Wii:WLAN

From gc-linux

Jump to: navigation, search

Contents

WLAN Card Architecture Overview

The following hand-crafted ascii-art chart illustrates the main functional blocks present in the Nintendo Wii WLAN daughter card:

  • The small block on the left side represents the second SDHCI controller on the motherboard of the Nintendo Wii.
  • The large block on the right side represents the chipset on the Nintendo Wii WLAN card.


                    ...........................................................
                   :                                                           :
                   :                            +-------------+  +---------+   :
                   :                            |             |  |         |   :
                   :                            | ChipCommon  |  | PCMCIA  |   :
                   :                            |             |  |         |   :
                   :                            +----v--------+  +----v----+   :
+--------------+   :                                 |                |        :
|              |   :  +----------------+             |                |        :
| SDHCI        |   :  |                |        +----^----------------^----+   :
| Controller   >------< Host Interface >---//---< Sonics Silicon Backplane |   :
|              |   :  |     (SDIO)     |        +----v----------------v----+   :
| @ 0d080000   |   :  |                |             |                |        :
|              |   :  +----------------+             |                |        :
+--------------+   :                            +----^--------+  +----^-----+  :
                   :                            |             |  |          |  :
                   :                            | 802.11      |  | PCI      |  :
                   :                            | 4318        |  |          |  :
                   :                            +-------------+  +----------+  :
                   :                                                           :
                   :                                                  BCM4318E :
                    ...........................................................

                <------------------------------->
                <----->                     ^
                   ^                        |
                   |                        |
                   |                        \_____ SSB over SDIO Layer
                   |
                   \______________________________ SDIO Layer

The Nintendo Wii WLAN daughter card is powered by a Broadcom BCM4318E chipset. This chipset includes an internal switched backplane (called Sonics Silicon Backplane, SSB) that interconnects the different functional blocks (called cores) within the chipset.

The 4318 chipset at the heart of the Nintendo Wii WLAN card has 4 cores (including core 0):

  • ChipCommon (typical core used in SSB to control chipset-wide functionality)
  • 802.11 (WLAN core)
  • PCI
  • PCMCIA

The included SDIO host interface enables communication between the Nintendo Wii video game console and the 4318 chipset in the WLAN card.

Note that the chipset does not expose a SDIO core through the SSB backplane. It is believed that the existing SDIO host interface is not part of the SSB. Instead, it probably interfaces directly to the PCMCIA (more probable) or PCI (less probable) core. Nevertheless, this is just speculation.


For more information about the Sonics Silicon Backplane, please refer to:

SDIO (Secure Digital Input Output) Layer

This layer allows communication between the Nintendo Wii video game console and the SDIO host interface present on the Nintendo Wii WLAN card.

A custom 20-pin header connector which includes signals for a 4-bit SDIO interface connects the WLAN card to the video game console.

The Nintendo Wii WLAN card:

  • can be accessed via the embedded standard SDIO Host Controller at 0x0d080000 using Hollywood IRQ 8
  • identifies itself as vendor 0x02d0 (VENDOR_BROADCOM_PCMCIA), device 0x044b (SD4318_BOARD)
  • reports 2 SDIO functions (function 0 and function 1)
  • allows access to the Sonics Silicon Backplane of the Broadcom 4318 chip through SDIO function 1
  • reports hardware information via tuples in the Card Information Structure (CIS)


Tuples

The structure of the tuples reported by the Nintendo Wii WLAN card matches the PCMCIA definitions found in https://dev.openwrt.org/browser/trunk/target/linux/brcm-2.4/files/arch/mips/bcm947xx/include/sbpcmcia.h

Extended Functions, FUNCE (type 0x22)

The card reports the MAC address via a PCMCIA-like FUNCE (type 0x22) tuple.

04 06 00 1d bc 62 79 fd
^^ ^^ ^^^^^^^^^^^^^^^^^
 |  |                 |
 |  |                 +--- MAC address
 |  +--------------------- length (6 bytes for a ethernet MAC address)
 +------------------------ type 4 (CISTPL_FUNCE_LAN_NODE_ID)

Vendor Tuples (type 0x80)

The rest of the information is reported via vendor specific (type 0x80) tuples. The vendor specific tuples contain a subtype (1 byte) and the vendor data. The length of the vendor data is the length of the tuple minus one (the subtype byte).

