2 * BCM43xx device microcode
4 * For Wireless-Core Revision 5
6 * Copyright (C) 2009 University of Brescia
8 * Copyright (C) 2008 Michael Buesch <mb@bu3sch.de>
9 * Copyright (C) 2008, 2009 Lorenzo Nava <navalorenx@gmail.com>
10 * Francesco Gringoli <francesco.gringoli@ing.unibs.it>
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * version 2, as published by the Free Software Foundation.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
22 #include "initvals.inc"
27 .initvals(b0g0initvals5)
29 /* write 0x5 @ 0x0016 (core revision) */
30 //mmio32 0x3010005, MMIO_SHM_CONTROL
31 //mmio32 0x0050000, MMIO_SHM_DATA
33 /* first mac command */
34 mmio32 0x4, MMIO_MACCMD
36 /* Initialize the interrupts */
37 mmio32 0, MMIO_GEN_IRQ_REASON
38 mmio32 0, MMIO_GEN_IRQ_MASK
41 mmio32 0, MMIO_RAM_CONTROL
42 mmio32 0x70040A, MMIO_RAM_DATA
43 mmio32 0xD4BEEF, MMIO_RAM_DATA
44 mmio32 0xFF000005, MMIO_RAM_DATA
45 mmio32 0xFF02FF01, MMIO_RAM_DATA
48 mmio32 0x01000000, MMIO_IPFT0
52 mmio16 0, MMIO_PSM_BRC
53 mmio16 0xE3F9, MMIO_PSM_BRED0
54 mmio16 0xFDAF, MMIO_PSM_BRPO0
55 mmio16 0xFFFF, MMIO_PSM_BRCL0
56 mmio16 0x0000, MMIO_PSM_BRCL0
57 mmio16 0x0000, MMIO_PSM_BRCL1
58 mmio16 0x1ACF, MMIO_PSM_BRED2
59 mmio16 0x0000, MMIO_PSM_BRCL2
60 mmio16 0x0000, MMIO_PSM_BRWK2
61 mmio16 0x00C7, MMIO_PSM_BRED3
62 mmio16 0xFFFF, MMIO_PSM_BRPO3
63 mmio16 0xFFFF, MMIO_PSM_BRCL3
65 /* Initialize RX engine */
66 mmio16 1, MMIO_RXE_FIFOCTL
67 mmio16 0, MMIO_RXE_FIFOCTL
69 mmio16 0, MMIO_RXE_FIFOCTL
71 /* where is initialized MMIO_RXE_RXCOPYLEN ?? */
72 mmio16 SHM_RXHEADER, MMIO_RXE_RXMEM
74 /* Initialize TME Mask */
82 /* Transmit Control Init */
83 mmio16 0x8000, MMIO_TCTL_FIFOCMD
84 mmio16 0x0E06, MMIO_TCTL_FIFODEF
85 mmio16 0x8000, MMIO_TCTL_FIFOCMD
87 mmio16 0x8100, MMIO_TCTL_FIFOCMD
88 mmio16 0x1B0F, MMIO_TCTL_FIFODEF
89 mmio16 0x8100, MMIO_TCTL_FIFOCMD
91 mmio16 0x8200, MMIO_TCTL_FIFOCMD
92 mmio16 0x251C, MMIO_TCTL_FIFODEF
93 mmio16 0x8200, MMIO_TCTL_FIFOCMD
95 mmio16 0x8300, MMIO_TCTL_FIFOCMD
96 mmio16 0x2D26, MMIO_TCTL_FIFODEF
97 mmio16 0x8300, MMIO_TCTL_FIFOCMD
99 mmio16 0x8400, MMIO_TCTL_FIFOCMD
100 mmio16 0x3A2E, MMIO_TCTL_FIFODEF
101 mmio16 0x8400, MMIO_TCTL_FIFOCMD
103 mmio16 0x8500, MMIO_TCTL_FIFOCMD
104 mmio16 0x3B3B, MMIO_TCTL_FIFODEF
105 mmio16 0x8500, MMIO_TCTL_FIFOCMD
108 mmio16 1, MMIO_TSF_CFP_PRETBTT
113 /* Interframe space init */
114 mmio16 0xB, MMIO_IFSCTL
116 // **********************************************************************
117 // **********************************************************************
120 // *****************************************************
121 // BLOCK1, starts @ 0x0010 = 0x0004 * 4
122 // 0x0010: [(00 00) (00 00)] [(00 80) (00 00)] [(00 47) (00 47)]
123 // 00x01c: [(00 00) (00 64)] [(09 30) (00 00)]
124 // 0x0010: 802.11 Slot Time = 0 (SHM_SLOTT), used by ucode not by b43?
