b43: Fix and update LP-PHY code

-Fix a few nasty typos (b43_phy_* operations instead of b43_radio_*)
 in the channel tune routines.
-Fix some typos & spec errors found by MMIO tracing.
-Optimize b43_phy_write & b43_phy_mask/set/maskset to use
 only the minimal number of MMIO accesses. (Write is possible
 using a single 32-bit MMIO write, while set/mask/maskset can
 be done in 3 16-bit MMIOs).
-Set the default channel back to 1, as the bug forcing us to use
 channel 7 is now fixed.

With this, the device comes up, scans, associates, transmits,
receives, monitors and injects on all channels - in other words,
it's fully functional. Sensitivity and TX power are still sub-optimal,
due to the lack of calibration (that's next on my list).

Signed-off-by: Gábor Stefanik <netrolller.3d@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
index 51686ec9698457a4389624cadd4b73337b8128dd..6e704becda6fe8a8a2da989657cc522b2545a740 100644 (file)
--- a/drivers/net/wireless/b43/phy_common.c
+++ b/drivers/net/wireless/b43/phy_common.c
@@ -249,20 +249,35 @@ void b43_phy_copy(struct b43_wldev *dev, u16 destreg, u16 srcreg)
 
 void b43_phy_mask(struct b43_wldev *dev, u16 offset, u16 mask)
 {
-       b43_phy_write(dev, offset,
-                     b43_phy_read(dev, offset) & mask);
+       if (dev->phy.ops->phy_maskset) {
+               assert_mac_suspended(dev);
+               dev->phy.ops->phy_maskset(dev, offset, mask, 0);
+       } else {
+               b43_phy_write(dev, offset,
+                             b43_phy_read(dev, offset) & mask);
+       }
 }
 
 void b43_phy_set(struct b43_wldev *dev, u16 offset, u16 set)
 {
-       b43_phy_write(dev, offset,
-                     b43_phy_read(dev, offset) | set);
+       if (dev->phy.ops->phy_maskset) {
+               assert_mac_suspended(dev);
+               dev->phy.ops->phy_maskset(dev, offset, 0xFFFF, set);
+       } else {
+               b43_phy_write(dev, offset,
+                             b43_phy_read(dev, offset) | set);
+       }
 }
 
 void b43_phy_maskset(struct b43_wldev *dev, u16 offset, u16 mask, u16 set)
 {
-       b43_phy_write(dev, offset,
-                     (b43_phy_read(dev, offset) & mask) | set);
+       if (dev->phy.ops->phy_maskset) {
+               assert_mac_suspended(dev);
+               dev->phy.ops->phy_maskset(dev, offset, mask, set);
+       } else {
+               b43_phy_write(dev, offset,
+                             (b43_phy_read(dev, offset) & mask) | set);
+       }
 }
 
 int b43_switch_channel(struct b43_wldev *dev, unsigned int new_channel)

diff --git a/drivers/net/wireless/b43/phy_common.h b/drivers/net/wireless/b43/phy_common.h
index 9f9f23cab72a48bb064c995f21fd11ec5b4d1f3e..b47a0f55c0b6d57cb5c31c2275fc3d24eb14e07e 100644 (file)
--- a/drivers/net/wireless/b43/phy_common.h
+++ b/drivers/net/wireless/b43/phy_common.h
@@ -95,6 +95,8 @@ enum b43_txpwr_result {
  *                     Must not be NULL.
  * @phy_write:         Write to a PHY register.
  *                     Must not be NULL.
+ * @phy_maskset:       Maskset a PHY register, taking shortcuts.
+ *                     If it is NULL, a generic algorithm is used.
  * @radio_read:                Read from a Radio register.
  *                     Must not be NULL.
  * @radio_write:       Write to a Radio register.
@@ -154,6 +156,7 @@ struct b43_phy_operations {
        /* Register access */
        u16 (*phy_read)(struct b43_wldev *dev, u16 reg);
        void (*phy_write)(struct b43_wldev *dev, u16 reg, u16 value);
+       void (*phy_maskset)(struct b43_wldev *dev, u16 reg, u16 mask, u16 set);
        u16 (*radio_read)(struct b43_wldev *dev, u16 reg);
        void (*radio_write)(struct b43_wldev *dev, u16 reg, u16 value);
 

