bcm-specs

[Specification

Chip Init

  1. Write 0x404 to MMIO offset 0x120

  2. Microcode and PCM upload (See MicrocodeUpload)

  3. Write 0xFFFFFFFF to MMIO offset 0x128

  4. Write 0x20402 to MMIO offset 0x120 (StatusBitField)

  5. Spinwait until the "Ready" bit in the Generic IRQ Reason register (MMIO offset 0x128) is set (wait length is up to 10 sec, check every 10 uSec)

  6. Dummy read on MMIO offset 0x128

  7. Set up the GPIOs

  8. Upload the InitialValues

  9. If the Wireless Core revision is 9 or greater
    1. Loop over the Loop Values table below
      1. Write the 0x540 value to MMIO offset 0x540

      2. Write the 0x520 value to MMIO offset 0x520

      3. Write the 0x540 value to MMIO offset 0x540

    2. Write 0xE0A to MMIO offset 0x418

    3. Write 0x90B to MMIO offset 0x41A

    4. Write 0x20E to MMIO offset 0x41C

    5. Write 0 to MMIO offset 0x41E

  10. If framebursting is enabled
    1. Write 0x5 to SHM offset 0x5C

  11. Otherwise
    1. Write 0xA to SHM offset 0x5C

  12. Write 0x1000000 to MMIO offset 0x100

  13. If Core Revision is < 5

    1. Write 0x1000000 to MMIO offset 0x10C

  14. Unset bit 0x40000 and set bit 0x20000 in the StatusBitField

  15. If we're in PIO mode
    1. Write 0x00000100 to DMA Controller Recieve Channel Control Register 1

    2. If the Wireless Core revision is 4 or less
      1. Write 0x00000100 to MMIO offset 0x270 (DMA Controller Recieve Channel Control Register 4)

    3. If the Wireless Core revision is 7 or less
      1. Write 0 to SHM offset 0x34

  16. Write the Probe Response Timeout value (default 0) to SHM offset 0x74

  17. If framebursting is enabled
    1. Write 0x10 to SHM offset 0x400

  18. Otherwise
    1. Write 0x8 to SHM offset 0x400

  19. Set the slot time as required (see SlotTiming)

  20. If the Core Revision is < 3

    1. Write 0 to MMIO offset 0x60E

    2. Write 0x8000 to MMIO offset 0x610

    3. Write 0 to MMIO offset 0x604

    4. Write 0x200 to MMIO offset 0x606

  21. Otherwise
    1. Write 0x80000000 to 0x188
    2. Write 0x2000000 to 0x18C
  22. Write 0x4000 to MMIO offset 0x128 (Generic Interrupt Reason)

  23. Write 0x1DC00 to MMIO offset 0x24 (DMA Interrupt Mask for Controller 1)

  24. Write 0xDC00 to MMIO offset 0x2C (DMA Interrupt Mask for Controller 2)

  25. Write 0xDC00 to MMIO offset 0x34 (DMA Interrupt Mask for Controller 3)

  26. Write 0x1DC00 to MMIO offset 0x3C (DMA Interrupt Mask for Controller 4)

  27. Write 0xDC00 to MMIO offset 0x44 (DMA Interrupt Mask for Controller 5)

  28. Write 0xDC00 to MMIO offset 0x4C (DMA Interrupt Mask for Controller 6)

  29. Set Silicone Backplane Core Flags sbtmstatelow with 0x100000
  30. If the Wireless Core Revision is 5 or greater
    1. Write the Fast Powerup Delay value to MMIO offset 0x6A8 (see PowerControl)

  31. Write the Wireless Core revision to SHM offset 0x16

  32. Write the Short Retry Limit (default 7) to SHM routing number 0x0002, offset 0x0006

  33. Write the Long Retry Limit (default 4) to SHM routing number 0x0002, offset 0x0007

  34. Write 3 to SHM offset 0x44

  35. Write 2 to SHM offset 0x46

  36. Set our MAC address in the MacAddressFilter at offset 0

  37. Write our MAC address to TemplateRam offsets 0x20, 0x78 and 0x478 ( /!\ Do not clobber the first two octets of the BSSID, remember that we write in 32 bit chunks and the BSSID is not 32bit aligned!)

  38. Set the BSSID MAC address in the MacAddressFilter at offset 3

  39. Write the BSSID MAC address to TemplateRam offsets 0x26, 0x7E and 0x47E ( /!\ These addresses are not 32 bit aligned, you will need to compensate for this when writing these values.)

Loop Values

Loop Position

MMIO 0x520

MMIO 0x540

0

0x00000506

0xFFFF8000

1

0x00001306

0xFFFF8100

2

0x00001E14

0xFFFF8200

3

0x0000271F

0xFFFF8300

4

0x00003528

0xFFFF8400

5

0x00003736

0xFFFF8500


Exported/Archived from the wiki to HTML on 2016-10-27