125 // 0x0012: DTIM Period = 0 (SHM_DTIMPER), used by ucode not by b43?
126 // 0x0014: Not used by ucode or b43
127 // 0x0016: 802.11 Core Revision (SHM_WLCOREREV), should take the same value assigned above? used by b43
128 // 0x0018: Beacon 0 Template Length (SHM_BTL0) = 0x47, used by ucode, not by b43 (sure? check with AP mode)
129 // 0x001a: Beacon 1 Template Length (SHM_BTL1) = 0x47, used by ucode, not by b43 (sure? check with AP mode)
130 // 0x001c: Beacon Transmit TSF Offset (SHM_BTSFOFF) = 0, used by ucode, not by b43 (sure? check with AP mode)
131 // 0x001e: TIM Position (SHM_TIMBPOS) = 100, used by ucode, not by b43 (sure? check with AP mode)
132 // 0x0020: MAXPDULEN (SHM_MAXPDULEN) = 0x930 = 2352, used by ucode, not by b43
133 // 0x0022: ACK/CTS PHY control word (SHM_ACKCTSPHYCTL) = 0, used by ucode and b43
134 mmio32 0x03010004, MMIO_SHM_CONTROL
135 mmio32 0x00000000, MMIO_SHM_DATA
136 mmio32 0x00000080, MMIO_SHM_DATA
137 mmio32 0x00470047, MMIO_SHM_DATA
138 mmio32 0x00640000, MMIO_SHM_DATA
139 mmio32 0x00000930, MMIO_SHM_DATA
141 // *****************************************************
142 // BLOCK2, starts @ 0x0034 = 0x000D * 4
143 // 0x0034: [(00 02) (00 02)] [(00 01) (00 04)] [(00 1e) (00 00)]
144 // 0x0034: RX Padding Data Offset (SHM_RXPADOFF) = 2,
145 // sometime its value is copied to [0xA90(=0x548*2)]
146 // 0x0036: ?? = 2, not used by ucode or b43
147 // 0x0038: Offset To Duration (SHM_TBL_OFF2DUR) = 1,
148 // useb by ucode in rx_beacon_probe_resp to obtain the frame duration from
149 // second level rate table to refresh the receive time and synhronize
150 // 0x003A: ?? = 4, not used by ucode or b43
151 // 0x003C: Default IV location = 1e, not used by ucode or b43
152 // 0x003E: Number of soft RX transmitter addresses (max 8) = 0, not used by ucode or b43
153 mmio32 0x0301000D, MMIO_SHM_CONTROL
154 mmio32 0x00020002, MMIO_SHM_DATA
155 mmio32 0x00040001, MMIO_SHM_DATA
156 mmio32 0x0000001E, MMIO_SHM_DATA
158 // *****************************************************
159 // BLOCK3, starts @ 0x0044 = 0x0011 * 4
160 // 0x0044: [(00 64) (00 64)] [(00 0E) (00 47)] [(28 00) (00 00)]
161 // 0x0044: Short Frame Fallback Retry Limit (SHM_SFFBLIM) (beacon related??) = 0x64, used by b43 and by ucode
162 // 0x0046: Long Frame Fallback Retry Limit (SHM_LFFBLIM) (beacon related??) = 0x64, used by b43 not by ucode as RTS/CTS not implemented
163 // 0x0048: Probe Response SSID Length (SHM_PRSSIDLEN) = 0x08, not used by ucode, not used by b43 (check if ap or ad-hoc use them)
164 // 0x004A: Probe Response Template Length (SHM_PRTLEN) = 0x47, not used by ucode, not used by b43 (check if ap or ad-hoc use them)
165 // 0x004C: NOSLPZNAT DTIM (SHM_NOSLPZNATDTIM) = 0x2800, used by ucode, not used by b43 (check if ap or ad-hoc use them)
166 // 0x004E: OFDM/CCK delta in CCK power boost mode = 0x0000, not used by ucode, not used by b43
167 mmio32 0x03010011, MMIO_SHM_CONTROL
168 mmio32 0x00640064, MMIO_SHM_DATA
169 mmio32 0x0047000E, MMIO_SHM_DATA
170 mmio32 0x00002800, MMIO_SHM_DATA
172 // *****************************************************
173 // BLOCK4, starts @ 0x0054 = 0x0015 * 4
174 // 0x0044: [(00 00) (05 82)] [(FF FF) (FF FF)] [(00 0A) (00 00)]
175 // 0x0054: Beacon PHY TX control word (SHM_BEACPHYCTL), used by ucode, used by b43
