I’m playing with kernel 2.6 (svn r3014) on wap54g. The bcm43xx/dscape seems to have a problem with wifi hw (original miniPCI BCM94306MP). When bringing up it shows on the console:

bcm43xx: FIXME: Possibly broken code in bcm43xx_phy_initg() at /m/linux/usr/src/openwrt-hd/build_mipsel/linux-2.6-brcm/bcm43xx-dscape-20060104/bcm43xx_phy.c:1059
Data bus error, epc == c010d1f4, ra == c0107a24
…

When the test at bcm43xx_phy.c:1059 is bypassed, bcm43xx driver detects hw corectly as 11g and is at least able to iwlist scan.
I haven’t managed get it connected to AP.

Any ideas?
Can you write _VERIFIED_ example of if/iwconfig cmds to bring up bcm43xx and connect as client without hotplug stuff?
I'm not sure when use wlan0 and when wlan0.11.

Full console output:

PMON version 1.0.0, Gemtek Corp. Compiled on Tue Aug 12 16:21:01 2003
CPU type 4710.CPU clock frequency 125 MHz.Avail RAM 8192 KBytes.
Visit www.gemtek.com for updates.
Modified by PeterChen. 2003/06/12 PM 21:54

Starting to restore all default valus ...
Restoring all default valus ... Completed
Downloading os image in 3 seconds
Using specified MAC address.
et1: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.11.30.1
MAC Address: 00:11:22:33:44:56
Opened ethernet
Downloading from ethernet, ^C to abort
Downloading image time out
Boot os from the flash
CRC OK
Uncompressing....done
Doing command call 80001000
Linux version 2.6.15.1 (vanekt@big) (gcc version 3.4.4) #1 Thu Jan 19 22:43:32 CET 2006
CPU revision is: 00024000
Determined physical RAM map:
 memory: 00800000 @ 00000000 (usable)
Built 1 zonelists
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 init=/etc/preinit noinitrd console=ttyS0,115200
Primary instruction cache 8kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 4kB, 2-way, linesize 16 bytes.
Synthesized TLB refill handler (19 instructions).
Synthesized TLB load handler fastpath (31 instructions).
Synthesized TLB store handler fastpath (31 instructions).
Synthesized TLB modify handler fastpath (30 instructions).
PID hash table entries: 64 (order: 6, 1024 bytes)
Using 100.000 MHz high precision timer.
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 5576k/8192k available (1987k kernel code, 2616k reserved, 252k data, 120k init, 0k highmem)
Mount-cache hash table entries: 512
Checking for 'wait' instruction...  unavailable.
NET: Registered protocol family 16
PCI: fixing up bridge
PCI: Fixing up device 0000:01:00.0
Squashfs 2.2 (released 2005/07/03) (C) 2002-2005 Phillip Lougher
devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
JFFS2 version 2.2. (NAND) (C) 2001-2003 Red Hat, Inc.
Initializing Cryptographic API
io scheduler noop registered
io scheduler anticipatory registered
Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 2) is a 16550A
serial8250: ttyS1 at MMIO 0x0 (irq = 2) is a 16550A
PCI: Enabling device 0000:00:03.0 (0000 -> 0002)
b44.c:v0.97 (Nov 30, 2005)
PCI: Enabling device 0000:00:02.0 (0000 -> 0002)
eth0: Broadcom 47xx 10/100BaseT Ethernet 00:11:22:33:44:55
PCI: Enabling device 0000:00:08.0 (0000 -> 0002)
eth1: Broadcom 47xx 10/100BaseT Ethernet 00:11:22:33:44:56
Physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
Physically mapped flash: CFI does not contain boot bank location. Assuming top.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Flash device: 0x200000 at 0x1fc00000
bootloader size flag: 0
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "cfe"
0x00040000-0x001f0000 : "linux"
0x000e7400-0x001ac000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x001f0000-0x00200000 : "nvram"
0x001b0000-0x001f0000 : "OpenWrt"
NET: Registered protocol family 2
IP route cache hash table entries: 128 (order: -3, 512 bytes)
TCP established hash table entries: 512 (order: -1, 2048 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
ip_conntrack version 2.4 (64 buckets, 512 max) - 244 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
TCP vegas registered
NET: Registered protocol family 1
NET: Registered protocol family 17
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 120k freed
Algorithmics/MIPS FPU Emulator v1.5
insmod: diag.ko: no module by that name found
Unlocking OpenWrt ...
umount: Couldn't umount /rom/dev: No such file or directory
init started:  BusyBox v1.1.0 (2006.01.19-21:48+0000) multi-call binary

