Offset

Size

Name/Function

Availability (core revision)

Used by

Device Control

0x000C

4

BIS Status

host

0x0010

4

BIS Status 2

host

0x0018

4

General Purpose Timer

>= 3

host

Interrupt Control

0x0020

4

DMA/PIO Interrupt Status 1

host

0x0024

4

DMA/PIO Interrupt Mask 1

host

0x0028

4

DMA/PIO Interrupt Status 2

host

0x002C

4

DMA/PIO Interrupt Mask 2

host

0x0030

4

DMA/PIO Interrupt Status 3

host

0x0034

4

DMA/PIO Interrupt Mask 3

host

0x0038

4

DMA/PIO Interrupt Status 4

host

0x003C

4

DMA/PIO Interrupt Mask 4

host

0x0040

4

DMA/PIO Interrupt Status 5

host

0x0044

4

DMA/PIO Interrupt Mask 5

host

0x0048

4

DMA/PIO Interrupt Status 6

host

0x004C

4

DMA/PIO Interrupt Mask 6

host

0x0050

4

DMA/PIO Interrupt Status 7

host

0x0054

4

DMA/PIO Interrupt Mask 7

host

0x0058

4

DMA/PIO Interrupt Status 8

host

0x005C

4

DMA/PIO Interrupt Mask 8

host

TX/RX Interrupts Per Frame and Timeout (IPFT)

0x0100

4

DMA/PIO IPFT 1

host

0x0104

4

DMA/PIO IPFT 2

host

0x0108

4

DMA/PIO IPFT 3

host

0x010C

4

DMA/PIO IPFT 4

host

MAC Registers

0x0120

4

MAC Control

host

0x0124

4

MAC Command

host

0x0128

4

MAC Interrupt Status

host

0x012C

4

MAC Interrupt Status Mask

host

Transmit Template

0x0130

4

Transmit Template Control

host

0x0134

4

Transmit Template Data

host

Power Management Queue

0x0140

4

PMQ host status (read only!)

host

0x0140

2

PMQ control (read/write)

host

0x0144

4

PMQ pattern (low)

host

0x0148

4

PMQ pattern (high)

host

Registers

0x0150

4

DMA Channel Status

host

0x0154

4

PSM Debug

>= 3

host

0x0158

4

PHY Debug

>= 3

host

0x015c

4

MAC capabilities

>= 13

host

Extended Internal Objects

0x0160

4

Object Control

host

0x0164

4

Object Data

host

TX Status

0x0170

4

Frame TX Status

>= 5

host

0x0174

4

Frame TX Status 2

>= 5

host

Timing Synchronization Function (TSF) Host Acccess

0x0180

4

TSF Timer Low

>= 3

host

0x0184

4

TSF Timer High

>= 3

host

0x0188

4

TSF Contention Free Period Rep

>= 3

host

0x018C

4

TSF Contention Free Period Start

>= 3

host

0x0190

4

TSF Contention Free Period Max Duration

>= 3

host

DMA/PIO Registers (0x200 - 0x37F) - See DMA and PIO

DMA Layout - Core Revision < 11

0x0200

16

32 Bit DMA TX Channel 0

host

0x0210

16

32 Bit DMA RX Channel 0

host

0x0220

16

32 Bit DMA TX Channel 1

host

0x0230

16

32 Bit DMA RX Channel 1

host

0x0240

16

32 Bit DMA TX Channel 2

host

0x0250

16

32 Bit DMA RX Channel 2

host

0x0260

16

32 Bit DMA TX Channel 3

host

0x0270

16

32 Bit DMA RX Channel 3

host

0x0280

16

32 Bit DMA TX Channel 4

host

0x0290

16

32 Bit DMA RX Channel 4

host

0x02A0

16

32 Bit DMA TX Channel 5

host

0x02B0

16

32 Bit DMA RX Channel 5

host

0x02C0

16

32 Bit DMA TX Channel 6

host

0x02D0

16

32 Bit DMA RX Channel 6

host

0x02E0

16

32 Bit DMA TX Channel 7

host

0x02F0

16

32 Bit DMA RX Channel 7

host

0x0300

8

2/4 Byte PIO TX Queue 0

(Core Revision >= 8 uses 4 Byte)

