * This consists in twelve signed 12-bit values.
2368 		 */
2369 		for (j = 0; j < 3; j++) {
2370 			AR_CLRBITS(sc, AR_PHY_CHAN_INFO_MEMORY,
2371 			    AR_PHY_CHAN_INFO_TAB_S2_READ);
2372 			reg = AR_READ(sc, AR_PHY_CHAN_INFO_TAB(i, j));
2373 			res[j * 2 + 0] = reg;
2374 
2375 			AR_SETBITS(sc, AR_PHY_CHAN_INFO_MEMORY,
2376 			    AR_PHY_CHAN_INFO_TAB_S2_READ);
2377 			reg = AR_READ(sc, AR_PHY_CHAN_INFO_TAB(i, j));
2378 			res[j * 2 + 1] = reg & 0xffff;
2379 		}
2380 
2381 		/* Compute Tx IQ correction. */
2382 		if (ar9003_get_iq_corr(sc, res, coeff) != 0)
2383 			return (EIO);
2384 
2385 		/* Write Tx IQ correction coefficients. */
2386 		reg = AR_READ(sc, AR_PHY_TX_IQCAL_CORR_COEFF_01_B(i));
2387 		reg = RW(reg, AR_PHY_TX_IQCAL_CORR_COEFF_01_COEFF_TABLE,
2388 		    coeff[0]);
2389 		AR_WRITE(sc, AR_PHY_TX_IQCAL_CORR_COEFF_01_B(i), reg);
2390 
2391 		reg = AR_READ(sc, AR_PHY_RX_IQCAL_CORR_B(i));
2392 		reg = RW(reg, AR_PHY_RX_IQCAL_CORR_LOOPBACK_IQCORR_Q_Q_COFF,
2393 		    coeff[1] >> 7);
2394 		reg = RW(reg, AR_PHY_RX_IQCAL_CORR_LOOPBACK_IQCORR_Q_I_COFF,
2395 		    coeff[1]);
2396 		AR_WRITE(sc, AR_PHY_RX_IQCAL_CORR_B(i), reg);
2397 		AR_WRITE_BARRIER(sc);
2398 	}
2399 
2400 	/* Enable Tx IQ correction. */
2401 	AR_SETBITS(sc, AR_PHY_TX_IQCAL_CONTROL_3,
2402 	    AR_PHY_TX_IQCAL_CONTROL_3_IQCORR_EN);
2403 	AR_SETBITS(sc, AR_PHY_RX_IQCAL_CORR_B(0),
2404 	    AR_PHY_RX_IQCAL_CORR_B0_LOOPBACK_IQCORR_EN);
2405 	AR_WRITE_BARRIER(sc);
2406 	return (0);
2407 }
2408 #undef DELPT
2409 
2410 /*-
2411  * The power amplifier predistortion state machine works as follows:
2412  * 1) Disable digital predistorters for all Tx chains
2413  * 2) Repeat steps 3~7 for all Tx chains
2414  * 3)   Force Tx gain to that of training signal
2415  * 4)   Send training signal (asynchronous)
2416  * 5)   Wait for training signal to complete (asynchronous)
2417  * 6)   Read PA measurements (input power, output power, output phase)
2418  * 7)   Compute the predistortion function that linearizes PA output
2419  * 8) Write predistortion functions to hardware tables for all Tx chains
2420  * 9) Enable digital predistorters for all Tx chains
2421  */
2422 void
2423 ar9003_paprd_calib(struct athn_softc *sc, struct ieee80211_channel *c)
2424 {
2425 	static const int scaling[] = {
2426 		261376, 248079, 233759, 220464,
2427 		208194, 196949, 185706, 175487
2428 	};
2429 	struct athn_ops *ops = &sc->ops;
2430 	uint32_t reg, ht20mask, ht40mask;
2431 	int i;
2432 
2433 	/* Read PA predistortion masks from ROM. */
2434 	ops->get_paprd_masks(sc, c, &ht20mask, &ht40mask);
2435 
2436 	/* AM-to-AM: amplifier's amplitude characteristic. */
2437 	reg = AR_READ(sc, AR_PHY_PAPRD_AM2AM);
2438 	reg = RW(reg, AR_PHY_PAPRD_AM2AM_MASK, ht20mask);
2439 	AR_WRITE(sc, AR_PHY_PAPRD_AM2AM, reg);
2440 
2441 	/* AM-to-PM: amplifier's phase transfer characteristic. */
2442 	reg = AR_READ(sc, AR_PHY_PAPRD_AM2PM);
2443 	reg = RW(reg, AR_PHY_PAPRD_AM2PM_MASK, ht20mask);
2444 	AR_WRITE(sc, AR_PHY_PAPRD_AM2PM, reg);
2445 
2446 	reg = AR_READ(sc, AR_PHY_PAPRD_HT40);
2447 	reg = RW(reg, AR_PHY_PAPRD_HT40_MASK, ht40mask);
2448 	AR_WRITE(sc, AR_PHY_PAPRD_HT40, reg);
2449 
2450 	for (i = 0; i < AR9003_MAX_CHAINS; i++) {
2451 		AR_SETBITS(sc, AR_PHY_PAPRD_CTRL0_B(i),
2452 		    AR_PHY_PAPRD_CTRL0_USE_SINGLE_TABLE);
2453 
2454 		reg = AR_READ(sc, AR_PHY_PAPRD_CTRL1_B(i));
2455 		reg = RW(reg, AR_PHY_PAPRD_CTRL1_PA_GAIN_SCALE_FACT, 181);
2456 		reg = RW(reg, AR_PHY_PAPRD_CTRL1_MAG_SCALE_FACT, 361);
2457 		reg &= ~AR_PHY_PAPRD_CTRL1_ADAPTIVE_SCALING_ENA;
2458 		reg |= AR_PHY_PAPRD_CTRL1_ADAPTIVE_AM2AM_ENA;
2459 		reg |= AR_PHY_PAPRD_CTRL1_ADAPTIVE_AM2PM_ENA;
2460 		AR_WRITE(sc, AR_PHY_PAPRD_CTRL1_B(i), reg);
2461 
2462 		reg = AR_READ(sc, AR_PHY_PAPRD_CTRL0_B(i));
2463 		reg = RW(reg, AR_PHY_PAPRD_CTRL0_PAPRD_MAG_THRSH, 3);
2464 		AR_WRITE(sc, AR_PHY_PAPRD_CTRL0_B(i), reg);
2465 	}
2466 
2467 	/* Disable all digital predistorters during calibration. */
2468 	for (i = 0; i < AR9003_MAX_CHAINS; i++) {
2469 		AR_CLRBITS(sc, AR_PHY_PAPRD_CTRL0_B(i),
2470 		    AR_PHY_PAPRD_CTRL0_PAPRD_ENABLE);
2471 	}
2472 	AR_WRITE_BARRIER(sc);
2473 
2474 	/*
2475 	 * Configure training signal.