176 // 0x0056: Key table pointer (SHM_KTP), not used by ucode, used by b43
177 // 0x0058: TSSI for the last 4 CCK frames lo (SHM_TSSI_CCK_LO), used with value below by tx_frame_now... , used by b43
178 // 0x005A: TSSI for the last 4 CCK frames high (SHM_TSSI_CCK_HI), ... through off5 (SPR_BASE5) , used by b43
179 // 0x005C: Antenna swap threshold (SHM_ANTSWAP), used by ucode, not used by b43
180 // 0x005E: Hostflags for ucode options (low) (SHM_HF_LO), used by ucode, used by b43
181 mmio32 0x03010015, MMIO_SHM_CONTROL
182 mmio32 0x05820000, MMIO_SHM_DATA
183 mmio32 0xFFFFFFFF, MMIO_SHM_DATA
184 mmio32 0x0000000A, MMIO_SHM_DATA
186 // *****************************************************
187 // BLOCK5, starts @ 0x0074 = 0x001D * 4
188 // 0x0074: [(27 10) (00 00)]
189 // 0x0074: Probe Response max time (SHM_PRMAXTIME), not used by ucode, used by b43 (related to offloading?)
190 // 0x0076: ? no mean?
191 mmio32 0x0301001D, MMIO_SHM_CONTROL
192 mmio32 0x00002710, MMIO_SHM_DATA
194 // *****************************************************
195 // BLOCK6, starts @ 0x0080 = 0x0020 * 4
196 // 0x0080: [(00 06) (27 10)]
197 // 0x0080: Maximum number of frames in a burst (SHM_MAXBFRAMES), not used by ucode, not used by b43 (Turbo?)
198 // 0x0082: ? no mean?
199 mmio32 0x03010020, MMIO_SHM_CONTROL
200 mmio32 0x27100006, MMIO_SHM_DATA
202 // *****************************************************
203 // BLOCK7, starts @ 0x008C = 0x0023 * 4
204 // 0x008C: [(00 00) (02 07)]
205 // 0x008C: Measure JSSI AUX (SHM_JSSIAUX), used by ucode, not used by b43
206 // 0x008E: ? no mean?
207 mmio32 0x03010023, MMIO_SHM_CONTROL
208 mmio32 0x02070000, MMIO_SHM_DATA
210 // *****************************************************
211 // BLOCK8, starts @ 0x0094 = 0x0025 * 4
212 // 0x0094: [(00 00) (00 32)] [(0D 09) (08 0A)] [(01 0D) (00 00)]
213 // 0x0094: pre-wakeup for synth PU in us (SHM_SPUWKUP), not used by ucode, used by b43
214 // 0x0096: pre-TBTT in us (SHM_PRETBTT), not used by ucode, used by b43
215 // 0x0098: TX FIFO size for FIFO 0 (low) and 1 (high) (SHM_TXFIFO_SIZE01), not used by ucode, not used by b43
216 // 0x009A: TX FIFO size for FIFO 2 (low) and 3 (high) (SHM_TXFIFO_SIZE23), not used by ucode, not used by b43
217 // 0x009C: TX FIFO size for FIFO 4 (low) and 5 (high) (SHM_TXFIFO_SIZE45), not used by ucode, not used by b43
218 // 0x009E: TX FIFO size for FIFO 6 (low) and 7 (high) (SHM_TXFIFO_SIZE67), not used by ucode, not used by b43
219 mmio32 0x03010025, MMIO_SHM_CONTROL
220 mmio32 0x00320000, MMIO_SHM_DATA
221 mmio32 0x080A0D09, MMIO_SHM_DATA
222 mmio32 0x0000010D, MMIO_SHM_DATA
224 // *****************************************************
225 // BLOCK9, starts @ 0x00A4 = 0x0029 * 4
226 // 0x00A4: ?? no mean? not used
227 // 0x00A6: Value for the G-PHY classify control register (SHM_GCLASSCTL), used by ucode, not used by b43
228 // 0x00A8: Last bcast/mcast frame ID (SHM_MCASTCOOKIE), used by ucode, not used by b43
229 // 0x00AA: ?? no mean? not used
230 mmio32 0x03010029, MMIO_SHM_CONTROL
231 mmio32 0x013F0000, MMIO_SHM_DATA
232 mmio32 0x0000FFFF, MMIO_SHM_DATA
234 // *****************************************************
235 // BLOCK10, starts @ 0x0160 = 0x0058 * 4
236 // 0x0160: Probe Response SSID (SHM_PRSSID), not used by ucode, not used by b43
237 // 0x0162: ?? no mean?