host

0x0308

8

2/4 Byte PIO RX Queue 0

(Core Revision >= 8 uses 4 Byte)

host

0x0310

8

2/4 Byte PIO TX Queue 1

(Core Revision >= 8 uses 4 Byte)

host

0x0318

8

2/4 Byte PIO RX Queue 1

(Core Revision >= 8 uses 4 Byte)

host

0x0320

8

2/4 Byte PIO TX Queue 2

(Core Revision >= 8 uses 4 Byte)

host

0x0328

8

2/4 Byte PIO RX Queue 2

(Core Revision >= 8 uses 4 Byte)

host

0x0330

8

2/4 Byte PIO TX Queue 3

(Core Revision >= 8 uses 4 Byte)

host

0x0338

8

2/4 Byte PIO RX Queue 3

(Core Revision >= 8 uses 4 Byte)

host

0x0340

8

2/4 Byte PIO TX Queue 4

(Core Revision >= 8 uses 4 Byte)

host

0x0348

8

2/4 Byte PIO RX Queue 4

(Core Revision >= 8 uses 4 Byte)

host

0x0350

8

2/4 Byte PIO TX Queue 5

(Core Revision >= 8 uses 4 Byte)

host

0x0358

8

2/4 Byte PIO RX Queue 5

(Core Revision >= 8 uses 4 Byte)

host

0x0360

8

2/4 Byte PIO TX Queue 6

(Core Revision >= 8 uses 4 Byte)

host

0x0368

8

2/4 Byte PIO RX Queue 6

(Core Revision >= 8 uses 4 Byte)

host

0x0370

8

2/4 Byte PIO TX Queue 7

(Core Revision >= 8 uses 4 Byte)

host

0x0378

8

2/4 Byte PIO RX Queue 7

(Core Revision >= 8 uses 4 Byte)

host

DMA Layout - Core Revision >= 11

0x0200

64

DMA/PIO Channel 0

host

0x0240

64

DMA/PIO Channel 1

host

0x0280

64

DMA/PIO Channel 2

host

0x02C0

64

DMA/PIO Channel 3

host

0x0300

64

DMA/PIO Channel 4

host

0x0340

64

DMA/PIO Channel 5

host

FIFO Diagnostic Port Access

0x0380

4

FIFO Diagnostic Address

?

0x0384

4

FIFO Diagnostic Data (Low 32 bits)

?

0x0388

4

FIFO Diagnostic Data (High 32 bits)

?

Time Delay Between RF Disable and Radio Shutdown

0x03DC

4

RF Disable Delay (time in units of 0.05 μs, runs off 20 MHz clock, set to 500ms)

>= 10

?

PHY Registers

0x03E0

2

PHY Version

host

0x03E2

2

PHY BB Config (B PHY only? others seem to have it in the PHY Registers)

host

0x03E4

2

PHY ADC Bias

host

0x03E6

2

PHY 0

host

0x03E8

2

PHY RX Status 0

host

0x03EA

2

PHY RX Status 1

host

0x03EC

2

PHY 1

host

0x03EE

2

PHY TX Error

host

0x03F0

2

PHY Channel

host

0x03F4

2

PHY Test

TX Test?

host

0x03F6

2

Radio Register Address (PHY 2)

host

0x03F8

2

Radio Register Data High (PHY 3)

host

0x03FA

2

Radio Register Data Low (PHY 4)

host

0x03FC

2

PHY Register Address

host

0x03FE

2

PHY Register Data

host

Internal Hardware Register (IHR) Region (0x400 - 0x7FE)

Receive Engine (RXE)

0x0402

2

Receive memory address (in 16-bit words)
[this is where the RXE puts the received frame header into the SHM for use by the Microcode]

IV

0x0404

2

Receive copy length (amount of bytes the RXE copies into SHM)

IV

0x0406

2

Receive FIFO Control

ucode

0x0408

2

Receive ???

ucode

0x040A

2

Received Frame Count (??)

ucode

0x040E

2

RXE Receive Header Offset (in 16-bit words; the RXE will take the RX header from SHM at this location)

ucode

0x0410

2

RXE Receive Header Length (in 16-bit words; indicates how many words the RXE will put into the RX header)

ucode

0x0412

2

PHY RX Status 0 (cf. 802.11/RX)

ucode

0x0414

2

PHY RX Status 1 (cf. 802.11/RX)

ucode

0x0416

2

?