diff --git a/drivers/net/wireless/b43/phy_lp.c b/drivers/net/wireless/b43/phy_lp.c
index 5306f2c66b34001717d2b085b5aaef3c50b29a27..1a57d3390e9283d16467ec0966a333c72106ad7c 100644 (file)
--- a/drivers/net/wireless/b43/phy_lp.c
+++ b/drivers/net/wireless/b43/phy_lp.c
@@ -44,7 +44,7 @@ static inline u16 channel2freq_lp(u8 channel)
 static unsigned int b43_lpphy_op_get_default_chan(struct b43_wldev *dev)
 {
        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
-               return 7; //FIXME temporary - channel 1 is broken
+               return 1;
        return 36;
 }
 
@@ -182,8 +182,8 @@ static void lpphy_adjust_gain_table(struct b43_wldev *dev, u32 freq)
        temp[1] = temp[0] + 0x1000;
        temp[2] = temp[0] + 0x2000;
 
-       b43_lptab_write_bulk(dev, B43_LPTAB16(12, 0), 3, temp);
        b43_lptab_write_bulk(dev, B43_LPTAB16(13, 0), 3, temp);
+       b43_lptab_write_bulk(dev, B43_LPTAB16(12, 0), 3, temp);
 }
 
 static void lpphy_table_init(struct b43_wldev *dev)
@@ -223,8 +223,8 @@ static void lpphy_baseband_rev0_1_init(struct b43_wldev *dev)
        b43_phy_maskset(dev, B43_LPPHY_VERYLOWGAINDB, 0xFF00, 0x0006);
        b43_phy_mask(dev, B43_LPPHY_RX_RADIO_CTL, 0xFFFE);
        b43_phy_maskset(dev, B43_LPPHY_CLIPCTRTHRESH, 0xFFE0, 0x0005);
-       b43_phy_maskset(dev, B43_LPPHY_CLIPCTRTHRESH, 0xFC10, 0x0180);
-       b43_phy_maskset(dev, B43_LPPHY_CLIPCTRTHRESH, 0x83FF, 0x3800);
+       b43_phy_maskset(dev, B43_LPPHY_CLIPCTRTHRESH, 0xFC1F, 0x0180);
+       b43_phy_maskset(dev, B43_LPPHY_CLIPCTRTHRESH, 0x83FF, 0x3C00);
        b43_phy_maskset(dev, B43_LPPHY_GAINDIRECTMISMATCH, 0xFFF0, 0x0005);
        b43_phy_maskset(dev, B43_LPPHY_GAIN_MISMATCH_LIMIT, 0xFFC0, 0x001A);
        b43_phy_maskset(dev, B43_LPPHY_CRS_ED_THRESH, 0xFF00, 0x00B3);
@@ -237,7 +237,7 @@ static void lpphy_baseband_rev0_1_init(struct b43_wldev *dev)
                /* TODO:
                 * Set the LDO voltage to 0x0028 - FIXME: What is this?
                 * Call sb_pmu_set_ldo_voltage with 4 and the LDO voltage
-                *      as arguments
+                *      as arguments
                 * Call sb_pmu_paref_ldo_enable with argument TRUE
                 */
                if (dev->phy.rev == 0) {
@@ -340,11 +340,11 @@ static void lpphy_baseband_rev0_1_init(struct b43_wldev *dev)
        if (dev->phy.rev == 1) {
                tmp = b43_phy_read(dev, B43_LPPHY_CLIPCTRTHRESH);
                tmp2 = (tmp & 0x03E0) >> 5;
-               tmp2 |= tmp << 5;
+               tmp2 |= tmp2 << 5;
                b43_phy_write(dev, B43_LPPHY_4C3, tmp2);
-               tmp = b43_phy_read(dev, B43_LPPHY_OFDMSYNCTHRESH0);
+               tmp = b43_phy_read(dev, B43_LPPHY_GAINDIRECTMISMATCH);
                tmp2 = (tmp & 0x1F00) >> 8;
-               tmp2 |= tmp << 5;
+               tmp2 |= tmp2 << 5;
                b43_phy_write(dev, B43_LPPHY_4C4, tmp2);
                tmp = b43_phy_read(dev, B43_LPPHY_VERYLOWGAINDB);
                tmp2 = tmp & 0x00FF;
@@ -761,7 +761,7 @@ static void lpphy_disable_crs(struct b43_wldev *dev, bool user)
        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x3);
        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0xFFFB);
        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x4);
-       b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_0, 0xFFF7);
+       b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0xFFF7);
        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x8);
        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0x10);
        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x10);
@@ -956,7 +956,7 @@ static void lpphy_run_ddfs(struct b43_wldev *dev, int i_on, int q_on,
        b43_phy_maskset(dev, B43_LPPHY_AFE_DDFS, 0xFF9F, scale_idx << 5);
        b43_phy_mask(dev, B43_LPPHY_AFE_DDFS, 0xFFFB);
        b43_phy_set(dev, B43_LPPHY_AFE_DDFS, 0x2);
-       b43_phy_set(dev, B43_LPPHY_AFE_DDFS, 0x20);
+       b43_phy_set(dev, B43_LPPHY_LP_PHY_CTL, 0x20);
 }
 