SROMREV (subtype 0x00)

Definition

#define HNBU_SROMREV            0x00            /* A byte with sromrev, 1 if not present */

Sample dump data

[    1.915859] mmc1: queuing CIS tuple 0x80 length 2
[    1.921226]  00000000: 00 02                                            ..
                          ^^ ^^
                           |  |
                           |  +---- SROM Revision
                           +------- vendor tuple subtype 

Sample dump interpretation

SROM Revision 2
CHIPID (subtype 0x01)

Definition

#define HNBU_CHIPID             0x01            /* Two 16bit values: PCI vendor & device id */

Sample dump data

[    1.935441] mmc1: queuing CIS tuple 0x80 length 5
[    1.940392]  00000000: 01 e4 14 18 43                                   ....C
                          ^^ ^^^^^ ^^^^^
                           |     |     |
                           |     |     +---- Device ID
                           |     +---------- Vendor ID
                           +---------------- vendor tuple subtype 

Sample dump interpretation

Two 16-bit values stored in little endian mode
PCI ID 0x14e4:0x4318 BCM4318 [AirForce One 54g] 802.11g Wireless LAN Controller
BOARDREV (subtype 0x02)

Definition

#define HNBU_BOARDREV           0x02            /* One byte board revision */

Sample dump data

[    1.952230] mmc1: queuing CIS tuple 0x80 length 2
[    1.956971]  00000000: 02 32                                            .2
                          ^^ ^^
                           |  |
                           |  +---- Board Revision
                           +------- vendor tuple subtype 

Sample dump interpretation

Revision 2
PAPARAMS (subtype 0x03)

Definition

#define HNBU_PAPARMS            0x03            /* PA parameters: 8 (sromrev == 1)
                                                 * or 9 (sromrev > 1) bytes

Sample dump data

[    2.001521] mmc1: queuing CIS tuple 0x80 length 10
[    2.006172]  00000000: 03 3b 15 80 fa 77 fe 3e 3d 04                    .;...w.>=.
                          ^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^
                           |                          |
                           |                          +---- power amplifier parameters
                           +------------------------------- vendor tuple subtype 

Sample dump interpretation

FIXME!
AA (subtype 0x06)

Definition

#define HNBU_AA                 0x06            /* Antennas available */

Sample dump data

[    2.015473] mmc1: queuing CIS tuple 0x80 length 2
[    2.020156]  00000000: 06 03                                            ..
                          ^^ ^^
                           |  |
                           |  +---- Antennas available
                           +------- vendor tuple subtype 

Sample dump interpretation

2 antennas available (1 bit set for each antenna available)
AG (subtype 0x07)

Definition

#define HNBU_AG                 0x07            /* Antenna gain */

Sample dump data

[    2.029343] mmc1: queuing CIS tuple 0x80 length 2
[    2.033958]  00000000: 07 02                                            ..
                          ^^ ^^
                           |  |
                           |  +---- Antenna gain
                           +------- vendor tuple subtype 

Sample dump interpretation

FIXME!
BOARDFLAGS (subtype 0x08)

FIXME!

Definition

#define HNBU_BOARDFLAGS         0x08            /* board flags (2 or 4 bytes) */

Sample dump data

[    1.970098] mmc1: queuing CIS tuple 0x80 length 5
[    1.974635]  00000000: 08 08 88 00 00                                   .....
                          ^^ ^^^^^^^^^^^
                           |           |
                           |           +---- board flags
                           +---------------- vendor tuple subtype 

Sample dump interpretation

?? Little endian?
?? #define BFL_ADCDIV              0x00000008      /* This board has the rssi ADC divider */
?? #define BFL_FEM                 0x00000800      /* This board supports the Front End Module */
?? #define BFL_ALTIQ               0x00008000      /* Alternate I/Q settings */
LEDS (subtype 0x09)

Definition

#define HNBU_LEDS               0x09            /* LED set */

Sample dump data

[    2.042953] mmc1: queuing CIS tuple 0x80 length 5
[    2.047419]  00000000: 09 ff ff ff ff                                   .....
                          ^^ ^^^^^^^^^^^
                           |           |
                           |           +---- LED set
                           +---------------- vendor tuple subtype 

Sample dump interpretation

No LEDs available (the four LED descriptors are all ones)
CCODE (subtype 0x0a)

Definition

#define HNBU_CCODE              0x0a            /* Country code (2 bytes ascii + 1 byte cctl)
                                                 * in rev 2 */

Sample dump data

[    2.056323] mmc1: queuing CIS tuple 0x80 length 4
[    2.060780]  00000000: 0a 47 42 00                                      .GB.

