Analog is switched on right after reading PHY version:
read16 0xfaafc3e0 -> 0xa801
phy_read(0x043b) -> 0x0000
phy_write(0x043b) <- 0x0000
Switched off after after killing radio:
>>> Switch Radio(OFF) end
phy_read(0x043c) -> 0x0000
phy_write(0x043c) <- 0x0007
phy_read(0x043b) -> 0x0000
phy_write(0x043b) <- 0x0007
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Some hardware with 64-bit DMA uses lower address word for setting
routing (translation) bit. Add workaround for such boards.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Sometimes we need to write table which is 2-10 elements long. It's
easier to create such a function instead of defining array every time.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
MMIO hacks were used to trick ndis&wl. For example following:
phy_read(0x0280) -> 0xffff
phy_write(0x0280) <- 0xff3e
***
phy_read(0x0280) -> 0x0000
phy_write(0x0280) <- 0x003e
was translated to mask 0xff00 and set 0x3e.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Replace "old" and "new" with number of the first firmware known to use
the given format.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
b43_op_config and b43_op_bss_info_changed apply many settings by directly
writing to hardware registers. These settings are lost as soon as the core
is restarted and the initvals are reloaded. This was discovered because
restarting hostapd led to the beacon interval getting set to ~33s (see
https://dev.openwrt.org/ticket/8033 for more information).
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This causes an databus error on a Broadcom SoC using bcma.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Since kernel 3.0, the problems with controlling b43 devices that have
low-power (LP) PHYs have been fixed and the EXPERIMENTAL designation
can be fixed.
This patch also fixes a typo as the device supports 802.11b communications.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Acked-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This ieee80211 core was found on a Netgear wndr3400.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
linux/wireless.h and net/iw_handler.h headers are
for wireless extensions only, so mac80211 drivers
shouldn't be including them.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
wldev is freed in b43_one_core_detach() and should not be accessed after
that call. Keep wldev->dev in a local variable.
Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
We've fixed the last issue with BCMA support which caused memory
corruption on loading and unloading b43. Support for BCMA in b43 was
tested with 14e4:4353, 14e4:4357, 14e4:4727 and 14e4:4331. First two
cards (BCM43224 and BCM43225) are supported.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (43 commits)
fs: Merge split strings
treewide: fix potentially dangerous trailing ';' in #defined values/expressions
uwb: Fix misspelling of neighbourhood in comment
net, netfilter: Remove redundant goto in ebt_ulog_packet
trivial: don't touch files that are removed in the staging tree
lib/vsprintf: replace link to Draft by final RFC number
doc: Kconfig: `to be' -> `be'
doc: Kconfig: Typo: square -> squared
doc: Konfig: Documentation/power/{pm => apm-acpi}.txt
drivers/net: static should be at beginning of declaration
drivers/media: static should be at beginning of declaration
drivers/i2c: static should be at beginning of declaration
XTENSA: static should be at beginning of declaration
SH: static should be at beginning of declaration
MIPS: static should be at beginning of declaration
ARM: static should be at beginning of declaration
rcu: treewide: Do not use rcu_read_lock_held when calling rcu_dereference_check
Update my e-mail address
PCIe ASPM: forcedly -> forcibly
gma500: push through device driver tree
...
Fix up trivial conflicts:
- arch/arm/mach-ep93xx/dma-m2p.c (deleted)
- drivers/gpio/gpio-ep93xx.c (renamed and context nearby)
- drivers/net/r8169.c (just context changes)
Remove b43's workarounds at the same time. Other users of
ssb_dma_translation do not support any 64-bit DMA devices, so they are
not affected.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Analyze of MMIO dumps from BCM43224, BCM43225, BCM4313 and BCM4331 has
shown that wl disables parity check for all that cards. This is required
for receiving any packets from the hardware.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Some of the newer Broadcom chipsets have longe names like BCM43224,
BCM43225, etc. However Broadcom decided to keep using u16 for storing
them. Use %X or %d depending on chip_id value to avoid BCMA8D8, etc.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Acked-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Old masks were causing ugly, delayed lock ups.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Following operation was incorrectly translated:
radio_read(0x0011) -> 0xffff
radio_write(0x0011) <- 0xfff7
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Also change the default channel to 11. This is the first channel closed
driver switches to.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
BCMA_IOCTL is register in agent (AKA wrapper) core, we need to use
special R/W ops for it.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
We use all that functions by pointers only. This forces compiler to
create additional duplicated functions that are not inline.