 static bool lpphy_rx_iq_est(struct b43_wldev *dev, u16 samples, u8 time,
@@ -968,7 +968,7 @@ static bool lpphy_rx_iq_est(struct b43_wldev *dev, u16 samples, u8 time,
        b43_phy_write(dev, B43_LPPHY_IQ_NUM_SMPLS_ADDR, samples);
        b43_phy_maskset(dev, B43_LPPHY_IQ_ENABLE_WAIT_TIME_ADDR, 0xFF00, time);
        b43_phy_mask(dev, B43_LPPHY_IQ_ENABLE_WAIT_TIME_ADDR, 0xFEFF);
-       b43_phy_set(dev, B43_LPPHY_IQ_ENABLE_WAIT_TIME_ADDR, 0xFDFF);
+       b43_phy_set(dev, B43_LPPHY_IQ_ENABLE_WAIT_TIME_ADDR, 0x200);
 
        for (i = 0; i < 500; i++) {
                if (!(b43_phy_read(dev,
@@ -1135,9 +1135,9 @@ static void lpphy_set_tx_power_control(struct b43_wldev *dev,
        }
        if (dev->phy.rev >= 2) {
                if (mode == B43_LPPHY_TXPCTL_HW)
-                       b43_phy_maskset(dev, B43_PHY_OFDM(0xD0), 0xFD, 0x2);
+                       b43_phy_set(dev, B43_PHY_OFDM(0xD0), 0x2);
                else
-                       b43_phy_maskset(dev, B43_PHY_OFDM(0xD0), 0xFD, 0);
+                       b43_phy_mask(dev, B43_PHY_OFDM(0xD0), 0xFFFD);
        }
        lpphy_write_tx_pctl_mode_to_hardware(dev);
 }
@@ -1169,7 +1169,7 @@ static void lpphy_rev0_1_rc_calib(struct b43_wldev *dev)
        err = b43_lpphy_op_switch_channel(dev, 7);
        if (err) {
                b43dbg(dev->wl,
-                      "RC calib: Failed to switch to channel 7, error = %d",
+                      "RC calib: Failed to switch to channel 7, error = %d\n",
                       err);
        }
        old_txg_ovr = !!(b43_phy_read(dev, B43_LPPHY_AFE_CTL_OVR) & 0x40);
@@ -1499,9 +1499,16 @@ static u16 b43_lpphy_op_read(struct b43_wldev *dev, u16 reg)
 }
 