Sample dump interpretation

GB -> ISO Country Code for the United Kingdom
FIXME: maybe GB means GloBal here...


Function 1 Register Space

SDIO function 1 allows access to the BCM4318E chipset in the Nintendo Wii WLAN card.

The register address space (128KiB) for SDIO function 1 in the Nintendo Wii WLAN card is further divided into two additional address spaces as shown in the following table.

Start End Size Description
0x00000 0x0ffff 64K MMIO
0x10000 0x1ffff 64K Control Registers

MMIO

The MMIO address space maps to the portion of the Sonic's Silicon Backplane address space specified by the SBADDRLOW, SBADDRMID and SBADDRHIGH control registers. See #SSB Input/Output for additional information.

Control Registers

The second address space gives access to a set of registers that can be used to control the Sonic's Silicon Backplane of the internal Nintendo Wii WLAN card. Some of these registers seem to be described in http://android.git.kernel.org/?p=platform/system/wlan/broadcom.git;a=blob;f=src/include/sbsdio.h

#define SBSDIO_SPROM_CS         0x10000 /* sprom command and status */
#define SBSDIO_SPROM_INFO       0x10001 /* sprom info register */
#define SBSDIO_SPROM_DATA_LOW   0x10002 /* sprom indirect access data byte 0 */
#define SBSDIO_SPROM_DATA_HIGH  0x10003 /* sprom indirect access data byte 1 */
#define SBSDIO_SPROM_ADDR_LOW   0x10004 /* sprom indirect access addr byte 0 */
#define SBSDIO_SPROM_ADDR_HIGH  0x10005 /* sprom indirect access addr byte 1 */
#define SBSDIO_CHIP_CTRL_DATA   0x10006 /* xtal_pu (gpio) output */
#define SBSDIO_CHIP_CTRL_EN     0x10007 /* xtal_pu (gpio) enable */
#define SBSDIO_WATERMARK        0x10008 /* rev < 7, watermark for sdio device */
#define SBSDIO_DEVICE_CTL       0x10009 /* control busy signal generation */
#define SBSDIO_FUNC1_SBADDRLOW  0x1000A /* SB Address Window Low (b15) */
#define SBSDIO_FUNC1_SBADDRMID  0x1000B /* SB Address Window Mid (b23-b16) */
#define SBSDIO_FUNC1_SBADDRHIGH 0x1000C /* SB Address Window High (b24-b31) */
#define SBSDIO_FUNC1_FRAMECTRL  0x1000D /* Frame Control (frame term/abort) */
#define SBSDIO_FUNC1_CHIPCLKCSR 0x1000E /* ChipClockCSR (ALP/HT ctl/status) */
#define SBSDIO_FUNC1_SDIOPULLUP 0x1000F /* SdioPullUp (on cmd, d0-d2) */
#define SBSDIO_FUNC1_WFRAMEBCLO 0x10019 /* Write Frame Byte Count Low */
#define SBSDIO_FUNC1_WFRAMEBCHI 0x1001A /* Write Frame Byte Count High */
#define SBSDIO_FUNC1_RFRAMEBCLO 0x1001B /* Read Frame Byte Count Low */
#define SBSDIO_FUNC1_RFRAMEBCHI 0x1001C /* Read Frame Byte Count High */


SDIO Input/Output

Access to the SDIO address space is done using CMD52 (IO_RW_DIRECT) for 8-bit accesses and CMD53 (IO_RW_EXTENDED) for 16-bit and 32-bit accesses. Please, refer to SD Specifications Part E1 SDIO Simplified Specification for additional information.

The width and endianness of the registers accessible via the MMIO region (first 64KiB addressing range) depend on the mapped SSB core at the SSB address window.

The backplane control registers (sitting on the second 64KiB addressing range) are 8-bit registers.


