Template RAM is written indirectly via registers 0x130 and 0x134. It can only be written in 4-byte quantities and can not be read back.
To write to the template RAM, write the address to MMIO offset 0x130 and then the data word to 0x134. Note that the address is not given shifted by 2 bits like the SHM control word!
When writing to the Template RAM, observe bit 0x10000 in the StatusBitField. If it is unset, you need to byte-swap all accesses of register 0x134.
The packets here all include the 6 byte PLCP header.
Addresses in template RAM:
0x0000 - 0x0013 |
used for DummyTransmission |
0x0010 |
start of second packet (null function, check the initial values). Except for the MAC addresses below, this packet is only written by the InitialValues. Since it overlaps with the dummy packet maybe it isn't used (there must be a bug in the Broadcom driver somewhere, and if this were used that bug would have surfaced. I think the bug is that the dummy packet is too long) |
0x0020 - 0x002B |
MAC Address and BSSID |
0x0068 |
start of the third packet. This is the regular beacon frame template. It's size is written to the SHM at 0x18, bit 0 of MMIO register 0x124 is set when this packet is valid. |
0x0078 - 0x0083 |
Source MAC Address and BSSID (see above). This is part of the beacon packet. |
0x0268 |
start of the fourth packet. This is the probe response packet template. It's length is in the SHM at address 0x4A. |
0x0468 |
fifth packet, see above. The size of this packet is written to the SHM at 0x1A, bit 1 of MMIO register 0x124 is set when this packet is valid. This is also a beacon frame template (possibly the one containing the TIM?). |
0x0478 - 0x0483 |
Source MAC address and BSSID (see above). This is part of the beacon packet at 0x0468. |
FIXME: which packets are for the A and which for the B/G PHYs? This should be deductible by looking at the PLCP stuff.