Noticed by Michael in similar bcma code.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
We were uploading different firmwares to the hardware until finding
responding one.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
LCN-PHY was found in 14e4:4727 card. It uses LCN/1 and 0x2064/1 radio.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Older cores had unique PHY. This is not true anymore for newer ones.
For example core rev 16 can be LP, SSLPN or N (PHY).
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Our current TKIP code races against itself on TX
since we can process multiple packets at the same
time on different ACs, but they all share the TX
context for TKIP. This can lead to bad IVs etc.
Also, the crypto offload helper code just obtains
the P1K/P2K from the cache, and can update it as
well, but there's no guarantee that packets are
really processed in order.
To fix these issues, first introduce a spinlock
that will protect the IV16/IV32 values in the TX
context. This first step makes sure that we don't
assign the same IV multiple times or get confused
in other ways.
Secondly, change the way the P1K cache works. I
add a field "p1k_iv32" that stores the value of
the IV32 when the P1K was last recomputed, and
if different from the last time, then a new P1K
is recomputed. This can cause the P1K computation
to flip back and forth if packets are processed
out of order. All this also happens under the new
spinlock.
Finally, because there are argument differences,
split up the ieee80211_get_tkip_key() API into
ieee80211_get_tkip_p1k() and ieee80211_get_tkip_p2k()
and give them the correct arguments.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This adds a memory barrier to ensure the writes to the ring memory
are committed before the DMA ring pointer is updated.
We do a similar thing on the TX side already.
Signed-off-by: Michael Buesch <m@bues.ch>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Sometimes additional steps are performed while initializing 2059 radio.
We did not find the condition yet, so make it always true for now.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
They were written from observing MMIO writes to registers 0x72 0x74 and
0x73 right after phy_write(0x017e) <- 0x3830 which finishes chennel
switching. RegExps were used to translate writes to arrays.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Tables were taken from observing writes in MMIO dumps.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Starring at MMIO dumps around PHY channel switching has led to finding
serie of 3 similar ops this patch implements.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
After calibrating radio you can find few PHY writes in MMIO dumps:
phy_read(0x0009) -> 0x0000
phy_write(0x01ce) <- 0x03dd
phy_write(0x01cf) <- 0x03d9
phy_write(0x01d0) <- 0x03d5
phy_write(0x01d1) <- 0x0424
phy_write(0x01d2) <- 0x0429
phy_write(0x01d3) <- 0x042d
By comparing to N-PHY code we found out that they are PHY tables for
channel switching plus band info read at the beginning.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
They are big arrays uploaded to the hardware on init, calibration, etc.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Two functions in ssb are using register_pci_controller() which is
__devinit. The functions ssb_pcicore_init_hostmode() and
ssb_gige_probe() should also be __devinit.
This fixes the following warning:
WARNING: vmlinux.o(.text+0x2727b8): Section mismatch in reference from the function ssb_pcicore_init_hostmode() to the function .devinit.text:register_pci_controller()
The function ssb_pcicore_init_hostmode() references
the function __devinit register_pci_controller().
This is often because ssb_pcicore_init_hostmode lacks a __devinit
annotation or the annotation of register_pci_controller is wrong.
WARNING: vmlinux.o(.text+0x273398): Section mismatch in reference from the function ssb_gige_probe() to the function .devinit.text:register_pci_controller()
The function ssb_gige_probe() references
the function __devinit register_pci_controller().
This is often because ssb_gige_probe lacks a __devinit
annotation or the annotation of register_pci_controller is wrong.
Reported-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
After uploading radio values calibration goes in. In MMIO dump it is:
radio_read(0x002b) -> 0x0008
radio_write(0x002b) <- 0x0008
radio_read(0x002e) -> 0x0004
radio_write(0x002e) <- 0x0000
radio_read(0x002e) -> 0x0000
radio_write(0x002e) <- 0x0004
radio_read(0x002b) -> 0x0008
radio_write(0x002b) <- 0x0009
To find masks and sets, MMIO hacks were used to fool closed driver.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Switching channel happens after specific SHM write to B43_SHM_SH_CHAN.
