Home | History | Annotate | Download | only in ath5k
      1 /*
      2  * Copyright (c) 2006-2008 Nick Kossifidis <mickflemm (at) gmail.com>
      3  * Copyright (c) 2004-2008 Reyk Floeter <reyk (at) openbsd.org>
      4  * Copyright (c) 2007-2008 Michael Taylor <mike.taylor (at) apprion.com>
      5  *
      6  * Permission to use, copy, modify, and distribute this software for any
      7  * purpose with or without fee is hereby granted, provided that the above
      8  * copyright notice and this permission notice appear in all copies.
      9  *
     10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
     11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
     12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
     13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
     14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
     15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
     16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
     17  *
     18  */
     19 
     20 /*
     21  * Register values for Atheros 5210/5211/5212 cards from OpenBSD's ar5k
     22  * maintained by Reyk Floeter
     23  *
     24  * I tried to document those registers by looking at ar5k code, some
     25  * 802.11 (802.11e mostly) papers and by reading various public available
     26  * Atheros presentations and papers like these:
     27  *
     28  * 5210 - http://nova.stanford.edu/~bbaas/ps/isscc2002_slides.pdf
     29  *        http://www.it.iitb.ac.in/~janak/wifire/01222734.pdf
     30  *
     31  * 5211 - http://www.hotchips.org/archives/hc14/3_Tue/16_mcfarland.pdf
     32  *
     33  * This file also contains register values found on a memory dump of
     34  * Atheros's ART program (Atheros Radio Test), on ath9k, on legacy-hal
     35  * released by Atheros and on various debug messages found on the net.
     36  */
     37 
     38 
     39 
     40 /*====MAC DMA REGISTERS====*/
     41 
     42 /*
     43  * AR5210-Specific TXDP registers
     44  * 5210 has only 2 transmit queues so no DCU/QCU, just
     45  * 2 transmit descriptor pointers...
     46  */
     47 #define AR5K_NOQCU_TXDP0	0x0000		/* Queue 0 - data */
     48 #define AR5K_NOQCU_TXDP1	0x0004		/* Queue 1 - beacons */
     49 
     50 /*
     51  * Mac Control Register
     52  */
     53 #define	AR5K_CR		0x0008			/* Register Address */
     54 #define AR5K_CR_TXE0	0x00000001	/* TX Enable for queue 0 on 5210 */
     55 #define AR5K_CR_TXE1	0x00000002	/* TX Enable for queue 1 on 5210 */
     56 #define	AR5K_CR_RXE	0x00000004	/* RX Enable */
     57 #define AR5K_CR_TXD0	0x00000008	/* TX Disable for queue 0 on 5210 */
     58 #define AR5K_CR_TXD1	0x00000010	/* TX Disable for queue 1 on 5210 */
     59 #define	AR5K_CR_RXD	0x00000020	/* RX Disable */
     60 #define	AR5K_CR_SWI	0x00000040	/* Software Interrupt */
     61 
     62 /*
     63  * RX Descriptor Pointer register
     64  */
     65 #define	AR5K_RXDP	0x000c
     66 
     67 /*
     68  * Configuration and status register
     69  */
     70 #define	AR5K_CFG		0x0014			/* Register Address */
     71 #define	AR5K_CFG_SWTD		0x00000001	/* Byte-swap TX descriptor (for big endian archs) */
     72 #define	AR5K_CFG_SWTB		0x00000002	/* Byte-swap TX buffer */
     73 #define	AR5K_CFG_SWRD		0x00000004	/* Byte-swap RX descriptor */
     74 #define	AR5K_CFG_SWRB		0x00000008	/* Byte-swap RX buffer */
     75 #define	AR5K_CFG_SWRG		0x00000010	/* Byte-swap Register access */
     76 #define AR5K_CFG_IBSS		0x00000020 	/* 0-BSS, 1-IBSS [5211+] */
     77 #define AR5K_CFG_PHY_OK		0x00000100	/* [5211+] */
     78 #define AR5K_CFG_EEBS		0x00000200	/* EEPROM is busy */
     79 #define	AR5K_CFG_CLKGD		0x00000400	/* Clock gated (Disable dynamic clock) */
     80 #define AR5K_CFG_TXCNT		0x00007800	/* Tx frame count (?) [5210] */
     81 #define AR5K_CFG_TXCNT_S	11
     82 #define AR5K_CFG_TXFSTAT	0x00008000	/* Tx frame status (?) [5210] */
     83 #define AR5K_CFG_TXFSTRT	0x00010000	/* [5210] */
     84 #define	AR5K_CFG_PCI_THRES	0x00060000	/* PCI Master req q threshold [5211+] */
     85 #define	AR5K_CFG_PCI_THRES_S	17
     86 
     87 /*
     88  * Interrupt enable register
     89  */
     90 #define AR5K_IER		0x0024		/* Register Address */
     91 #define AR5K_IER_DISABLE	0x00000000	/* Disable card interrupts */
     92 #define AR5K_IER_ENABLE		0x00000001	/* Enable card interrupts */
     93 
     94 
     95 /*
     96  * 0x0028 is Beacon Control Register on 5210
     97  * and first RTS duration register on 5211
     98  */
     99 
    100 /*
    101  * Beacon control register [5210]
    102  */
    103 #define AR5K_BCR		0x0028		/* Register Address */
    104 #define AR5K_BCR_AP		0x00000000	/* AP mode */
    105 #define AR5K_BCR_ADHOC		0x00000001	/* Ad-Hoc mode */
    106 #define AR5K_BCR_BDMAE		0x00000002	/* DMA enable */
    107 #define AR5K_BCR_TQ1FV		0x00000004	/* Use Queue1 for CAB traffic */
    108 #define AR5K_BCR_TQ1V		0x00000008	/* Use Queue1 for Beacon traffic */
    109 #define AR5K_BCR_BCGET		0x00000010
    110 
    111 /*
    112  * First RTS duration register [5211]
    113  */
    114 #define AR5K_RTSD0		0x0028		/* Register Address */
    115 #define	AR5K_RTSD0_6		0x000000ff	/* 6Mb RTS duration mask (?) */
    116 #define	AR5K_RTSD0_6_S		0		/* 6Mb RTS duration shift (?) */
    117 #define	AR5K_RTSD0_9		0x0000ff00	/* 9Mb*/
    118 #define	AR5K_RTSD0_9_S		8
    119 #define	AR5K_RTSD0_12		0x00ff0000	/* 12Mb*/
    120 #define	AR5K_RTSD0_12_S		16
    121 #define	AR5K_RTSD0_18		0xff000000	/* 16Mb*/
    122 #define	AR5K_RTSD0_18_S		24
    123 
    124 
    125 /*
    126  * 0x002c is Beacon Status Register on 5210
    127  * and second RTS duration register on 5211
    128  */
    129 
    130 /*
    131  * Beacon status register [5210]
    132  *
    133  * As i can see in ar5k_ar5210_tx_start Reyk uses some of the values of BCR
    134  * for this register, so i guess TQ1V,TQ1FV and BDMAE have the same meaning
    135  * here and SNP/SNAP means "snapshot" (so this register gets synced with BCR).
    136  * So SNAPPEDBCRVALID sould also stand for "snapped BCR -values- valid", so i
    137  * renamed it to SNAPSHOTSVALID to make more sense. I realy have no idea what
    138  * else can it be. I also renamed SNPBCMD to SNPADHOC to match BCR.
    139  */
    140 #define AR5K_BSR		0x002c			/* Register Address */
    141 #define AR5K_BSR_BDLYSW		0x00000001	/* SW Beacon delay (?) */
    142 #define AR5K_BSR_BDLYDMA	0x00000002	/* DMA Beacon delay (?) */
    143 #define AR5K_BSR_TXQ1F		0x00000004	/* Beacon queue (1) finished */
    144 #define AR5K_BSR_ATIMDLY	0x00000008	/* ATIM delay (?) */
    145 #define AR5K_BSR_SNPADHOC	0x00000100	/* Ad-hoc mode set (?) */
    146 #define AR5K_BSR_SNPBDMAE	0x00000200	/* Beacon DMA enabled (?) */
    147 #define AR5K_BSR_SNPTQ1FV	0x00000400	/* Queue1 is used for CAB traffic (?) */
    148 #define AR5K_BSR_SNPTQ1V	0x00000800	/* Queue1 is used for Beacon traffic (?) */
    149 #define AR5K_BSR_SNAPSHOTSVALID	0x00001000	/* BCR snapshots are valid (?) */
    150 #define AR5K_BSR_SWBA_CNT	0x00ff0000
    151 
    152 /*
    153  * Second RTS duration register [5211]
    154  */
    155 #define AR5K_RTSD1		0x002c			/* Register Address */
    156 #define	AR5K_RTSD1_24		0x000000ff	/* 24Mb */
    157 #define	AR5K_RTSD1_24_S		0
    158 #define	AR5K_RTSD1_36		0x0000ff00	/* 36Mb */
    159 #define	AR5K_RTSD1_36_S		8
    160 #define	AR5K_RTSD1_48		0x00ff0000	/* 48Mb */
    161 #define	AR5K_RTSD1_48_S		16
    162 #define	AR5K_RTSD1_54		0xff000000	/* 54Mb */
    163 #define	AR5K_RTSD1_54_S		24
    164 
    165 
    166 /*
    167  * Transmit configuration register
    168  */
    169 #define AR5K_TXCFG			0x0030			/* Register Address */
    170 #define AR5K_TXCFG_SDMAMR		0x00000007	/* DMA size (read) */
    171 #define AR5K_TXCFG_SDMAMR_S		0
    172 #define AR5K_TXCFG_B_MODE		0x00000008	/* Set b mode for 5111 (enable 2111) */
    173 #define AR5K_TXCFG_TXFSTP		0x00000008	/* TX DMA full Stop [5210] */
    174 #define AR5K_TXCFG_TXFULL		0x000003f0	/* TX Triger level mask */
    175 #define AR5K_TXCFG_TXFULL_S		4
    176 #define AR5K_TXCFG_TXFULL_0B		0x00000000
    177 #define AR5K_TXCFG_TXFULL_64B		0x00000010
    178 #define AR5K_TXCFG_TXFULL_128B		0x00000020
    179 #define AR5K_TXCFG_TXFULL_192B		0x00000030
    180 #define AR5K_TXCFG_TXFULL_256B		0x00000040
    181 #define AR5K_TXCFG_TXCONT_EN		0x00000080
    182 #define AR5K_TXCFG_DMASIZE		0x00000100	/* Flag for passing DMA size [5210] */
    183 #define AR5K_TXCFG_JUMBO_DESC_EN	0x00000400	/* Enable jumbo tx descriptors [5211+] */
    184 #define AR5K_TXCFG_ADHOC_BCN_ATIM	0x00000800	/* Adhoc Beacon ATIM Policy */
    185 #define AR5K_TXCFG_ATIM_WINDOW_DEF_DIS	0x00001000	/* Disable ATIM window defer [5211+] */
    186 #define AR5K_TXCFG_RTSRND		0x00001000	/* [5211+] */
    187 #define AR5K_TXCFG_FRMPAD_DIS		0x00002000	/* [5211+] */
    188 #define AR5K_TXCFG_RDY_CBR_DIS		0x00004000	/* Ready time CBR disable [5211+] */
    189 #define AR5K_TXCFG_JUMBO_FRM_MODE	0x00008000	/* Jumbo frame mode [5211+] */
    190 #define	AR5K_TXCFG_DCU_DBL_BUF_DIS	0x00008000	/* Disable double buffering on DCU */
    191 #define AR5K_TXCFG_DCU_CACHING_DIS	0x00010000	/* Disable DCU caching */
    192 
    193 /*
    194  * Receive configuration register
    195  */
    196 #define AR5K_RXCFG		0x0034			/* Register Address */
    197 #define AR5K_RXCFG_SDMAMW	0x00000007	/* DMA size (write) */
    198 #define AR5K_RXCFG_SDMAMW_S	0
    199 #define AR5K_RXCFG_ZLFDMA	0x00000008	/* Enable Zero-length frame DMA */
    200 #define	AR5K_RXCFG_DEF_ANTENNA	0x00000010	/* Default antenna (?) */
    201 #define AR5K_RXCFG_JUMBO_RXE	0x00000020	/* Enable jumbo rx descriptors [5211+] */
    202 #define AR5K_RXCFG_JUMBO_WRAP	0x00000040	/* Wrap jumbo frames [5211+] */
    203 #define AR5K_RXCFG_SLE_ENTRY	0x00000080	/* Sleep entry policy */
    204 
    205 /*
    206  * Receive jumbo descriptor last address register
    207  * Only found in 5211 (?)
    208  */
    209 #define AR5K_RXJLA		0x0038
    210 
    211 /*
    212  * MIB control register
    213  */
    214 #define AR5K_MIBC		0x0040			/* Register Address */
    215 #define AR5K_MIBC_COW		0x00000001	/* Warn test indicator */
    216 #define AR5K_MIBC_FMC		0x00000002	/* Freeze MIB Counters  */
    217 #define AR5K_MIBC_CMC		0x00000004	/* Clean MIB Counters  */
    218 #define AR5K_MIBC_MCS		0x00000008	/* MIB counter strobe */
    219 
    220 /*
    221  * Timeout prescale register
    222  */
    223 #define AR5K_TOPS		0x0044
    224 #define	AR5K_TOPS_M		0x0000ffff
    225 
    226 /*
    227  * Receive timeout register (no frame received)
    228  */
    229 #define AR5K_RXNOFRM		0x0048
    230 #define	AR5K_RXNOFRM_M		0x000003ff
    231 
    232 /*
    233  * Transmit timeout register (no frame sent)
    234  */
    235 #define AR5K_TXNOFRM		0x004c
    236 #define	AR5K_TXNOFRM_M		0x000003ff
    237 #define	AR5K_TXNOFRM_QCU	0x000ffc00
    238 #define	AR5K_TXNOFRM_QCU_S	10
    239 
    240 /*
    241  * Receive frame gap timeout register
    242  */
    243 #define AR5K_RPGTO		0x0050
    244 #define AR5K_RPGTO_M		0x000003ff
    245 
    246 /*
    247  * Receive frame count limit register
    248  */
    249 #define AR5K_RFCNT		0x0054
    250 #define AR5K_RFCNT_M		0x0000001f	/* [5211+] (?) */
    251 #define AR5K_RFCNT_RFCL		0x0000000f	/* [5210] */
    252 
    253 /*
    254  * Misc settings register
    255  * (reserved0-3)
    256  */
    257 #define AR5K_MISC		0x0058			/* Register Address */
    258 #define	AR5K_MISC_DMA_OBS_M	0x000001e0
    259 #define	AR5K_MISC_DMA_OBS_S	5
    260 #define	AR5K_MISC_MISC_OBS_M	0x00000e00
    261 #define	AR5K_MISC_MISC_OBS_S	9
    262 #define	AR5K_MISC_MAC_OBS_LSB_M	0x00007000
    263 #define	AR5K_MISC_MAC_OBS_LSB_S	12
    264 #define	AR5K_MISC_MAC_OBS_MSB_M	0x00038000
    265 #define	AR5K_MISC_MAC_OBS_MSB_S	15
    266 #define AR5K_MISC_LED_DECAY	0x001c0000	/* [5210] */
    267 #define AR5K_MISC_LED_BLINK	0x00e00000	/* [5210] */
    268 
    269 /*
    270  * QCU/DCU clock gating register (5311)
    271  * (reserved4-5)
    272  */
    273 #define	AR5K_QCUDCU_CLKGT	0x005c			/* Register Address (?) */
    274 #define	AR5K_QCUDCU_CLKGT_QCU	0x0000ffff	/* Mask for QCU clock */
    275 #define	AR5K_QCUDCU_CLKGT_DCU	0x07ff0000	/* Mask for DCU clock */
    276 
    277 /*
    278  * Interrupt Status Registers
    279  *
    280  * For 5210 there is only one status register but for
    281  * 5211/5212 we have one primary and 4 secondary registers.
    282  * So we have AR5K_ISR for 5210 and AR5K_PISR /SISRx for 5211/5212.
    283  * Most of these bits are common for all chipsets.
    284  */
    285 #define AR5K_ISR		0x001c			/* Register Address [5210] */
    286 #define AR5K_PISR		0x0080			/* Register Address [5211+] */
    287 #define AR5K_ISR_RXOK		0x00000001	/* Frame successfuly recieved */
    288 #define AR5K_ISR_RXDESC		0x00000002	/* RX descriptor request */
    289 #define AR5K_ISR_RXERR		0x00000004	/* Receive error */
    290 #define AR5K_ISR_RXNOFRM	0x00000008	/* No frame received (receive timeout) */
    291 #define AR5K_ISR_RXEOL		0x00000010	/* Empty RX descriptor */
    292 #define AR5K_ISR_RXORN		0x00000020	/* Receive FIFO overrun */
    293 #define AR5K_ISR_TXOK		0x00000040	/* Frame successfuly transmited */
    294 #define AR5K_ISR_TXDESC		0x00000080	/* TX descriptor request */
    295 #define AR5K_ISR_TXERR		0x00000100	/* Transmit error */
    296 #define AR5K_ISR_TXNOFRM	0x00000200	/* No frame transmited (transmit timeout) */
    297 #define AR5K_ISR_TXEOL		0x00000400	/* Empty TX descriptor */
    298 #define AR5K_ISR_TXURN		0x00000800	/* Transmit FIFO underrun */
    299 #define AR5K_ISR_MIB		0x00001000	/* Update MIB counters */
    300 #define AR5K_ISR_SWI		0x00002000	/* Software interrupt */
    301 #define AR5K_ISR_RXPHY		0x00004000	/* PHY error */
    302 #define AR5K_ISR_RXKCM		0x00008000	/* RX Key cache miss */
    303 #define AR5K_ISR_SWBA		0x00010000	/* Software beacon alert */
    304 #define AR5K_ISR_BRSSI		0x00020000	/* Beacon rssi below threshold (?) */
    305 #define AR5K_ISR_BMISS		0x00040000	/* Beacon missed */
    306 #define AR5K_ISR_HIUERR		0x00080000	/* Host Interface Unit error [5211+] */
    307 #define AR5K_ISR_BNR		0x00100000 	/* Beacon not ready [5211+] */
    308 #define AR5K_ISR_MCABT		0x00100000	/* Master Cycle Abort [5210] */
    309 #define AR5K_ISR_RXCHIRP	0x00200000	/* CHIRP Received [5212+] */
    310 #define AR5K_ISR_SSERR		0x00200000	/* Signaled System Error [5210] */
    311 #define AR5K_ISR_DPERR		0x00400000	/* Det par Error (?) [5210] */
    312 #define AR5K_ISR_RXDOPPLER	0x00400000	/* Doppler chirp received [5212+] */
    313 #define AR5K_ISR_TIM		0x00800000	/* [5211+] */
    314 #define AR5K_ISR_BCNMISC	0x00800000	/* 'or' of TIM, CAB_END, DTIM_SYNC, BCN_TIMEOUT,
    315 						CAB_TIMEOUT and DTIM bits from SISR2 [5212+] */
    316 #define AR5K_ISR_GPIO		0x01000000	/* GPIO (rf kill) */
    317 #define AR5K_ISR_QCBRORN	0x02000000	/* QCU CBR overrun [5211+] */
    318 #define AR5K_ISR_QCBRURN	0x04000000	/* QCU CBR underrun [5211+] */
    319 #define AR5K_ISR_QTRIG		0x08000000	/* QCU scheduling trigger [5211+] */
    320 
    321 /*
    322  * Secondary status registers [5211+] (0 - 4)
    323  *
    324  * These give the status for each QCU, only QCUs 0-9 are
    325  * represented.