2476 	 */
2477 	reg = AR_READ(sc, AR_PHY_PAPRD_TRAINER_CNTL1);
2478 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL1_AGC2_SETTLING, 28);
2479 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL1_LB_SKIP, 0x30);
2480 	reg &= ~AR_PHY_PAPRD_TRAINER_CNTL1_RX_BB_GAIN_FORCE;
2481 	reg &= ~AR_PHY_PAPRD_TRAINER_CNTL1_IQCORR_ENABLE;
2482 	reg |= AR_PHY_PAPRD_TRAINER_CNTL1_LB_ENABLE;
2483 	reg |= AR_PHY_PAPRD_TRAINER_CNTL1_TX_GAIN_FORCE;
2484 	reg |= AR_PHY_PAPRD_TRAINER_CNTL1_TRAIN_ENABLE;
2485 	AR_WRITE(sc, AR_PHY_PAPRD_TRAINER_CNTL1, reg);
2486 
2487 	AR_WRITE(sc, AR_PHY_PAPRD_TRAINER_CNTL2, 147);
2488 
2489 	reg = AR_READ(sc, AR_PHY_PAPRD_TRAINER_CNTL3);
2490 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_FINE_CORR_LEN, 4);
2491 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_COARSE_CORR_LEN, 4);
2492 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_NUM_CORR_STAGES, 7);
2493 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_MIN_LOOPBACK_DEL, 1);
2494 	if (AR_SREV_9485(sc))
2495 		reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_QUICK_DROP, -3);
2496 	else
2497 		reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_QUICK_DROP, -6);
2498 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL3_ADC_DESIRED_SIZE, -15);
2499 	reg |= AR_PHY_PAPRD_TRAINER_CNTL3_BBTXMIX_DISABLE;
2500 	AR_WRITE(sc, AR_PHY_PAPRD_TRAINER_CNTL3, reg);
2501 
2502 	reg = AR_READ(sc, AR_PHY_PAPRD_TRAINER_CNTL4);
2503 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL4_SAFETY_DELTA, 0);
2504 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL4_MIN_CORR, 400);
2505 	reg = RW(reg, AR_PHY_PAPRD_TRAINER_CNTL4_NUM_TRAIN_SAMPLES, 100);
2506 	AR_WRITE(sc, AR_PHY_PAPRD_TRAINER_CNTL4, reg);
2507 
2508 	for (i = 0; i < nitems(scaling); i++) {
2509 		reg = AR_READ(sc, AR_PHY_PAPRD_PRE_POST_SCALE_B0(i));
2510 		reg = RW(reg, AR_PHY_PAPRD_PRE_POST_SCALING, scaling[i]);
2511 		AR_WRITE(sc, AR_PHY_PAPRD_PRE_POST_SCALE_B0(i), reg);
2512 	}
2513 
2514 	/* Save Tx gain table. */
2515 	for (i = 0; i < AR9003_TX_GAIN_TABLE_SIZE; i++)
2516 		sc->txgain[i] = AR_READ(sc, AR_PHY_TXGAIN_TABLE(i));
2517 
2518 	/* Set Tx power of training signal (use setting for MCS0). */
2519 	sc->trainpow = MS(AR_READ(sc, AR_PHY_PWRTX_RATE5),
2520 	    AR_PHY_PWRTX_RATE5_POWERTXHT20_0) - 4;
2521 
2522 	/*
2523 	 * Start PA predistortion calibration state machine.
2524 	 */
2525 	/* Find first available Tx chain. */
2526 	sc->paprd_curchain = 0;
2527 	while (!(sc->txchainmask & (1 << sc->paprd_curchain)))
2528 		sc->paprd_curchain++;
2529 
2530 	/* Make sure training done bit is clear. */
2531 	AR_CLRBITS(sc, AR_PHY_PAPRD_TRAINER_STAT1,
2532 	    AR_PHY_PAPRD_TRAINER_STAT1_TRAIN_DONE);
2533 	AR_WRITE_BARRIER(sc);
2534 
2535 	/* Transmit training signal. */
2536 	ar9003_paprd_tx_tone(sc);
2537 }
2538 
2539 int
2540 ar9003_get_desired_txgain(struct athn_softc *sc, int chain, int pow)
2541 {
2542 	int32_t scale, atemp, avolt, tempcal, voltcal, temp, volt;
2543 	int32_t tempcorr, voltcorr;
2544 	uint32_t reg;
2545 	int8_t delta;
2546 
2547 	scale = MS(AR_READ(sc, AR_PHY_TPC_12),
2548 	    AR_PHY_TPC_12_DESIRED_SCALE_HT40_5);
2549 
2550 	reg = AR_READ(sc, AR_PHY_TPC_19);
2551 	atemp = MS(reg, AR_PHY_TPC_19_ALPHA_THERM);
2552 	avolt = MS(reg, AR_PHY_TPC_19_ALPHA_VOLT);
2553 
2554 	reg = AR_READ(sc, AR_PHY_TPC_18);
2555 	tempcal = MS(reg, AR_PHY_TPC_18_THERM_CAL);
2556 	voltcal = MS(reg, AR_PHY_TPC_18_VOLT_CAL);
2557 
2558 	reg = AR_READ(sc, AR_PHY_BB_THERM_ADC_4);
2559 	temp = MS(reg, AR_PHY_BB_THERM_ADC_4_LATEST_THERM);
2560 	volt = MS(reg, AR_PHY_BB_THERM_ADC_4_LATEST_VOLT);
2561 
2562 	delta = (int8_t)MS(AR_READ(sc, AR_PHY_TPC_11_B(chain)),
2563 	    AR_PHY_TPC_11_OLPC_GAIN_DELTA);
2564 
2565 	/* Compute temperature and voltage correction. */
2566 	tempcorr = (atemp * (temp - tempcal) + 128) / 256;
2567 	voltcorr = (avolt * (volt - voltcal) + 64) / 128;
2568 
2569 	/* Compute desired Tx gain. */
2570 	return (pow - delta - tempcorr - voltcorr + scale);
2571 }
2572 
2573 void
2574 ar9003_force_txgain(struct athn_softc *sc, uint32_t txgain)
2575 {
2576 	uint32_t reg;
2577 
2578 	reg = AR_READ(sc, AR_PHY_TX_FORCED_GAIN);
2579 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_TXBB1DBGAIN,
2580 	    MS(txgain, AR_PHY_TXGAIN_TXBB1DBGAIN));
2581 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_TXBB6DBGAIN,
2582 	    MS(txgain, AR_PHY_TXGAIN_TXBB6DBGAIN));
2583 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_TXMXRGAIN,
2584 	    MS(txgain, AR_PHY_TXGAIN_TXMXRGAIN));
2585 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_PADRVGNA,
2586 	    MS(txgain, AR_PHY_TXGAIN_PADRVGNA));
2587 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_PADRVGNB,
2588 	    MS(txgain, AR_PHY_TXGAIN_PADRVGNB));
2589 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_PADRVGNC,
2590 	    MS(txgain, AR_PHY_TXGAIN_PADRVGNC));
2591 	reg = RW(reg, AR_PHY_TX_FORCED_GAIN_PADRVGND,
2592 	    MS(txgain, AR_PHY_TXGAIN_PADRVGND));
2593 	reg &= ~AR_PHY_TX_FORCED_GAIN_ENABLE_PAL;
2594 	reg &= ~AR_PHY_TX_FORCED_GAIN_FORCE_TX_GAIN;
2595 	AR_WRITE(sc, AR_PHY_TX_FORCED_GAIN, reg);
2596 
2597 	reg = AR_READ(sc, AR_PHY_TPC_1);
2598 	reg = RW(reg, AR_PHY_TPC_1_FORCED_DAC_GAIN, 0);
2599 	reg &= ~AR_PHY_TPC_1_FORCE_DAC_GAIN;
2600 	AR_WRITE(sc, AR_PHY_TPC_1, reg);
2601 	AR_WRITE_BARRIER(sc);
2602 }
2603 
2604 void
2605 ar9003_set_training_gain(struct athn_softc *sc, int chain)
2606 {
2607 	int i, gain;
2608 
2609 	/*
2610 	 * Get desired gain for training signal power (take into account
2611 	 * current temperature/voltage).