238 // 0x0164: (MMIO_SHM_DATA), not used by ucode, not used by b43
239 // 0x0166: (MMIO_SHM_DATA_UNALIGNED), not used by ucode, not used by b43
240 // 0x0168: ?? no mean?
241 // 0x016A: ?? no mean?
242 // 0x016C: ?? no mean?
243 // 0x016E: (SHM_FIFO_RDY), used by ucode, not used by b43
244 mmio32 0x03010058, MMIO_SHM_CONTROL
245 mmio32 0x4D435242, MMIO_SHM_DATA
246 mmio32 0x5345545F, MMIO_SHM_DATA
247 mmio32 0x53535F54, MMIO_SHM_DATA
248 mmio32 0x00004449, MMIO_SHM_DATA
250 /* Rate Tables: each 32-bit word is made of a couple of pointers to upper shm tables */
252 // OFDM direct (Firmware access at 0x00E0 = 0x0070 * 2, real address is 0x01c0)
253 // 32 bytes up to 0x0078 - 1
254 mmio32 0x03010070, MMIO_SHM_CONTROL
256 mmio32 0x032E032E, MMIO_SHM_DATA
257 mmio32 0x032E032E, MMIO_SHM_DATA
258 mmio32 0x032E032E, MMIO_SHM_DATA
259 mmio32 0x032E032E, MMIO_SHM_DATA
260 mmio32 0x0356036A, MMIO_SHM_DATA // high: addr for 24Mb/s ACK, low: addr for 48Mb/s ACK
261 mmio32 0x032E0342, MMIO_SHM_DATA // high: addr for 6Mb/s ACK, low: addr for 12Mb/s ACK
262 mmio32 0x03600374, MMIO_SHM_DATA // high: addr for 36Mb/s ACK, low: addr for 54Mb/s ACK
263 mmio32 0x0338034C, MMIO_SHM_DATA // high: addr for 9Mb/s ACK, low: addr for 18Mb/s ACK
265 // CCK direct (Firmware access at 0x100 = 0x0080 * 2, real address is 0x0200)
266 // 32 bytes up to 0x0088 - 1
267 mmio32 0x03010080, MMIO_SHM_CONTROL
269 mmio32 0x037E037E, MMIO_SHM_DATA
270 mmio32 0x037E037E, MMIO_SHM_DATA
271 mmio32 0x037E0389, MMIO_SHM_DATA //(high: -- low: addr for 2Mb/s ACK)
272 mmio32 0x0394037E, MMIO_SHM_DATA //(high: addr for 5.5Mb/s ACK low: --)
273 mmio32 0x037E037E, MMIO_SHM_DATA
274 mmio32 0x037E037E, MMIO_SHM_DATA //(high: -- low: addr for 1Mb/s ACK)
275 mmio32 0x037E037E, MMIO_SHM_DATA
276 mmio32 0x037E039F, MMIO_SHM_DATA //(high: -- low: addr for 11Mb/s ACK)
278 /* Contention Window */
280 // firmware uses just one contention window (Firmware access at 0x0130 = 0x098 * 2, real address is 0x0260)
281 mmio32 0x03010098, MMIO_SHM_CONTROL
283 mmio32 0x001F0000, MMIO_SHM_DATA
284 mmio32 0x001F03FF, MMIO_SHM_DATA
285 mmio32 0x00000001, MMIO_SHM_DATA
286 mmio32 0x00000001, MMIO_SHM_DATA
288 // Actual rate tables (Firmware access from 0x32E = 0x197 * 2, real address is 0x65C = 0x197 * 4)
289 mmio32 0x03010197, MMIO_SHM_CONTROL
291 mmio32 0x01CB0020, MMIO_SHM_DATA // 0x32E high: encoding for 6Mb/s ACK, low --
292 mmio32 0x00000000, MMIO_SHM_DATA