    326  */
    327 #define AR5K_SISR0		0x0084			/* Register Address [5211+] */
    328 #define AR5K_SISR0_QCU_TXOK	0x000003ff	/* Mask for QCU_TXOK */
    329 #define AR5K_SISR0_QCU_TXOK_S	0
    330 #define AR5K_SISR0_QCU_TXDESC	0x03ff0000	/* Mask for QCU_TXDESC */
    331 #define AR5K_SISR0_QCU_TXDESC_S	16
    332 
    333 #define AR5K_SISR1		0x0088			/* Register Address [5211+] */
    334 #define AR5K_SISR1_QCU_TXERR	0x000003ff	/* Mask for QCU_TXERR */
    335 #define AR5K_SISR1_QCU_TXERR_S	0
    336 #define AR5K_SISR1_QCU_TXEOL	0x03ff0000	/* Mask for QCU_TXEOL */
    337 #define AR5K_SISR1_QCU_TXEOL_S	16
    338 
    339 #define AR5K_SISR2		0x008c			/* Register Address [5211+] */
    340 #define AR5K_SISR2_QCU_TXURN	0x000003ff	/* Mask for QCU_TXURN */
    341 #define	AR5K_SISR2_QCU_TXURN_S	0
    342 #define	AR5K_SISR2_MCABT	0x00100000	/* Master Cycle Abort */
    343 #define	AR5K_SISR2_SSERR	0x00200000	/* Signaled System Error */
    344 #define	AR5K_SISR2_DPERR	0x00400000	/* Bus parity error */
    345 #define	AR5K_SISR2_TIM		0x01000000	/* [5212+] */
    346 #define	AR5K_SISR2_CAB_END	0x02000000	/* [5212+] */
    347 #define	AR5K_SISR2_DTIM_SYNC	0x04000000	/* DTIM sync lost [5212+] */
    348 #define	AR5K_SISR2_BCN_TIMEOUT	0x08000000	/* Beacon Timeout [5212+] */
    349 #define	AR5K_SISR2_CAB_TIMEOUT	0x10000000	/* CAB Timeout [5212+] */
    350 #define	AR5K_SISR2_DTIM		0x20000000	/* [5212+] */
    351 #define	AR5K_SISR2_TSFOOR	0x80000000	/* TSF OOR (?) */
    352 
    353 #define AR5K_SISR3		0x0090			/* Register Address [5211+] */
    354 #define AR5K_SISR3_QCBRORN	0x000003ff	/* Mask for QCBRORN */
    355 #define AR5K_SISR3_QCBRORN_S	0
    356 #define AR5K_SISR3_QCBRURN	0x03ff0000	/* Mask for QCBRURN */
    357 #define AR5K_SISR3_QCBRURN_S	16
    358 
    359 #define AR5K_SISR4		0x0094			/* Register Address [5211+] */
    360 #define AR5K_SISR4_QTRIG	0x000003ff	/* Mask for QTRIG */
    361 #define AR5K_SISR4_QTRIG_S	0
    362 
    363 /*
    364  * Shadow read-and-clear interrupt status registers [5211+]
    365  */
    366 #define AR5K_RAC_PISR		0x00c0		/* Read and clear PISR */
    367 #define AR5K_RAC_SISR0		0x00c4		/* Read and clear SISR0 */
    368 #define AR5K_RAC_SISR1		0x00c8		/* Read and clear SISR1 */
    369 #define AR5K_RAC_SISR2		0x00cc		/* Read and clear SISR2 */
    370 #define AR5K_RAC_SISR3		0x00d0		/* Read and clear SISR3 */
    371 #define AR5K_RAC_SISR4		0x00d4		/* Read and clear SISR4 */
    372 
    373 /*
    374  * Interrupt Mask Registers
    375  *
    376  * As whith ISRs 5210 has one IMR (AR5K_IMR) and 5211/5212 has one primary
    377  * (AR5K_PIMR) and 4 secondary IMRs (AR5K_SIMRx). Note that ISR/IMR flags match.
    378  */
    379 #define	AR5K_IMR		0x0020			/* Register Address [5210] */
    380 #define AR5K_PIMR		0x00a0			/* Register Address [5211+] */
    381 #define AR5K_IMR_RXOK		0x00000001	/* Frame successfuly recieved*/
    382 #define AR5K_IMR_RXDESC		0x00000002	/* RX descriptor request*/
    383 #define AR5K_IMR_RXERR		0x00000004	/* Receive error*/
    384 #define AR5K_IMR_RXNOFRM	0x00000008	/* No frame received (receive timeout)*/
    385 #define AR5K_IMR_RXEOL		0x00000010	/* Empty RX descriptor*/
    386 #define AR5K_IMR_RXORN		0x00000020	/* Receive FIFO overrun*/
    387 #define AR5K_IMR_TXOK		0x00000040	/* Frame successfuly transmited*/
    388 #define AR5K_IMR_TXDESC		0x00000080	/* TX descriptor request*/
    389 #define AR5K_IMR_TXERR		0x00000100	/* Transmit error*/
    390 #define AR5K_IMR_TXNOFRM	0x00000200	/* No frame transmited (transmit timeout)*/
    391 #define AR5K_IMR_TXEOL		0x00000400	/* Empty TX descriptor*/
    392 #define AR5K_IMR_TXURN		0x00000800	/* Transmit FIFO underrun*/
    393 #define AR5K_IMR_MIB		0x00001000	/* Update MIB counters*/
    394 #define AR5K_IMR_SWI		0x00002000	/* Software interrupt */
    395 #define AR5K_IMR_RXPHY		0x00004000	/* PHY error*/
    396 #define AR5K_IMR_RXKCM		0x00008000	/* RX Key cache miss */
    397 #define AR5K_IMR_SWBA		0x00010000	/* Software beacon alert*/
    398 #define AR5K_IMR_BRSSI		0x00020000	/* Beacon rssi below threshold (?) */
    399 #define AR5K_IMR_BMISS		0x00040000	/* Beacon missed*/
    400 #define AR5K_IMR_HIUERR		0x00080000	/* Host Interface Unit error [5211+] */
    401 #define AR5K_IMR_BNR		0x00100000 	/* Beacon not ready [5211+] */
    402 #define AR5K_IMR_MCABT		0x00100000	/* Master Cycle Abort [5210] */
    403 #define AR5K_IMR_RXCHIRP	0x00200000	/* CHIRP Received [5212+]*/
    404 #define AR5K_IMR_SSERR		0x00200000	/* Signaled System Error [5210] */
    405 #define AR5K_IMR_DPERR		0x00400000	/* Det par Error (?) [5210] */
    406 #define AR5K_IMR_RXDOPPLER	0x00400000	/* Doppler chirp received [5212+] */
    407 #define AR5K_IMR_TIM		0x00800000	/* [5211+] */
    408 #define AR5K_IMR_BCNMISC	0x00800000	/* 'or' of TIM, CAB_END, DTIM_SYNC, BCN_TIMEOUT,
    409 						CAB_TIMEOUT and DTIM bits from SISR2 [5212+] */
    410 #define AR5K_IMR_GPIO		0x01000000	/* GPIO (rf kill)*/
    411 #define AR5K_IMR_QCBRORN	0x02000000	/* QCU CBR overrun (?) [5211+] */
    412 #define AR5K_IMR_QCBRURN	0x04000000	/* QCU CBR underrun (?) [5211+] */
    413 #define AR5K_IMR_QTRIG		0x08000000	/* QCU scheduling trigger [5211+] */
    414 
    415 /*
    416  * Secondary interrupt mask registers [5211+] (0 - 4)
    417  */
    418 #define AR5K_SIMR0		0x00a4			/* Register Address [5211+] */
    419 #define AR5K_SIMR0_QCU_TXOK	0x000003ff	/* Mask for QCU_TXOK */
    420 #define AR5K_SIMR0_QCU_TXOK_S	0
    421 #define AR5K_SIMR0_QCU_TXDESC	0x03ff0000	/* Mask for QCU_TXDESC */
    422 #define AR5K_SIMR0_QCU_TXDESC_S	16
    423 
    424 #define AR5K_SIMR1		0x00a8			/* Register Address [5211+] */
    425 #define AR5K_SIMR1_QCU_TXERR	0x000003ff	/* Mask for QCU_TXERR */
    426 #define AR5K_SIMR1_QCU_TXERR_S	0
    427 #define AR5K_SIMR1_QCU_TXEOL	0x03ff0000	/* Mask for QCU_TXEOL */
    428 #define AR5K_SIMR1_QCU_TXEOL_S	16
    429 
    430 #define AR5K_SIMR2		0x00ac			/* Register Address [5211+] */
    431 #define AR5K_SIMR2_QCU_TXURN	0x000003ff	/* Mask for QCU_TXURN */
    432 #define AR5K_SIMR2_QCU_TXURN_S	0
    433 #define	AR5K_SIMR2_MCABT	0x00100000	/* Master Cycle Abort */
    434 #define	AR5K_SIMR2_SSERR	0x00200000	/* Signaled System Error */
    435 #define	AR5K_SIMR2_DPERR	0x00400000	/* Bus parity error */
    436 #define	AR5K_SIMR2_TIM		0x01000000	/* [5212+] */
    437 #define	AR5K_SIMR2_CAB_END	0x02000000	/* [5212+] */
    438 #define	AR5K_SIMR2_DTIM_SYNC	0x04000000	/* DTIM Sync lost [5212+] */
    439 #define	AR5K_SIMR2_BCN_TIMEOUT	0x08000000	/* Beacon Timeout [5212+] */
    440 #define	AR5K_SIMR2_CAB_TIMEOUT	0x10000000	/* CAB Timeout [5212+] */
    441 #define	AR5K_SIMR2_DTIM		0x20000000	/* [5212+] */
    442 #define	AR5K_SIMR2_TSFOOR	0x80000000	/* TSF OOR (?) */
    443 
    444 #define AR5K_SIMR3		0x00b0			/* Register Address [5211+] */
    445 #define AR5K_SIMR3_QCBRORN	0x000003ff	/* Mask for QCBRORN */
    446 #define AR5K_SIMR3_QCBRORN_S	0
    447 #define AR5K_SIMR3_QCBRURN	0x03ff0000	/* Mask for QCBRURN */
    448 #define AR5K_SIMR3_QCBRURN_S	16
    449 
    450 #define AR5K_SIMR4		0x00b4			/* Register Address [5211+] */
    451 #define AR5K_SIMR4_QTRIG	0x000003ff	/* Mask for QTRIG */
    452 #define AR5K_SIMR4_QTRIG_S	0
    453 
    454 /*
    455  * DMA Debug registers 0-7
    456  * 0xe0 - 0xfc
    457  */
    458 
    459 /*
    460  * Decompression mask registers [5212+]
    461  */
    462 #define AR5K_DCM_ADDR		0x0400		/*Decompression mask address (index) */
    463 #define AR5K_DCM_DATA		0x0404		/*Decompression mask data */
    464 
    465 /*
    466  * Wake On Wireless pattern control register [5212+]
    467  */
    468 #define	AR5K_WOW_PCFG			0x0410			/* Register Address */
    469 #define	AR5K_WOW_PCFG_PAT_MATCH_EN	0x00000001	/* Pattern match enable */
    470 #define	AR5K_WOW_PCFG_LONG_FRAME_POL	0x00000002	/* Long frame policy */
    471 #define	AR5K_WOW_PCFG_WOBMISS		0x00000004	/* Wake on bea(con) miss (?) */
    472 #define	AR5K_WOW_PCFG_PAT_0_EN		0x00000100	/* Enable pattern 0 */
    473 #define	AR5K_WOW_PCFG_PAT_1_EN		0x00000200	/* Enable pattern 1 */
    474 #define	AR5K_WOW_PCFG_PAT_2_EN		0x00000400	/* Enable pattern 2 */
    475 #define	AR5K_WOW_PCFG_PAT_3_EN		0x00000800	/* Enable pattern 3 */
    476 #define	AR5K_WOW_PCFG_PAT_4_EN		0x00001000	/* Enable pattern 4 */
    477 #define	AR5K_WOW_PCFG_PAT_5_EN		0x00002000	/* Enable pattern 5 */
    478 
    479 /*
    480  * Wake On Wireless pattern index register (?) [5212+]
    481  */
    482 #define	AR5K_WOW_PAT_IDX	0x0414
    483 
    484 /*
    485  * Wake On Wireless pattern data register [5212+]
    486  */
    487 #define	AR5K_WOW_PAT_DATA	0x0418			/* Register Address */
    488 #define	AR5K_WOW_PAT_DATA_0_3_V	0x00000001	/* Pattern 0, 3 value */
    489 #define	AR5K_WOW_PAT_DATA_1_4_V	0x00000100	/* Pattern 1, 4 value */
    490 #define	AR5K_WOW_PAT_DATA_2_5_V	0x00010000	/* Pattern 2, 5 value */
    491 #define	AR5K_WOW_PAT_DATA_0_3_M	0x01000000	/* Pattern 0, 3 mask */
    492 #define	AR5K_WOW_PAT_DATA_1_4_M	0x04000000	/* Pattern 1, 4 mask */
    493 #define	AR5K_WOW_PAT_DATA_2_5_M	0x10000000	/* Pattern 2, 5 mask */
    494 
    495 /*
    496  * Decompression configuration registers [5212+]
    497  */
    498 #define AR5K_DCCFG		0x0420			/* Register Address */
    499 #define AR5K_DCCFG_GLOBAL_EN	0x00000001	/* Enable decompression on all queues */
    500 #define AR5K_DCCFG_BYPASS_EN	0x00000002	/* Bypass decompression */
    501 #define AR5K_DCCFG_BCAST_EN	0x00000004	/* Enable decompression for bcast frames */
    502 #define AR5K_DCCFG_MCAST_EN	0x00000008	/* Enable decompression for mcast frames */
    503 
    504 /*
    505  * Compression configuration registers [5212+]
    506  */
    507 #define AR5K_CCFG		0x0600			/* Register Address */
    508 #define	AR5K_CCFG_WINDOW_SIZE	0x00000007	/* Compression window size */
    509 #define	AR5K_CCFG_CPC_EN	0x00000008	/* Enable performance counters */
    510 
    511 #define AR5K_CCFG_CCU		0x0604			/* Register Address */
    512 #define AR5K_CCFG_CCU_CUP_EN	0x00000001	/* CCU Catchup enable */
    513 #define AR5K_CCFG_CCU_CREDIT	0x00000002	/* CCU Credit (field) */
    514 #define AR5K_CCFG_CCU_CD_THRES	0x00000080	/* CCU Cyc(lic?) debt threshold (field) */
    515 #define AR5K_CCFG_CCU_CUP_LCNT	0x00010000	/* CCU Catchup lit(?) count */
    516 #define	AR5K_CCFG_CCU_INIT	0x00100200	/* Initial value during reset */
    517 
    518 /*
    519  * Compression performance counter registers [5212+]
    520  */
    521 #define AR5K_CPC0		0x0610		/* Compression performance counter 0 */
    522 #define AR5K_CPC1		0x0614		/* Compression performance counter 1*/
    523 #define AR5K_CPC2		0x0618		/* Compression performance counter 2 */
    524 #define AR5K_CPC3		0x061c		/* Compression performance counter 3 */
    525 #define AR5K_CPCOVF		0x0620		/* Compression performance overflow */
    526 
    527 
    528 /*
    529  * Queue control unit (QCU) registers [5211+]
    530  *
    531  * Card has 12 TX Queues but i see that only 0-9 are used (?)
    532  * both in binary HAL (see ah.h) and ar5k. Each queue has it's own
    533  * TXDP at addresses 0x0800 - 0x082c, a CBR (Constant Bit Rate)
    534  * configuration register (0x08c0 - 0x08ec), a ready time configuration
    535  * register (0x0900 - 0x092c), a misc configuration register (0x09c0 -
    536  * 0x09ec) and a status register (0x0a00 - 0x0a2c). We also have some
    537  * global registers, QCU transmit enable/disable and "one shot arm (?)"
    538  * set/clear, which contain status for all queues (we shift by 1 for each
    539  * queue). To access these registers easily we define some macros here
    540  * that are used inside HAL. For more infos check out *_tx_queue functs.
    541  */
    542 
    543 /*
    544  * Generic QCU Register access macros
    545  */
    546 #define	AR5K_QUEUE_REG(_r, _q)		(((_q) << 2) + _r)
    547 #define AR5K_QCU_GLOBAL_READ(_r, _q)	(AR5K_REG_READ(_r) & (1 << _q))
    548 #define AR5K_QCU_GLOBAL_WRITE(_r, _q)	AR5K_REG_WRITE(_r, (1 << _q))
    549 
    550 /*
    551  * QCU Transmit descriptor pointer registers
    552  */
    553 #define AR5K_QCU_TXDP_BASE	0x0800		/* Register Address - Queue0 TXDP */
    554 #define AR5K_QUEUE_TXDP(_q)	AR5K_QUEUE_REG(AR5K_QCU_TXDP_BASE, _q)
    555 
    556 /*
    557  * QCU Transmit enable register
    558  */
    559 #define AR5K_QCU_TXE		0x0840
    560 #define AR5K_ENABLE_QUEUE(_q)	AR5K_QCU_GLOBAL_WRITE(AR5K_QCU_TXE, _q)
    561 #define AR5K_QUEUE_ENABLED(_q)	AR5K_QCU_GLOBAL_READ(AR5K_QCU_TXE, _q)
    562 
    563 /*
    564  * QCU Transmit disable register
    565  */
    566 #define AR5K_QCU_TXD		0x0880
    567 #define AR5K_DISABLE_QUEUE(_q)	AR5K_QCU_GLOBAL_WRITE(AR5K_QCU_TXD, _q)
    568 #define AR5K_QUEUE_DISABLED(_q)	AR5K_QCU_GLOBAL_READ(AR5K_QCU_TXD, _q)
    569 
    570 /*
    571  * QCU Constant Bit Rate configuration registers
    572  */
    573 #define	AR5K_QCU_CBRCFG_BASE		0x08c0	/* Register Address - Queue0 CBRCFG */
    574 #define	AR5K_QCU_CBRCFG_INTVAL		0x00ffffff	/* CBR Interval mask */
    575 #define AR5K_QCU_CBRCFG_INTVAL_S	0
    576 #define	AR5K_QCU_CBRCFG_ORN_THRES	0xff000000	/* CBR overrun threshold mask */
    577 #define AR5K_QCU_CBRCFG_ORN_THRES_S	24
    578 #define	AR5K_QUEUE_CBRCFG(_q)		AR5K_QUEUE_REG(AR5K_QCU_CBRCFG_BASE, _q)
    579 
    580 /*
    581  * QCU Ready time configuration registers
    582  */
    583 #define	AR5K_QCU_RDYTIMECFG_BASE	0x0900	/* Register Address - Queue0 RDYTIMECFG */
    584 #define	AR5K_QCU_RDYTIMECFG_INTVAL	0x00ffffff	/* Ready time interval mask */
    585 #define AR5K_QCU_RDYTIMECFG_INTVAL_S	0
    586 #define	AR5K_QCU_RDYTIMECFG_ENABLE	0x01000000	/* Ready time enable mask */
    587 #define AR5K_QUEUE_RDYTIMECFG(_q)	AR5K_QUEUE_REG(AR5K_QCU_RDYTIMECFG_BASE, _q)
    588 
    589 /*
    590  * QCU one shot arm set registers
    591  */
    592 #define	AR5K_QCU_ONESHOTARM_SET		0x0940	/* Register Address -QCU "one shot arm set (?)" */
    593 #define	AR5K_QCU_ONESHOTARM_SET_M	0x0000ffff
    594 
    595 /*
    596  * QCU one shot arm clear registers
    597  */
    598 #define	AR5K_QCU_ONESHOTARM_CLEAR	0x0980	/* Register Address -QCU "one shot arm clear (?)" */
    599 #define	AR5K_QCU_ONESHOTARM_CLEAR_M	0x0000ffff
    600 
    601 /*
    602  * QCU misc registers
    603  */
    604 #define AR5K_QCU_MISC_BASE		0x09c0			/* Register Address -Queue0 MISC */
    605 #define	AR5K_QCU_MISC_FRSHED_M		0x0000000f	/* Frame sheduling mask */
    606 #define	AR5K_QCU_MISC_FRSHED_ASAP		0	/* ASAP */
    607 #define	AR5K_QCU_MISC_FRSHED_CBR		1	/* Constant Bit Rate */
    608 #define	AR5K_QCU_MISC_FRSHED_DBA_GT		2	/* DMA Beacon alert gated */
    609 #define	AR5K_QCU_MISC_FRSHED_TIM_GT		3	/* TIMT gated */
    610 #define	AR5K_QCU_MISC_FRSHED_BCN_SENT_GT	4	/* Beacon sent gated */
    611 #define	AR5K_QCU_MISC_ONESHOT_ENABLE	0x00000010	/* Oneshot enable */
    612 #define	AR5K_QCU_MISC_CBREXP_DIS	0x00000020	/* Disable CBR expired counter (normal queue) */
    613 #define	AR5K_QCU_MISC_CBREXP_BCN_DIS	0x00000040	/* Disable CBR expired counter (beacon queue) */
    614 #define	AR5K_QCU_MISC_BCN_ENABLE	0x00000080	/* Enable Beacon use */
    615 #define	AR5K_QCU_MISC_CBR_THRES_ENABLE	0x00000100	/* CBR expired threshold enabled */
    616 #define	AR5K_QCU_MISC_RDY_VEOL_POLICY	0x00000200	/* TXE reset when RDYTIME expired or VEOL */
    617 #define	AR5K_QCU_MISC_CBR_RESET_CNT	0x00000400	/* CBR threshold (counter) reset */
    618 #define	AR5K_QCU_MISC_DCU_EARLY		0x00000800	/* DCU early termination */
    619 #define AR5K_QCU_MISC_DCU_CMP_EN	0x00001000	/* Enable frame compression */
    620 #define AR5K_QUEUE_MISC(_q)		AR5K_QUEUE_REG(AR5K_QCU_MISC_BASE, _q)
    621 
    622 
    623 /*
    624  * QCU status registers
    625  */
    626 #define AR5K_QCU_STS_BASE	0x0a00			/* Register Address - Queue0 STS */
    627 #define	AR5K_QCU_STS_FRMPENDCNT	0x00000003	/* Frames pending counter */
    628 #define	AR5K_QCU_STS_CBREXPCNT	0x0000ff00	/* CBR expired counter */
    629 #define	AR5K_QUEUE_STATUS(_q)	AR5K_QUEUE_REG(AR5K_QCU_STS_BASE, _q)
    630 
    631 /*
    632  * QCU ready time shutdown register
    633  */
    634 #define AR5K_QCU_RDYTIMESHDN	0x0a40
    635 #define AR5K_QCU_RDYTIMESHDN_M	0x000003ff
    636 
    637 /*
    638  * QCU compression buffer base registers [5212+]
    639  */
    640 #define AR5K_QCU_CBB_SELECT	0x0b00
    641 #define AR5K_QCU_CBB_ADDR	0x0b04
    642 #define AR5K_QCU_CBB_ADDR_S	9
    643 
    644 /*
    645  * QCU compression buffer configuration register [5212+]
    646  * (buffer size)
    647  */
    648 #define AR5K_QCU_CBCFG		0x0b08
    649 
    650 
    651 
    652 /*
    653  * Distributed Coordination Function (DCF) control unit (DCU)
    654  * registers [5211+]
    655  *
    656  * These registers control the various characteristics of each queue
    657  * for 802.11e (WME) combatibility so they go together with
    658  * QCU registers in pairs. For each queue we have a QCU mask register,
    659  * (0x1000 - 0x102c), a local-IFS settings register (0x1040 - 0x106c),
    660  * a retry limit register (0x1080 - 0x10ac), a channel time register
    661  * (0x10c0 - 0x10ec), a misc-settings register (0x1100 - 0x112c) and
    662  * a sequence number register (0x1140 - 0x116c). It seems that "global"
    663  * registers here afect all queues (see use of DCU_GBL_IFS_SLOT in ar5k).