SDIO Read access

SDIO 8-bit Read
Command Response (R5)
  • CMD52
  • R/W flag set to 0
  • Read after Write set to 0
  • Function number (0 for Common I/O Area, 1 for WLAN card)
  • Register Address set to the desired offset into the SDIO address space
  • Write Data/Stuff bits set to 0
  • Read or Write Data contains the value read.
SDIO 16-bit Read
Command Response (R5)
  • CMD53
  • R/W flag set to 0
  • Function number (0 for Common I/O Area, 1 for WLAN card)
  • Block Mode set to 0
  • OP code set to 1
  • Register Address set to the desired offset into the SDIO address space
  • Byte/Block count set to 2
  • Read data is returned on the DAT line, as in CMD17.
  • Read or Write Data contains 0s
SDIO 32-bit Read
Command Response (R5)
  • CMD53
  • R/W flag set to 0
  • Function number (0 for Common I/O Area, 1 for WLAN card)
  • Block Mode set to 0
  • OP code set to 1
  • Register Address set to the desired offset into the SDIO address space
  • Byte/Block count set to 4
  • Read data is returned on the DAT line, as in CMD17.
  • Read or Write Data contains 0s
SDIO FIFO Read
Command Response (R5)
  • CMD53
  • R/W flag set to 0
  • Function number (0 for Common I/O Area, 1 for WLAN card)
  • Block Mode set to 0 or 1 accordingly
  • OP code set to 0
  • Register Address set to the desired FIFO offset into the SDIO address space
  • Byte/Block count set accordingly
  • Read data is returned on the DAT line, as in CMD17.
  • Read or Write Data contains 0s

Note that a number of block mode or byte mode operations can be used to satisfy a FIFO request. The best results can be obtained by using block mode with a block size of 64 bytes for most of the transfer, and byte mode for the remainder of the transfer if applicable.

SDIO Write access

SDIO 8-bit Write
Command Response (R5)
  • CMD52
  • R/W flag set to 1
  • Read after Write set to 0
  • Function number (0 for Common I/O Area, 1 for WLAN card)
  • Register Address set to the desired offset into the SDIO address space
  • Write Data/Stuff bits set to the value written
  • Read or Write Data contains the value written
SDIO 16-bit Write
Command Response (R5)
  • CMD53
  • R/W flag set to 1
  • Function number (0 for Common I/O Area, 1 for WLAN card)
  • Block Mode set to 0
  • OP code set to 1
  • Register Address set to the desired offset into the SDIO address space
  • Byte/Block count set to 2
  • Written data must be provided on the DAT line, as in CMD24.
  • Read or Write Data contains 0s
SDIO 32-bit Write
Command Response (R5)
  • CMD53
  • R/W flag set to 1
  • Function number (0 for Common I/O Area, 1 for WLAN card)
  • Block Mode set to 0
  • OP code set to 1
  • Register Address set to the desired offset into the SDIO address space
  • Byte/Block count set to 4
  • Written data must be provided on the DAT line, as in CMD24.
  • Read or Write Data contains 0s
SDIO FIFO Write
Command Response (R5)
  • CMD53
  • R/W flag set to 1
  • Function number (0 for Common I/O Area, 1 for WLAN card)
  • Block Mode set to 0 or 1 accordingly
  • OP code set to 0
  • Register Address set to the desired FIFO offset into the SDIO address space
  • Byte/Block count set accordingly
  • Written data must be provided on the DAT line, as in CMD24.
  • Read or Write Data contains 0s

Note that a number of block mode or byte mode operations can be used to satisfy a FIFO request. The best results can be obtained by using block mode with a block size of 64 bytes for most of the transfer, and byte mode for the remainder of the transfer if applicable.


SSB (Sonics Silicon Backplane) over SDIO layer

This layer enables communication between the Nintendo Wii video game console and the Sonics Silicon Backplane of the 4318 chipset.

The following sections describe the specifics of the SSB over SDIO interface present in the Nintendo Wii WLAN daughter card. For a general description of the operation of a Sonics Silicon Backplane, please refer to the links pointed in the #WLAN Card Architecture Overview section.

SSB Address Map

This is the address map of the Sonics Silicon Backplane found on the Nintendo Wii WLAN daughter card.