ucode

0x0418

2

RXE Frame Length (in bytes, reports even while RX in progress and hence increases during reception)

ucode

0x041A

2

?

ucode

0x041C

2

RXE Receive flags (0x2000 is set if received with OFDM on a G PHY)

ucode

0x0420

2

RCM control; to use, write 0x20 ORed with 6, 9 or 12 and then the MAC address into RCM match data (three writes). External conditions are updated then? What are 6, 9, 12?

ucode

0x0422

2

RCM Match Data

ucode

0x0424

2

RCM Match Mask

-

0x0426

2

RCM Match Delay

-

0x0428

2

RCM Condition Mask Low

?

0x042A

2

RCM Condition Mask High

?

0x042C

2

RCM Condition Delay

?

0x0430

2

PHY register control/address (0x4000 is a busy bit, before doing anything wait for it to clear; to read write 0x1000 ORed with the required address and spin until 0x1000 is clear, then read EXT IHR data; to write write the data to EXT IHR data and then 0x2000 ORed with the required address and spin until 0x2000 is clear

ucode

0x0432

2

PHY register data

ucode

0x0434

2

PHY RX Status 2 (cf. 802.11/RX)

ucode

0x0436

2

PHY RX Status 3 (cf. 802.11/RX)

ucode

0x0438

2

PHY Mode

?

0x043A

2

RCM TA control. Set to 1 to start matching (write address before), spin until bit 0 is unset again. After that, if bit 1 (mask 0x2) is set, a match was successful and bits 2-8 (mask 0xfc) contain the index of the match

ucode

0x043C

2

RCM TA Size (number of MAC addresses in the special memory)

host

0x043E

2

RCM TA upper 16 bits of MAC address to match (aa:bb of aa:bb:cc:dd:ee:ff)

ucode

0x0440

2

RCM TA middle 16 bits of MAC address to match

ucode

0x0442

2

RCM TA lower 16 bits of MAC address to match

ucode

Programmable State Machine (PSM)

0x0480

2

MAC nap time (in cycles of a ~88MHz clock)

ucode

0x0482

2

MAC Control (high 16 bits)

ucode

0x0484

2

MAC Interrupt Status Low

ucode

0x0486

2

MAC Interrupt Status High. Writing to these registers causes the interrupt bit to be set and an interrupt to be triggered.

ucode

0x0488

2

MAC Interrupt Mask Low

-

0x048A

2

MAC Interrupt Mask High

-

0x048C

2

MAC ???

ucode

0x048E

2

MAC Command (if a bit is written from the ucode it turns off, iow. the MAC can write a bitmask of bits to turn off here)

ucode

0x0490

2

BRC

ucode (IV?)

0x0492

2

PHY HDR Parameter

ucode

0x0494

2

Postcard

-

0x0496

2

Postcard Location Low

-

0x0498

2

Postcard Location High

-

0x049A

2

GPIO In

ucode

0x049C

2

GPIO Out

ucode

0x049E

2

GPIO Output Enable

ucode

0x04A0

2

BRED 0

-

0x04A2

2

BRED 1

-

0x04A4

2

BRED 2

-

0x04A6

2

BRED 3

-

0x04A8

2

BRCL 0

ucode

0x04AA

2

BRCL 1

ucode

0x04AC

2

BRCL 2

ucode

0x04AE

2

BRCL 3

ucode

0x04B0

2

BRPO 0

ucode

0x04B2

2

BRPO 1

ucode

0x04B4

2

BRPO 2

ucode

0x04B6

2

BRPO 3

ucode

0x04B8

2

BRWK 0

-

0x04BA

2

BRWK 1

-

0x04BC

2

BRWK 2

-

0x04BE

2

BRWK 3

ucode

0x04C0

2

Base 0 (offset registers)

ucode

0x04C2

2

Base 1

ucode

0x04C4

2

Base 2

ucode

0x04C6

2

Base 3

ucode

0x04C8

2

Base 4

ucode

0x04CA

2

Base 5

ucode

0x04CC

2

Base 6

ucode

0x04D0

2

PC Register 0 (link registers)

ucode

0x04D2

2

PC Register 1

ucode

0x04D4

2

PC Register 2

ucode

0x04D6

2

PC Register 3

ucode

0x04D8

2

PSM conditions (bitwise) [to be tested!]

ucode

Transmit Engine (TXE) (0) (0x0500 - 0x057E)

0x0500

2

TXE Control

ucode

0x0502

2

TXE auxiliary (flags? bits 0 and 1 seem to be used only)

ucode

0x0504

2

TXE TS Loc (timestamp location?)

host/IV?