    664  * We use the same macros here for easier register access.
    665  *
    666  */
    667 
    668 /*
    669  * DCU QCU mask registers
    670  */
    671 #define AR5K_DCU_QCUMASK_BASE	0x1000		/* Register Address -Queue0 DCU_QCUMASK */
    672 #define AR5K_DCU_QCUMASK_M	0x000003ff
    673 #define AR5K_QUEUE_QCUMASK(_q)	AR5K_QUEUE_REG(AR5K_DCU_QCUMASK_BASE, _q)
    674 
    675 /*
    676  * DCU local Inter Frame Space settings register
    677  */
    678 #define AR5K_DCU_LCL_IFS_BASE		0x1040			/* Register Address -Queue0 DCU_LCL_IFS */
    679 #define	AR5K_DCU_LCL_IFS_CW_MIN	        0x000003ff	/* Minimum Contention Window */
    680 #define	AR5K_DCU_LCL_IFS_CW_MIN_S	0
    681 #define	AR5K_DCU_LCL_IFS_CW_MAX	        0x000ffc00	/* Maximum Contention Window */
    682 #define	AR5K_DCU_LCL_IFS_CW_MAX_S	10
    683 #define	AR5K_DCU_LCL_IFS_AIFS		0x0ff00000	/* Arbitrated Interframe Space */
    684 #define	AR5K_DCU_LCL_IFS_AIFS_S		20
    685 #define	AR5K_DCU_LCL_IFS_AIFS_MAX	0xfc		/* Anything above that can cause DCU to hang */
    686 #define	AR5K_QUEUE_DFS_LOCAL_IFS(_q)	AR5K_QUEUE_REG(AR5K_DCU_LCL_IFS_BASE, _q)
    687 
    688 /*
    689  * DCU retry limit registers
    690  */
    691 #define AR5K_DCU_RETRY_LMT_BASE		0x1080			/* Register Address -Queue0 DCU_RETRY_LMT */
    692 #define AR5K_DCU_RETRY_LMT_SH_RETRY	0x0000000f	/* Short retry limit mask */
    693 #define AR5K_DCU_RETRY_LMT_SH_RETRY_S	0
    694 #define AR5K_DCU_RETRY_LMT_LG_RETRY	0x000000f0	/* Long retry limit mask */
    695 #define AR5K_DCU_RETRY_LMT_LG_RETRY_S	4
    696 #define AR5K_DCU_RETRY_LMT_SSH_RETRY	0x00003f00	/* Station short retry limit mask (?) */
    697 #define AR5K_DCU_RETRY_LMT_SSH_RETRY_S	8
    698 #define AR5K_DCU_RETRY_LMT_SLG_RETRY	0x000fc000	/* Station long retry limit mask (?) */
    699 #define AR5K_DCU_RETRY_LMT_SLG_RETRY_S	14
    700 #define	AR5K_QUEUE_DFS_RETRY_LIMIT(_q)	AR5K_QUEUE_REG(AR5K_DCU_RETRY_LMT_BASE, _q)
    701 
    702 /*
    703  * DCU channel time registers
    704  */
    705 #define AR5K_DCU_CHAN_TIME_BASE		0x10c0			/* Register Address -Queue0 DCU_CHAN_TIME */
    706 #define	AR5K_DCU_CHAN_TIME_DUR		0x000fffff	/* Channel time duration */
    707 #define	AR5K_DCU_CHAN_TIME_DUR_S	0
    708 #define	AR5K_DCU_CHAN_TIME_ENABLE	0x00100000	/* Enable channel time */
    709 #define AR5K_QUEUE_DFS_CHANNEL_TIME(_q)	AR5K_QUEUE_REG(AR5K_DCU_CHAN_TIME_BASE, _q)
    710 
    711 /*
    712  * DCU misc registers [5211+]
    713  *
    714  * Note: Arbiter lockout control controls the
    715  * behaviour on low priority queues when we have multiple queues
    716  * with pending frames. Intra-frame lockout means we wait until
    717  * the queue's current frame transmits (with post frame backoff and bursting)
    718  * before we transmit anything else and global lockout means we
    719  * wait for the whole queue to finish before higher priority queues
    720  * can transmit (this is used on beacon and CAB queues).
    721  * No lockout means there is no special handling.
    722  */
    723 #define AR5K_DCU_MISC_BASE		0x1100			/* Register Address -Queue0 DCU_MISC */
    724 #define	AR5K_DCU_MISC_BACKOFF		0x0000003f	/* Mask for backoff threshold */
    725 #define	AR5K_DCU_MISC_ETS_RTS_POL	0x00000040	/* End of transmission series
    726 							station RTS/data failure count
    727 							reset policy (?) */
    728 #define AR5K_DCU_MISC_ETS_CW_POL	0x00000080	/* End of transmission series
    729 							CW reset policy */
    730 #define	AR5K_DCU_MISC_FRAG_WAIT		0x00000100	/* Wait for next fragment */
    731 #define AR5K_DCU_MISC_BACKOFF_FRAG	0x00000200	/* Enable backoff while bursting */
    732 #define	AR5K_DCU_MISC_HCFPOLL_ENABLE	0x00000800	/* CF - Poll enable */
    733 #define	AR5K_DCU_MISC_BACKOFF_PERSIST	0x00001000	/* Persistent backoff */
    734 #define	AR5K_DCU_MISC_FRMPRFTCH_ENABLE	0x00002000	/* Enable frame pre-fetch */
    735 #define	AR5K_DCU_MISC_VIRTCOL		0x0000c000	/* Mask for Virtual Collision (?) */
    736 #define	AR5K_DCU_MISC_VIRTCOL_NORMAL	0
    737 #define	AR5K_DCU_MISC_VIRTCOL_IGNORE	1
    738 #define	AR5K_DCU_MISC_BCN_ENABLE	0x00010000	/* Enable Beacon use */
    739 #define	AR5K_DCU_MISC_ARBLOCK_CTL	0x00060000	/* Arbiter lockout control mask */
    740 #define	AR5K_DCU_MISC_ARBLOCK_CTL_S	17
    741 #define	AR5K_DCU_MISC_ARBLOCK_CTL_NONE		0	/* No arbiter lockout */
    742 #define	AR5K_DCU_MISC_ARBLOCK_CTL_INTFRM	1	/* Intra-frame lockout */
    743 #define	AR5K_DCU_MISC_ARBLOCK_CTL_GLOBAL	2	/* Global lockout */
    744 #define	AR5K_DCU_MISC_ARBLOCK_IGNORE	0x00080000	/* Ignore Arbiter lockout */
    745 #define	AR5K_DCU_MISC_SEQ_NUM_INCR_DIS	0x00100000	/* Disable sequence number increment */
    746 #define	AR5K_DCU_MISC_POST_FR_BKOFF_DIS	0x00200000	/* Disable post-frame backoff */
    747 #define	AR5K_DCU_MISC_VIRT_COLL_POLICY	0x00400000	/* Virtual Collision cw policy */
    748 #define	AR5K_DCU_MISC_BLOWN_IFS_POLICY	0x00800000	/* Blown IFS policy (?) */
    749 #define	AR5K_DCU_MISC_SEQNUM_CTL	0x01000000	/* Sequence number control (?) */
    750 #define AR5K_QUEUE_DFS_MISC(_q)		AR5K_QUEUE_REG(AR5K_DCU_MISC_BASE, _q)
    751 
    752 /*
    753  * DCU frame sequence number registers
    754  */
    755 #define AR5K_DCU_SEQNUM_BASE		0x1140
    756 #define	AR5K_DCU_SEQNUM_M		0x00000fff
    757 #define	AR5K_QUEUE_DCU_SEQNUM(_q)	AR5K_QUEUE_REG(AR5K_DCU_SEQNUM_BASE, _q)
    758 
    759 /*
    760  * DCU global IFS SIFS register
    761  */
    762 #define AR5K_DCU_GBL_IFS_SIFS	0x1030
    763 #define AR5K_DCU_GBL_IFS_SIFS_M	0x0000ffff
    764 
    765 /*
    766  * DCU global IFS slot interval register
    767  */
    768 #define AR5K_DCU_GBL_IFS_SLOT	0x1070
    769 #define AR5K_DCU_GBL_IFS_SLOT_M	0x0000ffff
    770 
    771 /*
    772  * DCU global IFS EIFS register
    773  */
    774 #define AR5K_DCU_GBL_IFS_EIFS	0x10b0
    775 #define AR5K_DCU_GBL_IFS_EIFS_M	0x0000ffff
    776 
    777 /*
    778  * DCU global IFS misc register
    779  *
    780  * LFSR stands for Linear Feedback Shift Register
    781  * and it's used for generating pseudo-random
    782  * number sequences.
    783  *
    784  * (If i understand corectly, random numbers are
    785  * used for idle sensing -multiplied with cwmin/max etc-)
    786  */
    787 #define AR5K_DCU_GBL_IFS_MISC			0x10f0			/* Register Address */
    788 #define	AR5K_DCU_GBL_IFS_MISC_LFSR_SLICE	0x00000007	/* LFSR Slice Select */
    789 #define	AR5K_DCU_GBL_IFS_MISC_TURBO_MODE	0x00000008	/* Turbo mode */
    790 #define	AR5K_DCU_GBL_IFS_MISC_SIFS_DUR_USEC	0x000003f0	/* SIFS Duration mask */
    791 #define	AR5K_DCU_GBL_IFS_MISC_USEC_DUR		0x000ffc00	/* USEC Duration mask */
    792 #define	AR5K_DCU_GBL_IFS_MISC_USEC_DUR_S	10
    793 #define	AR5K_DCU_GBL_IFS_MISC_DCU_ARB_DELAY	0x00300000	/* DCU Arbiter delay mask */
    794 #define AR5K_DCU_GBL_IFS_MISC_SIFS_CNT_RST	0x00400000	/* SIFS cnt reset policy (?) */
    795 #define AR5K_DCU_GBL_IFS_MISC_AIFS_CNT_RST	0x00800000	/* AIFS cnt reset policy (?) */
    796 #define AR5K_DCU_GBL_IFS_MISC_RND_LFSR_SL_DIS	0x01000000	/* Disable random LFSR slice */
    797 
    798 /*
    799  * DCU frame prefetch control register
    800  */
    801 #define AR5K_DCU_FP			0x1230			/* Register Address */
    802 #define AR5K_DCU_FP_NOBURST_DCU_EN	0x00000001	/* Enable non-burst prefetch on DCU (?) */
    803 #define AR5K_DCU_FP_NOBURST_EN		0x00000010	/* Enable non-burst prefetch (?) */
    804 #define AR5K_DCU_FP_BURST_DCU_EN	0x00000020	/* Enable burst prefetch on DCU (?) */
    805 
    806 /*
    807  * DCU transmit pause control/status register
    808  */
    809 #define AR5K_DCU_TXP		0x1270			/* Register Address */
    810 #define	AR5K_DCU_TXP_M		0x000003ff	/* Tx pause mask */
    811 #define	AR5K_DCU_TXP_STATUS	0x00010000	/* Tx pause status */
    812 
    813 /*
    814  * DCU transmit filter table 0 (32 entries)
    815  * each entry contains a 32bit slice of the
    816  * 128bit tx filter for each DCU (4 slices per DCU)
    817  */
    818 #define AR5K_DCU_TX_FILTER_0_BASE	0x1038
    819 #define	AR5K_DCU_TX_FILTER_0(_n)	(AR5K_DCU_TX_FILTER_0_BASE + (_n * 64))
    820 
    821 /*
    822  * DCU transmit filter table 1 (16 entries)
    823  */
    824 #define AR5K_DCU_TX_FILTER_1_BASE	0x103c
    825 #define	AR5K_DCU_TX_FILTER_1(_n)	(AR5K_DCU_TX_FILTER_1_BASE + (_n * 64))
    826 
    827 /*
    828  * DCU clear transmit filter register
    829  */
    830 #define AR5K_DCU_TX_FILTER_CLR	0x143c
    831 
    832 /*
    833  * DCU set transmit filter register
    834  */
    835 #define AR5K_DCU_TX_FILTER_SET	0x147c
    836 
    837 /*
    838  * Reset control register
    839  */
    840 #define AR5K_RESET_CTL		0x4000			/* Register Address */
    841 #define AR5K_RESET_CTL_PCU	0x00000001	/* Protocol Control Unit reset */
    842 #define AR5K_RESET_CTL_DMA	0x00000002	/* DMA (Rx/Tx) reset [5210] */
    843 #define	AR5K_RESET_CTL_BASEBAND	0x00000002	/* Baseband reset [5211+] */
    844 #define AR5K_RESET_CTL_MAC	0x00000004	/* MAC reset (PCU+Baseband ?) [5210] */
    845 #define AR5K_RESET_CTL_PHY	0x00000008	/* PHY reset [5210] */
    846 #define AR5K_RESET_CTL_PCI	0x00000010	/* PCI Core reset (interrupts etc) */
    847 
    848 /*
    849  * Sleep control register
    850  */
    851 #define AR5K_SLEEP_CTL			0x4004			/* Register Address */
    852 #define AR5K_SLEEP_CTL_SLDUR		0x0000ffff	/* Sleep duration mask */
    853 #define AR5K_SLEEP_CTL_SLDUR_S		0
    854 #define AR5K_SLEEP_CTL_SLE		0x00030000	/* Sleep enable mask */
    855 #define AR5K_SLEEP_CTL_SLE_S		16
    856 #define AR5K_SLEEP_CTL_SLE_WAKE		0x00000000	/* Force chip awake */
    857 #define AR5K_SLEEP_CTL_SLE_SLP		0x00010000	/* Force chip sleep */
    858 #define AR5K_SLEEP_CTL_SLE_ALLOW	0x00020000	/* Normal sleep policy */
    859 #define AR5K_SLEEP_CTL_SLE_UNITS	0x00000008	/* [5211+] */
    860 #define AR5K_SLEEP_CTL_DUR_TIM_POL	0x00040000	/* Sleep duration timing policy */
    861 #define AR5K_SLEEP_CTL_DUR_WRITE_POL	0x00080000	/* Sleep duration write policy */
    862 #define AR5K_SLEEP_CTL_SLE_POL		0x00100000	/* Sleep policy mode */
    863 
    864 /*
    865  * Interrupt pending register
    866  */
    867 #define AR5K_INTPEND	0x4008
    868 #define AR5K_INTPEND_M	0x00000001
    869 
    870 /*
    871  * Sleep force register
    872  */
    873 #define AR5K_SFR	0x400c
    874 #define AR5K_SFR_EN	0x00000001
    875 
    876 /*
    877  * PCI configuration register
    878  * TODO: Fix LED stuff
    879  */
    880 #define AR5K_PCICFG			0x4010			/* Register Address */
    881 #define AR5K_PCICFG_EEAE		0x00000001	/* Eeprom access enable [5210] */
    882 #define AR5K_PCICFG_SLEEP_CLOCK_EN	0x00000002	/* Enable sleep clock */
    883 #define AR5K_PCICFG_CLKRUNEN		0x00000004	/* CLKRUN enable [5211+] */
    884 #define AR5K_PCICFG_EESIZE		0x00000018	/* Mask for EEPROM size [5211+] */
    885 #define AR5K_PCICFG_EESIZE_S		3
    886 #define AR5K_PCICFG_EESIZE_4K		0		/* 4K */
    887 #define AR5K_PCICFG_EESIZE_8K		1		/* 8K */
    888 #define AR5K_PCICFG_EESIZE_16K		2		/* 16K */
    889 #define AR5K_PCICFG_EESIZE_FAIL		3		/* Failed to get size [5211+] */
    890 #define AR5K_PCICFG_LED			0x00000060	/* Led status [5211+] */
    891 #define AR5K_PCICFG_LED_NONE		0x00000000	/* Default [5211+] */
    892 #define AR5K_PCICFG_LED_PEND		0x00000020	/* Scan / Auth pending */
    893 #define AR5K_PCICFG_LED_ASSOC		0x00000040	/* Associated */
    894 #define	AR5K_PCICFG_BUS_SEL		0x00000380	/* Mask for "bus select" [5211+] (?) */
    895 #define AR5K_PCICFG_CBEFIX_DIS		0x00000400	/* Disable CBE fix */
    896 #define AR5K_PCICFG_SL_INTEN		0x00000800	/* Enable interrupts when asleep */
    897 #define AR5K_PCICFG_LED_BCTL		0x00001000	/* Led blink (?) [5210] */
    898 #define AR5K_PCICFG_RETRY_FIX		0x00001000	/* Enable pci core retry fix */
    899 #define AR5K_PCICFG_SL_INPEN		0x00002000	/* Sleep even whith pending interrupts*/
    900 #define AR5K_PCICFG_SPWR_DN		0x00010000	/* Mask for power status */
    901 #define AR5K_PCICFG_LEDMODE		0x000e0000	/* Ledmode [5211+] */
    902 #define AR5K_PCICFG_LEDMODE_PROP	0x00000000	/* Blink on standard traffic [5211+] */
    903 #define AR5K_PCICFG_LEDMODE_PROM	0x00020000	/* Default mode (blink on any traffic) [5211+] */
    904 #define AR5K_PCICFG_LEDMODE_PWR		0x00040000	/* Some other blinking mode  (?) [5211+] */
    905 #define AR5K_PCICFG_LEDMODE_RAND	0x00060000	/* Random blinking (?) [5211+] */
    906 #define AR5K_PCICFG_LEDBLINK		0x00700000	/* Led blink rate */
    907 #define AR5K_PCICFG_LEDBLINK_S		20
    908 #define AR5K_PCICFG_LEDSLOW		0x00800000	/* Slowest led blink rate [5211+] */
    909 #define AR5K_PCICFG_LEDSTATE				\
    910 	(AR5K_PCICFG_LED | AR5K_PCICFG_LEDMODE |	\
    911 	AR5K_PCICFG_LEDBLINK | AR5K_PCICFG_LEDSLOW)
    912 #define	AR5K_PCICFG_SLEEP_CLOCK_RATE	0x03000000	/* Sleep clock rate */
    913 #define	AR5K_PCICFG_SLEEP_CLOCK_RATE_S	24
    914 
    915 /*
    916  * "General Purpose Input/Output" (GPIO) control register
    917  *
    918  * I'm not sure about this but after looking at the code
    919  * for all chipsets here is what i got.
    920  *
    921  * We have 6 GPIOs (pins), each GPIO has 4 modes (2 bits)
    922  * Mode 0 -> always input
    923  * Mode 1 -> output when GPIODO for this GPIO is set to 0
    924  * Mode 2 -> output when GPIODO for this GPIO is set to 1
    925  * Mode 3 -> always output
    926  *
    927  * For more infos check out get_gpio/set_gpio and
    928  * set_gpio_input/set_gpio_output functs.
    929  * For more infos on gpio interrupt check out set_gpio_intr.