This is the way we found it in BCM4331 MMIO dumps. By comparing with
N-PHY code we noticed there is routing used for SYN and TX/RX.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
The trick was to find 0x810 PHY reg ops close to analog enabling code.
To find out proper masks and sets, MMIO hacks were used.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Closed drivers kill radio right after reading radio version and MACCTL,
so it was easy to find related PHY ops:
phy_read(0x0810) -> 0x0000
phy_write(0x0810) <- 0x0000
To find out the mask of above OP, MMIO hack was used to fake read val:
phy_read(0x0810) -> 0xffff
phy_write(0x0810) <- 0x0000
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Turning it on is always done between reading PHY version and radio
version, so it was easy to find it in MMIO dumps from ndiswrapper.
Turning off is done by writing different values to the same registers.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Every PHY has some specific bit used for reading radio regs. Analyze of
MMIO dumps from BCM4331 and ndiswrapper has shown it is 0x200 for HT.
radio_read(0x037f) -> 0x0073
radio_write(0x017f) <- 0x0072
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
It is always "y" for now, b43 will not compile without CONFIG_SSB yet.
This is just a first step of dropping SSB dependency.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This is totally broken plus we do not have specs for HT PHY yet. Just
introduce place for writing driver if we discover anything.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Add some error handling if the allocation fails.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Semicolons are not necessary after switch/while/for/if braces
so remove them.
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (40 commits)
tg3: Fix tg3_skb_error_unmap()
net: tracepoint of net_dev_xmit sees freed skb and causes panic
drivers/net/can/flexcan.c: add missing clk_put
net: dm9000: Get the chip in a known good state before enabling interrupts
drivers/net/davinci_emac.c: add missing clk_put
af-packet: Add flag to distinguish VID 0 from no-vlan.
caif: Fix race when conditionally taking rtnl lock
usbnet/cdc_ncm: add missing .reset_resume hook
vlan: fix typo in vlan_dev_hard_start_xmit()
net/ipv4: Check for mistakenly passed in non-IPv4 address
iwl4965: correctly validate temperature value
bluetooth l2cap: fix locking in l2cap_global_chan_by_psm
ath9k: fix two more bugs in tx power
cfg80211: don't drop p2p probe responses
Revert "net: fix section mismatches"
drivers/net/usb/catc.c: Fix potential deadlock in catc_ctrl_run()
sctp: stop pending timers and purge queues when peer restart asoc
drivers/net: ks8842 Fix crash on received packet when in PIO mode.
ip_options_compile: properly handle unaligned pointer
iwlagn: fix incorrect PCI subsystem id for 6150 devices
...
It does nothing useful yet, so it is matched as BROKEN.
For now this is just an option for b43, in future we may want to make
b43 support SSB or BCMA (note: or, not xor).
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Luckily the only flag we use when calling core reset is GMODE one.
Thanks to that we can just switch to single bool and make function calls
bus generic.
Tested on my BCM4312 (LP-PHY) and early tested with BCM43224.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
gcc 4.6.0 warnings for b43:
CC [M] drivers/net/wireless/b43/lo.o
drivers/net/wireless/b43/lo.c: In function ‘lo_measure_gain_values’:
drivers/net/wireless/b43/lo.c:304:7: warning: variable ‘trsw_rx’ set but not used [-Wunused-but-set-variable]
CC [M] drivers/net/wireless/b43/dma.o
drivers/net/wireless/b43/dma.c: In function ‘free_all_descbuffers’:
drivers/net/wireless/b43/dma.c:760:30: warning: variable ‘desc’ set but not used [-Wunused-but-set-variable]
drivers/net/wireless/b43/dma.c: In function ‘b43_dma_handle_txstatus’:
drivers/net/wireless/b43/dma.c:1391:30: warning: variable ‘desc’ set but not used [-Wunused-but-set-variable]
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
SDIO code is SSB specific, we can safely just use "sdev"
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