 static void b43_lpphy_op_write(struct b43_wldev *dev, u16 reg, u16 value)
+{
+       b43_write32(dev, B43_MMIO_PHY_CONTROL, ((u32)value << 16) | reg);
+}
+
+static void b43_lpphy_op_maskset(struct b43_wldev *dev, u16 reg, u16 mask,
+                                u16 set)
 {
        b43_write16(dev, B43_MMIO_PHY_CONTROL, reg);
-       b43_write16(dev, B43_MMIO_PHY_DATA, value);
+       b43_write16(dev, B43_MMIO_PHY_DATA,
+                   (b43_read16(dev, B43_MMIO_PHY_DATA) & mask) | set);
 }
 
 static u16 b43_lpphy_op_radio_read(struct b43_wldev *dev, u16 reg)
@@ -1920,8 +1927,8 @@ static void lpphy_b2062_reset_pll_bias(struct b43_wldev *dev)
 
 static void lpphy_b2062_vco_calib(struct b43_wldev *dev)
 {
-       b43_phy_write(dev, B2062_S_RFPLL_CTL21, 0x42);
-       b43_phy_write(dev, B2062_S_RFPLL_CTL21, 0x62);
+       b43_radio_write(dev, B2062_S_RFPLL_CTL21, 0x42);
+       b43_radio_write(dev, B2062_S_RFPLL_CTL21, 0x62);
        udelay(200);
 }
 
@@ -1980,7 +1987,7 @@ static int lpphy_b2062_tune(struct b43_wldev *dev,
        tmp6 = tmp5 / tmp4;
        tmp7 = tmp5 % tmp4;
        b43_radio_write(dev, B2062_S_RFPLL_CTL29, tmp6 + ((2 * tmp7) / tmp4));
-       tmp8 = b43_phy_read(dev, B2062_S_RFPLL_CTL19);
+       tmp8 = b43_radio_read(dev, B2062_S_RFPLL_CTL19);
        tmp9 = ((2 * tmp3 * (tmp8 + 1)) + (3 * tmp1)) / (6 * tmp1);
        b43_radio_write(dev, B2062_S_RFPLL_CTL23, (tmp9 >> 8) + 16);
        b43_radio_write(dev, B2062_S_RFPLL_CTL24, tmp9 & 0xFF);
@@ -2019,17 +2026,17 @@ static void lpphy_b2063_vco_calib(struct b43_wldev *dev)
 {
        u16 tmp;
 
-       b43_phy_mask(dev, B2063_PLL_SP1, ~0x40);
-       tmp = b43_phy_read(dev, B2063_PLL_JTAG_CALNRST) & 0xF8;
-       b43_phy_write(dev, B2063_PLL_JTAG_CALNRST, tmp);
+       b43_radio_mask(dev, B2063_PLL_SP1, ~0x40);
+       tmp = b43_radio_read(dev, B2063_PLL_JTAG_CALNRST) & 0xF8;
+       b43_radio_write(dev, B2063_PLL_JTAG_CALNRST, tmp);
        udelay(1);
-       b43_phy_write(dev, B2063_PLL_JTAG_CALNRST, tmp | 0x4);
+       b43_radio_write(dev, B2063_PLL_JTAG_CALNRST, tmp | 0x4);
        udelay(1);
-       b43_phy_write(dev, B2063_PLL_JTAG_CALNRST, tmp | 0x6);
+       b43_radio_write(dev, B2063_PLL_JTAG_CALNRST, tmp | 0x6);
        udelay(1);
-       b43_phy_write(dev, B2063_PLL_JTAG_CALNRST, tmp | 0x7);
+       b43_radio_write(dev, B2063_PLL_JTAG_CALNRST, tmp | 0x7);
        udelay(300);
-       b43_phy_set(dev, B2063_PLL_SP1, 0x40);
+       b43_radio_set(dev, B2063_PLL_SP1, 0x40);
 }
 
