This page only describes what we knew earlier, with the v4 driver we have learned much more, described on ObjectMemory.

Addressing in the SHM

The SHM is accessed through MMIO offsets 0x160 (Control), 0x164 (Data, Low 16 bits) and 0x166 (Data, High 16 bits).

A 32 bit control word is used for addressing in the SHM. A control word can be broken up into two parts, the routing information (High 16 bits) and the memory offset to address (Low 16 bits). Note that these addresses are actually pointers to a word in the SHM, not a byte, so when the address is incremented (in either the internal counter or from a supplied address), it is pointing to the next aligned word.

The routing information dictates which shared memory is being accessed.

Note that the Shared Memory addresses are given as byte addresses instead of 32 bit word addresses.

Reading from the SHM

Reading from the SHM is accomplished by first writing the control word to MMIO offset 0x160. If a 32 bit value is to be read, read it as a 32 bit value from 0x164. If a 16bit value is to be read, read it from MMIO 0x164 for the aligned read and 0x166 for the unaligned read. Note that after the memory read is complete, the internal pointer will move to the next aligned offset, moved 32 bits ahead, even for a 16 bit read.

Writing to the SHM

Writing to the SHM is accomplished by first writing the control word to MMIO offset 0x160. If a 32 bit value is to be written, write it as a 32 bit value to 0x164. If a 16bit value is to be written, write it to MMIO 0x164 for the aligned write and 0x166 for the unaligned write. Note that after the memory write is complete, the internal pointer will move to the next aligned offset, moved 32 bits ahead, even for a 16 bit write.

SHM Offsets and Usage

0x0001 - Shared Memory

The Shared Memory offsets are given here by byte offsets instead of 32 bit offsets (as required for addressing). To address these properly, you will have to use the proper 32 bit offset and then decide whether the address is aligned or unaligned.

0x0002 - 802.11 Settings

There are some special 802.11 related values here (all 32 bits wide).

Those that are different between the PHY types are the contention window minimum value which is 0xF for 802.11a and 0x1F for 802.11b/g, and a few others that also differ just in 0xF vs. 0x1F. I'd appreciate hints on where these values occur in the spec. It is possible, however, that the default minimum CW is written in two places (0x00020005 and 0x00020010).

0x0003 - PCM Data

The PCM data is writen to address 0x01EB as 32 bit words. For more on the PCM, see PCMUpload. This also seems to be the routing number for the IHR register. (Anyone have a guess as to what IHR is?) The "bitfields in the table below are only ever written to with 0x4000, and only when writing. Perhaps this is a "data incoming" switch?

0x0004 - Security Hardware MAC Address list

If the core revision is 5 or higher, the hardware decryption address list is here. The MAC is written as a big endian value and is written as an int and a short. The next MAC skips the two bytes left over and starts on the next aligned word.

0x0300 - Microcode

The microcode is written here as 32 bit words starting at 0x0000. For more on the microcode see MicrocodeUpload.

0x0301

The initial value microcode is written as part of the InitialValues on DeviceInitialization.