2612 	 */
2613 	gain = ar9003_get_desired_txgain(sc, chain, sc->trainpow);
2614 	/* Find entry in table. */
2615 	for (i = 0; i < AR9003_TX_GAIN_TABLE_SIZE - 1; i++)
2616 		if (MS(sc->txgain[i], AR_PHY_TXGAIN_INDEX) >= gain)
2617 			break;
2618 	ar9003_force_txgain(sc, sc->txgain[i]);
2619 }
2620 
2621 int
2622 ar9003_paprd_tx_tone(struct athn_softc *sc)
2623 {
2624 #define TONE_LEN	1800
2625 	struct ieee80211com *ic = &sc->sc_ic;
2626 	struct ieee80211_frame *wh;
2627 	struct ieee80211_node *ni;
2628 	struct mbuf *m;
2629 	int error;
2630 
2631 	/* Build a Null (no data) frame of TONE_LEN bytes. */
2632 	m = MCLGETL(NULL, M_DONTWAIT, TONE_LEN);
2633 	if (m == NULL)
2634 		return (ENOBUFS);
2635 	memset(mtod(m, caddr_t), 0, TONE_LEN);
2636 	wh = mtod(m, struct ieee80211_frame *);
2637 	wh->i_fc[0] = IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_NODATA;
2638 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
2639 	*(uint16_t *)wh->i_dur = htole16(10);	/* XXX */
2640 	IEEE80211_ADDR_COPY(wh->i_addr1, ic->ic_myaddr);
2641 	IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
2642 	IEEE80211_ADDR_COPY(wh->i_addr3, ic->ic_myaddr);
2643 	m->m_pkthdr.len = m->m_len = TONE_LEN;
2644 
2645 	/* Set gain of training signal. */
2646 	ar9003_set_training_gain(sc, sc->paprd_curchain);
2647 
2648 	/* Transmit training signal. */
2649 	ni = ieee80211_ref_node(ic->ic_bss);
2650 	if ((error = ar9003_tx(sc, m, ni, ATHN_TXFLAG_PAPRD)) != 0)
2651 		ieee80211_release_node(ic, ni);
2652 	return (error);
2653 #undef TONE_LEN
2654 }
2655 
2656 static __inline int
2657 get_scale(int val)
2658 {
2659 	int log = 0;
2660 
2661 	/* Find the log base 2 (position of highest bit set). */
2662 	while (val >>= 1)
2663 		log++;
2664 
2665 	return ((log > 10) ? log - 10 : 0);
2666 }
2667 
2668 /*
2669  * Compute predistortion function to linearize power amplifier output based
2670  * on feedback from training signal.
2671  */
2672 int
2673 ar9003_compute_predistortion(struct athn_softc *sc, const uint32_t *lo,
2674     const uint32_t *hi)
2675 {
2676 #define NBINS	23
2677 	int chain = sc->paprd_curchain;
2678 	int x[NBINS + 1], y[NBINS + 1], t[NBINS + 1];
2679 	int b1[NBINS + 1], b2[NBINS + 1], xtilde[NBINS + 1];
2680 	int nsamples, txsum, rxsum, rosum, maxidx;
2681 	int order, order5x, order5xrem, order3x, order3xrem, y5, y3;
2682 	int icept, G, I, L, M, angle, xnonlin, y2, y4, sumy2, sumy4;
2683 	int alpha, beta, scale, Qalpha, Qbeta, Qscale, Qx, Qb1, Qb2;
2684 	int tavg, ttilde, maxb1abs, maxb2abs, maxxtildeabs, in;
2685 	int tmp, i;
2686 
2687 	/* Set values at origin. */
2688 	x[0] = y[0] = t[0] = 0;
2689 
2690 #define SCALE	32
2691 	maxidx = 0;
2692 	for (i = 0; i < NBINS; i++) {
2693 		nsamples = lo[i] & 0xffff;
2694 		/* Skip bins that contain 16 or less samples. */
2695 		if (nsamples <= 16) {
2696 			x[i + 1] = y[i + 1] = t[i + 1] = 0;
2697 			continue;
2698 		}
2699 		txsum = (hi[i] & 0x7ff) << 16 | lo[i] >> 16;
2700 		rxsum = (lo[i + NBINS] & 0xffff) << 5 |
2701 		    ((hi[i] >> 11) & 0x1f);
2702 		rosum = (hi[i + NBINS] & 0x7ff) << 16 | hi[i + NBINS] >> 16;
2703 		/* Sign-extend 27-bit value. */
2704 		rosum = (rosum ^ 0x4000000) - 0x4000000;
2705 
2706 		txsum *= SCALE;
2707 		rxsum *= SCALE;
2708 		rosum *= SCALE;
2709 
2710 		x[i + 1] = ((txsum + nsamples) / nsamples + SCALE) / SCALE;
2711 		y[i + 1] = ((rxsum + nsamples) / nsamples + SCALE) / SCALE +
2712 		    SCALE * maxidx + SCALE / 2;
2713 		t[i + 1] = (rosum + nsamples) / nsamples;
2714 		maxidx++;
2715 	}
2716 #undef SCALE
2717 
2718 #define SCALE_LOG	8
2719 #define SCALE		(1 << SCALE_LOG)
2720 	if (x[6] == x[3])
2721 		return (1);	/* Prevent division by 0. */
2722 	G = ((y[6] - y[3]) * SCALE + (x[6] - x[3])) / (x[6] - x[3]);
2723 	if (G == 0)
2724 		return (1);	/* Prevent division by 0. */
2725 
2726 	sc->gain1[chain] = G;	/* Save low signal gain. */
2727 
2728 	/* Find interception point. */
2729 	icept = (G * (x[0] - x[3]) + SCALE) / SCALE + y[3];
2730 	for (i = 0; i <= 3; i++) {
2731 		y[i] = i * 32;
2732 		x[i] = (y[i] * SCALE + G) / G;
2733 	}
2734 	for (i = 4; i <= maxidx; i++)
2735 		y[i] -= icept;
2736 