 static int lpphy_b2063_tune(struct b43_wldev *dev,
@@ -2124,31 +2131,31 @@ static int lpphy_b2063_tune(struct b43_wldev *dev,
                scale = 0;
                tmp5 = ((tmp4 + (tmp3 >> 1)) / tmp3) - 8;
        }
-       b43_phy_maskset(dev, B2063_PLL_JTAG_PLL_CP2, 0xFFC0, tmp5);
-       b43_phy_maskset(dev, B2063_PLL_JTAG_PLL_CP2, 0xFFBF, scale << 6);
+       b43_radio_maskset(dev, B2063_PLL_JTAG_PLL_CP2, 0xFFC0, tmp5);
+       b43_radio_maskset(dev, B2063_PLL_JTAG_PLL_CP2, 0xFFBF, scale << 6);
 
        tmp6 = lpphy_qdiv_roundup(100 * val1, val3, 16);
        tmp6 *= (tmp5 * 8) * (scale + 1);
        if (tmp6 > 150)
                tmp6 = 0;
 
-       b43_phy_maskset(dev, B2063_PLL_JTAG_PLL_CP3, 0xFFE0, tmp6);
-       b43_phy_maskset(dev, B2063_PLL_JTAG_PLL_CP3, 0xFFDF, scale << 5);
+       b43_radio_maskset(dev, B2063_PLL_JTAG_PLL_CP3, 0xFFE0, tmp6);
+       b43_radio_maskset(dev, B2063_PLL_JTAG_PLL_CP3, 0xFFDF, scale << 5);
 
-       b43_phy_maskset(dev, B2063_PLL_JTAG_PLL_XTAL_12, 0xFFFB, 0x4);
+       b43_radio_maskset(dev, B2063_PLL_JTAG_PLL_XTAL_12, 0xFFFB, 0x4);
        if (crystal_freq > 26000000)
-               b43_phy_set(dev, B2063_PLL_JTAG_PLL_XTAL_12, 0x2);
+               b43_radio_set(dev, B2063_PLL_JTAG_PLL_XTAL_12, 0x2);
        else
-               b43_phy_mask(dev, B2063_PLL_JTAG_PLL_XTAL_12, 0xFD);
+               b43_radio_mask(dev, B2063_PLL_JTAG_PLL_XTAL_12, 0xFD);
 
        if (val1 == 45)
-               b43_phy_set(dev, B2063_PLL_JTAG_PLL_VCO1, 0x2);
+               b43_radio_set(dev, B2063_PLL_JTAG_PLL_VCO1, 0x2);
        else
-               b43_phy_mask(dev, B2063_PLL_JTAG_PLL_VCO1, 0xFD);
+               b43_radio_mask(dev, B2063_PLL_JTAG_PLL_VCO1, 0xFD);
 
-       b43_phy_set(dev, B2063_PLL_SP2, 0x3);
+       b43_radio_set(dev, B2063_PLL_SP2, 0x3);
        udelay(1);
-       b43_phy_mask(dev, B2063_PLL_SP2, 0xFFFC);
+       b43_radio_mask(dev, B2063_PLL_SP2, 0xFFFC);
        lpphy_b2063_vco_calib(dev);
        b43_radio_write(dev, B2063_COMM15, old_comm15);
 
@@ -2158,10 +2165,9 @@ static int lpphy_b2063_tune(struct b43_wldev *dev,
 static int b43_lpphy_op_switch_channel(struct b43_wldev *dev,
                                       unsigned int new_channel)
 {
+       struct b43_phy_lp *lpphy = dev->phy.lp;
        int err;
 
-       b43_write16(dev, B43_MMIO_CHANNEL, new_channel);
-
        if (dev->phy.radio_ver == 0x2063) {
                err = lpphy_b2063_tune(dev, new_channel);
                if (err)
@@ -2174,6 +2180,9 @@ static int b43_lpphy_op_switch_channel(struct b43_wldev *dev,
                lpphy_adjust_gain_table(dev, channel2freq_lp(new_channel));
        }
 