Please press Enter to activate this console.
80211: module license 'unspecified' taints kernel.
bcm43xx driver 0.0.1
PCI: Enabling device 0000:01:01.0 (0000 -> 0002)
PCI: Fixing up device 0000:01:01.0
bcm43xx: Chip ID 0x4306, rev 0x2
bcm43xx: Number of cores: 6
bcm43xx: Core 0: ID 0x800, rev 0x2, vendor 0x4243, enabled
bcm43xx: Core 1: ID 0x812, rev 0x4, vendor 0x4243, disabled
bcm43xx: Core 2: ID 0x80d, rev 0x1, vendor 0x4243, enabled
bcm43xx: Core 3: ID 0x807, rev 0x1, vendor 0x4243, disabled
bcm43xx: Core 4: ID 0x804, rev 0x7, vendor 0x4243, enabled
bcm43xx: Core 5: ID 0x812, rev 0x4, vendor 0x4243, disabled
bcm43xx: Ignoring additional 802.11 core.
bcm43xx: PHY connected
bcm43xx: Detected PHY: Version: 1, Type 2, Revision 1
bcm43xx: Detected Radio:  ID: 2205017f (Manuf: 17f Ver: 2050 Rev: 2)
bcm43xx: Radio turned off
bcm43xx: Radio turned off
device eth0 entered promiscuous mode
bcm43xx: PHY connected
bcm43xx: PHY disconnected
bcm43xx: FIXME: Possibly broken code in bcm43xx_phy_initg() at /m/linux/usr/src/openwrt-hd/build_mipsel/linux-2.6-brcm/bcm43xx-dscape-20060104/bcm43xx_phy.c:1059
Data bus error, epc == c010d1f4, ra == c0107a24
Oops[#1]:
Cpu 0
$ 0   : 00000000 10008400 c0064000 00000000
$ 4   : c011a950 000003fc 00000001 00000803
$ 8   : 80220000 000015a1 80260000 80260000
$12   : 80260000 fffffff8 0000000a ffffffff
$16   : 80782e44 c0110000 80782e44 80782f68
$20   : 80782fa8 00000000 80782f38 00000001
$24   : 00000002 c010d250                  
$28   : 80688000 80689c98 80689d48 c0107a24
Hi    : 00000042
Lo    : 0c496e00
epc   : c010d1f4     Tainted: P     
ra    : c0107a24 Status: 10008402    KERNEL EXL 
Cause : 0000801c
PrId  : 00024000
Modules linked in: bcm43xx rate_control 80211
Process ifconfig (pid: 401, threadinfo=80688000, task=8065d3f8)
Stack : 0000003f 0000ffff c0107688 c0107688 80782e44 c0107a24 80782f38 00000001
        c00f8588 c0110000 80782e44 80782f68 c00f8588 c0110000 80782e44 c01120c4
        80782e44 c0117d14 c011a8b8 00000423 00000000 00000000 c00f8588 10008401
        80782e44 80782f68 00000000 c011252c 000000ff 00000000 80785598 80782278
        00030032 80782278 807857dc 80782e44 c00fd71c c00fd590 0000416d 00000003
        ...
Call Trace: [<c0107688>]  [<c0107688>]  [<c0107a24>]  [<c00f8588>]  [<c0110000>]  [<c00f8588>]  [<c0110000>]  [<c01120c4>]  [<c00f8588>]  [<c011252c>]  [<c00fd71c>]  [<c00fd590>]  [<80033600>]  [<c0097a9c>]  [<80157eec>]  [<80026c14>]  [<801af000>]  [<80159ebc>]  [<801b0488>]  [<801b02f8>]  [<801b1f34>]  [<8009a3ac>]  [<8014b364>]  [<800fdb1c>]  [<80093bb0>]  [<80093f2c>]  [<8014badc>]  [<80093fa4>]  [<800127c0>]  [<800127c0>] 