2737 	xnonlin = x[maxidx] - (y[maxidx] * SCALE + G) / G;
2738 	order = (xnonlin + y[maxidx]) / y[maxidx];
2739 	if (order == 0)
2740 		M = 10;
2741 	else if (order == 1)
2742 		M = 9;
2743 	else
2744 		M = 8;
2745 
2746 	I = (maxidx >= 16) ? 7 : maxidx / 2;
2747 	L = maxidx - I;
2748 
2749 	sumy2 = sumy4 = y2 = y4 = 0;
2750 	for (i = 0; i <= L; i++) {
2751 		if (y[i + I] == 0)
2752 			return (1);	/* Prevent division by 0. */
2753 
2754 		xnonlin = x[i + I] - ((y[i + I] * SCALE) + G) / G;
2755 		xtilde[i] = ((xnonlin << M) + y[i + I]) / y[i + I];
2756 		xtilde[i] = ((xtilde[i] << M) + y[i + I]) / y[i + I];
2757 		xtilde[i] = ((xtilde[i] << M) + y[i + I]) / y[i + I];
2758 
2759 		y2 = (y[i + I] * y[i + I] + SCALE * SCALE) / (SCALE * SCALE);
2760 
2761 		sumy2 += y2;
2762 		sumy4 += y2 * y2;
2763 
2764 		b1[i] = y2 * (L + 1);
2765 		b2[i] = y2;
2766 	}
2767 	for (i = 0; i <= L; i++) {
2768 		b1[i] -= sumy2;
2769 		b2[i] = sumy4 - sumy2 * b2[i];
2770 	}
2771 
2772 	maxxtildeabs = maxb1abs = maxb2abs = 0;
2773 	for (i = 0; i <= L; i++) {
2774 		tmp = abs(xtilde[i]);
2775 		if (tmp > maxxtildeabs)
2776 			maxxtildeabs = tmp;
2777 
2778 		tmp = abs(b1[i]);
2779 		if (tmp > maxb1abs)
2780 			maxb1abs = tmp;
2781 
2782 		tmp = abs(b2[i]);
2783 		if (tmp > maxb2abs)
2784 			maxb2abs = tmp;
2785 	}
2786 	Qx  = get_scale(maxxtildeabs);
2787 	Qb1 = get_scale(maxb1abs);
2788 	Qb2 = get_scale(maxb2abs);
2789 	for (i = 0; i <= L; i++) {
2790 		xtilde[i] /= 1 << Qx;
2791 		b1[i] /= 1 << Qb1;
2792 		b2[i] /= 1 << Qb2;
2793 	}
2794 
2795 	alpha = beta = 0;
2796 	for (i = 0; i <= L; i++) {
2797 		alpha += b1[i] * xtilde[i];
2798 		beta  += b2[i] * xtilde[i];
2799 	}
2800 
2801 	scale = ((y4 / SCALE_LOG) * (L + 1) -
2802 		 (y2 / SCALE_LOG) * sumy2) * SCALE_LOG;
2803 
2804 	Qscale = get_scale(abs(scale));
2805 	scale /= 1 << Qscale;
2806 	Qalpha = get_scale(abs(alpha));
2807 	alpha /= 1 << Qalpha;
2808 	Qbeta  = get_scale(abs(beta));
2809 	beta  /= 1 << Qbeta;
2810 
2811 	order = 3 * M - Qx - Qb1 - Qbeta + 10 + Qscale;
2812 	order5x = 1 << (order / 5);
2813 	order5xrem = 1 << (order % 5);
2814 
2815 	order = 3 * M - Qx - Qb2 - Qalpha + 10 + Qscale;
2816 	order3x = 1 << (order / 3);
2817 	order3xrem = 1 << (order % 3);
2818 
2819 	for (i = 0; i < AR9003_PAPRD_MEM_TAB_SIZE; i++) {
2820 		tmp = i * 32;
2821 
2822 		/* Fifth order. */
2823 		y5 = ((beta * tmp) / 64) / order5x;
2824 		y5 = (y5 * tmp) / order5x;
2825 		y5 = (y5 * tmp) / order5x;
2826 		y5 = (y5 * tmp) / order5x;
2827 		y5 = (y5 * tmp) / order5x;
2828 		y5 = y5 / order5xrem;
2829 
2830 		/* Third oder. */
2831 		y3 = (alpha * tmp) / order3x;
2832 		y3 = (y3 * tmp) / order3x;
2833 		y3 = (y3 * tmp) / order3x;
2834 		y3 = y3 / order3xrem;
2835 
2836 		in = y5 + y3 + (SCALE * tmp) / G;
2837 		if (i >= 2 && in < sc->pa_in[chain][i - 1]) {
2838 			in = sc->pa_in[chain][i - 1] +
2839 			    (sc->pa_in[chain][i - 1] -
2840 			     sc->pa_in[chain][i - 2]);
2841 		}
2842 		if (in > 1400)
2843 			in = 1400;
2844 		sc->pa_in[chain][i] = in;
2845 	}
2846 
2847 	/* Compute average theta of first 5 bins (linear region). */
2848 	tavg = 0;
2849 	for (i = 1; i <= 5; i++)
2850 		tavg += t[i];
2851 	tavg /= 5;
2852 	for (i = 1; i <= 5; i++)
2853 		t[i] = 0;
2854 	for (i = 6; i <= maxidx; i++)
2855 		t[i] -= tavg;
2856 
2857 	alpha = beta = 0;
2858 	for (i = 0; i <= L; i++) {
2859 		ttilde = ((t[i + I] << M) + y[i + I]) / y[i + I];
2860 		ttilde = ((ttilde << M) +  y[i + I]) / y[i + I];
2861 		ttilde = ((ttilde << M) +  y[i + I]) / y[i + I];
2862 
2863 		alpha += b2[i] * ttilde;
2864 		beta  += b1[i] * ttilde;
2865 	}
2866 
2867 	Qalpha = get_scale(abs(alpha));
2868 	alpha /= 1 << Qalpha;
2869 	Qbeta  = get_scale(abs(beta));
2870 	beta  /= 1 << Qbeta;
2871 
2872 	order = 3 * M - Qx - Qb1 - Qbeta + 10 + Qscale + 5;
2873 	order5x = 1 << (order / 5);
2874 	order5xrem = 1 << (order % 5);
2875 
2876 	order = 3 * M - Qx - Qb2 - Qalpha + 10 + Qscale + 5;
2877 	order3x = 1 << (order / 3);
2878 	order3xrem = 1 << (order % 3);
2879 
2880 	for (i = 0; i <= 4; i++)
2881 		sc->angle[chain][i] = 0;	/* Linear at that range. */
2882 	for (i = 5; i < AR9003_PAPRD_MEM_TAB_SIZE; i++) {
2883 		tmp = i * 32;