Start End Size Description
0x18000000 0x18000fff 4K Core 0 (ChipCommon)
0x18001000 0x18001fff 4K Core 1 (IEEE 802.11)
0x18002000 0x18002fff 4K Core 2 (PCI)
0x18003000 0x18003fff 4K Core 3 (PCMCIA)

SSB Core Register Space

Each core on the Sonics Silicon Backplane has a set of common registers (present on all cores) and a set of core dependent registers.

The register space for each core starts at address 0x18000000 + (core_index * 4K). Start and End fields on the following table reflect offsets within each core register space.

Start End Size Description
0x0000 0x0dff 3584 bytes Core dependent registers
0x0e00 0x0fff 512 bytes Common registers

SSB Input/Output

A core must be first "focused", or switched to, before performing any input/output on it.

Switching Between SSB Cores

Switching to a given core involves setting the Sonics Silicon Backplane address window to the base of the register address space of the core (see column Start on #SSB Address Map). The Sonics Silicon Backplane address window defines the address prefix (of up to 17 high order bits) used when accessing the SSB address space. The length of the address window is 64KiB, as the length of the #MMIO region.

The Sonics Silicon Backplane address window is controlled through the SDIO function 1 control registers SBADDRLOW, SBADDRMID and SBADDRHIGH.

Setting the SSB Address Window

Given a 32-bit address window base:

  • write bits 15-8 of the address window base masked with 0x80 to register 0x1000a (SBADDRLOW) executing a #SDIO 8-bit Write
  • write bits 23-16 of the address window base to register 0x1000b (SBADDRMID) executing a #SDIO 8-bit Write
  • write bits 31-24 of the address window base to register 0x1000c (SBADDRHIGH) executing a #SDIO 8-bit Write

Effective SSB Address Calculation

The effective address used in any input/output operation carried over the Sonics Silicon Backplane via the SDIO host interface is determined by the current configured SSB address window base and the offset specified for the operation.

This 32-bit effective address is computed by OR'ing the 17 high order bits of the 32-bit address window base with the 16-bit offset of the I/O operation.

 b31 b30 b29 b28 b27 b26 b25 b24 b23 b22 b21 b20 b19 b18 b17 b16 b15 b14 b13 b12 b11 b10 b09 b08 b07 b06 b05 b04 b03 b02 b01 b00
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
|W31|W30|W29|W28|W27|W26|W25|W24|W23|W22|W21|W20|W19|W18|W17|W16|W15| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | SSB Address Window Base
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |O15|O14|O13|O12|O11|O10|O09|O08|O07|O06|O05|O04|O03|O02|O01|O00| Offset of I/O Operation
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

Note that bit 15 of the effective address can be influenced by both the address window base and the offset of the operation.

SSB 32-bit Input/Output Flag

Bit 15 of the effective address of a SSB I/O operation is used to indicate if the operation requested is a 32-bit operation, in contrast to a 16-bit operation. This is supposedly used by the SDIO host interface to disambiguate the desired access width of a CMD53 command with a length multiple of 4.

Read access

This section describes 16-bit and 32-bit read operations on the Sonics Silicon Backplane via the SDIO host interface. 8-bit reads are not described, as they are not required for the operation of the Nintendo Wii WLAN card.

SSB 16-bit Read

Given a Sonics Silicon Backplane 32-bit address address:

  • If address does not fall within the current configured SSB address window, set the SSB address window base to address masked with 0xffff0000 (see #Setting the SSB Address Window)
  • Calculate offset as address masked with 0x7fff
  • Read a 16-bit value from address offset of SDIO function 1 (see #SDIO 16-bit Read).
SSB 32-bit Read

Given a Sonics Silicon Backplane 32-bit address address:

  • If address does not fall within the current configured SSB address window, set the SSB address window base to address masked with 0xffff0000 (see #Setting the SSB Address Window)
  • Calculate offset as address masked with 0x7fff
  • Set 32-bit access flag by OR'ing offset with 0x8000
  • Read a 32-bit value from address offset of SDIO function 1 (see #SDIO 32-bit Read).
SSB Block Read (FIFO)

Given a Sonics Silicon Backplane 32-bit address address, an access width width in bytes, and a length len in bytes (multiple of the access width):

  • If address does not fall within the current configured SSB address window, set the SSB address window base to address masked with 0xffff0000 (see #Setting the SSB Address Window)
  • Calculate offset as address masked with 0x7fff
  • If the access width width is 4 bytes, set the 32-bit access flag by OR'ing offset with 0x8000
  • Read len bytes from address offset of SDIO function 1 using as many #SDIO FIFO Read operations as needed, taking into account that the block size of the function is 64 bytes.

