[lwfinger]

A large number of PCI-based BCM4306 rev 3 devices have an SPROM programming error in the Bluetooth coexistence mode that completely kills the radio. I have been fixing these for people individually, but have decided to post the solution and let each user fix their own. The first step is to acquire and build the b43 tools. You will need packages for git, make, and gcc. Issue the following commands:

git clone http://git.bu3sch.de/git/b43-tools.git
cd b43-tools/ssb_sprom
make

Once the above steps are completed without error, issue the following commands:

SPROM=$(find /sys -name ssb_sprom)
echo $SPROM
sudo cat $SPROM > sprom.old

The second of these commands should echo something like "/sys/devices/pci0000:00/0000:00:0b.0/ssb_sprom" - the numbers will depend on which buss your bcm43xx device is attached.

The next step is to read out the current contents of the SPROM with the command:

./ssb-sprom -i sprom.old -P

A lot of info will be listed. We are only interested in the section that looks like:

SPROM(0x38, High 16 bits of Boardflags) = 0xFFFF
SPROM(0x72, Low 16 bits of Boardflags) = 0x4A49
SPROM(0x4A, MAC address for 802.11b/g) = 00:1a:73:6b:28:5a

In fact, only the low 16 bits of the boardflags are important. What we need to do is make the least-significant bit be zero.

IMPORTANT: If the last digit of the low-order boardflags is NOT 1, 3, 5, 7, 9, B, D, or F, QUIT RIGHT NOW. You do not have this problem. For each of the odd numbers, decrease it by 1 to make it even. For the case above, the 9 has to become 8. This change is done by the following command:

./ssb-sprom -i sprom.old -o sprom.new --bfl 0x4A48

You can verify the results with the commannd

./ssb-sprom -i sprom.new -P

You can load the new SPROM contents into the device with the following sequence:

SPROM=$(find /sys -name ssb_sprom)
echo $SPROM
sudo cp sprom.new $SPROM

The third command should not print anything.

After you have tested the device and it works now but didn't before, please issue the following command:

/sbin/lspci -nnv

Your BCM43xx wireless device will contain lines that look like:

04:00.0 Network controller [0280]: Broadcom Corporation BCM94311MCG wlan mini-PCI [14e4:4311] (rev 02)
Subsystem: Hewlett-Packard Company Device [103c:137c]

Please PM me with that information and a note saying that the BT SPROM fix was needed for your card. That way we will be able to modify the kernel source to do this fix dynamically rather than by modifying the SPROM contents.

Larry