2884 
2885 		/* Fifth order. */
2886 		if (beta > 0)
2887 			y5 = (((beta * tmp - 64) / 64) - order5x) / order5x;
2888 		else
2889 			y5 = (((beta * tmp - 64) / 64) + order5x) / order5x;
2890 		y5 = (y5 * tmp) / order5x;
2891 		y5 = (y5 * tmp) / order5x;
2892 		y5 = (y5 * tmp) / order5x;
2893 		y5 = (y5 * tmp) / order5x;
2894 		y5 = y5 / order5xrem;
2895 
2896 		/* Third oder. */
2897 		if (beta > 0)	/* XXX alpha? */
2898 			y3 = (alpha * tmp - order3x) / order3x;
2899 		else
2900 			y3 = (alpha * tmp + order3x) / order3x;
2901 		y3 = (y3 * tmp) / order3x;
2902 		y3 = (y3 * tmp) / order3x;
2903 		y3 = y3 / order3xrem;
2904 
2905 		angle = y5 + y3;
2906 		if (angle < -150)
2907 			angle = -150;
2908 		else if (angle > 150)
2909 			angle = 150;
2910 		sc->angle[chain][i] = angle;
2911 	}
2912 	/* Angle for entry 4 is derived from angle for entry 5. */
2913 	sc->angle[chain][4] = (sc->angle[chain][5] + 2) / 2;
2914 
2915 	return (0);
2916 #undef SCALE
2917 #undef SCALE_LOG
2918 #undef NBINS
2919 }
2920 
2921 void
2922 ar9003_enable_predistorter(struct athn_softc *sc, int chain)
2923 {
2924 	uint32_t reg;
2925 	int i;
2926 
2927 	/* Write digital predistorter lookup table. */
2928 	for (i = 0; i < AR9003_PAPRD_MEM_TAB_SIZE; i++) {
2929 		AR_WRITE(sc, AR_PHY_PAPRD_MEM_TAB_B(chain, i),
2930 		    SM(AR_PHY_PAPRD_PA_IN, sc->pa_in[chain][i]) |
2931 		    SM(AR_PHY_PAPRD_ANGLE, sc->angle[chain][i]));
2932 	}
2933 
2934 	reg = AR_READ(sc, AR_PHY_PA_GAIN123_B(chain));
2935 	reg = RW(reg, AR_PHY_PA_GAIN123_PA_GAIN1, sc->gain1[chain]);
2936 	AR_WRITE(sc, AR_PHY_PA_GAIN123_B(chain), reg);
2937 
2938 	/* Indicate Tx power used for calibration (training signal). */
2939 	reg = AR_READ(sc, AR_PHY_PAPRD_CTRL1_B(chain));
2940 	reg = RW(reg, AR_PHY_PAPRD_CTRL1_POWER_AT_AM2AM_CAL, sc->trainpow);
2941 	AR_WRITE(sc, AR_PHY_PAPRD_CTRL1_B(chain), reg);
2942 
2943 	/* Enable digital predistorter for this chain. */
2944 	AR_SETBITS(sc, AR_PHY_PAPRD_CTRL0_B(chain),
2945 	    AR_PHY_PAPRD_CTRL0_PAPRD_ENABLE);
2946 	AR_WRITE_BARRIER(sc);
2947 }
2948 
2949 void
2950 ar9003_paprd_enable(struct athn_softc *sc)
2951 {
2952 	int i;
2953 
2954 	/* Enable digital predistorters for all Tx chains. */
2955 	for (i = 0; i < AR9003_MAX_CHAINS; i++)
2956 		if (sc->txchainmask & (1 << i))
2957 			ar9003_enable_predistorter(sc, i);
2958 }
2959 
2960 /*
2961  * This function is called when our training signal has been sent.
2962  */
2963 void
2964 ar9003_paprd_tx_tone_done(struct athn_softc *sc)
2965 {
2966 	uint32_t lo[48], hi[48];
2967 	int i;
2968 
2969 	/* Make sure training is complete. */
2970 	if (!(AR_READ(sc, AR_PHY_PAPRD_TRAINER_STAT1) &
2971 	    AR_PHY_PAPRD_TRAINER_STAT1_TRAIN_DONE))
2972 		return;
2973 
2974 	/* Read feedback from training signal. */
2975 	AR_CLRBITS(sc, AR_PHY_CHAN_INFO_MEMORY, AR_PHY_CHAN_INFO_TAB_S2_READ);
2976 	for (i = 0; i < nitems(lo); i++)
2977 		lo[i] = AR_READ(sc, AR_PHY_CHAN_INFO_TAB(0, i));
2978 	AR_SETBITS(sc, AR_PHY_CHAN_INFO_MEMORY, AR_PHY_CHAN_INFO_TAB_S2_READ);
2979 	for (i = 0; i < nitems(hi); i++)
2980 		hi[i] = AR_READ(sc, AR_PHY_CHAN_INFO_TAB(0, i));
2981 
2982 	AR_CLRBITS(sc, AR_PHY_PAPRD_TRAINER_STAT1,
2983 	    AR_PHY_PAPRD_TRAINER_STAT1_TRAIN_DONE);
2984 
2985 	/* Compute predistortion function based on this feedback. */
2986 	if (ar9003_compute_predistortion(sc, lo, hi) != 0)
2987 		return;
2988 
2989 	/* Get next available Tx chain. */
2990 	while (++sc->paprd_curchain < AR9003_MAX_CHAINS)
2991 		if (sc->txchainmask & (1 << sc->paprd_curchain))
2992 			break;
2993 	if (sc->paprd_curchain == AR9003_MAX_CHAINS) {
2994 		/* All Tx chains measured; enable digital predistortion. */
2995 		ar9003_paprd_enable(sc);
2996 	} else	/* Measure next Tx chain. */
2997 		ar9003_paprd_tx_tone(sc);
2998 }
2999 
3000 void
3001 ar9003_write_txpower(struct athn_softc *sc, int16_t power[ATHN_POWER_COUNT])
3002 {
3003 	/* Make sure forced gain is disabled. */
3004 	AR_WRITE(sc, AR_PHY_TX_FORCED_GAIN, 0);
3005 
3006 	AR_WRITE(sc, AR_PHY_PWRTX_RATE1,
3007 	    (power[ATHN_POWER_OFDM18  ] & 0x3f) << 24 |
3008 	    (power[ATHN_POWER_OFDM12  ] & 0x3f) << 16 |
3009 	    (power[ATHN_POWER_OFDM9   ] & 0x3f) <<  8 |
