After b43_phy_ht_tx_power_ctl_setup there are some extra radio ops:
 radio_read(0x08bf) -> 0x0001
radio_write(0x08bf) <- 0x0001
radio_write(0x0159) <- 0x0011
On N-PHY we write 0x11 to TSSI regs, so it's probably sth similar.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Now when we know many radio regs at 0x000 are core-generic, I've noticed
we duplicate some values in the tables.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

After comparing writes to registers at 0x000, 0x400 and 0x800 it seems
there are many very similar writes. So 0x000 offset is not for accessing
something totally different, but probably just the first out of three
cores.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>

Drivers that don't use chanctxes cannot perform VHT association because
they still use a "backward compatibility" pair of {ieee80211_channel,
nl80211_channel_type} in ieee80211_conf and ieee80211_local.
Signed-off-by: NKarl Beldan <karl.beldan@rivierawaves.com>
[fix kernel-doc]
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

It was another sequence I recognized in HT-PHY dump:
 phy_read(0x00c7) -> 0x0001
 phy_read(0x00c3) -> 0x0000
phy_write(0x00c3) <- 0x0002
 phy_read(0x00c3) -> 0x0000
phy_write(0x00c3) <- 0x0000
The difference to N-PHY is that it writes to 6 tables instead of a one
(after above).
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Don't enable it until we have (almost?) whole TX power management
figured out. It's similar to the N-PHY, the difference is that we call a
"fix" *before* disabling power control.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

It was just another similar-to-N-PHY and easy-to-track routine:
write32 0xb0601408 <- 0x00002057
 phy_read(0x0001) -> 0x0000
phy_write(0x0001) <- 0x4000
phy_write(0x0001) <- 0x0000
write32 0xb0601408 <- 0x00002055
(b43_phy_ht_force_rf_sequence was moved up unmodified)
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

On N-PHY it's also done after TX power fix, so it was easy to spot.
Unfortunately the MMIO logs I have from ndsiwrapper include channels
1-12 only, so enabling code for 13 and 14 is just a N-PHY-based guess.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

On N-PHY after B43_PHY_B_TEST operation there is a call to TX power fix
function which iterates over available cores. It matches our HT-PHY code
which means it's probably also some TX fix.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

After comparing operations on reg 0xB on N and HT it seems to be the
same register with similar ops. Implement them for HT-PHY.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

It you take a look at N-PHY analog switch function it touches every core
on the chipset. It seems HT-PHY does they same, it just has 3 cores
instead of 2 (which make sense since BCM4331 is 3x3). Rename AFE defines
to include core id.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

HT-PHY was found only on BCM4331 which is a BCMA-based chipset. This is
reallly unlikely we will ever see HT-PHY on SSB thus make the whole code
BCMA specific. This will allow us to call various BCMA-specific
functions directly (without extra checks).
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

We don't know yet when to restore it, implement just reading. We found
out what for are that PHY ops by comparing HT with N code.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Comparison of the HT and N code has shown similarities in the ops
performed after b43_mac_phy_clock_set. That way we understood what is
happening in the HT-PHY code.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

MMIO hacks were used to trick ndis&wl. For example following:
 phy_read(0x0280) -> 0xffff
phy_write(0x0280) <- 0xff3e
***
 phy_read(0x0280) -> 0x0000
phy_write(0x0280) <- 0x003e
was translated to mask 0xff00 and set 0x3e.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Old masks were causing ugly, delayed lock ups.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Following operation was incorrectly translated:
 radio_read(0x0011) -> 0xffff
radio_write(0x0011) <- 0xfff7
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Also change the default channel to 11. This is the first channel closed
driver switches to.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Without them we get Oops with NULL pointer
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Sometimes additional steps are performed while initializing 2059 radio.
We did not find the condition yet, so make it always true for now.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Masks and sets were found in MMIO dumps by using MMIO hacks. Shortly:
radio_write(0x0c51) <- 0x0070
radio_write(0x0c5a) <- 0x0003
radio_write(0x0146) <- 0x0003
radio_write(0x0546) <- 0x0003
radio_write(0x0946) <- 0x0003
radio_write(0x002e) <- 0x0078
radio_write(0x00c0) <- 0x0080
radio_write(0x002e) <- 0xff87
radio_write(0x00c0) <- 0xff7f
radio_write(0x0011) <- 0xfff7
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Starring at MMIO dumps around PHY channel switching has led to finding
serie of 3 similar ops this patch implements.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

After calibrating radio you can find few PHY writes in MMIO dumps:
 phy_read(0x0009) -> 0x0000
phy_write(0x01ce) <- 0x03dd
phy_write(0x01cf) <- 0x03d9
phy_write(0x01d0) <- 0x03d5
phy_write(0x01d1) <- 0x0424
phy_write(0x01d2) <- 0x0429
phy_write(0x01d3) <- 0x042d
By comparing to N-PHY code we found out that they are PHY tables for
channel switching plus band info read at the beginning.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>