293 mmio32 0x08AB0000, MMIO_SHM_DATA
294 mmio32 0x04100000, MMIO_SHM_DATA
295 mmio32 0x00000084, MMIO_SHM_DATA
297 mmio32 0x01CF0014, MMIO_SHM_DATA // 0x338 high: encoding for 9Mb/s ACK, low --
298 mmio32 0x00000002, MMIO_SHM_DATA
299 mmio32 0x08AF0000, MMIO_SHM_DATA
300 mmio32 0x04100002, MMIO_SHM_DATA
301 mmio32 0x00000064, MMIO_SHM_DATA
303 mmio32 0x01CA0010, MMIO_SHM_DATA // 0x342 high: encoding for 12Mb/s ACK, low --
304 mmio32 0x00000002, MMIO_SHM_DATA
305 mmio32 0x08AA0000, MMIO_SHM_DATA
306 mmio32 0x04100002, MMIO_SHM_DATA
307 mmio32 0x00000054, MMIO_SHM_DATA
309 mmio32 0x01CE0008, MMIO_SHM_DATA // 0x34C high: encoding for 18Mb/s ACK, low --
310 mmio32 0x00000000, MMIO_SHM_DATA
311 mmio32 0x08AE0000, MMIO_SHM_DATA
312 mmio32 0x04100000, MMIO_SHM_DATA
313 mmio32 0x00000044, MMIO_SHM_DATA
315 mmio32 0x01C90008, MMIO_SHM_DATA // 0x356 high: encoding for 24Mb/s ACK, low --
316 mmio32 0x00000002, MMIO_SHM_DATA
317 mmio32 0x08A90000, MMIO_SHM_DATA
318 mmio32 0x04100002, MMIO_SHM_DATA
319 mmio32 0x0000003C, MMIO_SHM_DATA
321 mmio32 0x01CD0004, MMIO_SHM_DATA // 0x360 high: encoding for 36Mb/s ACK, low --
322 mmio32 0x00000000, MMIO_SHM_DATA
323 mmio32 0x08AD0000, MMIO_SHM_DATA
324 mmio32 0x04100000, MMIO_SHM_DATA
325 mmio32 0x00000034, MMIO_SHM_DATA
327 mmio32 0x01C80004, MMIO_SHM_DATA // 0x36A high: encoding for 48Mb/s ACK, low --
328 mmio32 0x00000000, MMIO_SHM_DATA
329 mmio32 0x08A80000, MMIO_SHM_DATA
330 mmio32 0x04100000, MMIO_SHM_DATA
331 mmio32 0x00000030, MMIO_SHM_DATA
333 mmio32 0x01CC0000, MMIO_SHM_DATA // 0x374 high: encoding for 54Mb/s ACK, low --
334 mmio32 0x00000002, MMIO_SHM_DATA
335 mmio32 0x08AC0000, MMIO_SHM_DATA
336 mmio32 0x04100002, MMIO_SHM_DATA
337 mmio32 0x00000030, MMIO_SHM_DATA
339 mmio32 0x040A00C0, MMIO_SHM_DATA // 0x37E high: enconding for 1Mb/s ACK, low: --
340 mmio32 0x00000070, MMIO_SHM_DATA // high: -- low: duration for 1Mb/s ACK
341 mmio32 0x040A013A, MMIO_SHM_DATA // high: -- low: NAV for 1Mb/s ACK (314us = 14*8 + 192 + 10)
342 mmio32 0xC02C0228, MMIO_SHM_DATA
343 mmio32 0x000002F2, MMIO_SHM_DATA
345 mmio32 0x00600000, MMIO_SHM_DATA // 0x388
346 mmio32 0x00380414, MMIO_SHM_DATA // high: duration for for 2Mb/s ACK low: encoding for 2Mb/s ACK
347 mmio32 0x01020000, MMIO_SHM_DATA // high: NAV for 2Mb/s ACK (258us = 14*8/2 + 192 + 10) low: --
348 mmio32 0x01140414, MMIO_SHM_DATA
349 mmio32 0x01DEC02C, MMIO_SHM_DATA
351 // we have 2 bytes skipped!