3010 	    (power[ATHN_POWER_OFDM6   ] & 0x3f));
3011 	AR_WRITE(sc, AR_PHY_PWRTX_RATE2,
3012 	    (power[ATHN_POWER_OFDM54  ] & 0x3f) << 24 |
3013 	    (power[ATHN_POWER_OFDM48  ] & 0x3f) << 16 |
3014 	    (power[ATHN_POWER_OFDM36  ] & 0x3f) <<  8 |
3015 	    (power[ATHN_POWER_OFDM24  ] & 0x3f));
3016 	AR_WRITE(sc, AR_PHY_PWRTX_RATE3,
3017 	    (power[ATHN_POWER_CCK2_SP ] & 0x3f) << 24 |
3018 	    (power[ATHN_POWER_CCK2_LP ] & 0x3f) << 16 |
3019 	    /* NB: No eXtended Range for AR9003. */
3020 	    (power[ATHN_POWER_CCK1_LP ] & 0x3f));
3021 	AR_WRITE(sc, AR_PHY_PWRTX_RATE4,
3022 	    (power[ATHN_POWER_CCK11_SP] & 0x3f) << 24 |
3023 	    (power[ATHN_POWER_CCK11_LP] & 0x3f) << 16 |
3024 	    (power[ATHN_POWER_CCK55_SP] & 0x3f) <<  8 |
3025 	    (power[ATHN_POWER_CCK55_LP] & 0x3f));
3026 	/*
3027 	 * NB: AR_PHY_PWRTX_RATE5 needs to be written even if HT is disabled
3028 	 * because it is read by PA predistortion functions.
3029 	 */
3030 	AR_WRITE(sc, AR_PHY_PWRTX_RATE5,
3031 	    (power[ATHN_POWER_HT20( 5)] & 0x3f) << 24 |
3032 	    (power[ATHN_POWER_HT20( 4)] & 0x3f) << 16 |
3033 	    (power[ATHN_POWER_HT20( 1)] & 0x3f) <<  8 |
3034 	    (power[ATHN_POWER_HT20( 0)] & 0x3f));
3035 	AR_WRITE(sc, AR_PHY_PWRTX_RATE6,
3036 	    (power[ATHN_POWER_HT20(13)] & 0x3f) << 24 |
3037 	    (power[ATHN_POWER_HT20(12)] & 0x3f) << 16 |
3038 	    (power[ATHN_POWER_HT20( 7)] & 0x3f) <<  8 |
3039 	    (power[ATHN_POWER_HT20( 6)] & 0x3f));
3040 	AR_WRITE(sc, AR_PHY_PWRTX_RATE7,
3041 	    (power[ATHN_POWER_HT40( 5)] & 0x3f) << 24 |
3042 	    (power[ATHN_POWER_HT40( 4)] & 0x3f) << 16 |
3043 	    (power[ATHN_POWER_HT40( 1)] & 0x3f) <<  8 |
3044 	    (power[ATHN_POWER_HT40( 0)] & 0x3f));
3045 	AR_WRITE(sc, AR_PHY_PWRTX_RATE8,
3046 	    (power[ATHN_POWER_HT40(13)] & 0x3f) << 24 |
3047 	    (power[ATHN_POWER_HT40(12)] & 0x3f) << 16 |
3048 	    (power[ATHN_POWER_HT40( 7)] & 0x3f) <<  8 |
3049 	    (power[ATHN_POWER_HT40( 6)] & 0x3f));
3050 	AR_WRITE(sc, AR_PHY_PWRTX_RATE10,
3051 	    (power[ATHN_POWER_HT20(21)] & 0x3f) << 24 |
3052 	    (power[ATHN_POWER_HT20(20)] & 0x3f) << 16 |
3053 	    (power[ATHN_POWER_HT20(15)] & 0x3f) <<  8 |
3054 	    (power[ATHN_POWER_HT20(14)] & 0x3f));
3055 	AR_WRITE(sc, AR_PHY_PWRTX_RATE11,
3056 	    (power[ATHN_POWER_HT40(23)] & 0x3f) << 24 |
3057 	    (power[ATHN_POWER_HT40(22)] & 0x3f) << 16 |
3058 	    (power[ATHN_POWER_HT20(23)] & 0x3f) <<  8 |
3059 	    (power[ATHN_POWER_HT20(22)] & 0x3f));
3060 	AR_WRITE(sc, AR_PHY_PWRTX_RATE12,
3061 	    (power[ATHN_POWER_HT40(21)] & 0x3f) << 24 |
3062 	    (power[ATHN_POWER_HT40(20)] & 0x3f) << 16 |
3063 	    (power[ATHN_POWER_HT40(15)] & 0x3f) <<  8 |
3064 	    (power[ATHN_POWER_HT40(14)] & 0x3f));
3065 	AR_WRITE_BARRIER(sc);
3066 }
3067 
3068 void
3069 ar9003_reset_rx_gain(struct athn_softc *sc, struct ieee80211_channel *c)
3070 {
3071 #define X(x)	((uint32_t)(x) << 2)
3072 	const struct athn_gain *prog = sc->rx_gain;
3073 	const uint32_t *pvals;
3074 	int i;
3075 
3076 	if (IEEE80211_IS_CHAN_2GHZ(c))
3077 		pvals = prog->vals_2g;
3078 	else
3079 		pvals = prog->vals_5g;
3080 	for (i = 0; i < prog->nregs; i++)
3081 		AR_WRITE(sc, X(prog->regs[i]), pvals[i]);
3082 	AR_WRITE_BARRIER(sc);
3083 #undef X
3084 }
3085 
3086 void
3087 ar9003_reset_tx_gain(struct athn_softc *sc, struct ieee80211_channel *c)
3088 {
3089 #define X(x)	((uint32_t)(x) << 2)
3090 	const struct athn_gain *prog = sc->tx_gain;
3091 	const uint32_t *pvals;
3092 	int i;
3093 
3094 	if (IEEE80211_IS_CHAN_2GHZ(c))
3095 		pvals = prog->vals_2g;
3096 	else
3097 		pvals = prog->vals_5g;
3098 	for (i = 0; i < prog->nregs; i++)
3099 		AR_WRITE(sc, X(prog->regs[i]), pvals[i]);
3100 	AR_WRITE_BARRIER(sc);
3101 #undef X
3102 }
3103 
3104 void
3105 ar9003_hw_init(struct athn_softc *sc, struct ieee80211_channel *c,
3106     struct ieee80211_channel *extc)
3107 {
3108 #define X(x)	((uint32_t)(x) << 2)
3109 	struct athn_ops *ops = &sc->ops;
3110 	const struct athn_ini *ini = sc->ini;
3111 	const uint32_t *pvals;
3112 	uint32_t reg;
3113 	int i;
3114 
3115 	/*
3116 	 * The common init values include the pre and core phases for the
3117 	 * SoC, MAC, BB and Radio subsystems.