Write access

This section describes 16-bit and 32-bit write operations on the Sonics Silicon Backplane via the SDIO host interface. 8-bit writes are not described, as they are not required for the operation of the Nintendo Wii WLAN card.

SSB 16-bit Write

Given a Sonics Silicon Backplane 32-bit address address and a 16-bit value val:

  • If address does not fall within the current configured SSB address window, set the SSB address window base to address masked with 0xffff0000 (see #Setting the SSB Address Window)
  • Calculate offset as address masked with 0x7fff
  • Write val to address offset of SDIO function 1 (see #SDIO 16-bit Write).
SSB 32-bit Write

Given a Sonics Silicon Backplane 32-bit address address and a 32-bit value val:

  • If address does not fall within the current configured SSB address window, set the SSB address window base to address masked with 0xffff0000 (see #Setting the SSB Address Window)
  • Calculate offset as address masked with 0x7fff
  • Set 32-bit access flag by OR'ing offset with 0x8000
  • Write val to address offset of SDIO function 1 (see #SDIO 32-bit Write).

For obscure reasons, the SDIO 32-bit write needs to be followed by a dummy SDIO 32-bit read to avoid getting garbage on a subsequent read. So this is needed too for now:

SSB Block Write (FIFO)

Given a Sonics Silicon Backplane 32-bit address address, an access width width in bytes, and a length len in bytes (multiple of the access width):

  • If address does not fall within the current configured SSB address window, set the SSB address window base to address masked with 0xffff0000 (see #Setting the SSB Address Window)
  • Calculate offset as address masked with 0x7fff
  • If the access width width is 4 bytes, set the 32-bit access flag by OR'ing offset with 0x8000
  • Write len bytes to address offset of SDIO function 1 using as many #SDIO FIFO Write operations as needed, taking into account that the block size of the function is 64 bytes.


4318 layer

The Nintendo Wii WLAN card includes a standard 4318 802.11 core.

Please, refer to the bcm-specs 802.11 documentation for additional information about this core.


Firmware

The Nintendo Wii WLAN card has been successfully tested with version 5.2 of the OpenFWWF firmware. This firmware is licensed under GPLv2 and is freely redistributable.


Linux Kernel Driver

The b43 driver in the Linux kernel is capable of managing the 4318 core in the BCM4318E chipset found on the Nintendo Wii WLAN card. However, the current b43 kernel driver only supports PCI, PCMCIA and SSB host interfaces (not SDIO), and it is incompatible with the locking required by the Linux SDIO stack.

A patchset to add SSB over SDIO support to the Linux kernel and to overcome the current b43 driver limitations has been developed.

Tested hardware

  • Nintendo Wii WLAN card (SDIO vendor 0x02d0 device 0x044b)
    • 4318 core rev 9
    • G PHY rev 7
    • 0x2050 radio rev 8

Tested working enviroments

The following configurations have been tested and are known to work.

Ad-hoc

  • 64-bit PC running fully patched Ubuntu 9.04 "Jaunty" with USB 802.11g wireless network card (D-Link DWL-G122 H/W Ver.:C1 F/W Ver.: 3.10)
  • Nintendo Wii running gc-linux.org 2.6.30 WLAN-enabled kernel
  • Security settings (any of):
    • Open
    • 128-bit WEP
    • WPA2 AES-CCMP

Infrastructure

  • WRT54G ver 2 running DD-WRT v24 preSP2 [Beta] Build 12533
  • Nintendo Wii running gc-linux.org 2.6.30 WLAN-enabled kernel
  • Security settings (any of):
    • Open
    • 128-bit WEP
    • WPA2 AES-CCMP