+       lpphy->channel = new_channel;
+       b43_write16(dev, B43_MMIO_CHANNEL, new_channel);
+
        return 0;
 }
 
@@ -2185,10 +2194,9 @@ static int b43_lpphy_op_init(struct b43_wldev *dev)
        lpphy_baseband_init(dev);
        lpphy_radio_init(dev);
        lpphy_calibrate_rc(dev);
-       err = b43_lpphy_op_switch_channel(dev,
-                               b43_lpphy_op_get_default_chan(dev));
+       err = b43_lpphy_op_switch_channel(dev, 7);
        if (err) {
-               b43dbg(dev->wl, "Switch to init channel failed, error = %d.\n",
+               b43dbg(dev->wl, "Switch to channel 7 failed, error = %d.\n",
                       err);
        }
        lpphy_tx_pctl_init(dev);
@@ -2222,6 +2230,7 @@ const struct b43_phy_operations b43_phyops_lp = {
        .init                   = b43_lpphy_op_init,
        .phy_read               = b43_lpphy_op_read,
        .phy_write              = b43_lpphy_op_write,
+       .phy_maskset            = b43_lpphy_op_maskset,
        .radio_read             = b43_lpphy_op_radio_read,
        .radio_write            = b43_lpphy_op_radio_write,
        .software_rfkill        = b43_lpphy_op_software_rfkill,

diff --git a/drivers/net/wireless/b43/phy_lp.h b/drivers/net/wireless/b43/phy_lp.h
index e158d1f66c0eef5d0810e3252a32b2efe043fb77..c3232c17b60a4d7b070373a59a480b7d1a09910c 100644 (file)
--- a/drivers/net/wireless/b43/phy_lp.h
+++ b/drivers/net/wireless/b43/phy_lp.h
@@ -888,6 +888,9 @@ struct b43_phy_lp {
        bool crs_usr_disable, crs_sys_disable;
 
        unsigned int pdiv;
+
+       /* The channel we are tuned to */
+       u8 channel;
 };
 
 enum tssi_mux_mode {

diff --git a/drivers/net/wireless/b43/tables_lpphy.c b/drivers/net/wireless/b43/tables_lpphy.c
index 60d472f285afa259bbf675770c0e88af302ebd96..c784def19b192b8c9f3f4695ca2fc07424e2c25c 100644 (file)
--- a/drivers/net/wireless/b43/tables_lpphy.c
+++ b/drivers/net/wireless/b43/tables_lpphy.c
@@ -624,30 +624,35 @@ u32 b43_lptab_read(struct b43_wldev *dev, u32 offset)
 void b43_lptab_read_bulk(struct b43_wldev *dev, u32 offset,
                         unsigned int nr_elements, void *_data)
 {
-       u32 type, value;
+       u32 type;
        u8 *data = _data;
        unsigned int i;
 
        type = offset & B43_LPTAB_TYPEMASK;
+       offset &= ~B43_LPTAB_TYPEMASK;
+       B43_WARN_ON(offset > 0xFFFF);
+
+       b43_phy_write(dev, B43_LPPHY_TABLE_ADDR, offset);
+
        for (i = 0; i < nr_elements; i++) {
-               value = b43_lptab_read(dev, offset);
                switch (type) {
                case B43_LPTAB_8BIT:
-                       *data = value;
+                       *data = b43_phy_read(dev, B43_LPPHY_TABLEDATALO) & 0xFF;
                        data++;
                        break;
                case B43_LPTAB_16BIT:
-                       *((u16 *)data) = value;
+                       *((u16 *)data) = b43_phy_read(dev, B43_LPPHY_TABLEDATALO);
                        data += 2;
                        break;
                case B43_LPTAB_32BIT:
-                       *((u32 *)data) = value;
+                       *((u32 *)data) = b43_phy_read(dev, B43_LPPHY_TABLEDATAHI);
+                       *((u32 *)data) <<= 16;
+                       *((u32 *)data) |= b43_phy_read(dev, B43_LPPHY_TABLEDATALO);
                        data += 4;
                        break;
                default:
                        B43_WARN_ON(1);
                }
-               offset++;
        }
 }
 