3118 	 */
3119 	DPRINTFN(4, ("writing pre and core init vals\n"));
3120 	for (i = 0; i < ini->ncmregs; i++) {
3121 		AR_WRITE(sc, X(ini->cmregs[i]), ini->cmvals[i]);
3122 		if (AR_IS_ANALOG_REG(X(ini->cmregs[i])))
3123 			DELAY(100);
3124 		if ((i & 0x1f) == 0)
3125 			DELAY(1);
3126 	}
3127 
3128 	/*
3129 	 * The modal init values include the post phase for the SoC, MAC,
3130 	 * BB and Radio subsystems.
3131 	 */
3132 	if (extc != NULL) {
3133 		if (IEEE80211_IS_CHAN_2GHZ(c))
3134 			pvals = ini->vals_2g40;
3135 		else
3136 			pvals = ini->vals_5g40;
3137 	} else {
3138 		if (IEEE80211_IS_CHAN_2GHZ(c))
3139 			pvals = ini->vals_2g20;
3140 		else
3141 			pvals = ini->vals_5g20;
3142 	}
3143 	DPRINTFN(4, ("writing post init vals\n"));
3144 	for (i = 0; i < ini->nregs; i++) {
3145 		AR_WRITE(sc, X(ini->regs[i]), pvals[i]);
3146 		if (AR_IS_ANALOG_REG(X(ini->regs[i])))
3147 			DELAY(100);
3148 		if ((i & 0x1f) == 0)
3149 			DELAY(1);
3150 	}
3151 
3152 	if (sc->rx_gain != NULL)
3153 		ar9003_reset_rx_gain(sc, c);
3154 	if (sc->tx_gain != NULL)
3155 		ar9003_reset_tx_gain(sc, c);
3156 
3157 	if (IEEE80211_IS_CHAN_5GHZ(c) &&
3158 	    (sc->flags & ATHN_FLAG_FAST_PLL_CLOCK)) {
3159 		/* Update modal values for fast PLL clock. */
3160 		if (extc != NULL)
3161 			pvals = ini->fastvals_5g40;
3162 		else
3163 			pvals = ini->fastvals_5g20;
3164 		DPRINTFN(4, ("writing fast pll clock init vals\n"));
3165 		for (i = 0; i < ini->nfastregs; i++) {
3166 			AR_WRITE(sc, X(ini->fastregs[i]), pvals[i]);
3167 			if (AR_IS_ANALOG_REG(X(ini->fastregs[i])))
3168 				DELAY(100);
3169 			if ((i & 0x1f) == 0)
3170 				DELAY(1);
3171 		}
3172 	}
3173 
3174 	/*
3175 	 * Set the RX_ABORT and RX_DIS bits to prevent frames with corrupted
3176 	 * descriptor status.
3177 	 */
3178 	AR_SETBITS(sc, AR_DIAG_SW, AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT);
3179 
3180 	reg = AR_READ(sc, AR_PCU_MISC_MODE2);
3181 	reg &= ~AR_PCU_MISC_MODE2_ADHOC_MCAST_KEYID_ENABLE;
3182 	reg |= AR_PCU_MISC_MODE2_AGG_WEP_ENABLE_FIX;
3183 	reg |= AR_PCU_MISC_MODE2_ENABLE_AGGWEP;
3184 	AR_WRITE(sc, AR_PCU_MISC_MODE2, reg);
3185 	AR_WRITE_BARRIER(sc);
3186 
3187 	ar9003_set_phy(sc, c, extc);
3188 	ar9003_init_chains(sc);
3189 
3190 	ops->set_txpower(sc, c, extc);
3191 #undef X
3192 }
3193 
3194 void
3195 ar9003_get_lg_tpow(struct athn_softc *sc, struct ieee80211_channel *c,
3196     uint8_t ctl, const uint8_t *fbins,
3197     const struct ar_cal_target_power_leg *tgt, int nchans, uint8_t tpow[4])
3198 {
3199 	uint8_t fbin;
3200 	int i, delta, lo, hi;
3201 
3202 	lo = hi = -1;
3203 	fbin = athn_chan2fbin(c);
3204 	for (i = 0; i < nchans; i++) {
3205 		delta = fbin - fbins[i];
3206 		/* Find the largest sample that is <= our frequency. */
3207 		if (delta >= 0 && (lo == -1 || delta < fbin - fbins[lo]))
3208 			lo = i;
3209 		/* Find the smallest sample that is >= our frequency. */
3210 		if (delta <= 0 && (hi == -1 || delta > fbin - fbins[hi]))
3211 			hi = i;
3212 	}
3213 	if (lo == -1)
3214 		lo = hi;
3215 	else if (hi == -1)
3216 		hi = lo;
3217 	/* Interpolate values. */
3218 	for (i = 0; i < 4; i++) {
3219 		tpow[i] = athn_interpolate(fbin,
3220 		    fbins[lo], tgt[lo].tPow2x[i],
3221 		    fbins[hi], tgt[hi].tPow2x[i]);
3222 	}
3223 	/* XXX Apply conformance test limit. */
3224 }
3225 
3226 void
3227 ar9003_get_ht_tpow(struct athn_softc *sc, struct ieee80211_channel *c,
3228     uint8_t ctl, const uint8_t *fbins,
3229     const struct ar_cal_target_power_ht *tgt, int nchans, uint8_t tpow[14])
3230 {
3231 	uint8_t fbin;
3232 	int i, delta, lo, hi;
3233 
3234 	lo = hi = -1;
3235 	fbin = athn_chan2fbin(c);
3236 	for (i = 0; i < nchans; i++) {
3237 		delta = fbin - fbins[i];
3238 		/* Find the largest sample that is <= our frequency. */
3239 		if (delta >= 0 && (lo == -1 || delta < fbin - fbins[lo]))
3240 			lo = i;
3241 		/* Find the smallest sample that is >= our frequency. */
3242 		if (delta <= 0 && (hi == -1 || delta > fbin - fbins[hi]))
3243 			hi = i;
3244 	}
3245 	if (lo == -1)
3246 		lo = hi;
3247 	else if (hi == -1)
3248 		hi = lo;
3249 	/* Interpolate values. */
3250 	for (i = 0; i < 14; i++) {
3251 		tpow[i] = athn_interpolate(fbin,
3252 		    fbins[lo], tgt[lo].tPow2x[i],
3253 		    fbins[hi], tgt[hi].tPow2x[i]);
3254 	}
3255 	/* XXX Apply conformance test limit. */
3256 }
3257 
3258 /*
3259  * Adaptive noise immunity.