    930  */
    931 #define AR5K_NUM_GPIO	6
    932 
    933 #define AR5K_GPIOCR		0x4014				/* Register Address */
    934 #define AR5K_GPIOCR_INT_ENA	0x00008000		/* Enable GPIO interrupt */
    935 #define AR5K_GPIOCR_INT_SELL	0x00000000		/* Generate interrupt when pin is low */
    936 #define AR5K_GPIOCR_INT_SELH	0x00010000		/* Generate interrupt when pin is high */
    937 #define AR5K_GPIOCR_IN(n)	(0 << ((n) * 2))	/* Mode 0 for pin n */
    938 #define AR5K_GPIOCR_OUT0(n)	(1 << ((n) * 2))	/* Mode 1 for pin n */
    939 #define AR5K_GPIOCR_OUT1(n)	(2 << ((n) * 2))	/* Mode 2 for pin n */
    940 #define AR5K_GPIOCR_OUT(n)	(3 << ((n) * 2))	/* Mode 3 for pin n */
    941 #define AR5K_GPIOCR_INT_SEL(n)	((n) << 12)		/* Interrupt for GPIO pin n */
    942 
    943 /*
    944  * "General Purpose Input/Output" (GPIO) data output register
    945  */
    946 #define AR5K_GPIODO	0x4018
    947 
    948 /*
    949  * "General Purpose Input/Output" (GPIO) data input register
    950  */
    951 #define AR5K_GPIODI	0x401c
    952 #define AR5K_GPIODI_M	0x0000002f
    953 
    954 /*
    955  * Silicon revision register
    956  */
    957 #define AR5K_SREV		0x4020			/* Register Address */
    958 #define AR5K_SREV_REV		0x0000000f	/* Mask for revision */
    959 #define AR5K_SREV_REV_S		0
    960 #define AR5K_SREV_VER		0x000000ff	/* Mask for version */
    961 #define AR5K_SREV_VER_S		4
    962 
    963 /*
    964  * TXE write posting register
    965  */
    966 #define	AR5K_TXEPOST	0x4028
    967 
    968 /*
    969  * QCU sleep mask
    970  */
    971 #define	AR5K_QCU_SLEEP_MASK	0x402c
    972 
    973 /* 0x4068 is compression buffer configuration
    974  * register on 5414 and pm configuration register
    975  * on 5424 and newer pci-e chips. */
    976 
    977 /*
    978  * Compression buffer configuration
    979  * register (enable/disable) [5414]
    980  */
    981 #define AR5K_5414_CBCFG		0x4068
    982 #define AR5K_5414_CBCFG_BUF_DIS	0x10	/* Disable buffer */
    983 
    984 /*
    985  * PCI-E Power managment configuration
    986  * and status register [5424+]
    987  */
    988 #define	AR5K_PCIE_PM_CTL		0x4068			/* Register address */
    989 /* Only 5424 */
    990 #define	AR5K_PCIE_PM_CTL_L1_WHEN_D2	0x00000001	/* enable PCIe core enter L1
    991 							when d2_sleep_en is asserted */
    992 #define	AR5K_PCIE_PM_CTL_L0_L0S_CLEAR	0x00000002	/* Clear L0 and L0S counters */
    993 #define	AR5K_PCIE_PM_CTL_L0_L0S_EN	0x00000004	/* Start L0 nd L0S counters */
    994 #define	AR5K_PCIE_PM_CTL_LDRESET_EN	0x00000008	/* Enable reset when link goes
    995 							down */
    996 /* Wake On Wireless */
    997 #define	AR5K_PCIE_PM_CTL_PME_EN		0x00000010	/* PME Enable */
    998 #define	AR5K_PCIE_PM_CTL_AUX_PWR_DET	0x00000020	/* Aux power detect */
    999 #define	AR5K_PCIE_PM_CTL_PME_CLEAR	0x00000040	/* Clear PME */
   1000 #define	AR5K_PCIE_PM_CTL_PSM_D0		0x00000080
   1001 #define	AR5K_PCIE_PM_CTL_PSM_D1		0x00000100
   1002 #define	AR5K_PCIE_PM_CTL_PSM_D2		0x00000200
   1003 #define	AR5K_PCIE_PM_CTL_PSM_D3		0x00000400
   1004 
   1005 /*
   1006  * PCI-E Workaround enable register
   1007  */
   1008 #define	AR5K_PCIE_WAEN	0x407c
   1009 
   1010 /*
   1011  * PCI-E Serializer/Desirializer
   1012  * registers
   1013  */
   1014 #define	AR5K_PCIE_SERDES	0x4080
   1015 #define	AR5K_PCIE_SERDES_RESET	0x4084
   1016 
   1017 /*====EEPROM REGISTERS====*/
   1018 
   1019 /*
   1020  * EEPROM access registers
   1021  *
   1022  * Here we got a difference between 5210/5211-12
   1023  * read data register for 5210 is at 0x6800 and
   1024  * status register is at 0x6c00. There is also
   1025  * no eeprom command register on 5210 and the
   1026  * offsets are different.
   1027  *
   1028  * To read eeprom data for a specific offset:
   1029  * 5210 - enable eeprom access (AR5K_PCICFG_EEAE)
   1030  *        read AR5K_EEPROM_BASE +(4 * offset)
   1031  *        check the eeprom status register
   1032  *        and read eeprom data register.
   1033  *
   1034  * 5211 - write offset to AR5K_EEPROM_BASE
   1035  * 5212   write AR5K_EEPROM_CMD_READ on AR5K_EEPROM_CMD
   1036  *        check the eeprom status register
   1037  *        and read eeprom data register.
   1038  *
   1039  * To write eeprom data for a specific offset:
   1040  * 5210 - enable eeprom access (AR5K_PCICFG_EEAE)
   1041  *        write data to AR5K_EEPROM_BASE +(4 * offset)
   1042  *        check the eeprom status register
   1043  * 5211 - write AR5K_EEPROM_CMD_RESET on AR5K_EEPROM_CMD
   1044  * 5212   write offset to AR5K_EEPROM_BASE
   1045  *        write data to data register
   1046  *	  write AR5K_EEPROM_CMD_WRITE on AR5K_EEPROM_CMD
   1047  *        check the eeprom status register
   1048  *
   1049  * For more infos check eeprom_* functs and the ar5k.c
   1050  * file posted in madwifi-devel mailing list.
   1051  * http://sourceforge.net/mailarchive/message.php?msg_id=8966525
   1052  *
   1053  */
   1054 #define AR5K_EEPROM_BASE	0x6000
   1055 
   1056 /*
   1057  * EEPROM data register
   1058  */
   1059 #define AR5K_EEPROM_DATA_5211	0x6004
   1060 #define AR5K_EEPROM_DATA_5210	0x6800
   1061 #define	AR5K_EEPROM_DATA	(ah->ah_version == AR5K_AR5210 ? \
   1062 				AR5K_EEPROM_DATA_5210 : AR5K_EEPROM_DATA_5211)
   1063 
   1064 /*
   1065  * EEPROM command register
   1066  */
   1067 #define AR5K_EEPROM_CMD		0x6008			/* Register Addres */
   1068 #define AR5K_EEPROM_CMD_READ	0x00000001	/* EEPROM read */
   1069 #define AR5K_EEPROM_CMD_WRITE	0x00000002	/* EEPROM write */
   1070 #define AR5K_EEPROM_CMD_RESET	0x00000004	/* EEPROM reset */
   1071 
   1072 /*
   1073  * EEPROM status register
   1074  */
   1075 #define AR5K_EEPROM_STAT_5210	0x6c00			/* Register Address [5210] */
   1076 #define AR5K_EEPROM_STAT_5211	0x600c			/* Register Address [5211+] */
   1077 #define	AR5K_EEPROM_STATUS	(ah->ah_version == AR5K_AR5210 ? \
   1078 				AR5K_EEPROM_STAT_5210 : AR5K_EEPROM_STAT_5211)
   1079 #define AR5K_EEPROM_STAT_RDERR	0x00000001	/* EEPROM read failed */
   1080 #define AR5K_EEPROM_STAT_RDDONE	0x00000002	/* EEPROM read successful */
   1081 #define AR5K_EEPROM_STAT_WRERR	0x00000004	/* EEPROM write failed */
   1082 #define AR5K_EEPROM_STAT_WRDONE	0x00000008	/* EEPROM write successful */
   1083 
   1084 /*
   1085  * EEPROM config register
   1086  */
   1087 #define AR5K_EEPROM_CFG			0x6010			/* Register Addres */
   1088 #define AR5K_EEPROM_CFG_SIZE		0x00000003		/* Size determination override */
   1089 #define AR5K_EEPROM_CFG_SIZE_AUTO	0
   1090 #define AR5K_EEPROM_CFG_SIZE_4KBIT	1
   1091 #define AR5K_EEPROM_CFG_SIZE_8KBIT	2
   1092 #define AR5K_EEPROM_CFG_SIZE_16KBIT	3
   1093 #define AR5K_EEPROM_CFG_WR_WAIT_DIS	0x00000004	/* Disable write wait */
   1094 #define AR5K_EEPROM_CFG_CLK_RATE	0x00000018	/* Clock rate */
   1095 #define AR5K_EEPROM_CFG_CLK_RATE_S		3
   1096 #define AR5K_EEPROM_CFG_CLK_RATE_156KHZ	0
   1097 #define AR5K_EEPROM_CFG_CLK_RATE_312KHZ	1
   1098 #define AR5K_EEPROM_CFG_CLK_RATE_625KHZ	2
   1099 #define AR5K_EEPROM_CFG_PROT_KEY	0x00ffff00      /* Protection key */
   1100 #define AR5K_EEPROM_CFG_PROT_KEY_S	8
   1101 #define AR5K_EEPROM_CFG_LIND_EN		0x01000000	/* Enable length indicator (?) */
   1102 
   1103 
   1104 /*
   1105  * TODO: Wake On Wireless registers
   1106  * Range 0x7000 - 0x7ce0
   1107  */
   1108 
   1109 /*
   1110  * Protocol Control Unit (PCU) registers
   1111  */
   1112 /*
   1113  * Used for checking initial register writes
   1114  * during channel reset (see reset func)
   1115  */
   1116 #define AR5K_PCU_MIN	0x8000
   1117 #define AR5K_PCU_MAX	0x8fff
   1118 
   1119 /*
   1120  * First station id register (Lower 32 bits of MAC address)
   1121  */
   1122 #define AR5K_STA_ID0		0x8000
   1123 #define	AR5K_STA_ID0_ARRD_L32	0xffffffff
   1124 
   1125 /*
   1126  * Second station id register (Upper 16 bits of MAC address + PCU settings)
   1127  */
   1128 #define AR5K_STA_ID1			0x8004			/* Register Address */
   1129 #define	AR5K_STA_ID1_ADDR_U16		0x0000ffff	/* Upper 16 bits of MAC addres */
   1130 #define AR5K_STA_ID1_AP			0x00010000	/* Set AP mode */
   1131 #define AR5K_STA_ID1_ADHOC		0x00020000	/* Set Ad-Hoc mode */
   1132 #define AR5K_STA_ID1_PWR_SV		0x00040000	/* Power save reporting */
   1133 #define AR5K_STA_ID1_NO_KEYSRCH		0x00080000	/* No key search */
   1134 #define AR5K_STA_ID1_NO_PSPOLL		0x00100000	/* No power save polling [5210] */
   1135 #define AR5K_STA_ID1_PCF_5211		0x00100000	/* Enable PCF on [5211+] */
   1136 #define AR5K_STA_ID1_PCF_5210		0x00200000	/* Enable PCF on [5210]*/
   1137 #define	AR5K_STA_ID1_PCF		(ah->ah_version == AR5K_AR5210 ? \
   1138 					AR5K_STA_ID1_PCF_5210 : AR5K_STA_ID1_PCF_5211)
   1139 #define AR5K_STA_ID1_DEFAULT_ANTENNA	0x00200000	/* Use default antenna */
   1140 #define AR5K_STA_ID1_DESC_ANTENNA	0x00400000	/* Update antenna from descriptor */
   1141 #define AR5K_STA_ID1_RTS_DEF_ANTENNA	0x00800000	/* Use default antenna for RTS */
   1142 #define AR5K_STA_ID1_ACKCTS_6MB		0x01000000	/* Use 6Mbit/s for ACK/CTS */
   1143 #define AR5K_STA_ID1_BASE_RATE_11B	0x02000000	/* Use 11b base rate for ACK/CTS [5211+] */
   1144 #define AR5K_STA_ID1_SELFGEN_DEF_ANT	0x04000000	/* Use def. antenna for self generated frames */
   1145 #define AR5K_STA_ID1_CRYPT_MIC_EN	0x08000000	/* Enable MIC */
   1146 #define AR5K_STA_ID1_KEYSRCH_MODE	0x10000000	/* Look up key when key id != 0 */
   1147 #define AR5K_STA_ID1_PRESERVE_SEQ_NUM	0x20000000	/* Preserve sequence number */
   1148 #define AR5K_STA_ID1_CBCIV_ENDIAN	0x40000000	/* ??? */
   1149 #define AR5K_STA_ID1_KEYSRCH_MCAST	0x80000000	/* Do key cache search for mcast frames */
   1150 
   1151 /*
   1152  * First BSSID register (MAC address, lower 32bits)
   1153  */
   1154 #define AR5K_BSS_ID0	0x8008
   1155 
   1156 /*
   1157  * Second BSSID register (MAC address in upper 16 bits)
   1158  *
   1159  * AID: Association ID
   1160  */
   1161 #define AR5K_BSS_ID1		0x800c
   1162 #define AR5K_BSS_ID1_AID	0xffff0000
   1163 #define AR5K_BSS_ID1_AID_S	16
   1164 
   1165 /*
   1166  * Backoff slot time register
   1167  */
   1168 #define AR5K_SLOT_TIME	0x8010
   1169 
   1170 /*
   1171  * ACK/CTS timeout register
   1172  */
   1173 #define AR5K_TIME_OUT		0x8014			/* Register Address */
   1174 #define AR5K_TIME_OUT_ACK	0x00001fff	/* ACK timeout mask */
   1175 #define AR5K_TIME_OUT_ACK_S	0
   1176 #define AR5K_TIME_OUT_CTS	0x1fff0000	/* CTS timeout mask */
   1177 #define AR5K_TIME_OUT_CTS_S	16
   1178 
   1179 /*
   1180  * RSSI threshold register
   1181  */
   1182 #define AR5K_RSSI_THR			0x8018		/* Register Address */
   1183 #define AR5K_RSSI_THR_M			0x000000ff	/* Mask for RSSI threshold [5211+] */
   1184 #define AR5K_RSSI_THR_BMISS_5210	0x00000700	/* Mask for Beacon Missed threshold [5210] */
   1185 #define AR5K_RSSI_THR_BMISS_5210_S	8
   1186 #define AR5K_RSSI_THR_BMISS_5211	0x0000ff00	/* Mask for Beacon Missed threshold [5211+] */
   1187 #define AR5K_RSSI_THR_BMISS_5211_S	8
   1188 #define	AR5K_RSSI_THR_BMISS		(ah->ah_version == AR5K_AR5210 ? \
   1189 					AR5K_RSSI_THR_BMISS_5210 : AR5K_RSSI_THR_BMISS_5211)
   1190 #define	AR5K_RSSI_THR_BMISS_S		8
   1191 
   1192 /*
   1193  * 5210 has more PCU registers because there is no QCU/DCU
   1194  * so queue parameters are set here, this way a lot common
   1195  * registers have different address for 5210. To make things
   1196  * easier we define a macro based on ah->ah_version for common
   1197  * registers with different addresses and common flags.
   1198  */
   1199 
   1200 /*
   1201  * Retry limit register
   1202  *
   1203  * Retry limit register for 5210 (no QCU/DCU so it's done in PCU)
   1204  */
   1205 #define AR5K_NODCU_RETRY_LMT		0x801c			/* Register Address */
   1206 #define AR5K_NODCU_RETRY_LMT_SH_RETRY	0x0000000f	/* Short retry limit mask */
   1207 #define AR5K_NODCU_RETRY_LMT_SH_RETRY_S	0
   1208 #define AR5K_NODCU_RETRY_LMT_LG_RETRY	0x000000f0	/* Long retry mask */
   1209 #define AR5K_NODCU_RETRY_LMT_LG_RETRY_S	4
   1210 #define AR5K_NODCU_RETRY_LMT_SSH_RETRY	0x00003f00	/* Station short retry limit mask */
   1211 #define AR5K_NODCU_RETRY_LMT_SSH_RETRY_S	8
   1212 #define AR5K_NODCU_RETRY_LMT_SLG_RETRY	0x000fc000	/* Station long retry limit mask */
   1213 #define AR5K_NODCU_RETRY_LMT_SLG_RETRY_S	14
   1214 #define AR5K_NODCU_RETRY_LMT_CW_MIN	0x3ff00000	/* Minimum contention window mask */
   1215 #define AR5K_NODCU_RETRY_LMT_CW_MIN_S	20
   1216 
   1217 /*
   1218  * Transmit latency register
   1219  */
   1220 #define AR5K_USEC_5210			0x8020			/* Register Address [5210] */
   1221 #define AR5K_USEC_5211			0x801c			/* Register Address [5211+] */
   1222 #define AR5K_USEC			(ah->ah_version == AR5K_AR5210 ? \
   1223 					AR5K_USEC_5210 : AR5K_USEC_5211)
   1224 #define AR5K_USEC_1			0x0000007f	/* clock cycles for 1us */
   1225 #define AR5K_USEC_1_S			0
   1226 #define AR5K_USEC_32			0x00003f80	/* clock cycles for 1us while on 32Mhz clock */
   1227 #define AR5K_USEC_32_S			7
   1228 #define AR5K_USEC_TX_LATENCY_5211	0x007fc000
   1229 #define AR5K_USEC_TX_LATENCY_5211_S	14
   1230 #define AR5K_USEC_RX_LATENCY_5211	0x1f800000
   1231 #define AR5K_USEC_RX_LATENCY_5211_S	23
   1232 #define AR5K_USEC_TX_LATENCY_5210	0x000fc000	/* also for 5311 */
   1233 #define AR5K_USEC_TX_LATENCY_5210_S	14
   1234 #define AR5K_USEC_RX_LATENCY_5210	0x03f00000	/* also for 5311 */
   1235 #define AR5K_USEC_RX_LATENCY_5210_S	20
   1236 
   1237 /*
   1238  * PCU beacon control register
   1239  */
   1240 #define AR5K_BEACON_5210	0x8024			/*Register Address [5210] */
   1241 #define AR5K_BEACON_5211	0x8020			/*Register Address [5211+] */
   1242 #define AR5K_BEACON		(ah->ah_version == AR5K_AR5210 ? \
   1243 				AR5K_BEACON_5210 : AR5K_BEACON_5211)
   1244 #define AR5K_BEACON_PERIOD	0x0000ffff	/* Mask for beacon period */
   1245 #define AR5K_BEACON_PERIOD_S	0
   1246 #define AR5K_BEACON_TIM		0x007f0000	/* Mask for TIM offset */
   1247 #define AR5K_BEACON_TIM_S	16
   1248 #define AR5K_BEACON_ENABLE	0x00800000	/* Enable beacons */
   1249 #define AR5K_BEACON_RESET_TSF	0x01000000	/* Force TSF reset */
   1250 
   1251 /*
   1252  * CFP period register
   1253  */
   1254 #define AR5K_CFP_PERIOD_5210	0x8028
   1255 #define AR5K_CFP_PERIOD_5211	0x8024
   1256 #define AR5K_CFP_PERIOD		(ah->ah_version == AR5K_AR5210 ? \
   1257 				AR5K_CFP_PERIOD_5210 : AR5K_CFP_PERIOD_5211)
   1258 
   1259 /*
   1260  * Next beacon time register
   1261  */
   1262 #define AR5K_TIMER0_5210	0x802c
   1263 #define AR5K_TIMER0_5211	0x8028
   1264 #define AR5K_TIMER0		(ah->ah_version == AR5K_AR5210 ? \
   1265 				AR5K_TIMER0_5210 : AR5K_TIMER0_5211)
   1266 
   1267 /*
   1268  * Next DMA beacon alert register
   1269  */
   1270 #define AR5K_TIMER1_5210	0x8030
   1271 #define AR5K_TIMER1_5211	0x802c
   1272 #define AR5K_TIMER1		(ah->ah_version == AR5K_AR5210 ? \
   1273 				AR5K_TIMER1_5210 : AR5K_TIMER1_5211)
   1274 
   1275 /*
   1276  * Next software beacon alert register
   1277  */
   1278 #define AR5K_TIMER2_5210	0x8034
   1279 #define AR5K_TIMER2_5211	0x8030
   1280 #define AR5K_TIMER2		(ah->ah_version == AR5K_AR5210 ? \
   1281 				AR5K_TIMER2_5210 : AR5K_TIMER2_5211)
   1282 
   1283 /*
   1284  * Next ATIM window time register
   1285  */
   1286 #define AR5K_TIMER3_5210	0x8038
   1287 #define AR5K_TIMER3_5211	0x8034
   1288 #define AR5K_TIMER3		(ah->ah_version == AR5K_AR5210 ? \
   1289 				AR5K_TIMER3_5210 : AR5K_TIMER3_5211)
   1290 
   1291 
   1292 /*
   1293  * 5210 First inter frame spacing register (IFS)
   1294  */
   1295 #define AR5K_IFS0		0x8040
   1296 #define AR5K_IFS0_SIFS		0x000007ff
   1297 #define AR5K_IFS0_SIFS_S	0
   1298 #define AR5K_IFS0_DIFS		0x007ff800
   1299 #define AR5K_IFS0_DIFS_S	11
   1300 
   1301 /*
   1302  * 5210 Second inter frame spacing register (IFS)
   1303  */
   1304 #define AR5K_IFS1		0x8044
   1305 #define AR5K_IFS1_PIFS		0x00000fff
   1306 #define AR5K_IFS1_PIFS_S	0
   1307 #define AR5K_IFS1_EIFS		0x03fff000
   1308 #define AR5K_IFS1_EIFS_S	12
   1309 #define AR5K_IFS1_CS_EN		0x04000000
   1310 
   1311 
   1312 /*
   1313  * CFP duration register
   1314  */
   1315 #define AR5K_CFP_DUR_5210	0x8048
   1316 #define AR5K_CFP_DUR_5211	0x8038
   1317 #define AR5K_CFP_DUR		(ah->ah_version == AR5K_AR5210 ? \
   1318 				AR5K_CFP_DUR_5210 : AR5K_CFP_DUR_5211)
   1319 
   1320 /*
   1321  * Receive filter register
   1322  */
   1323 #define AR5K_RX_FILTER_5210	0x804c			/* Register Address [5210] */
   1324 #define AR5K_RX_FILTER_5211	0x803c			/* Register Address [5211+] */
   1325 #define AR5K_RX_FILTER		(ah->ah_version == AR5K_AR5210 ? \
   1326 				AR5K_RX_FILTER_5210 : AR5K_RX_FILTER_5211)
   1327 #define	AR5K_RX_FILTER_UCAST 	0x00000001	/* Don't filter unicast frames */
   1328 #define	AR5K_RX_FILTER_MCAST 	0x00000002	/* Don't filter multicast frames */
   1329 #define	AR5K_RX_FILTER_BCAST 	0x00000004	/* Don't filter broadcast frames */
   1330 #define	AR5K_RX_FILTER_CONTROL 	0x00000008	/* Don't filter control frames */
   1331 #define	AR5K_RX_FILTER_BEACON 	0x00000010	/* Don't filter beacon frames */
   1332 #define	AR5K_RX_FILTER_PROM 	0x00000020	/* Set promiscuous mode */
   1333 #define	AR5K_RX_FILTER_XRPOLL 	0x00000040	/* Don't filter XR poll frame [5212+] */
   1334 #define	AR5K_RX_FILTER_PROBEREQ 0x00000080	/* Don't filter probe requests [5212+] */
   1335 #define	AR5K_RX_FILTER_PHYERR_5212	0x00000100	/* Don't filter phy errors [5212+] */
   1336 #define	AR5K_RX_FILTER_RADARERR_5212 	0x00000200	/* Don't filter phy radar errors [5212+] */
   1337 #define AR5K_RX_FILTER_PHYERR_5211	0x00000040	/* [5211] */
   1338 #define AR5K_RX_FILTER_RADARERR_5211	0x00000080	/* [5211] */
   1339 #define AR5K_RX_FILTER_PHYERR  \
   1340 	((ah->ah_version == AR5K_AR5211 ? \
   1341 	AR5K_RX_FILTER_PHYERR_5211 : AR5K_RX_FILTER_PHYERR_5212))
   1342 #define        AR5K_RX_FILTER_RADARERR \
   1343 	((ah->ah_version == AR5K_AR5211 ? \
   1344 	AR5K_RX_FILTER_RADARERR_5211 : AR5K_RX_FILTER_RADARERR_5212))
   1345 
   1346 /*
   1347  * Multicast filter register (lower 32 bits)
   1348  */
   1349 #define AR5K_MCAST_FILTER0_5210	0x8050
   1350 #define AR5K_MCAST_FILTER0_5211	0x8040
   1351 #define AR5K_MCAST_FILTER0	(ah->ah_version == AR5K_AR5210 ? \
   1352 				AR5K_MCAST_FILTER0_5210 : AR5K_MCAST_FILTER0_5211)
   1353 
   1354 /*
   1355  * Multicast filter register (higher 16 bits)
   1356  */
   1357 #define AR5K_MCAST_FILTER1_5210	0x8054
   1358 #define AR5K_MCAST_FILTER1_5211	0x8044
   1359 #define AR5K_MCAST_FILTER1	(ah->ah_version == AR5K_AR5210 ? \
   1360 				AR5K_MCAST_FILTER1_5210 : AR5K_MCAST_FILTER1_5211)
   1361 
   1362 
   1363 /*
   1364  * Transmit mask register (lower 32 bits) [5210]
   1365  */
   1366 #define AR5K_TX_MASK0	0x8058
   1367 
   1368 /*
   1369  * Transmit mask register (higher 16 bits) [5210]
   1370  */
   1371 #define AR5K_TX_MASK1	0x805c
   1372 
   1373 /*
   1374  * Clear transmit mask [5210]
   1375  */
   1376 #define AR5K_CLR_TMASK	0x8060
   1377 
   1378 /*
   1379  * Trigger level register (before transmission) [5210]
   1380  */
   1381 #define AR5K_TRIG_LVL	0x8064
   1382 
   1383 
   1384 /*
   1385  * PCU control register
   1386  *
   1387  * Only DIS_RX is used in the code, the rest i guess are
   1388  * for tweaking/diagnostics.