@@ -688,26 +693,34 @@ void b43_lptab_write_bulk(struct b43_wldev *dev, u32 offset,
        unsigned int i;
 
        type = offset & B43_LPTAB_TYPEMASK;
+       offset &= ~B43_LPTAB_TYPEMASK;
+       B43_WARN_ON(offset > 0xFFFF);
+
+       b43_phy_write(dev, B43_LPPHY_TABLE_ADDR, offset);
+
        for (i = 0; i < nr_elements; i++) {
                switch (type) {
                case B43_LPTAB_8BIT:
                        value = *data;
                        data++;
+                       B43_WARN_ON(value & ~0xFF);
+                       b43_phy_write(dev, B43_LPPHY_TABLEDATALO, value);
                        break;
                case B43_LPTAB_16BIT:
                        value = *((u16 *)data);
                        data += 2;
+                       B43_WARN_ON(value & ~0xFFFF);
+                       b43_phy_write(dev, B43_LPPHY_TABLEDATALO, value);
                        break;
                case B43_LPTAB_32BIT:
                        value = *((u32 *)data);
                        data += 4;
+                       b43_phy_write(dev, B43_LPPHY_TABLEDATAHI, value >> 16);
+                       b43_phy_write(dev, B43_LPPHY_TABLEDATALO, value);
                        break;
                default:
                        B43_WARN_ON(1);
-                       value = 0;
                }
-               b43_lptab_write(dev, offset, value);
-               offset++;
        }
 }
 
@@ -777,7 +790,7 @@ static const u8 lpphy_pll_fraction_table[] = {
        0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80,
 };
 
-static const u16 lpphy_iq_local_table[] = {
+static const u16 lpphy_iqlo_cal_table[] = {
        0x0200, 0x0300, 0x0400, 0x0600, 0x0800, 0x0b00, 0x1000, 0x1001, 0x1002,
        0x1003, 0x1004, 0x1005, 0x1006, 0x1007, 0x1707, 0x2007, 0x2d07, 0x4007,
        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
@@ -789,10 +802,17 @@ static const u16 lpphy_iq_local_table[] = {
        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x4000, 0x0000, 0x0000,
        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
-       0x0000, 0x0000,
+       0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
 };
 