0x0506

2

TXE Timeout (bit 0x8000 seems to be special, value in microseconds, but what does it do?)

ucode

0x0508

2

TXE WM 0

ucode

0x050A

2

TXE WM 1

ucode

0x050C

2

TXE PHY Control, cf. PHY TX Control Word

ucode

0x050E

2

TXE Status

ucode

0x0518 - 0x051e

8

TX Status FIFO access
To put something into the fifo, first fill in 0x88d-0x88f and then 0x88c with the lowest bit set, just like the driver would expect it. It appears that (only) the lowest bit of 0x88c is a control bit. The FIFO seems to be 16 full 8-byte items long.

>= 5

ucode

0x0518

2

TXE Status FIFO Value 0 (lower 16 bits of mmio register 0x170)

0x051a

2

TXE Status FIFO Value 1 (upper 16 bits of mmio register 0x170)

0x051c

2

TXE Status FIFO Value 2 (lower 16 bits of mmio register 0x174)

0x051e

2

TXE Status FIFO Value 3 (upper 16 bits of mmio register 0x174)

Transmit Control

0x0520

2

Transmit FIFO Def

IV/host

0x0522

2

??

ucode

0x0540

2

Transmit FIFO Command

>= 9?

ucode

0x0542

2

Transmit FIFO Flush

bitmask of which FIFOs a flush was requested on (?), when a bit is written then the flush seems to be signalled as complete (?)

ucode

0x0544

2

Transmit FIFO Threshold

?

0x0546

2

Transmit FIFO Ready (bitfield)

ucode

0x0548

2

Transmit FIFO PRI Ready

?

0x054A

2

Transmit FIFO RQ PRI

?

0x054C

2

Transmit Template RAM offset (in bytes, for transmissions from Template RAM)

ucode

0x0550, 0x0562, 0x0562

6

write access to Template RAM
To write to Template RAM, write the address into the pointer register, the data into the two data registers and finally spin until bit 1 in the pointer register is cleared

ucode

0x0550

2

Transmit Template Pointer (byte offset into Template RAM, the low 2 bits are control bits and must be clear when writing)

0x0560

2

Transmit Template Data Low

0x0562

2

Transmit Template Data High

0x0568

2

Transmit Select (unknown meaning)

ucode

0x056A

2

Transmit byte count (length of template to transmit)

ucode

0x056C

2

Transmit SHM offset (in bytes, ??)

ucode

Transmit Modify Engine (0x0580 - 0x05FE)

0x0580 - 0x05be

32*2

Template fill mask. for any bit that is 1 here, the bit is taken from Template fill values instead of the regular channel (which is Template RAM, or the TX from driver, or ...) These registers seem to reset to all-zeroes after use.

ucode

0x05c0 - 0x05fe

32*2

Template fill values

ucode

Timing Syncronization Function (TSF)

0x0600

2

??

ucode

0x0602

2

??

ucode

0x0604

2

TSF CFP Start Low

ucode

0x0606

2

TSF CFP Start High

ucode

0x0608

2

??

ucode

0x060A

2

??

ucode

0x060E

2

??

ucode

0x0610

2

??

ucode

0x0612

2

TSF CFP Pre-TBTT

ucode

0x0616

2

??

ucode

0x061A

2

??

ucode

0x061E

2

??

ucode

0x0624

2

??

ucode

0x0626

2

??

ucode

0x0628

2

??

ucode

0x062A

2

??

ucode

0x062C

2

TX FES time (frame exchange sequence duration?)

ucode

0x0632

2

mac timer & 0x0000 0000 0000 FFFF

ucode (host for rev < 3)

0x0634

2

mac timer & 0x0000 0000 FFFF 0000

ucode (host for rev < 3)