Relevant dmesg output (Infrastructure)

whiite:~# dmesg | egrep "b43|mmc1|phy|sdio|wlan"
[    1.033802] mmc1: SDHCI controller on d080000.sdhc1 [d080000.sdhc1] using DMA
[    1.363553] mmc1: queuing CIS tuple 0x80 length 2
[    1.373003] mmc1: queuing CIS tuple 0x80 length 5
[    1.380441] mmc1: queuing CIS tuple 0x80 length 2
[    1.389520] mmc1: queuing CIS tuple 0x80 length 5
[    1.398324] mmc1: queuing CIS tuple 0x22 length 8
[    1.403196] mmc1: queuing CIS tuple 0x80 length 10
[    1.407544] mmc1: queuing CIS tuple 0x80 length 2
[    1.411728] mmc1: queuing CIS tuple 0x80 length 2
[    1.415768] mmc1: queuing CIS tuple 0x80 length 5
[    1.419728] mmc1: queuing CIS tuple 0x80 length 4
[    1.423243] mmc1: new SDIO card at address 0001
[    1.427618] b43-sdio mmc1:0001:1: Chip ID 14e4:4318
[    1.463310] b43-sdio mmc1:0001:1: switching to ChipCommon core, index 0
[    1.472707] b43-phy0: Broadcom 4318 WLAN found (core revision 9)
[    1.477253] b43-sdio mmc1:0001:1: switching to IEEE 802.11 core, index 1
[    1.508684] b43-phy0 debug: Found PHY: Analog 3, Type 2, Revision 7
[    1.513733] b43-phy0 debug: Found Radio: Manuf 0x17F, Version 0x2050, Revision 8
[    1.558536] phy0: Selected rate control algorithm 'minstrel'
[    1.565087] ssb: Sonics Silicon Backplane found on SDIO device mmc1:0001:1
[    4.834770] udev: renamed network interface wlan0 to wlan1
/* interface manually up'ed here */
[   24.417027] b43 ssb0:0: firmware: requesting b43/ucode5.fw
[   24.460231] b43 ssb0:0: firmware: requesting b43-open/ucode5.fw
[   24.502446] b43 ssb0:0: firmware: requesting b43-open/pcm5.fw
[   24.534776] b43 ssb0:0: firmware: requesting b43-open/b0g0initvals5.fw
[   24.578582] b43 ssb0:0: firmware: requesting b43-open/b0g0bsinitvals5.fw
[   25.573487] b43-phy0: Loading OpenSource firmware version 410.31754 (Hardware crypto not supported)
[   25.585541] b43-sdio mmc1:0001:1: switching to ChipCommon core, index 0
[   25.596997] b43-sdio mmc1:0001:1: switching to IEEE 802.11 core, index 1
[   25.952484] b43-phy0 debug: Chip initialized
[   25.970020] b43-phy0 debug: PIO initialized
[   26.188145] b43-phy0 debug: Wireless interface started
[   26.297324] b43-phy0 debug: Adding Interface type 2
[   26.343050] b43-phy0: Radio turned on by software
[   29.292431] wlan1: authenticate with AP 00:12:17:15:e7:79
[   29.393319] wlan1: authenticated
[   29.399086] wlan1: associate with AP 00:12:17:15:e7:79
[   29.414717] wlan1: RX AssocResp from 00:12:17:15:e7:79 (capab=0x431 status=0 aid=1)
[   29.425809] wlan1: associated

iwconfig output (Infrastructure)

whiite:~# iwconfig wlan1 | sed -e 's/ key:[^ ]*/ key:CACTUS/'
wlan1     IEEE 802.11bg  ESSID:"link01"  
          Mode:Managed  Frequency:2.442 GHz  Access Point: 00:12:17:15:E7:79   
          Bit Rate=54 Mb/s   Tx-Power=20 dBm   
          Retry min limit:7   RTS thr:off   Fragment thr:off
          Encryption key:CACTUS [2]   Security mode:open
          Power Management:off
          Link Quality=70/70  Signal level=-16 dBm  Noise level=-71 dBm
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0

Known Limitations

Throughput

The DMA engines of the 4318 core cannot be used due to the already described hardware interface (the 4318 core has no way to directly access the host memory via the SDIO interface). Thus, reception and transmission of frames must be performed through the 4318 FIFO engine which, according to the b43 developers, is only capable of offering 2-3 Mbps.