   1389  */
   1390 #define AR5K_DIAG_SW_5210		0x8068			/* Register Address [5210] */
   1391 #define AR5K_DIAG_SW_5211		0x8048			/* Register Address [5211+] */
   1392 #define AR5K_DIAG_SW			(ah->ah_version == AR5K_AR5210 ? \
   1393 					AR5K_DIAG_SW_5210 : AR5K_DIAG_SW_5211)
   1394 #define AR5K_DIAG_SW_DIS_WEP_ACK	0x00000001	/* Disable ACKs if WEP key is invalid */
   1395 #define AR5K_DIAG_SW_DIS_ACK		0x00000002	/* Disable ACKs */
   1396 #define AR5K_DIAG_SW_DIS_CTS		0x00000004	/* Disable CTSs */
   1397 #define AR5K_DIAG_SW_DIS_ENC		0x00000008	/* Disable encryption */
   1398 #define AR5K_DIAG_SW_DIS_DEC		0x00000010	/* Disable decryption */
   1399 #define AR5K_DIAG_SW_DIS_TX		0x00000020	/* Disable transmit [5210] */
   1400 #define AR5K_DIAG_SW_DIS_RX_5210	0x00000040	/* Disable recieve */
   1401 #define AR5K_DIAG_SW_DIS_RX_5211	0x00000020
   1402 #define	AR5K_DIAG_SW_DIS_RX		(ah->ah_version == AR5K_AR5210 ? \
   1403 					AR5K_DIAG_SW_DIS_RX_5210 : AR5K_DIAG_SW_DIS_RX_5211)
   1404 #define AR5K_DIAG_SW_LOOP_BACK_5210	0x00000080	/* Loopback (i guess it goes with DIS_TX) [5210] */
   1405 #define AR5K_DIAG_SW_LOOP_BACK_5211	0x00000040
   1406 #define AR5K_DIAG_SW_LOOP_BACK		(ah->ah_version == AR5K_AR5210 ? \
   1407 					AR5K_DIAG_SW_LOOP_BACK_5210 : AR5K_DIAG_SW_LOOP_BACK_5211)
   1408 #define AR5K_DIAG_SW_CORR_FCS_5210	0x00000100	/* Corrupted FCS */
   1409 #define AR5K_DIAG_SW_CORR_FCS_5211	0x00000080
   1410 #define AR5K_DIAG_SW_CORR_FCS		(ah->ah_version == AR5K_AR5210 ? \
   1411 					AR5K_DIAG_SW_CORR_FCS_5210 : AR5K_DIAG_SW_CORR_FCS_5211)
   1412 #define AR5K_DIAG_SW_CHAN_INFO_5210	0x00000200	/* Dump channel info */
   1413 #define AR5K_DIAG_SW_CHAN_INFO_5211	0x00000100
   1414 #define AR5K_DIAG_SW_CHAN_INFO		(ah->ah_version == AR5K_AR5210 ? \
   1415 					AR5K_DIAG_SW_CHAN_INFO_5210 : AR5K_DIAG_SW_CHAN_INFO_5211)
   1416 #define AR5K_DIAG_SW_EN_SCRAM_SEED_5210	0x00000400	/* Enable fixed scrambler seed */
   1417 #define AR5K_DIAG_SW_EN_SCRAM_SEED_5211	0x00000200
   1418 #define AR5K_DIAG_SW_EN_SCRAM_SEED	(ah->ah_version == AR5K_AR5210 ? \
   1419 					AR5K_DIAG_SW_EN_SCRAM_SEED_5210 : AR5K_DIAG_SW_EN_SCRAM_SEED_5211)
   1420 #define AR5K_DIAG_SW_ECO_ENABLE		0x00000400	/* [5211+] */
   1421 #define AR5K_DIAG_SW_SCVRAM_SEED	0x0003f800	/* [5210] */
   1422 #define AR5K_DIAG_SW_SCRAM_SEED_M	0x0001fc00	/* Scrambler seed mask */
   1423 #define AR5K_DIAG_SW_SCRAM_SEED_S	10
   1424 #define AR5K_DIAG_SW_DIS_SEQ_INC	0x00040000	/* Disable seqnum increment (?)[5210] */
   1425 #define AR5K_DIAG_SW_FRAME_NV0_5210	0x00080000
   1426 #define AR5K_DIAG_SW_FRAME_NV0_5211	0x00020000	/* Accept frames of non-zero protocol number */
   1427 #define	AR5K_DIAG_SW_FRAME_NV0		(ah->ah_version == AR5K_AR5210 ? \
   1428 					AR5K_DIAG_SW_FRAME_NV0_5210 : AR5K_DIAG_SW_FRAME_NV0_5211)
   1429 #define AR5K_DIAG_SW_OBSPT_M		0x000c0000	/* Observation point select (?) */
   1430 #define AR5K_DIAG_SW_OBSPT_S		18
   1431 #define AR5K_DIAG_SW_RX_CLEAR_HIGH	0x0010000	/* Force RX Clear high */
   1432 #define AR5K_DIAG_SW_IGNORE_CARR_SENSE	0x0020000	/* Ignore virtual carrier sense */
   1433 #define AR5K_DIAG_SW_CHANEL_IDLE_HIGH	0x0040000	/* Force channel idle high */
   1434 #define AR5K_DIAG_SW_PHEAR_ME		0x0080000	/* ??? */
   1435 
   1436 /*
   1437  * TSF (clock) register (lower 32 bits)
   1438  */
   1439 #define AR5K_TSF_L32_5210	0x806c
   1440 #define AR5K_TSF_L32_5211	0x804c
   1441 #define	AR5K_TSF_L32		(ah->ah_version == AR5K_AR5210 ? \
   1442 				AR5K_TSF_L32_5210 : AR5K_TSF_L32_5211)
   1443 
   1444 /*
   1445  * TSF (clock) register (higher 32 bits)
   1446  */
   1447 #define AR5K_TSF_U32_5210	0x8070
   1448 #define AR5K_TSF_U32_5211	0x8050
   1449 #define	AR5K_TSF_U32		(ah->ah_version == AR5K_AR5210 ? \
   1450 				AR5K_TSF_U32_5210 : AR5K_TSF_U32_5211)
   1451 
   1452 /*
   1453  * Last beacon timestamp register (Read Only)
   1454  */
   1455 #define AR5K_LAST_TSTP	0x8080
   1456 
   1457 /*
   1458  * ADDAC test register [5211+]
   1459  */
   1460 #define AR5K_ADDAC_TEST			0x8054			/* Register Address */
   1461 #define AR5K_ADDAC_TEST_TXCONT 		0x00000001	/* Test continuous tx */
   1462 #define AR5K_ADDAC_TEST_TST_MODE	0x00000002	/* Test mode */
   1463 #define AR5K_ADDAC_TEST_LOOP_EN		0x00000004	/* Enable loop */
   1464 #define AR5K_ADDAC_TEST_LOOP_LEN	0x00000008	/* Loop length (field) */
   1465 #define AR5K_ADDAC_TEST_USE_U8		0x00004000	/* Use upper 8 bits */
   1466 #define AR5K_ADDAC_TEST_MSB		0x00008000	/* State of MSB */
   1467 #define AR5K_ADDAC_TEST_TRIG_SEL	0x00010000	/* Trigger select */
   1468 #define AR5K_ADDAC_TEST_TRIG_PTY	0x00020000	/* Trigger polarity */
   1469 #define AR5K_ADDAC_TEST_RXCONT		0x00040000	/* Continuous capture */
   1470 #define AR5K_ADDAC_TEST_CAPTURE		0x00080000	/* Begin capture */
   1471 #define AR5K_ADDAC_TEST_TST_ARM		0x00100000	/* ARM rx buffer for capture */
   1472 
   1473 /*
   1474  * Default antenna register [5211+]
   1475  */
   1476 #define AR5K_DEFAULT_ANTENNA	0x8058
   1477 
   1478 /*
   1479  * Frame control QoS mask register (?) [5211+]
   1480  * (FC_QOS_MASK)
   1481  */
   1482 #define AR5K_FRAME_CTL_QOSM	0x805c
   1483 
   1484 /*
   1485  * Seq mask register (?) [5211+]
   1486  */
   1487 #define AR5K_SEQ_MASK	0x8060
   1488 
   1489 /*
   1490  * Retry count register [5210]
   1491  */
   1492 #define AR5K_RETRY_CNT		0x8084			/* Register Address [5210] */
   1493 #define AR5K_RETRY_CNT_SSH	0x0000003f	/* Station short retry count (?) */
   1494 #define AR5K_RETRY_CNT_SLG	0x00000fc0	/* Station long retry count (?) */
   1495 
   1496 /*
   1497  * Back-off status register [5210]
   1498  */
   1499 #define AR5K_BACKOFF		0x8088			/* Register Address [5210] */
   1500 #define AR5K_BACKOFF_CW		0x000003ff	/* Backoff Contention Window (?) */
   1501 #define AR5K_BACKOFF_CNT	0x03ff0000	/* Backoff count (?) */
   1502 
   1503 
   1504 
   1505 /*
   1506  * NAV register (current)
   1507  */
   1508 #define AR5K_NAV_5210		0x808c
   1509 #define AR5K_NAV_5211		0x8084
   1510 #define	AR5K_NAV		(ah->ah_version == AR5K_AR5210 ? \
   1511 				AR5K_NAV_5210 : AR5K_NAV_5211)
   1512 
   1513 /*
   1514  * RTS success register
   1515  */
   1516 #define AR5K_RTS_OK_5210	0x8090
   1517 #define AR5K_RTS_OK_5211	0x8088
   1518 #define	AR5K_RTS_OK		(ah->ah_version == AR5K_AR5210 ? \
   1519 				AR5K_RTS_OK_5210 : AR5K_RTS_OK_5211)
   1520 
   1521 /*
   1522  * RTS failure register
   1523  */
   1524 #define AR5K_RTS_FAIL_5210	0x8094
   1525 #define AR5K_RTS_FAIL_5211	0x808c
   1526 #define	AR5K_RTS_FAIL		(ah->ah_version == AR5K_AR5210 ? \
   1527 				AR5K_RTS_FAIL_5210 : AR5K_RTS_FAIL_5211)
   1528 
   1529 /*
   1530  * ACK failure register
   1531  */
   1532 #define AR5K_ACK_FAIL_5210	0x8098
   1533 #define AR5K_ACK_FAIL_5211	0x8090
   1534 #define	AR5K_ACK_FAIL		(ah->ah_version == AR5K_AR5210 ? \
   1535 				AR5K_ACK_FAIL_5210 : AR5K_ACK_FAIL_5211)
   1536 
   1537 /*
   1538  * FCS failure register
   1539  */
   1540 #define AR5K_FCS_FAIL_5210	0x809c
   1541 #define AR5K_FCS_FAIL_5211	0x8094
   1542 #define	AR5K_FCS_FAIL		(ah->ah_version == AR5K_AR5210 ? \
   1543 				AR5K_FCS_FAIL_5210 : AR5K_FCS_FAIL_5211)
   1544 
   1545 /*
   1546  * Beacon count register
   1547  */
   1548 #define AR5K_BEACON_CNT_5210	0x80a0
   1549 #define AR5K_BEACON_CNT_5211	0x8098
   1550 #define	AR5K_BEACON_CNT		(ah->ah_version == AR5K_AR5210 ? \
   1551 				AR5K_BEACON_CNT_5210 : AR5K_BEACON_CNT_5211)
   1552 
   1553 
   1554 /*===5212 Specific PCU registers===*/
   1555 
   1556 /*
   1557  * Transmit power control register
   1558  */
   1559 #define AR5K_TPC			0x80e8
   1560 #define AR5K_TPC_ACK			0x0000003f	/* ack frames */
   1561 #define AR5K_TPC_ACK_S			0
   1562 #define AR5K_TPC_CTS			0x00003f00	/* cts frames */
   1563 #define AR5K_TPC_CTS_S			8
   1564 #define AR5K_TPC_CHIRP			0x003f0000	/* chirp frames */
   1565 #define AR5K_TPC_CHIRP_S		16
   1566 #define AR5K_TPC_DOPPLER		0x0f000000	/* doppler chirp span */
   1567 #define AR5K_TPC_DOPPLER_S		24
   1568 
   1569 /*
   1570  * XR (eXtended Range) mode register
   1571  */
   1572 #define AR5K_XRMODE			0x80c0			/* Register Address */
   1573 #define	AR5K_XRMODE_POLL_TYPE_M		0x0000003f	/* Mask for Poll type (?) */
   1574 #define	AR5K_XRMODE_POLL_TYPE_S		0
   1575 #define	AR5K_XRMODE_POLL_SUBTYPE_M	0x0000003c	/* Mask for Poll subtype (?) */
   1576 #define	AR5K_XRMODE_POLL_SUBTYPE_S	2
   1577 #define	AR5K_XRMODE_POLL_WAIT_ALL	0x00000080	/* Wait for poll */
   1578 #define	AR5K_XRMODE_SIFS_DELAY		0x000fff00	/* Mask for SIFS delay */
   1579 #define	AR5K_XRMODE_FRAME_HOLD_M	0xfff00000	/* Mask for frame hold (?) */
   1580 #define	AR5K_XRMODE_FRAME_HOLD_S	20
   1581 
   1582 /*
   1583  * XR delay register
   1584  */
   1585 #define AR5K_XRDELAY			0x80c4			/* Register Address */
   1586 #define AR5K_XRDELAY_SLOT_DELAY_M	0x0000ffff	/* Mask for slot delay */
   1587 #define AR5K_XRDELAY_SLOT_DELAY_S	0
   1588 #define AR5K_XRDELAY_CHIRP_DELAY_M	0xffff0000	/* Mask for CHIRP data delay */
   1589 #define AR5K_XRDELAY_CHIRP_DELAY_S	16
   1590 
   1591 /*
   1592  * XR timeout register
   1593  */
   1594 #define AR5K_XRTIMEOUT			0x80c8			/* Register Address */
   1595 #define AR5K_XRTIMEOUT_CHIRP_M		0x0000ffff	/* Mask for CHIRP timeout */
   1596 #define AR5K_XRTIMEOUT_CHIRP_S		0
   1597 #define AR5K_XRTIMEOUT_POLL_M		0xffff0000	/* Mask for Poll timeout */
   1598 #define AR5K_XRTIMEOUT_POLL_S		16
   1599 
   1600 /*
   1601  * XR chirp register
   1602  */
   1603 #define AR5K_XRCHIRP			0x80cc			/* Register Address */
   1604 #define AR5K_XRCHIRP_SEND		0x00000001	/* Send CHIRP */
   1605 #define AR5K_XRCHIRP_GAP		0xffff0000	/* Mask for CHIRP gap (?) */
   1606 
   1607 /*
   1608  * XR stomp register
   1609  */
   1610 #define AR5K_XRSTOMP			0x80d0			/* Register Address */
   1611 #define AR5K_XRSTOMP_TX			0x00000001	/* Stomp Tx (?) */
   1612 #define AR5K_XRSTOMP_RX			0x00000002	/* Stomp Rx (?) */
   1613 #define AR5K_XRSTOMP_TX_RSSI		0x00000004	/* Stomp Tx RSSI (?) */
   1614 #define AR5K_XRSTOMP_TX_BSSID		0x00000008	/* Stomp Tx BSSID (?) */
   1615 #define AR5K_XRSTOMP_DATA		0x00000010	/* Stomp data (?)*/
   1616 #define AR5K_XRSTOMP_RSSI_THRES		0x0000ff00	/* Mask for XR RSSI threshold */
   1617 
   1618 /*
   1619  * First enhanced sleep register
   1620  */
   1621 #define AR5K_SLEEP0			0x80d4			/* Register Address */
   1622 #define AR5K_SLEEP0_NEXT_DTIM		0x0007ffff	/* Mask for next DTIM (?) */
   1623 #define AR5K_SLEEP0_NEXT_DTIM_S		0
   1624 #define AR5K_SLEEP0_ASSUME_DTIM		0x00080000	/* Assume DTIM */
   1625 #define AR5K_SLEEP0_ENH_SLEEP_EN	0x00100000	/* Enable enchanced sleep control */
   1626 #define AR5K_SLEEP0_CABTO		0xff000000	/* Mask for CAB Time Out */
   1627 #define AR5K_SLEEP0_CABTO_S		24
   1628 
   1629 /*
   1630  * Second enhanced sleep register
   1631  */
   1632 #define AR5K_SLEEP1			0x80d8			/* Register Address */
   1633 #define AR5K_SLEEP1_NEXT_TIM		0x0007ffff	/* Mask for next TIM (?) */
   1634 #define AR5K_SLEEP1_NEXT_TIM_S		0
   1635 #define AR5K_SLEEP1_BEACON_TO		0xff000000	/* Mask for Beacon Time Out */
   1636 #define AR5K_SLEEP1_BEACON_TO_S		24
   1637 
   1638 /*
   1639  * Third enhanced sleep register
   1640  */
   1641 #define AR5K_SLEEP2			0x80dc			/* Register Address */
   1642 #define AR5K_SLEEP2_TIM_PER		0x0000ffff	/* Mask for TIM period (?) */
   1643 #define AR5K_SLEEP2_TIM_PER_S		0
   1644 #define AR5K_SLEEP2_DTIM_PER		0xffff0000	/* Mask for DTIM period (?) */
   1645 #define AR5K_SLEEP2_DTIM_PER_S		16
   1646 
   1647 /*
   1648  * BSSID mask registers
   1649  */
   1650 #define AR5K_BSS_IDM0			0x80e0	/* Upper bits */
   1651 #define AR5K_BSS_IDM1			0x80e4	/* Lower bits */
   1652 
   1653 /*
   1654  * TX power control (TPC) register
   1655  *
   1656  * XXX: PCDAC steps (0.5dbm) or DBM ?