353 // Other tables (Firmware access from 0x394 = 0x1CA * 2, real address is 0x728 = 0x1CA * 4)
354 mmio32 0x030101CA, MMIO_SHM_CONTROL
356 mmio32 0x04370022, MMIO_SHM_DATA // high: encoding for 5.5Mb/s ACK low: --
357 mmio32 0x00000015, MMIO_SHM_DATA // high: -- low: duration for 5.5Mb/s ACK
358 mmio32 0x043700DF, MMIO_SHM_DATA // high: -- low: NAV for 5.5Mb/s ACK (223us = 14*8/5.5 + 192 + 10 ceiled)
359 mmio32 0xC02C0065, MMIO_SHM_DATA
360 mmio32 0x0000012E, MMIO_SHM_DATA
361 mmio32 0x00110000, MMIO_SHM_DATA
362 mmio32 0x000B846E, MMIO_SHM_DATA // high: duration for 11Mb/s ACK low: encoding for 11Mb/s ACK
363 mmio32 0x00D40000, MMIO_SHM_DATA // high: NAV for 11Mb/s ACK (should be 213us = 14*8/11 + 192 + 10 ceiled, instead it is 212??) low: --
364 mmio32 0x0033846E, MMIO_SHM_DATA
365 mmio32 0x00FCC02C, MMIO_SHM_DATA
367 .initvals(b0g0bsinitvals5)
376 mmio32 0x10003, MMIO_SHM_CONTROL
377 mmio16 0x000C0, MMIO_SHM_DATA // aPHY-RX-START-Delay
378 mmio32 0x10003, MMIO_SHM_CONTROL
379 mmio16 0x0000A, MMIO_SHM_DATA_UNALIGNED // EDCF Status Offset (aSIFSTime)
381 mmio32 0x10004, MMIO_SHM_CONTROL
382 mmio16 0x14, MMIO_SHM_DATA // aSlotTime
384 mmio32 0x10007, MMIO_SHM_CONTROL
385 mmio16 0x183, MMIO_SHM_DATA // Beacon Transmit TSF Offset
387 mmio32 0x10025, MMIO_SHM_CONTROL
388 mmio16 0x1F4, MMIO_SHM_DATA // Pre-wakeup for synth. PU = 500
390 mmio32 0x10199, MMIO_SHM_CONTROL
391 mmio16 0x3C, MMIO_SHM_DATA
393 mmio32 0x1019E, MMIO_SHM_CONTROL
394 mmio16 0x34, MMIO_SHM_DATA
396 mmio32 0x101A3, MMIO_SHM_CONTROL
397 mmio16 0x30, MMIO_SHM_DATA
399 mmio32 0x101A8, MMIO_SHM_CONTROL
400 mmio16 0x2C, MMIO_SHM_DATA
402 mmio32 0x101AD, MMIO_SHM_CONTROL
403 mmio16 0x2C, MMIO_SHM_DATA
405 mmio32 0x101B2, MMIO_SHM_CONTROL
406 mmio16 0x28, MMIO_SHM_DATA
408 mmio32 0x101B7, MMIO_SHM_CONTROL
409 mmio16 0x28, MMIO_SHM_DATA
411 mmio32 0x101BC, MMIO_SHM_CONTROL
412 mmio16 0x28, MMIO_SHM_DATA
414 /* Interframe space init */
415 //mmio16 0x0B4E, 0x686
416 //mmio16 0, MMIO_PHY0
420 // vim: syntax=b43 ts=8