0x0636

2

mac timer & 0x0000 FFFF 0000 0000

ucode (host for rev < 3)

0x0638

2

mac timer & 0xFFFF 0000 0000 0000

ucode (host for rev < 3)

0x063A

2

TSF TX Offset (offset to current TSF when writing the TSF into a beacon template for example)

ucode

0x063E

2

used for MAC Time field in RX header (for invalid frames only?)

ucode

0x0640

2

??

ucode

0x0642

2

??

ucode

0x0646

2

TSF GPT0 Stat (same as TSF GPT2 Stat)

ucode

0x0648

2

TSF GPT1 Stat (same as TSF GPT2 Stat)

ucode

0x064A

2

TSF GPT0 Counter low

ucode

0x064C

2

TSF GPT1 Counter low

ucode

0x064E

2

TSF GPT0 Counter high

ucode

0x0650

2

TSF GPT1 Counter high

ucode

0x0652

2

TSF GPT0 Value low

ucode

0x0654

2

TSF GPT1 Value low

ucode

0x0656

2

TSF GPT0 Value high

ucode

0x0658

2

TSF GPT1 Value high

ucode

0x065A

2

TSF Random (sometimes written, but what happens then?)

ucode/host

General Purpose Timer (GPT) 2

0x0664

2

TSF GPT2 ??

ucode

0x0666

2

TSF GPT2 Stat: 0x8000: start; 0x4000: on: 8MHz, off: same ~88MHz as nap timer

ucode

0x0668

2

TSF GPT2 Counter Low

ucode

0x066A

2

TSF GPT2 Counter High

ucode

0x066C

2

TSF GPT2 Value Low

ucode

0x066E

2

TSF GPT2 Value High

ucode

0x0670

2

TSF GPT All Stat

?

Interframe Space (IFS)

0x0684

2

IFS slot

ucode

0x0688

2

IFS control

ucode

0x068A

2

backoff delay? seems to control the backoff delay before sending the next frame in units of slots

ucode

0x068C

2

??

ucode

0x068E

2

??

ucode

0x0690

2

IFS Status

ucode

Slow Clock Control (SCC)

0x06A0

2

SCC Control

>= 5

ucode

0x06A2

2

SCC Timer Low

>= 5

ucode

0x06A4

2

SCC Timer High

>= 5

ucode

0x06A6

2

SCC Divisor

>= 5

ucode

0x06A8

2

SCC Fast Powerup Delay

>= 5

ucode

0x06AA

2

SCC Period

>= 5

?

0x06AC

2

SCC Period Divisor

>= 5

?

Network Allocation Vector (NAV)

0x0700

2

NAV Control

ucode

0x0702

2

NAV Stat

ucode

0x0704

2

??

ucode

0x0706

2

??

ucode

0x070C

2

NAV reserve time (microseconds)? (set to rx frame duration under certain circumstances)

ucode

0x070E

2

??

ucode

0x0710

2

??

ucode

0x0712

2

??

ucode

WEP

0x07C0

2

WEP Control

ucode

0x07C2

2

WEP IV Location; offset of data (beginning of IV) within a frame that is to be encrypted

ucode

0x07C4

2

WEP IV Key

ucode

0x07C6

2

WEP WKey

ucode

0x07D0

2

??

ucode

0x07D2

2

??

ucode

0x07D4

2

??

ucode

0x07D6

2

WEP AES Control (0 = regular, 1 = legacy)

ucode

PMQ

0x07E0

2

PMQ Control Low

ucode

0x07E2

2

PMQ Control High

ucode

0x07E4

2

PMQ Pat 0

ucode

0x07E6

2

PMQ Pat 1

ucode

0x07E8

2

PMQ Pat 2

ucode

0x07EA

2

PMQ Data

ucode

0x07EC

2

PMQ Data or(igin?)

ucode

0x07EE

2

??

ucode

SHM Region (0x800 - 0xEFE)