   1657  *
   1658  */
   1659 #define AR5K_TXPC			0x80e8			/* Register Address */
   1660 #define AR5K_TXPC_ACK_M			0x0000003f	/* ACK tx power */
   1661 #define AR5K_TXPC_ACK_S			0
   1662 #define AR5K_TXPC_CTS_M			0x00003f00	/* CTS tx power */
   1663 #define AR5K_TXPC_CTS_S			8
   1664 #define AR5K_TXPC_CHIRP_M		0x003f0000	/* CHIRP tx power */
   1665 #define AR5K_TXPC_CHIRP_S		16
   1666 #define AR5K_TXPC_DOPPLER		0x0f000000	/* Doppler chirp span (?) */
   1667 #define AR5K_TXPC_DOPPLER_S		24
   1668 
   1669 /*
   1670  * Profile count registers
   1671  */
   1672 #define AR5K_PROFCNT_TX			0x80ec	/* Tx count */
   1673 #define AR5K_PROFCNT_RX			0x80f0	/* Rx count */
   1674 #define AR5K_PROFCNT_RXCLR		0x80f4	/* Clear Rx count */
   1675 #define AR5K_PROFCNT_CYCLE		0x80f8	/* Cycle count (?) */
   1676 
   1677 /*
   1678  * Quiet period control registers
   1679  */
   1680 #define AR5K_QUIET_CTL1			0x80fc			/* Register Address */
   1681 #define AR5K_QUIET_CTL1_NEXT_QT_TSF	0x0000ffff	/* Next quiet period TSF (TU) */
   1682 #define AR5K_QUIET_CTL1_NEXT_QT_TSF_S	0
   1683 #define AR5K_QUIET_CTL1_QT_EN		0x00010000	/* Enable quiet period */
   1684 #define AR5K_QUIET_CTL1_ACK_CTS_EN	0x00020000	/* Send ACK/CTS during quiet period */
   1685 
   1686 #define AR5K_QUIET_CTL2			0x8100			/* Register Address */
   1687 #define AR5K_QUIET_CTL2_QT_PER		0x0000ffff	/* Mask for quiet period periodicity */
   1688 #define AR5K_QUIET_CTL2_QT_PER_S	0
   1689 #define AR5K_QUIET_CTL2_QT_DUR		0xffff0000	/* Mask for quiet period duration */
   1690 #define AR5K_QUIET_CTL2_QT_DUR_S	16
   1691 
   1692 /*
   1693  * TSF parameter register
   1694  */
   1695 #define AR5K_TSF_PARM			0x8104			/* Register Address */
   1696 #define AR5K_TSF_PARM_INC		0x000000ff	/* Mask for TSF increment */
   1697 #define AR5K_TSF_PARM_INC_S		0
   1698 
   1699 /*
   1700  * QoS NOACK policy
   1701  */
   1702 #define AR5K_QOS_NOACK			0x8108			/* Register Address */
   1703 #define AR5K_QOS_NOACK_2BIT_VALUES	0x0000000f	/* ??? */
   1704 #define AR5K_QOS_NOACK_2BIT_VALUES_S	0
   1705 #define AR5K_QOS_NOACK_BIT_OFFSET	0x00000070	/* ??? */
   1706 #define AR5K_QOS_NOACK_BIT_OFFSET_S	4
   1707 #define AR5K_QOS_NOACK_BYTE_OFFSET	0x00000180	/* ??? */
   1708 #define AR5K_QOS_NOACK_BYTE_OFFSET_S	7
   1709 
   1710 /*
   1711  * PHY error filter register
   1712  */
   1713 #define AR5K_PHY_ERR_FIL		0x810c
   1714 #define AR5K_PHY_ERR_FIL_RADAR		0x00000020	/* Radar signal */
   1715 #define AR5K_PHY_ERR_FIL_OFDM		0x00020000	/* OFDM false detect (ANI) */
   1716 #define AR5K_PHY_ERR_FIL_CCK		0x02000000	/* CCK false detect (ANI) */
   1717 
   1718 /*
   1719  * XR latency register
   1720  */
   1721 #define AR5K_XRLAT_TX		0x8110
   1722 
   1723 /*
   1724  * ACK SIFS register
   1725  */
   1726 #define AR5K_ACKSIFS		0x8114			/* Register Address */
   1727 #define AR5K_ACKSIFS_INC	0x00000000	/* ACK SIFS Increment (field) */
   1728 
   1729 /*
   1730  * MIC QoS control register (?)
   1731  */
   1732 #define	AR5K_MIC_QOS_CTL		0x8118			/* Register Address */
   1733 #define	AR5K_MIC_QOS_CTL_OFF(_n)	(1 << (_n * 2))
   1734 #define	AR5K_MIC_QOS_CTL_MQ_EN		0x00010000	/* Enable MIC QoS */
   1735 
   1736 /*
   1737  * MIC QoS select register (?)
   1738  */
   1739 #define	AR5K_MIC_QOS_SEL		0x811c
   1740 #define	AR5K_MIC_QOS_SEL_OFF(_n)	(1 << (_n * 4))
   1741 
   1742 /*
   1743  * Misc mode control register (?)
   1744  */
   1745 #define	AR5K_MISC_MODE			0x8120			/* Register Address */
   1746 #define	AR5K_MISC_MODE_FBSSID_MATCH	0x00000001	/* Force BSSID match */
   1747 #define	AR5K_MISC_MODE_ACKSIFS_MEM	0x00000002	/* ACK SIFS memory (?) */
   1748 #define	AR5K_MISC_MODE_COMBINED_MIC	0x00000004	/* use rx/tx MIC key */
   1749 /* more bits */
   1750 
   1751 /*
   1752  * OFDM Filter counter
   1753  */
   1754 #define	AR5K_OFDM_FIL_CNT		0x8124
   1755 
   1756 /*
   1757  * CCK Filter counter
   1758  */
   1759 #define	AR5K_CCK_FIL_CNT		0x8128
   1760 
   1761 /*
   1762  * PHY Error Counters (?)
   1763  */
   1764 #define	AR5K_PHYERR_CNT1		0x812c
   1765 #define	AR5K_PHYERR_CNT1_MASK		0x8130
   1766 
   1767 #define	AR5K_PHYERR_CNT2		0x8134
   1768 #define	AR5K_PHYERR_CNT2_MASK		0x8138
   1769 
   1770 /*
   1771  * TSF Threshold register (?)
   1772  */
   1773 #define	AR5K_TSF_THRES			0x813c
   1774 
   1775 /*
   1776  * TODO: Wake On Wireless registers
   1777  * Range: 0x8147 - 0x818c
   1778  */
   1779 
   1780 /*
   1781  * Rate -> ACK SIFS mapping table (32 entries)
   1782  */
   1783 #define	AR5K_RATE_ACKSIFS_BASE		0x8680			/* Register Address */
   1784 #define	AR5K_RATE_ACKSIFS(_n)		(AR5K_RATE_ACKSIFS_BSE + ((_n) << 2))
   1785 #define	AR5K_RATE_ACKSIFS_NORMAL	0x00000001	/* Normal SIFS (field) */
   1786 #define	AR5K_RATE_ACKSIFS_TURBO		0x00000400	/* Turbo SIFS (field) */
   1787 
   1788 /*
   1789  * Rate -> duration mapping table (32 entries)
   1790  */
   1791 #define AR5K_RATE_DUR_BASE		0x8700
   1792 #define AR5K_RATE_DUR(_n)		(AR5K_RATE_DUR_BASE + ((_n) << 2))
   1793 
   1794 /*
   1795  * Rate -> db mapping table
   1796  * (8 entries, each one has 4 8bit fields)
   1797  */
   1798 #define AR5K_RATE2DB_BASE		0x87c0
   1799 #define AR5K_RATE2DB(_n)		(AR5K_RATE2DB_BASE + ((_n) << 2))
   1800 
   1801 /*
   1802  * db -> Rate mapping table
   1803  * (8 entries, each one has 4 8bit fields)
   1804  */
   1805 #define AR5K_DB2RATE_BASE		0x87e0
   1806 #define AR5K_DB2RATE(_n)		(AR5K_DB2RATE_BASE + ((_n) << 2))
   1807 
   1808 /*===5212 end===*/
   1809 
   1810 /*
   1811  * Key table (WEP) register
   1812  */
   1813 #define AR5K_KEYTABLE_0_5210		0x9000
   1814 #define AR5K_KEYTABLE_0_5211		0x8800
   1815 #define AR5K_KEYTABLE_5210(_n)		(AR5K_KEYTABLE_0_5210 + ((_n) << 5))
   1816 #define AR5K_KEYTABLE_5211(_n)		(AR5K_KEYTABLE_0_5211 + ((_n) << 5))
   1817 #define	AR5K_KEYTABLE(_n)		(ah->ah_version == AR5K_AR5210 ? \
   1818 					AR5K_KEYTABLE_5210(_n) : AR5K_KEYTABLE_5211(_n))
   1819 #define AR5K_KEYTABLE_OFF(_n, x)	(AR5K_KEYTABLE(_n) + (x << 2))
   1820 #define AR5K_KEYTABLE_TYPE(_n)		AR5K_KEYTABLE_OFF(_n, 5)
   1821 #define AR5K_KEYTABLE_TYPE_40		0x00000000
   1822 #define AR5K_KEYTABLE_TYPE_104		0x00000001
   1823 #define AR5K_KEYTABLE_TYPE_128		0x00000003
   1824 #define AR5K_KEYTABLE_TYPE_TKIP		0x00000004	/* [5212+] */
   1825 #define AR5K_KEYTABLE_TYPE_AES		0x00000005	/* [5211+] */
   1826 #define AR5K_KEYTABLE_TYPE_CCM		0x00000006	/* [5212+] */
   1827 #define AR5K_KEYTABLE_TYPE_NULL		0x00000007	/* [5211+] */
   1828 #define AR5K_KEYTABLE_ANTENNA		0x00000008	/* [5212+] */
   1829 #define AR5K_KEYTABLE_MAC0(_n)		AR5K_KEYTABLE_OFF(_n, 6)
   1830 #define AR5K_KEYTABLE_MAC1(_n)		AR5K_KEYTABLE_OFF(_n, 7)
   1831 #define AR5K_KEYTABLE_VALID		0x00008000
   1832 
   1833 /* If key type is TKIP and MIC is enabled
   1834  * MIC key goes in offset entry + 64 */
   1835 #define	AR5K_KEYTABLE_MIC_OFFSET	64
   1836 
   1837 /* WEP 40-bit	= 40-bit  entered key + 24 bit IV = 64-bit
   1838  * WEP 104-bit	= 104-bit entered key + 24-bit IV = 128-bit
   1839  * WEP 128-bit	= 128-bit entered key + 24 bit IV = 152-bit
   1840  *
   1841  * Some vendors have introduced bigger WEP keys to address
   1842  * security vulnerabilities in WEP. This includes:
   1843  *
   1844  * WEP 232-bit = 232-bit entered key + 24 bit IV = 256-bit
   1845  *
   1846  * We can expand this if we find ar5k Atheros cards with a larger
   1847  * key table size.
   1848  */
   1849 #define AR5K_KEYTABLE_SIZE_5210		64
   1850 #define AR5K_KEYTABLE_SIZE_5211		128
   1851 #define	AR5K_KEYTABLE_SIZE		(ah->ah_version == AR5K_AR5210 ? \
   1852 					AR5K_KEYTABLE_SIZE_5210 : AR5K_KEYTABLE_SIZE_5211)
   1853 
   1854 
   1855 /*===PHY REGISTERS===*/
   1856 
   1857 /*
   1858  * PHY registers start
   1859  */
   1860 #define	AR5K_PHY_BASE			0x9800
   1861 #define	AR5K_PHY(_n)			(AR5K_PHY_BASE + ((_n) << 2))
   1862 
   1863 /*
   1864  * TST_2 (Misc config parameters)
   1865  */
   1866 #define	AR5K_PHY_TST2			0x9800			/* Register Address */
   1867 #define AR5K_PHY_TST2_TRIG_SEL		0x00000007	/* Trigger select (?)*/
   1868 #define AR5K_PHY_TST2_TRIG		0x00000010	/* Trigger (?) */
   1869 #define AR5K_PHY_TST2_CBUS_MODE		0x00000060	/* Cardbus mode (?) */
   1870 #define AR5K_PHY_TST2_CLK32		0x00000400	/* CLK_OUT is CLK32 (32Khz external) */
   1871 #define AR5K_PHY_TST2_CHANCOR_DUMP_EN	0x00000800	/* Enable Chancor dump (?) */
   1872 #define AR5K_PHY_TST2_EVEN_CHANCOR_DUMP	0x00001000	/* Even Chancor dump (?) */
   1873 #define AR5K_PHY_TST2_RFSILENT_EN	0x00002000	/* Enable RFSILENT */
   1874 #define AR5K_PHY_TST2_ALT_RFDATA	0x00004000	/* Alternate RFDATA (5-2GHz switch ?) */
   1875 #define AR5K_PHY_TST2_MINI_OBS_EN	0x00008000	/* Enable mini OBS (?) */
   1876 #define AR5K_PHY_TST2_RX2_IS_RX5_INV	0x00010000	/* 2GHz rx path is the 5GHz path inverted (?) */
   1877 #define AR5K_PHY_TST2_SLOW_CLK160	0x00020000	/* Slow CLK160 (?) */
   1878 #define AR5K_PHY_TST2_AGC_OBS_SEL_3	0x00040000	/* AGC OBS Select 3 (?) */
   1879 #define AR5K_PHY_TST2_BBB_OBS_SEL	0x00080000	/* BB OBS Select (field ?) */
   1880 #define AR5K_PHY_TST2_ADC_OBS_SEL	0x00800000	/* ADC OBS Select (field ?) */
   1881 #define AR5K_PHY_TST2_RX_CLR_SEL	0x08000000	/* RX Clear Select (?) */
   1882 #define AR5K_PHY_TST2_FORCE_AGC_CLR	0x10000000	/* Force AGC clear (?) */
   1883 #define AR5K_PHY_SHIFT_2GHZ		0x00004007	/* Used to access 2GHz radios */
   1884 #define AR5K_PHY_SHIFT_5GHZ		0x00000007	/* Used to access 5GHz radios (default) */
   1885 
   1886 /*
   1887  * PHY frame control register [5110] /turbo mode register [5111+]
   1888  *
   1889  * There is another frame control register for [5111+]
   1890  * at address 0x9944 (see below) but the 2 first flags
   1891  * are common here between 5110 frame control register
   1892  * and [5111+] turbo mode register, so this also works as
   1893  * a "turbo mode register" for 5110. We treat this one as
   1894  * a frame control register for 5110 below.
