[RFC] b43: working AC-PHY support for BCM4352/BCM4360

[Ville Takio]

Hi,

b43 has carried an AC-PHY stub (B43_PHY_AC, "BROKEN") since 2015. Alessio
Ferri has since written a working AC-PHY and radio 2069 implementation
[1], and I have spent the last months bringing it up on a Northstar router
and fixing what was missing. It now runs as an access point on both bands
at throughput comparable to Broadcom's wl driver on the same board. Before
preparing a series for wireless-next I would like to ask how, or whether,
you would like to receive it.

Hardware tested
  ASUS RT-AC66U B1 (same board as RT-AC68U): BCM4708 SoC, two BCM4360
  (core rev 42, AC-PHY rev 1, radio 2069 rev 4, femctrl 3) on PCIe/bcma.
  Kernel 6.18 with backports 7.2, as OpenWrt [2].

Firmware
  784.2 from Broadcom's 6.30.163.46 driver (ucode42 and the ac1 initvals),
  extracted with the existing b43-fwcutter.

Results (1x1 client at short range, iperf3 down/up, Mbit/s)
  2.4 GHz HT20      40-47 / 51-55
  2.4 GHz HT40      59 / 94
  5 GHz VHT80       134-137 / 139-163
  wl 7.14 measured on the same router: 119/164 on 5 GHz and 49/50 on 2.4 GHz.

What works
  - PHY/radio init, channel switching across 20/40/80 MHz, both bands
  - TX IQ/LO and RX IQ calibration, temperature-driven recalibration
  - TX power from the SROM (rev 11), including the 2.4 GHz 40 MHz
    power-detector offset
  - FEM control for femctrl 3; AGC init/clip gains computed from the SROM
    RX gain context per sub-band (the AGC registers now match wl on all
    three cores of both bands except one 2-bit field at 5 GHz 20 MHz)
  - AP mode via mac80211/hostapd; DFS behind a separate Kconfig option
    that depends on CFG80211_CERTIFICATION_ONUS

What does not / is untested
  - only femctrl 3 has a FEM table; other boards are refused on purpose
    rather than given a table that might damage the front end
  - only the 4352/4360 family; no 4350/43602
  - STA mode is untested; no TX beamforming
  - many values are tables and register writes specific to these chips;
    they are tied to chip and PHY revision where I could verify it

Size and layout
  About 18k added lines. Most of it is in new files under b43/ (phy_ac.c,
  radio_2069.c, tables_phy_ac.c, ppr_ac.c, helpers_phy_ac.c); the rest
  touches main.c, dma.c, xmit.c and phy_common.c. bcma and ssb need about
  700 lines for the BCM4352/BCM4360 family and SROM rev 11 fields
  (PMU/PLL setup, SROM extraction, NVRAM fallbacks on bcm47xx).

How the values were obtained
  Register and table values were captured from the running hardware
  under Broadcom's wl driver (stock ASUS firmware and DD-WRT). The
  sequencing and the formulas (gain split, calibration ladders, power
  offsets) were derived from analysing the wl 7.14 binary. This is not
  the two-team clean-room process the original b43 specifications used.
  If that rules the code out for mainline, I would rather know now.

Questions
  1. Is a new PHY in b43 (Orphan) still welcome, and through which tree:
     wireless-next directly, or via bcma first for the bus parts?
  2. Preferred split? I would propose bcma/ssb first, then the b43 core
     changes, then the AC-PHY in a few large patches (tables, radio,
     PHY, calibration), then the fixes on top.
  3. Is anyone willing to review or co-maintain it? I can test on the
     BCM4360 boards I have and keep it working.

Authorship: the base AC-PHY implementation is Alessio Ferri's; I have
asked him for his Signed-off-by and whether he wants to submit his part
himself [3]. Rosen Penev has N-PHY and HT-PHY patches and suggested
carrying all of this out of tree in OpenWrt for now [4], which is the
plan until upstream direction is clear.

The current patches (against backports 7.2) are in [2].

[1] https://github.com/aleferri/b43-ac-wip
[2] https://github.com/openwrt/openwrt/pull/26349
[3] https://github.com/aleferri/b43-ac-wip/issues/10
[4] https://github.com/openwrt/openwrt/pull/26349#issuecomment-6549024998

Thanks,
Ville Takio