-static const u16 lpphy_ofdm_cck_gain_table[] = {
+static const u16 lpphy_rev0_ofdm_cck_gain_table[] = {
+       0x0001, 0x0001, 0x0001, 0x0001, 0x1001, 0x2001, 0x3001, 0x4001, 0x5001,
+       0x6001, 0x7001, 0x7011, 0x7021, 0x2035, 0x2045, 0x2055, 0x2065, 0x2075,
+       0x006d, 0x007d, 0x014d, 0x015d, 0x115d, 0x035d, 0x135d, 0x055d, 0x155d,
+       0x0d5d, 0x1d5d, 0x2d5d, 0x555d, 0x655d, 0x755d,
+};
+
+static const u16 lpphy_rev1_ofdm_cck_gain_table[] = {
        0x5000, 0x6000, 0x7000, 0x0001, 0x1001, 0x2001, 0x3001, 0x4001, 0x5001,
        0x6001, 0x7001, 0x7011, 0x7021, 0x2035, 0x2045, 0x2055, 0x2065, 0x2075,
        0x006d, 0x007d, 0x014d, 0x015d, 0x115d, 0x035d, 0x135d, 0x055d, 0x155d,
@@ -2263,11 +2283,18 @@ void lpphy_rev0_1_table_init(struct b43_wldev *dev)
        b43_lptab_write_bulk(dev, B43_LPTAB8(6, 0),
                ARRAY_SIZE(lpphy_pll_fraction_table), lpphy_pll_fraction_table);
        b43_lptab_write_bulk(dev, B43_LPTAB16(0, 0),
-               ARRAY_SIZE(lpphy_iq_local_table), lpphy_iq_local_table);
-       b43_lptab_write_bulk(dev, B43_LPTAB16(13, 0),
-               ARRAY_SIZE(lpphy_ofdm_cck_gain_table), lpphy_ofdm_cck_gain_table);
-       b43_lptab_write_bulk(dev, B43_LPTAB16(12, 0),
-               ARRAY_SIZE(lpphy_ofdm_cck_gain_table), lpphy_ofdm_cck_gain_table);
+               ARRAY_SIZE(lpphy_iqlo_cal_table), lpphy_iqlo_cal_table);
+       if (dev->phy.rev == 0) {
+               b43_lptab_write_bulk(dev, B43_LPTAB16(13, 0),
+                       ARRAY_SIZE(lpphy_rev0_ofdm_cck_gain_table), lpphy_rev0_ofdm_cck_gain_table);
+               b43_lptab_write_bulk(dev, B43_LPTAB16(12, 0),
+                       ARRAY_SIZE(lpphy_rev0_ofdm_cck_gain_table), lpphy_rev0_ofdm_cck_gain_table);
+       } else {
+               b43_lptab_write_bulk(dev, B43_LPTAB16(13, 0),
+                       ARRAY_SIZE(lpphy_rev1_ofdm_cck_gain_table), lpphy_rev1_ofdm_cck_gain_table);
+               b43_lptab_write_bulk(dev, B43_LPTAB16(12, 0),
+                       ARRAY_SIZE(lpphy_rev1_ofdm_cck_gain_table), lpphy_rev1_ofdm_cck_gain_table);
+}
        b43_lptab_write_bulk(dev, B43_LPTAB16(15, 0),
                ARRAY_SIZE(lpphy_gain_delta_table), lpphy_gain_delta_table);
        b43_lptab_write_bulk(dev, B43_LPTAB32(10, 0),
@@ -2281,22 +2308,6 @@ void lpphy_rev2plus_table_init(struct b43_wldev *dev)
 
        B43_WARN_ON(dev->phy.rev < 2);
 
-       /*
-        * FIXME This code follows the specs, but it looks wrong:
-        * In each pass, it writes 4 bytes to an offset in table ID 7,
-        * then increments the offset by 1 for the next pass. This results
-        * in the first 3 bytes of each pass except the first one getting
-        * written to a location that has already been zeroed in the previous
-        * pass.
-        * This is what the vendor driver does, but it still looks suspicious.
-        *
-        * This should probably suffice:
-        *
-        * for (i = 0; i < 704; i+=4)
-        *      b43_lptab_write(dev, B43_LPTAB32(7, i), 0)
-        *
-        * This should be tested once the code is functional.
-        */
        for (i = 0; i < 704; i++)
                b43_lptab_write(dev, B43_LPTAB32(7, i), 0);
 
@@ -2323,7 +2334,7 @@ void lpphy_rev2plus_table_init(struct b43_wldev *dev)
        b43_lptab_write_bulk(dev, B43_LPTAB8(6, 0),
                ARRAY_SIZE(lpphy_pll_fraction_table), lpphy_pll_fraction_table);
        b43_lptab_write_bulk(dev, B43_LPTAB16(0, 0),
-               ARRAY_SIZE(lpphy_iq_local_table), lpphy_iq_local_table);
+               ARRAY_SIZE(lpphy_iqlo_cal_table), lpphy_iqlo_cal_table);
        b43_lptab_write_bulk(dev, B43_LPTAB32(9, 0),
                ARRAY_SIZE(lpphy_papd_eps_table), lpphy_papd_eps_table);
        b43_lptab_write_bulk(dev, B43_LPTAB32(10, 0),