Common Core Configuration Registers

0x0F00

256

Common Core Registers

host

Offset

Function

Notes

0x01000000

Transmit Interrupt

0x00010000

Receive Interrupt

0x00008000

Transmit FIFO Underflow Error

Fatal

0x00004000

Receive FIFO Underflow Error

Fatal

0x00002000

Receive Descriptor Underflow Error

Non-fatal

0x00001000

Descriptor Protocol Error

Fatal

0x00000800

PCI Data Error

Fatal

0x00000400

PCI Descriptor Error

Fatal

Mask

Function

0xFF000000

Frame Count

0x00FFFFFF

Time Out

Offset

Function

0x80000000

G Mode

0x40000000

Discard Power Management Queue (if set, microcode will not insert entries into the power management queue)

0x20000000

Discard TX Status

0x10000000

TBTT Hold

0x08000000

Closed Network (if set, the microcode will not respond to broadcast probe responses)

0x04000000

Device is awake

0x02000000

Hardware Power Saving (HPS)

0x01000000

Promiscuous Mode

0x00800000

Keep Bad Frames

0x00400000

Keep Control Frames

0x00200000

Keep Frames with bad PLCP

0x00100000

Beacons Promiscuous (if disabled, MAC filters beacons like regular packets)

0x00080000

Radio Lock

0x00040000

AP Mode

0x00020000

Infra Mode

0x00010000

Big Endian Mode

0x0000C000

GPOUT Select Mask

0x00002000

PSM Debug Enabled

0x00001000

0x00000800

0x00000400

IHR Region Enabled

0x00000200

SHM Upper

0x00000100

SHM Enabled

0x00000080

0x00000040

0x00000020

0x00000010

0x00000008

0x00000004

PSM Jump 0

0x00000002

PSM Run

0x00000001

MAC Enabled

Mask

Function

0x00000010

BG Noise

0x00000008

CCA

0x00000004

directed frame queue valid (IBSS power save mode, ATIM)

0x00000002

Beacon 1 busy/valid

0x00000001

Beacon 0 busy/valid

Offset

Function

Notes

0x80000000

General Purpose Time Out

Core Revision 3 or greater

0x40000000

PHY Status, Changed G Modes

0x20000000

TX Completed

Core Revision 5 or greater

0x10000000

RF Disable Changed (used changed rfkill button state)

Core Revision 10 or greater, lower revisions poll the relevant register which is revision dependent

0x08000000

0x04000000

0x02000000

0x01000000

0x00800000

0x00400000

0x00200000

0x00100000

0x00080000

0x00040000

Background Noise Sample Ready

(set by ucode)

0x00020000

CCA Measurement Complete

(set by ucode)

0x00010000

TX FIFO Suspend/Flush Complete

(set by ucode)

0x00008000

DMA Interrupts

0x00004000

General Purpose Timer 1

0x00002000

General Purpose Timer 0 (PSM microcode watchdog); reset chip if it is raised

0x00001000

Power Management Event

0x00000800

PHY TX Error

0x00000400

Non-Specifc Gen-Stat bit set by PSM

(set by ucode)

0x00000200

MAC TX Error

0x00000100

Non-Specifc Gen-Stat bit set by PSM

(set by ucode)

0x00000080

Non-Specifc Gen-Stat bit set by PSM

(set by ucode)

0x00000040

Power Management Queue Entries Available

(set by ucode)

0x00000020

End of ATIM Window (IBSS)

(set by ucode)

0x00000010

Beacon Cancelled (IBSS)

(set by ucode)

0x00000008

Beacon TX successful

(set by ucode)

0x00000004

TBTT Indication

(set by ucode)

0x00000002

Beacon Template available

(set by ucode)

0x00000001

MAC Suspended

(set by ucode)

Bit

Meaning

31

TKIP MIC hardware

30

TKIP phase 2 key calculation hardware

29

Bluetooth coexistance pins

28

Multi-BSS hardware

25-19

RX fifo size in blocks of 512 bytes

18-16

number of RX fifos

15-13

Microcode size (0: 3328 commands, 1: 4096 commands)

9-3

TX fifo size in blocks of 512 bytes

2-0

number of TX fifos

Mask

Function

0xFFFFFFC0

C. Beacon Interval Mask

0x00000001

CFPP

Offset

Size

Function

0x0000

24

64 Bit DMA TX Channel

0x0018

8

4 Byte PIO TX Queue

0x0020

24

64 Bit DMA RX Channel

0x0038

8

4 Byte PIO RX Queue