Code: 3c04c012  2484a950  00431021 <944603fe> 8e0304d4  240503fe  30d0ffff  1c60000c  02003021 



BusyBox v1.1.0 (2006.01.19-21:48+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge, r3014) -------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
root@OpenWrt:/# cat /proc/meminfo
MemTotal:         5696 kB
MemFree:           476 kB
Buffers:           164 kB
Cached:            808 kB
SwapCached:          0 kB
Active:           1672 kB
Inactive:          372 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:         5696 kB
LowFree:           476 kB
SwapTotal:           0 kB
SwapFree:            0 kB
Dirty:               0 kB
Writeback:           0 kB
Mapped:           1700 kB
Slab:             1732 kB
CommitLimit:      2848 kB
Committed_AS:    17588 kB
PageTables:        364 kB
VmallocTotal:  1048560 kB
VmallocUsed:       960 kB
VmallocChunk:  1047164 kB

root@OpenWrt:/# cat /proc/net/wireless
Inter-| sta-|   Quality        |   Discarded packets               | Missed | WE
 face | tus | link level noise |  nwid  crypt   frag  retry   misc | beacon | 19

root@OpenWrt:/# cat /proc/net/ieee80211/wlan0/info
hw_name=bcm43xx
modes=
rate_ctrl_alg=simple

root@OpenWrt:/# cat /proc/net/ieee80211/wlan0/config
low_level_driver=bcm43xx
channel=0
freq=0
mode=IEEE 802.11a
802.11h=0
wep_iv=0xf497df
antenna_sel=0
calib_int=60
tx_power_reduction=0.0 dBm
bridge_packets=1
key_tx_rx_threshold=0
rts_threshold=2347
fragmentation_threshold=2346
short_retry_limit=7
long_retry_limit=4
total_ps_buffered=0

root@OpenWrt:/# cat /proc/net/ieee80211/wlan0/counters
TransmittedFragmentCount=0
MulticastTransmittedFrameCount=0
FailedCount=0
RetryCount=0
MultipleRetryCount=0
FrameDuplicateCount=0
ReceivedFragmentCount=0
MulticastReceivedFrameCount=0
TransmittedFrameCount=0
WEPUndecryptableCount=0
ACKFailureCount=0
RTSFailureCount=0
FCSErrorCount=0
RTSSuccessCount=0

root@OpenWrt:/# cat /proc/net/ieee80211/wlan0/debug
num_scans=0
conf.bss_count=1
bss_dev_count=1
bss_dev[0]=80785598 (wlan0)

root@OpenWrt:/# cat /proc/net/ieee80211/wlan0/iface/wlan0
bss=80785874
type=norm
max_aid=0
num_sta_ps=0
num_buffered_multicast=0
dtim_period=2
dtim_count=0
num_beacons=0
force_unicast_rateidx=-1
max_ratectrl_rateidx=-1
channel_use=0
drop_unencrypted=0
eapol=1
ieee802_1x=0

root@(none):/# iwpriv wlan0.11 read_sprom
wlan0.11  read_sprom:01400000130037172043008002000200F017001800000000FFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFF0F001266E8B1FFFFFFFFFFFFFFFFFFFFFFFFFFFF4530B01198FB4FFEFFFFFFFF3C00FFFFFFF
FFFFF3E000F00FFFF000000000000000001A8