   1895  */
   1896 #define	AR5K_PHY_TURBO			0x9804			/* Register Address */
   1897 #define	AR5K_PHY_TURBO_MODE		0x00000001	/* Enable turbo mode */
   1898 #define	AR5K_PHY_TURBO_SHORT		0x00000002	/* Set short symbols to turbo mode */
   1899 #define	AR5K_PHY_TURBO_MIMO		0x00000004	/* Set turbo for mimo mimo */
   1900 
   1901 /*
   1902  * PHY agility command register
   1903  * (aka TST_1)
   1904  */
   1905 #define	AR5K_PHY_AGC			0x9808			/* Register Address */
   1906 #define	AR5K_PHY_TST1			0x9808
   1907 #define	AR5K_PHY_AGC_DISABLE		0x08000000	/* Disable AGC to A2 (?)*/
   1908 #define	AR5K_PHY_TST1_TXHOLD		0x00003800	/* Set tx hold (?) */
   1909 #define	AR5K_PHY_TST1_TXSRC_SRC		0x00000002	/* Used with bit 7 (?) */
   1910 #define	AR5K_PHY_TST1_TXSRC_SRC_S	1
   1911 #define	AR5K_PHY_TST1_TXSRC_ALT		0x00000080	/* Set input to tsdac (?) */
   1912 #define	AR5K_PHY_TST1_TXSRC_ALT_S	7
   1913 
   1914 
   1915 /*
   1916  * PHY timing register 3 [5112+]
   1917  */
   1918 #define	AR5K_PHY_TIMING_3		0x9814
   1919 #define	AR5K_PHY_TIMING_3_DSC_MAN	0xfffe0000
   1920 #define	AR5K_PHY_TIMING_3_DSC_MAN_S	17
   1921 #define	AR5K_PHY_TIMING_3_DSC_EXP	0x0001e000
   1922 #define	AR5K_PHY_TIMING_3_DSC_EXP_S	13
   1923 
   1924 /*
   1925  * PHY chip revision register
   1926  */
   1927 #define	AR5K_PHY_CHIP_ID		0x9818
   1928 
   1929 /*
   1930  * PHY activation register
   1931  */
   1932 #define	AR5K_PHY_ACT			0x981c			/* Register Address */
   1933 #define	AR5K_PHY_ACT_ENABLE		0x00000001	/* Activate PHY */
   1934 #define	AR5K_PHY_ACT_DISABLE		0x00000002	/* Deactivate PHY */
   1935 
   1936 /*
   1937  * PHY RF control registers
   1938  */
   1939 #define AR5K_PHY_RF_CTL2		0x9824			/* Register Address */
   1940 #define	AR5K_PHY_RF_CTL2_TXF2TXD_START	0x0000000f	/* TX frame to TX data start */
   1941 #define	AR5K_PHY_RF_CTL2_TXF2TXD_START_S	0
   1942 
   1943 #define AR5K_PHY_RF_CTL3		0x9828			/* Register Address */
   1944 #define AR5K_PHY_RF_CTL3_TXE2XLNA_ON	0x0000ff00	/* TX end to XLNA on */
   1945 #define	AR5K_PHY_RF_CTL3_TXE2XLNA_ON_S	8
   1946 
   1947 #define	AR5K_PHY_ADC_CTL			0x982c
   1948 #define	AR5K_PHY_ADC_CTL_INBUFGAIN_OFF		0x00000003
   1949 #define	AR5K_PHY_ADC_CTL_INBUFGAIN_OFF_S	0
   1950 #define	AR5K_PHY_ADC_CTL_PWD_DAC_OFF		0x00002000
   1951 #define	AR5K_PHY_ADC_CTL_PWD_BAND_GAP_OFF	0x00004000
   1952 #define	AR5K_PHY_ADC_CTL_PWD_ADC_OFF		0x00008000
   1953 #define	AR5K_PHY_ADC_CTL_INBUFGAIN_ON		0x00030000
   1954 #define	AR5K_PHY_ADC_CTL_INBUFGAIN_ON_S		16
   1955 
   1956 #define AR5K_PHY_RF_CTL4		0x9834			/* Register Address */
   1957 #define AR5K_PHY_RF_CTL4_TXF2XPA_A_ON	0x00000001	/* TX frame to XPA A on (field) */
   1958 #define AR5K_PHY_RF_CTL4_TXF2XPA_B_ON	0x00000100	/* TX frame to XPA B on (field) */
   1959 #define	AR5K_PHY_RF_CTL4_TXE2XPA_A_OFF	0x00010000	/* TX end to XPA A off (field) */
   1960 #define AR5K_PHY_RF_CTL4_TXE2XPA_B_OFF	0x01000000	/* TX end to XPA B off (field) */
   1961 
   1962 /*
   1963  * Pre-Amplifier control register
   1964  * (XPA -> external pre-amplifier)
   1965  */
   1966 #define	AR5K_PHY_PA_CTL			0x9838			/* Register Address */
   1967 #define	AR5K_PHY_PA_CTL_XPA_A_HI	0x00000001	/* XPA A high (?) */
   1968 #define	AR5K_PHY_PA_CTL_XPA_B_HI	0x00000002	/* XPA B high (?) */
   1969 #define	AR5K_PHY_PA_CTL_XPA_A_EN	0x00000004	/* Enable XPA A */
   1970 #define	AR5K_PHY_PA_CTL_XPA_B_EN	0x00000008	/* Enable XPA B */
   1971 
   1972 /*
   1973  * PHY settling register
   1974  */
   1975 #define AR5K_PHY_SETTLING		0x9844			/* Register Address */
   1976 #define	AR5K_PHY_SETTLING_AGC		0x0000007f	/* AGC settling time */
   1977 #define	AR5K_PHY_SETTLING_AGC_S		0
   1978 #define	AR5K_PHY_SETTLING_SWITCH	0x00003f80	/* Switch settlig time */
   1979 #define	AR5K_PHY_SETTLING_SWITCH_S	7
   1980 
   1981 /*
   1982  * PHY Gain registers
   1983  */
   1984 #define AR5K_PHY_GAIN			0x9848			/* Register Address */
   1985 #define	AR5K_PHY_GAIN_TXRX_ATTEN	0x0003f000	/* TX-RX Attenuation */
   1986 #define	AR5K_PHY_GAIN_TXRX_ATTEN_S	12
   1987 #define	AR5K_PHY_GAIN_TXRX_RF_MAX	0x007c0000
   1988 #define	AR5K_PHY_GAIN_TXRX_RF_MAX_S	18
   1989 
   1990 #define	AR5K_PHY_GAIN_OFFSET		0x984c			/* Register Address */
   1991 #define	AR5K_PHY_GAIN_OFFSET_RXTX_FLAG	0x00020000	/* RX-TX flag (?) */
   1992 
   1993 /*
   1994  * Desired ADC/PGA size register
   1995  * (for more infos read ANI patent)
   1996  */
   1997 #define AR5K_PHY_DESIRED_SIZE		0x9850			/* Register Address */
   1998 #define	AR5K_PHY_DESIRED_SIZE_ADC	0x000000ff	/* ADC desired size */
   1999 #define	AR5K_PHY_DESIRED_SIZE_ADC_S	0
   2000 #define	AR5K_PHY_DESIRED_SIZE_PGA	0x0000ff00	/* PGA desired size */
   2001 #define	AR5K_PHY_DESIRED_SIZE_PGA_S	8
   2002 #define	AR5K_PHY_DESIRED_SIZE_TOT	0x0ff00000	/* Total desired size */
   2003 #define	AR5K_PHY_DESIRED_SIZE_TOT_S	20
   2004 
   2005 /*
   2006  * PHY signal register
   2007  * (for more infos read ANI patent)
   2008  */
   2009 #define	AR5K_PHY_SIG			0x9858			/* Register Address */
   2010 #define	AR5K_PHY_SIG_FIRSTEP		0x0003f000	/* FIRSTEP */
   2011 #define	AR5K_PHY_SIG_FIRSTEP_S		12
   2012 #define	AR5K_PHY_SIG_FIRPWR		0x03fc0000	/* FIPWR */
   2013 #define	AR5K_PHY_SIG_FIRPWR_S		18
   2014 
   2015 /*
   2016  * PHY coarse agility control register
   2017  * (for more infos read ANI patent)
   2018  */
   2019 #define	AR5K_PHY_AGCCOARSE		0x985c			/* Register Address */
   2020 #define	AR5K_PHY_AGCCOARSE_LO		0x00007f80	/* AGC Coarse low */
   2021 #define	AR5K_PHY_AGCCOARSE_LO_S		7
   2022 #define	AR5K_PHY_AGCCOARSE_HI		0x003f8000	/* AGC Coarse high */
   2023 #define	AR5K_PHY_AGCCOARSE_HI_S		15
   2024 
   2025 /*
   2026  * PHY agility control register
   2027  */
   2028 #define	AR5K_PHY_AGCCTL			0x9860			/* Register address */
   2029 #define	AR5K_PHY_AGCCTL_CAL		0x00000001	/* Enable PHY calibration */
   2030 #define	AR5K_PHY_AGCCTL_NF		0x00000002	/* Enable Noise Floor calibration */
   2031 #define	AR5K_PHY_AGCCTL_NF_EN		0x00008000	/* Enable nf calibration to happen (?) */
   2032 #define	AR5K_PHY_AGCCTL_NF_NOUPDATE	0x00020000	/* Don't update nf automaticaly */
   2033 
   2034 /*
   2035  * PHY noise floor status register
   2036  */
   2037 #define AR5K_PHY_NF			0x9864			/* Register address */
   2038 #define AR5K_PHY_NF_M			0x000001ff	/* Noise floor mask */
   2039 #define AR5K_PHY_NF_ACTIVE		0x00000100	/* Noise floor calibration still active */
   2040 #define AR5K_PHY_NF_RVAL(_n)		(((_n) >> 19) & AR5K_PHY_NF_M)
   2041 #define AR5K_PHY_NF_AVAL(_n)		(-((_n) ^ AR5K_PHY_NF_M) + 1)
   2042 #define AR5K_PHY_NF_SVAL(_n)		(((_n) & AR5K_PHY_NF_M) | (1 << 9))
   2043 #define	AR5K_PHY_NF_THRESH62		0x0007f000	/* Thresh62 -check ANI patent- (field) */
   2044 #define	AR5K_PHY_NF_THRESH62_S		12
   2045 #define	AR5K_PHY_NF_MINCCA_PWR		0x0ff80000	/* ??? */
   2046 #define	AR5K_PHY_NF_MINCCA_PWR_S	19
   2047 
   2048 /*
   2049  * PHY ADC saturation register [5110]
   2050  */
   2051 #define	AR5K_PHY_ADCSAT			0x9868
   2052 #define	AR5K_PHY_ADCSAT_ICNT		0x0001f800
   2053 #define	AR5K_PHY_ADCSAT_ICNT_S		11
   2054 #define	AR5K_PHY_ADCSAT_THR		0x000007e0
   2055 #define	AR5K_PHY_ADCSAT_THR_S		5
   2056 
   2057 /*
   2058  * PHY Weak ofdm signal detection threshold registers (ANI) [5212+]
   2059  */
   2060 
   2061 /* High thresholds */
   2062 #define AR5K_PHY_WEAK_OFDM_HIGH_THR		0x9868
   2063 #define AR5K_PHY_WEAK_OFDM_HIGH_THR_M2_COUNT	0x0000001f
   2064 #define AR5K_PHY_WEAK_OFDM_HIGH_THR_M2_COUNT_S	0
   2065 #define AR5K_PHY_WEAK_OFDM_HIGH_THR_M1		0x00fe0000
   2066 #define AR5K_PHY_WEAK_OFDM_HIGH_THR_M1_S	17
   2067 #define AR5K_PHY_WEAK_OFDM_HIGH_THR_M2		0x7f000000
   2068 #define AR5K_PHY_WEAK_OFDM_HIGH_THR_M2_S	24
   2069 
   2070 /* Low thresholds */
   2071 #define AR5K_PHY_WEAK_OFDM_LOW_THR 		0x986c
   2072 #define AR5K_PHY_WEAK_OFDM_LOW_THR_SELFCOR_EN	0x00000001
   2073 #define AR5K_PHY_WEAK_OFDM_LOW_THR_M2_COUNT	0x00003f00
   2074 #define AR5K_PHY_WEAK_OFDM_LOW_THR_M2_COUNT_S	8
   2075 #define AR5K_PHY_WEAK_OFDM_LOW_THR_M1		0x001fc000
   2076 #define AR5K_PHY_WEAK_OFDM_LOW_THR_M1_S		14
   2077 #define AR5K_PHY_WEAK_OFDM_LOW_THR_M2		0x0fe00000
   2078 #define AR5K_PHY_WEAK_OFDM_LOW_THR_M2_S		21
   2079 
   2080 
   2081 /*
   2082  * PHY sleep registers [5112+]
   2083  */
   2084 #define AR5K_PHY_SCR			0x9870
   2085 
   2086 #define AR5K_PHY_SLMT			0x9874
   2087 #define AR5K_PHY_SLMT_32MHZ		0x0000007f
   2088 
   2089 #define AR5K_PHY_SCAL			0x9878
   2090 #define AR5K_PHY_SCAL_32MHZ		0x0000000e
   2091 #define	AR5K_PHY_SCAL_32MHZ_2417	0x0000000a
   2092 #define	AR5K_PHY_SCAL_32MHZ_HB63	0x00000032
   2093 
   2094 /*
   2095  * PHY PLL (Phase Locked Loop) control register
   2096  */
   2097 #define	AR5K_PHY_PLL			0x987c
   2098 #define	AR5K_PHY_PLL_20MHZ		0x00000013	/* For half rate (?) */
   2099 /* 40MHz -> 5GHz band */
   2100 #define	AR5K_PHY_PLL_40MHZ_5211		0x00000018
   2101 #define	AR5K_PHY_PLL_40MHZ_5212		0x000000aa
   2102 #define	AR5K_PHY_PLL_40MHZ_5413		0x00000004
   2103 #define	AR5K_PHY_PLL_40MHZ		(ah->ah_version == AR5K_AR5211 ? \
   2104 					AR5K_PHY_PLL_40MHZ_5211 : AR5K_PHY_PLL_40MHZ_5212)
   2105 /* 44MHz -> 2.4GHz band */
   2106 #define	AR5K_PHY_PLL_44MHZ_5211		0x00000019
   2107 #define	AR5K_PHY_PLL_44MHZ_5212		0x000000ab
   2108 #define	AR5K_PHY_PLL_44MHZ		(ah->ah_version == AR5K_AR5211 ? \
   2109 					AR5K_PHY_PLL_44MHZ_5211 : AR5K_PHY_PLL_44MHZ_5212)
   2110 
   2111 #define AR5K_PHY_PLL_RF5111		0x00000000
   2112 #define AR5K_PHY_PLL_RF5112		0x00000040
   2113 #define	AR5K_PHY_PLL_HALF_RATE		0x00000100
   2114 #define	AR5K_PHY_PLL_QUARTER_RATE	0x00000200
   2115 
   2116 /*
   2117  * RF Buffer register
   2118  *
   2119  * It's obvious from the code that 0x989c is the buffer register but
   2120  * for the other special registers that we write to after sending each
   2121  * packet, i have no idea. So i'll name them BUFFER_CONTROL_X registers
   2122  * for now. It's interesting that they are also used for some other operations.
   2123  */
   2124 
   2125 #define AR5K_RF_BUFFER			0x989c
   2126 #define AR5K_RF_BUFFER_CONTROL_0	0x98c0	/* Channel on 5110 */
   2127 #define AR5K_RF_BUFFER_CONTROL_1	0x98c4	/* Bank 7 on 5112 */
   2128 #define AR5K_RF_BUFFER_CONTROL_2	0x98cc	/* Bank 7 on 5111 */
   2129 
   2130 #define AR5K_RF_BUFFER_CONTROL_3	0x98d0	/* Bank 2 on 5112 */
   2131 						/* Channel set on 5111 */
   2132 						/* Used to read radio revision*/
   2133 
   2134 #define AR5K_RF_BUFFER_CONTROL_4	0x98d4  /* RF Stage register on 5110 */
   2135 						/* Bank 0,1,2,6 on 5111 */
   2136 						/* Bank 1 on 5112 */
   2137 						/* Used during activation on 5111 */
   2138 
   2139 #define AR5K_RF_BUFFER_CONTROL_5	0x98d8	/* Bank 3 on 5111 */
   2140 						/* Used during activation on 5111 */
   2141 						/* Channel on 5112 */
   2142 						/* Bank 6 on 5112 */
   2143 
   2144 #define AR5K_RF_BUFFER_CONTROL_6	0x98dc	/* Bank 3 on 5112 */
   2145 
   2146 /*
   2147  * PHY RF stage register [5210]
   2148  */
   2149 #define AR5K_PHY_RFSTG			0x98d4
   2150 #define AR5K_PHY_RFSTG_DISABLE		0x00000021
   2151 
   2152 /*
   2153  * BIN masks (?)
   2154  */
   2155 #define	AR5K_PHY_BIN_MASK_1	0x9900
   2156 #define	AR5K_PHY_BIN_MASK_2	0x9904
   2157 #define	AR5K_PHY_BIN_MASK_3	0x9908
   2158 
   2159 #define	AR5K_PHY_BIN_MASK_CTL		0x990c
   2160 #define	AR5K_PHY_BIN_MASK_CTL_MASK_4	0x00003fff
   2161 #define	AR5K_PHY_BIN_MASK_CTL_MASK_4_S	0
   2162 #define	AR5K_PHY_BIN_MASK_CTL_RATE	0xff000000
   2163 #define	AR5K_PHY_BIN_MASK_CTL_RATE_S	24
   2164 
   2165 /*
   2166  * PHY Antenna control register
   2167  */
   2168 #define AR5K_PHY_ANT_CTL		0x9910			/* Register Address */
   2169 #define	AR5K_PHY_ANT_CTL_TXRX_EN	0x00000001	/* Enable TX/RX (?) */
   2170 #define	AR5K_PHY_ANT_CTL_SECTORED_ANT	0x00000004	/* Sectored Antenna */
   2171 #define	AR5K_PHY_ANT_CTL_HITUNE5	0x00000008	/* Hitune5 (?) */
   2172 #define	AR5K_PHY_ANT_CTL_SWTABLE_IDLE	0x000003f0	/* Switch table idle (?) */
   2173 #define	AR5K_PHY_ANT_CTL_SWTABLE_IDLE_S	4
   2174 
   2175 /*
   2176  * PHY receiver delay register [5111+]
   2177  */
   2178 #define	AR5K_PHY_RX_DELAY		0x9914			/* Register Address */
   2179 #define	AR5K_PHY_RX_DELAY_M		0x00003fff	/* Mask for RX activate to receive delay (/100ns) */
   2180 
   2181 /*
   2182  * PHY max rx length register (?) [5111]
   2183  */
   2184 #define	AR5K_PHY_MAX_RX_LEN		0x991c
   2185 
   2186 /*
   2187  * PHY timing register 4
   2188  * I(nphase)/Q(adrature) calibration register [5111+]
   2189  */
   2190 #define	AR5K_PHY_IQ			0x9920			/* Register Address */
   2191 #define	AR5K_PHY_IQ_CORR_Q_Q_COFF	0x0000001f	/* Mask for q correction info */
   2192 #define	AR5K_PHY_IQ_CORR_Q_I_COFF	0x000007e0	/* Mask for i correction info */
   2193 #define	AR5K_PHY_IQ_CORR_Q_I_COFF_S	5
   2194 #define	AR5K_PHY_IQ_CORR_ENABLE		0x00000800	/* Enable i/q correction */
   2195 #define	AR5K_PHY_IQ_CAL_NUM_LOG_MAX	0x0000f000	/* Mask for max number of samples in log scale */
   2196 #define	AR5K_PHY_IQ_CAL_NUM_LOG_MAX_S	12
   2197 #define	AR5K_PHY_IQ_RUN			0x00010000	/* Run i/q calibration */
   2198 #define	AR5K_PHY_IQ_USE_PT_DF		0x00020000	/* Use pilot track df (?) */
   2199 #define	AR5K_PHY_IQ_EARLY_TRIG_THR	0x00200000	/* Early trigger threshold (?) (field) */
   2200 #define	AR5K_PHY_IQ_PILOT_MASK_EN	0x10000000	/* Enable pilot mask (?) */
   2201 #define	AR5K_PHY_IQ_CHAN_MASK_EN	0x20000000	/* Enable channel mask (?) */
   2202 #define	AR5K_PHY_IQ_SPUR_FILT_EN	0x40000000	/* Enable spur filter */
   2203 #define	AR5K_PHY_IQ_SPUR_RSSI_EN	0x80000000	/* Enable spur rssi */
   2204 
   2205 /*
   2206  * PHY timing register 5
   2207  * OFDM Self-correlator Cyclic RSSI threshold params
   2208  * (Check out bb_cycpwr_thr1 on ANI patent)
   2209  */
   2210 #define	AR5K_PHY_OFDM_SELFCORR			0x9924			/* Register Address */
   2211 #define	AR5K_PHY_OFDM_SELFCORR_CYPWR_THR1_EN	0x00000001	/* Enable cyclic RSSI thr 1 */
   2212 #define	AR5K_PHY_OFDM_SELFCORR_CYPWR_THR1	0x000000fe	/* Mask for Cyclic RSSI threshold 1 */
   2213 #define	AR5K_PHY_OFDM_SELFCORR_CYPWR_THR1_S	1
   2214 #define	AR5K_PHY_OFDM_SELFCORR_CYPWR_THR3	0x00000100	/* Cyclic RSSI threshold 3 (field) (?) */
   2215 #define	AR5K_PHY_OFDM_SELFCORR_RSSI_1ATHR_EN	0x00008000	/* Enable 1A RSSI threshold (?) */
   2216 #define	AR5K_PHY_OFDM_SELFCORR_RSSI_1ATHR	0x00010000	/* 1A RSSI threshold (field) (?) */
   2217 #define	AR5K_PHY_OFDM_SELFCORR_LSCTHR_HIRSSI	0x00800000	/* Long sc threshold hi rssi (?) */
   2218 
   2219 /*
   2220  * PHY-only warm reset register
   2221  */
   2222 #define	AR5K_PHY_WARM_RESET		0x9928
   2223 
   2224 /*
   2225  * PHY-only control register
   2226  */
   2227 #define AR5K_PHY_CTL			0x992c			/* Register Address */
   2228 #define	AR5K_PHY_CTL_RX_DRAIN_RATE	0x00000001	/* RX drain rate (?) */
   2229 #define	AR5K_PHY_CTL_LATE_TX_SIG_SYM	0x00000002	/* Late tx signal symbol (?) */
   2230 #define	AR5K_PHY_CTL_GEN_SCRAMBLER	0x00000004	/* Generate scrambler */
   2231 #define	AR5K_PHY_CTL_TX_ANT_SEL		0x00000008	/* TX antenna select */
   2232 #define	AR5K_PHY_CTL_TX_ANT_STATIC	0x00000010	/* Static TX antenna */
   2233 #define	AR5K_PHY_CTL_RX_ANT_SEL		0x00000020	/* RX antenna select */
   2234 #define	AR5K_PHY_CTL_RX_ANT_STATIC	0x00000040	/* Static RX antenna */
   2235 #define	AR5K_PHY_CTL_LOW_FREQ_SLE_EN	0x00000080	/* Enable low freq sleep */
   2236 
   2237 /*
   2238  * PHY PAPD probe register [5111+]
   2239  */
   2240 #define	AR5K_PHY_PAPD_PROBE		0x9930
   2241 #define	AR5K_PHY_PAPD_PROBE_SH_HI_PAR	0x00000001
   2242 #define	AR5K_PHY_PAPD_PROBE_PCDAC_BIAS	0x00000002
   2243 #define	AR5K_PHY_PAPD_PROBE_COMP_GAIN	0x00000040
   2244 #define	AR5K_PHY_PAPD_PROBE_TXPOWER	0x00007e00
   2245 #define	AR5K_PHY_PAPD_PROBE_TXPOWER_S	9
   2246 #define	AR5K_PHY_PAPD_PROBE_TX_NEXT	0x00008000
   2247 #define	AR5K_PHY_PAPD_PROBE_PREDIST_EN	0x00010000
   2248 #define	AR5K_PHY_PAPD_PROBE_TYPE	0x01800000	/* [5112+] */
   2249 #define	AR5K_PHY_PAPD_PROBE_TYPE_S	23
   2250 #define	AR5K_PHY_PAPD_PROBE_TYPE_OFDM	0
   2251 #define	AR5K_PHY_PAPD_PROBE_TYPE_XR	1
   2252 #define	AR5K_PHY_PAPD_PROBE_TYPE_CCK	2
   2253 #define	AR5K_PHY_PAPD_PROBE_GAINF	0xfe000000
   2254 #define	AR5K_PHY_PAPD_PROBE_GAINF_S	25
   2255 #define	AR5K_PHY_PAPD_PROBE_INI_5111	0x00004883	/* [5212+] */
   2256 #define	AR5K_PHY_PAPD_PROBE_INI_5112	0x00004882	/* [5212+] */
   2257 
   2258 /*
   2259  * PHY TX rate power registers [5112+]
   2260  */
   2261 #define	AR5K_PHY_TXPOWER_RATE1			0x9934
   2262 #define	AR5K_PHY_TXPOWER_RATE2			0x9938
   2263 #define	AR5K_PHY_TXPOWER_RATE_MAX		0x993c
   2264 #define	AR5K_PHY_TXPOWER_RATE_MAX_TPC_ENABLE	0x00000040
   2265 #define	AR5K_PHY_TXPOWER_RATE3			0xa234
   2266 #define	AR5K_PHY_TXPOWER_RATE4			0xa238
   2267 
   2268 /*
   2269  * PHY frame control register [5111+]
   2270  */
   2271 #define	AR5K_PHY_FRAME_CTL_5210		0x9804
   2272 #define	AR5K_PHY_FRAME_CTL_5211		0x9944
   2273 #define	AR5K_PHY_FRAME_CTL		(ah->ah_version == AR5K_AR5210 ? \
   2274 					AR5K_PHY_FRAME_CTL_5210 : AR5K_PHY_FRAME_CTL_5211)
   2275 /*---[5111+]---*/
   2276 #define	AR5K_PHY_FRAME_CTL_TX_CLIP	0x00000038	/* Mask for tx clip (?) */
   2277 #define	AR5K_PHY_FRAME_CTL_TX_CLIP_S	3
   2278 #define	AR5K_PHY_FRAME_CTL_PREP_CHINFO	0x00010000	/* Prepend chan info */
   2279 #define	AR5K_PHY_FRAME_CTL_EMU		0x80000000
   2280 #define	AR5K_PHY_FRAME_CTL_EMU_S	31
   2281 /*---[5110/5111]---*/
   2282 #define	AR5K_PHY_FRAME_CTL_TIMING_ERR	0x01000000	/* PHY timing error */
   2283 #define	AR5K_PHY_FRAME_CTL_PARITY_ERR	0x02000000	/* Parity error */
   2284 #define	AR5K_PHY_FRAME_CTL_ILLRATE_ERR	0x04000000	/* Illegal rate */
   2285 #define	AR5K_PHY_FRAME_CTL_ILLLEN_ERR	0x08000000	/* Illegal length */
   2286 #define	AR5K_PHY_FRAME_CTL_SERVICE_ERR	0x20000000
   2287 #define	AR5K_PHY_FRAME_CTL_TXURN_ERR	0x40000000	/* TX underrun */
   2288 #define AR5K_PHY_FRAME_CTL_INI		AR5K_PHY_FRAME_CTL_SERVICE_ERR | \
   2289 			AR5K_PHY_FRAME_CTL_TXURN_ERR | \
   2290 			AR5K_PHY_FRAME_CTL_ILLLEN_ERR | \
   2291 			AR5K_PHY_FRAME_CTL_ILLRATE_ERR | \
   2292 			AR5K_PHY_FRAME_CTL_PARITY_ERR | \
   2293 			AR5K_PHY_FRAME_CTL_TIMING_ERR
   2294 
   2295 /*
   2296  * PHY Tx Power adjustment register [5212A+]
   2297  */
   2298 #define	AR5K_PHY_TX_PWR_ADJ			0x994c
   2299 #define	AR5K_PHY_TX_PWR_ADJ_CCK_GAIN_DELTA	0x00000fc0
   2300 #define	AR5K_PHY_TX_PWR_ADJ_CCK_GAIN_DELTA_S	6
   2301 #define	AR5K_PHY_TX_PWR_ADJ_CCK_PCDAC_INDEX	0x00fc0000
   2302 #define	AR5K_PHY_TX_PWR_ADJ_CCK_PCDAC_INDEX_S	18
   2303 
   2304 /*
   2305  * PHY radar detection register [5111+]
   2306  */
   2307 #define	AR5K_PHY_RADAR			0x9954
   2308 #define	AR5K_PHY_RADAR_ENABLE		0x00000001
   2309 #define	AR5K_PHY_RADAR_DISABLE		0x00000000
   2310 #define AR5K_PHY_RADAR_INBANDTHR    	0x0000003e	/* Inband threshold
   2311 							5-bits, units unknown {0..31}
   2312 							(? MHz ?) */
   2313 #define AR5K_PHY_RADAR_INBANDTHR_S	1
   2314 
   2315 #define AR5K_PHY_RADAR_PRSSI_THR    	0x00000fc0	/* Pulse RSSI/SNR threshold
   2316 							6-bits, dBm range {0..63}
   2317 							in dBm units. */
   2318 #define AR5K_PHY_RADAR_PRSSI_THR_S	6
   2319 
   2320 #define AR5K_PHY_RADAR_PHEIGHT_THR   	0x0003f000	/* Pulse height threshold
   2321 							6-bits, dBm range {0..63}
   2322 							in dBm units. */
   2323 #define AR5K_PHY_RADAR_PHEIGHT_THR_S	12
   2324 
   2325 #define AR5K_PHY_RADAR_RSSI_THR    	0x00fc0000	/* Radar RSSI/SNR threshold.