The modified b43 driver compatible with the Nintendo Wii WLAN card currently offers the following throughput numbers:

  • RX ~2.8 Mbps
  • TX ~1.8 Mbps

RX iperf test

whiite:~# iperf -s
------------------------------------------------------------
Server listening on TCP port 5001
TCP window size: 85.3 KByte (default)
------------------------------------------------------------
[  4] local 192.168.1.127 port 5001 connected with 192.168.1.130 port 40095
[ ID] Interval       Transfer     Bandwidth
[  4]  0.0-10.1 sec  3.47 MBytes  2.87 Mbits/sec
^C
albert@k:~$ iperf -c 192.168.1.127
------------------------------------------------------------
Client connecting to 192.168.1.127, TCP port 5001
TCP window size: 16.0 KByte (default)
------------------------------------------------------------
[  3] local 192.168.1.130 port 40095 connected with 192.168.1.127 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0-10.0 sec  3.47 MBytes  2.90 Mbits/sec

TX iperf test

whiite:~# iperf -c 192.168.1.130
------------------------------------------------------------
Client connecting to 192.168.1.130, TCP port 5001
TCP window size: 16.0 KByte (default)
------------------------------------------------------------
[  3] local 192.168.1.127 port 55391 connected with 192.168.1.130 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0-10.1 sec  2.20 MBytes  1.84 Mbits/sec
albert@k:~$ iperf -s
------------------------------------------------------------
Server listening on TCP port 5001
TCP window size: 85.3 KByte (default)
------------------------------------------------------------
[  4] local 192.168.1.130 port 5001 connected with 192.168.1.127 port 55391
[ ID] Interval       Transfer     Bandwidth
[  4]  0.0-10.3 sec  2.20 MBytes  1.79 Mbits/sec
^C

RX/TX iperf test

whiite:~# iperf -s
------------------------------------------------------------
Server listening on TCP port 5001
TCP window size: 85.3 KByte (default)
------------------------------------------------------------
------------------------------------------------------------
Client connecting to 192.168.1.130, TCP port 5001
TCP window size: 16.0 KByte (default)
------------------------------------------------------------
[  5] local 192.168.1.127 port 55393 connected with 192.168.1.130 port 5001
[  4] local 192.168.1.127 port 5001 connected with 192.168.1.130 port 57787
Waiting for server threads to complete. Interrupt again to force quit.
[ ID] Interval       Transfer     Bandwidth
[  5]  0.0-10.1 sec  1.23 MBytes  1.03 Mbits/sec
[  4]  0.0-10.6 sec  1.59 MBytes  1.26 Mbits/sec
albert@k:~$ iperf -c 192.168.1.127 -d
------------------------------------------------------------
Server listening on TCP port 5001
TCP window size: 85.3 KByte (default)
------------------------------------------------------------
------------------------------------------------------------
Client connecting to 192.168.1.127, TCP port 5001
TCP window size: 16.0 KByte (default)
------------------------------------------------------------
[  4] local 192.168.1.130 port 57787 connected with 192.168.1.127 port 5001
[  5] local 192.168.1.130 port 5001 connected with 192.168.1.127 port 55393
[ ID] Interval       Transfer     Bandwidth
[  5]  0.0-10.3 sec  1.23 MBytes  1.01 Mbits/sec
[  4]  0.0-10.5 sec  1.59 MBytes  1.27 Mbits/sec

System Latency

From the description of the hardware interface, one can easily deduce that a lot of SDIO transactions are required to perform simple operations. For example, all 8-bit reads/writes, 16-bit reads/writes and 32-bit reads to the 802.11 core require at least one SDIO command/response cycle which may require attending several interrupts. 32-bit writes require at least two SDIO commands, due to the previously described bug^Wfeature. In addition, accessing the PHY registers, radio registers, microcode memory, shared memory, template ram, PIO engine, etc. all require several read/write operations to the 802.11 core. Moreover, the PIO engine FIFO must be accessed using a block size of 64 bytes only.

Every one of these SDIO transactions needed end up contributing to a rather high interrupt rate on the system. For example, the system may need to process ~30K interrupts per second to achieve the reported maximum RX speed, which requires a considerable amount of CPU resources.

The ultimate result is that latency sensitive applications, like audio or video playback from a network resource, will suffer specially when:

  • the required bit rate is greater than the above mentioned maximum throuput numbers
  • the CPU resources required to service the required bit rate leave not enough CPU resources for the application processing


Future Directions

  • The CPU bottleneck problem may be solved in the future by offloading part of the work to the Starlet processor.


Thanks

I'd like to thank the following individuals/organizations for making this possible:

Personal tools