3260  */
3261 void
3262 ar9003_set_noise_immunity_level(struct athn_softc *sc, int level)
3263 {
3264 	int high = level == 4;
3265 	uint32_t reg;
3266 
3267 	reg = AR_READ(sc, AR_PHY_DESIRED_SZ);
3268 	reg = RW(reg, AR_PHY_DESIRED_SZ_TOT_DES, high ? -62 : -55);
3269 	AR_WRITE(sc, AR_PHY_DESIRED_SZ, reg);
3270 
3271 	reg = AR_READ(sc, AR_PHY_AGC);
3272 	reg = RW(reg, AR_PHY_AGC_COARSE_LOW, high ? -70 : -64);
3273 	reg = RW(reg, AR_PHY_AGC_COARSE_HIGH, high ? -12 : -14);
3274 	AR_WRITE(sc, AR_PHY_AGC, reg);
3275 
3276 	reg = AR_READ(sc, AR_PHY_FIND_SIG);
3277 	reg = RW(reg, AR_PHY_FIND_SIG_FIRPWR, high ? -80 : -78);
3278 	AR_WRITE(sc, AR_PHY_FIND_SIG, reg);
3279 	AR_WRITE_BARRIER(sc);
3280 }
3281 
3282 void
3283 ar9003_enable_ofdm_weak_signal(struct athn_softc *sc)
3284 {
3285 	uint32_t reg;
3286 
3287 	reg = AR_READ(sc, AR_PHY_SFCORR_LOW);
3288 	reg = RW(reg, AR_PHY_SFCORR_LOW_M1_THRESH_LOW, 50);
3289 	reg = RW(reg, AR_PHY_SFCORR_LOW_M2_THRESH_LOW, 40);
3290 	reg = RW(reg, AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW, 48);
3291 	AR_WRITE(sc, AR_PHY_SFCORR_LOW, reg);
3292 
3293 	reg = AR_READ(sc, AR_PHY_SFCORR);
3294 	reg = RW(reg, AR_PHY_SFCORR_M1_THRESH, 77);
3295 	reg = RW(reg, AR_PHY_SFCORR_M2_THRESH, 64);
3296 	reg = RW(reg, AR_PHY_SFCORR_M2COUNT_THR, 16);
3297 	AR_WRITE(sc, AR_PHY_SFCORR, reg);
3298 
3299 	reg = AR_READ(sc, AR_PHY_SFCORR_EXT);
3300 	reg = RW(reg, AR_PHY_SFCORR_EXT_M1_THRESH_LOW, 50);
3301 	reg = RW(reg, AR_PHY_SFCORR_EXT_M2_THRESH_LOW, 40);
3302 	reg = RW(reg, AR_PHY_SFCORR_EXT_M1_THRESH, 77);
3303 	reg = RW(reg, AR_PHY_SFCORR_EXT_M2_THRESH, 64);
3304 	AR_WRITE(sc, AR_PHY_SFCORR_EXT, reg);
3305 
3306 	AR_SETBITS(sc, AR_PHY_SFCORR_LOW,
3307 	    AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW);
3308 	AR_WRITE_BARRIER(sc);
3309 }
3310 
3311 void
3312 ar9003_disable_ofdm_weak_signal(struct athn_softc *sc)
3313 {
3314 	uint32_t reg;
3315 
3316 	reg = AR_READ(sc, AR_PHY_SFCORR_LOW);
3317 	reg = RW(reg, AR_PHY_SFCORR_LOW_M1_THRESH_LOW, 127);
3318 	reg = RW(reg, AR_PHY_SFCORR_LOW_M2_THRESH_LOW, 127);
3319 	reg = RW(reg, AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW, 63);
3320 	AR_WRITE(sc, AR_PHY_SFCORR_LOW, reg);
3321 
3322 	reg = AR_READ(sc, AR_PHY_SFCORR);
3323 	reg = RW(reg, AR_PHY_SFCORR_M1_THRESH, 127);
3324 	reg = RW(reg, AR_PHY_SFCORR_M2_THRESH, 127);
3325 	reg = RW(reg, AR_PHY_SFCORR_M2COUNT_THR, 31);
3326 	AR_WRITE(sc, AR_PHY_SFCORR, reg);
3327 
3328 	reg = AR_READ(sc, AR_PHY_SFCORR_EXT);
3329 	reg = RW(reg, AR_PHY_SFCORR_EXT_M1_THRESH_LOW, 127);
3330 	reg = RW(reg, AR_PHY_SFCORR_EXT_M2_THRESH_LOW, 127);
3331 	reg = RW(reg, AR_PHY_SFCORR_EXT_M1_THRESH, 127);
3332 	reg = RW(reg, AR_PHY_SFCORR_EXT_M2_THRESH, 127);
3333 	AR_WRITE(sc, AR_PHY_SFCORR_EXT, reg);
3334 
3335 	AR_CLRBITS(sc, AR_PHY_SFCORR_LOW,
3336 	    AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW);
3337 	AR_WRITE_BARRIER(sc);
3338 }
3339 
3340 void
3341 ar9003_set_cck_weak_signal(struct athn_softc *sc, int high)
3342 {
3343 	uint32_t reg;
3344 
3345 	reg = AR_READ(sc, AR_PHY_CCK_DETECT);
3346 	reg = RW(reg, AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK, high ? 6 : 8);
3347 	AR_WRITE(sc, AR_PHY_CCK_DETECT, reg);
3348 	AR_WRITE_BARRIER(sc);
3349 }
3350 
3351 void
3352 ar9003_set_firstep_level(struct athn_softc *sc, int level)
3353 {
3354 	uint32_t reg;
3355 
3356 	reg = AR_READ(sc, AR_PHY_FIND_SIG);
3357 	reg = RW(reg, AR_PHY_FIND_SIG_FIRSTEP, level * 4);
3358 	AR_WRITE(sc, AR_PHY_FIND_SIG, reg);
3359 	AR_WRITE_BARRIER(sc);
3360 }
3361 
3362 void
3363 ar9003_set_spur_immunity_level(struct athn_softc *sc, int level)
3364 {
3365 	uint32_t reg;
3366 
3367 	reg = AR_READ(sc, AR_PHY_TIMING5);
3368 	reg = RW(reg, AR_PHY_TIMING5_CYCPWR_THR1, (level + 1) * 2);
3369 	AR_WRITE(sc, AR_PHY_TIMING5, reg);
3370 	AR_WRITE_BARRIER(sc);
3371 }
3372