   2326 							6-bits, dBm range {0..63}
   2327 							in dBm units. */
   2328 #define AR5K_PHY_RADAR_RSSI_THR_S	18
   2329 
   2330 #define AR5K_PHY_RADAR_FIRPWR_THR	0x7f000000	/* Finite Impulse Response
   2331 							filter power out threshold.
   2332 							7-bits, standard power range
   2333 							{0..127} in 1/2 dBm units. */
   2334 #define AR5K_PHY_RADAR_FIRPWR_THRS	24
   2335 
   2336 /*
   2337  * PHY antenna switch table registers
   2338  */
   2339 #define AR5K_PHY_ANT_SWITCH_TABLE_0	0x9960
   2340 #define AR5K_PHY_ANT_SWITCH_TABLE_1	0x9964
   2341 
   2342 /*
   2343  * PHY Noise floor threshold
   2344  */
   2345 #define AR5K_PHY_NFTHRES		0x9968
   2346 
   2347 /*
   2348  * Sigma Delta register (?) [5213]
   2349  */
   2350 #define AR5K_PHY_SIGMA_DELTA		0x996C
   2351 #define AR5K_PHY_SIGMA_DELTA_ADC_SEL	0x00000003
   2352 #define AR5K_PHY_SIGMA_DELTA_ADC_SEL_S	0
   2353 #define AR5K_PHY_SIGMA_DELTA_FILT2	0x000000f8
   2354 #define AR5K_PHY_SIGMA_DELTA_FILT2_S	3
   2355 #define AR5K_PHY_SIGMA_DELTA_FILT1	0x00001f00
   2356 #define AR5K_PHY_SIGMA_DELTA_FILT1_S	8
   2357 #define AR5K_PHY_SIGMA_DELTA_ADC_CLIP	0x01ffe000
   2358 #define AR5K_PHY_SIGMA_DELTA_ADC_CLIP_S	13
   2359 
   2360 /*
   2361  * RF restart register [5112+] (?)
   2362  */
   2363 #define AR5K_PHY_RESTART		0x9970		/* restart */
   2364 #define AR5K_PHY_RESTART_DIV_GC		0x001c0000	/* Fast diversity gc_limit (?) */
   2365 #define AR5K_PHY_RESTART_DIV_GC_S	18
   2366 
   2367 /*
   2368  * RF Bus access request register (for synth-oly channel switching)
   2369  */
   2370 #define AR5K_PHY_RFBUS_REQ		0x997C
   2371 #define AR5K_PHY_RFBUS_REQ_REQUEST	0x00000001
   2372 
   2373 /*
   2374  * Spur mitigation masks (?)
   2375  */
   2376 #define AR5K_PHY_TIMING_7		0x9980
   2377 #define AR5K_PHY_TIMING_8		0x9984
   2378 #define AR5K_PHY_TIMING_8_PILOT_MASK_2		0x000fffff
   2379 #define AR5K_PHY_TIMING_8_PILOT_MASK_2_S	0
   2380 
   2381 #define AR5K_PHY_BIN_MASK2_1		0x9988
   2382 #define AR5K_PHY_BIN_MASK2_2		0x998c
   2383 #define AR5K_PHY_BIN_MASK2_3		0x9990
   2384 
   2385 #define AR5K_PHY_BIN_MASK2_4		0x9994
   2386 #define AR5K_PHY_BIN_MASK2_4_MASK_4	0x00003fff
   2387 #define AR5K_PHY_BIN_MASK2_4_MASK_4_S	0
   2388 
   2389 #define AR5K_PHY_TIMING_9			0x9998
   2390 #define AR5K_PHY_TIMING_10			0x999c
   2391 #define AR5K_PHY_TIMING_10_PILOT_MASK_2		0x000fffff
   2392 #define AR5K_PHY_TIMING_10_PILOT_MASK_2_S	0
   2393 
   2394 /*
   2395  * Spur mitigation control
   2396  */
   2397 #define AR5K_PHY_TIMING_11			0x99a0		/* Register address */
   2398 #define AR5K_PHY_TIMING_11_SPUR_DELTA_PHASE	0x000fffff	/* Spur delta phase */
   2399 #define AR5K_PHY_TIMING_11_SPUR_DELTA_PHASE_S	0
   2400 #define AR5K_PHY_TIMING_11_SPUR_FREQ_SD		0x3ff00000	/* Freq sigma delta */
   2401 #define AR5K_PHY_TIMING_11_SPUR_FREQ_SD_S	20
   2402 #define AR5K_PHY_TIMING_11_USE_SPUR_IN_AGC	0x40000000	/* Spur filter in AGC detector */
   2403 #define AR5K_PHY_TIMING_11_USE_SPUR_IN_SELFCOR	0x80000000	/* Spur filter in OFDM self correlator */
   2404 
   2405 /*
   2406  * Gain tables
   2407  */
   2408 #define	AR5K_BB_GAIN_BASE		0x9b00	/* BaseBand Amplifier Gain table base address */
   2409 #define AR5K_BB_GAIN(_n)		(AR5K_BB_GAIN_BASE + ((_n) << 2))
   2410 #define	AR5K_RF_GAIN_BASE		0x9a00	/* RF Amplrifier Gain table base address */
   2411 #define AR5K_RF_GAIN(_n)		(AR5K_RF_GAIN_BASE + ((_n) << 2))
   2412 
   2413 /*
   2414  * PHY timing IQ calibration result register [5111+]
   2415  */
   2416 #define	AR5K_PHY_IQRES_CAL_PWR_I	0x9c10	/* I (Inphase) power value */
   2417 #define	AR5K_PHY_IQRES_CAL_PWR_Q	0x9c14	/* Q (Quadrature) power value */
   2418 #define	AR5K_PHY_IQRES_CAL_CORR		0x9c18	/* I/Q Correlation */
   2419 
   2420 /*
   2421  * PHY current RSSI register [5111+]
   2422  */
   2423 #define	AR5K_PHY_CURRENT_RSSI	0x9c1c
   2424 
   2425 /*
   2426  * PHY RF Bus grant register
   2427  */
   2428 #define	AR5K_PHY_RFBUS_GRANT	0x9c20
   2429 #define	AR5K_PHY_RFBUS_GRANT_OK	0x00000001
   2430 
   2431 /*
   2432  * PHY ADC test register
   2433  */
   2434 #define	AR5K_PHY_ADC_TEST	0x9c24
   2435 #define	AR5K_PHY_ADC_TEST_I	0x00000001
   2436 #define	AR5K_PHY_ADC_TEST_Q	0x00000200
   2437 
   2438 /*
   2439  * PHY DAC test register
   2440  */
   2441 #define	AR5K_PHY_DAC_TEST	0x9c28
   2442 #define	AR5K_PHY_DAC_TEST_I	0x00000001
   2443 #define	AR5K_PHY_DAC_TEST_Q	0x00000200
   2444 
   2445 /*
   2446  * PHY PTAT register (?)
   2447  */
   2448 #define	AR5K_PHY_PTAT		0x9c2c
   2449 
   2450 /*
   2451  * PHY Illegal TX rate register [5112+]
   2452  */
   2453 #define	AR5K_PHY_BAD_TX_RATE	0x9c30
   2454 
   2455 /*
   2456  * PHY SPUR Power register [5112+]
   2457  */
   2458 #define	AR5K_PHY_SPUR_PWR	0x9c34			/* Register Address */
   2459 #define	AR5K_PHY_SPUR_PWR_I	0x00000001	/* SPUR Power estimate for I (field) */
   2460 #define	AR5K_PHY_SPUR_PWR_Q	0x00000100	/* SPUR Power estimate for Q (field) */
   2461 #define	AR5K_PHY_SPUR_PWR_FILT	0x00010000	/* Power with SPUR removed (field) */
   2462 
   2463 /*
   2464  * PHY Channel status register [5112+] (?)
   2465  */
   2466 #define	AR5K_PHY_CHAN_STATUS		0x9c38
   2467 #define	AR5K_PHY_CHAN_STATUS_BT_ACT	0x00000001
   2468 #define	AR5K_PHY_CHAN_STATUS_RX_CLR_RAW	0x00000002
   2469 #define	AR5K_PHY_CHAN_STATUS_RX_CLR_MAC	0x00000004
   2470 #define	AR5K_PHY_CHAN_STATUS_RX_CLR_PAP	0x00000008
   2471 
   2472 /*
   2473  * Heavy clip enable register
   2474  */
   2475 #define	AR5K_PHY_HEAVY_CLIP_ENABLE	0x99e0
   2476 
   2477 /*
   2478  * PHY clock sleep registers [5112+]
   2479  */
   2480 #define AR5K_PHY_SCLOCK			0x99f0
   2481 #define AR5K_PHY_SCLOCK_32MHZ		0x0000000c
   2482 #define AR5K_PHY_SDELAY			0x99f4
   2483 #define AR5K_PHY_SDELAY_32MHZ		0x000000ff
   2484 #define AR5K_PHY_SPENDING		0x99f8
   2485 
   2486 
   2487 /*
   2488  * PHY PAPD I (power?) table (?)
   2489  * (92! entries)
   2490  */
   2491 #define	AR5K_PHY_PAPD_I_BASE	0xa000
   2492 #define	AR5K_PHY_PAPD_I(_n)	(AR5K_PHY_PAPD_I_BASE + ((_n) << 2))
   2493 
   2494 /*
   2495  * PHY PCDAC TX power table
   2496  */
   2497 #define	AR5K_PHY_PCDAC_TXPOWER_BASE	0xa180
   2498 #define	AR5K_PHY_PCDAC_TXPOWER(_n)	(AR5K_PHY_PCDAC_TXPOWER_BASE + ((_n) << 2))
   2499 
   2500 /*
   2501  * PHY mode register [5111+]
   2502  */
   2503 #define	AR5K_PHY_MODE			0x0a200			/* Register Address */
   2504 #define	AR5K_PHY_MODE_MOD		0x00000001	/* PHY Modulation bit */
   2505 #define AR5K_PHY_MODE_MOD_OFDM		0
   2506 #define AR5K_PHY_MODE_MOD_CCK		1
   2507 #define AR5K_PHY_MODE_FREQ		0x00000002	/* Freq mode bit */
   2508 #define	AR5K_PHY_MODE_FREQ_5GHZ		0
   2509 #define	AR5K_PHY_MODE_FREQ_2GHZ		2
   2510 #define AR5K_PHY_MODE_MOD_DYN		0x00000004	/* Enable Dynamic OFDM/CCK mode [5112+] */
   2511 #define AR5K_PHY_MODE_RAD		0x00000008	/* [5212+] */
   2512 #define AR5K_PHY_MODE_RAD_RF5111	0
   2513 #define AR5K_PHY_MODE_RAD_RF5112	8
   2514 #define AR5K_PHY_MODE_XR		0x00000010	/* Enable XR mode [5112+] */
   2515 #define	AR5K_PHY_MODE_HALF_RATE		0x00000020	/* Enable Half rate (test) */
   2516 #define	AR5K_PHY_MODE_QUARTER_RATE	0x00000040	/* Enable Quarter rat (test) */
   2517 
   2518 /*
   2519  * PHY CCK transmit control register [5111+ (?)]
   2520  */
   2521 #define AR5K_PHY_CCKTXCTL		0xa204
   2522 #define AR5K_PHY_CCKTXCTL_WORLD		0x00000000
   2523 #define AR5K_PHY_CCKTXCTL_JAPAN		0x00000010
   2524 #define	AR5K_PHY_CCKTXCTL_SCRAMBLER_DIS	0x00000001
   2525 #define	AR5K_PHY_CCKTXCTK_DAC_SCALE	0x00000004
   2526 
   2527 /*
   2528  * PHY CCK Cross-correlator Barker RSSI threshold register [5212+]
   2529  */
   2530 #define AR5K_PHY_CCK_CROSSCORR			0xa208
   2531 #define AR5K_PHY_CCK_CROSSCORR_WEAK_SIG_THR	0x0000000f
   2532 #define AR5K_PHY_CCK_CROSSCORR_WEAK_SIG_THR_S	0
   2533 
   2534 /* Same address is used for antenna diversity activation */
   2535 #define	AR5K_PHY_FAST_ANT_DIV		0xa208
   2536 #define	AR5K_PHY_FAST_ANT_DIV_EN	0x00002000
   2537 
   2538 /*
   2539  * PHY 2GHz gain register [5111+]
   2540  */
   2541 #define	AR5K_PHY_GAIN_2GHZ			0xa20c
   2542 #define	AR5K_PHY_GAIN_2GHZ_MARGIN_TXRX		0x00fc0000
   2543 #define	AR5K_PHY_GAIN_2GHZ_MARGIN_TXRX_S	18
   2544 #define	AR5K_PHY_GAIN_2GHZ_INI_5111		0x6480416c
   2545 
   2546 #define	AR5K_PHY_CCK_RX_CTL_4			0xa21c
   2547 #define	AR5K_PHY_CCK_RX_CTL_4_FREQ_EST_SHORT	0x01f80000
   2548 #define	AR5K_PHY_CCK_RX_CTL_4_FREQ_EST_SHORT_S	19
   2549 
   2550 #define	AR5K_PHY_DAG_CCK_CTL			0xa228
   2551 #define	AR5K_PHY_DAG_CCK_CTL_EN_RSSI_THR	0x00000200
   2552 #define	AR5K_PHY_DAG_CCK_CTL_RSSI_THR		0x0001fc00
   2553 #define	AR5K_PHY_DAG_CCK_CTL_RSSI_THR_S		10
   2554 
   2555 #define	AR5K_PHY_FAST_ADC	0xa24c
   2556 
   2557 #define	AR5K_PHY_BLUETOOTH	0xa254
   2558 
   2559 /*
   2560  * Transmit Power Control register
   2561  * [2413+]
   2562  */
   2563 #define	AR5K_PHY_TPC_RG1		0xa258
   2564 #define	AR5K_PHY_TPC_RG1_NUM_PD_GAIN	0x0000c000
   2565 #define	AR5K_PHY_TPC_RG1_NUM_PD_GAIN_S	14
   2566 #define AR5K_PHY_TPC_RG1_PDGAIN_1	0x00030000
   2567 #define AR5K_PHY_TPC_RG1_PDGAIN_1_S	16
   2568 #define AR5K_PHY_TPC_RG1_PDGAIN_2	0x000c0000
   2569 #define AR5K_PHY_TPC_RG1_PDGAIN_2_S	18
   2570 #define AR5K_PHY_TPC_RG1_PDGAIN_3	0x00300000
   2571 #define AR5K_PHY_TPC_RG1_PDGAIN_3_S	20
   2572 
   2573 #define	AR5K_PHY_TPC_RG5			0xa26C
   2574 #define	AR5K_PHY_TPC_RG5_PD_GAIN_OVERLAP	0x0000000F
   2575 #define	AR5K_PHY_TPC_RG5_PD_GAIN_OVERLAP_S	0
   2576 #define	AR5K_PHY_TPC_RG5_PD_GAIN_BOUNDARY_1	0x000003F0
   2577 #define	AR5K_PHY_TPC_RG5_PD_GAIN_BOUNDARY_1_S	4
   2578 #define	AR5K_PHY_TPC_RG5_PD_GAIN_BOUNDARY_2	0x0000FC00
   2579 #define	AR5K_PHY_TPC_RG5_PD_GAIN_BOUNDARY_2_S	10
   2580 #define	AR5K_PHY_TPC_RG5_PD_GAIN_BOUNDARY_3	0x003F0000
   2581 #define	AR5K_PHY_TPC_RG5_PD_GAIN_BOUNDARY_3_S	16
   2582 #define	AR5K_PHY_TPC_RG5_PD_GAIN_BOUNDARY_4	0x0FC00000
   2583 #define	AR5K_PHY_TPC_RG5_PD_GAIN_BOUNDARY_4_S	22
   2584 
   2585 /*
   2586  * PHY PDADC Tx power table
   2587  */
   2588 #define AR5K_PHY_PDADC_TXPOWER_BASE	0xa280
   2589 #define	AR5K_PHY_PDADC_TXPOWER(_n)	(AR5K_PHY_PDADC_TXPOWER_BASE + ((_n) << 2))
   2590