Introduction
For system secure requirements, non-volatile information storage becomes more and more important nowadays. Besides non-volatile requirements, access privilege control of the storage media for different application scenarios is another significant topic for a secure system. For chip, an OTP device is used to achieve this goal.
Among all embedded non-volatile memory (eNVM) such as embedded flash, electrical fuses (eFuse), multi-time programmable (MTP), and antifuse one-time programmable (OTP), OTP is the most secure today. OTP cannot be hacked using passive, semi-invasive or invasive methods. It provides a strong layer of protection at the most vulnerable physical layer. A cross-section comparison of eFuse bit and antifuse OTP bit is illustrated below. As shown, eFuse is not a secure solution because it is easy to identify the programmed bits. Programming is accomplished by silicide electromigration of the fuse link between the anode and the cathode. While there is no visible difference between the programmed and non-programmed antifuse bits. The antifuse bit cell does not store a charge, whether antifuse bit is programmed is determined through current, not voltage.
The chip contains up to 2K bytes of one-time-programmable antifuse used for part configuration, key storage, and various other uses. The OTP contains factory configuration data such as on-chip SWR calibration values (Realtek factory), Wi-Fi calibration values (user factory), among other things. It may also be used by customer applications to configure some details of device operation, secure boot public key, aspects of device security, debug options, and boot options.
OTP device adopts UMC 22nm single poly baseline ULP process.
Neo Fuse is an antifuse-based technology.
Icell current >I threshold: programmed bit =0
Icell current < I threshold: un-programmed bit=1
One-bit-two-cell architecture
Redundancy cell can reduce access failed rate
OTP Layout and Security Control
There are 16K bits physical OTP in chip. The OTP layout is summarized in the following figure.
The OTP is divided into four zones:
Logical zone: This zone contains system data for boot configuration, Wi-Fi & BT parameters, calibration data, and HCI_SDIO and HCI_USB. These data are actually programed in a Realtek-defined format in physical OTP. So even the physical data can only be programmed once, the logical data can be overwritten after format conversion.
Security zone: The security-related keys, key access controls, and user-defined area with TrustZone attribute are all located in this zone.
User-defined zone: Users can use this zone freely.
Hidden physical zone: This zone contains the Return Material Authorization (RMA) control, RMA keys and Realtek calibration data.
Logical Zone
Mapping Relationship of Physical OTP and Logical OTP
The following figure is an example to illustrate mapping relationship.
After programming frame1 and frame2, the value of logical OTP addr1 is data1, and value of addr2 is data2.
After program frame3 in physical OTP, the value of logical OTP addr1 is data3 now, which has been overwritten and changed from data1 to data3.
After changing frame3 in physical OTP, fram3 is invalidate. Then operation of frame3 is doing nothing. So the value of logical OTP addr1 has changed back to data1.
Logic Zone Layout
As the figure shows, the low address 0x000 ~ 0x200 of physical OTP is used for the logical area. Hardware and software will only parse this area for logical settings.
The logical area
0x000~0x01Fneeds to be auto-loaded to by hardware when the system boots.The logical area
0x020~0x3FFis used by software. Software will parse this area using a Realtek-defined OTP format.The logical area
0x200~0x29F(HCI_SDIO) and0x2A0~0x2FF(HCI_USB) needs to be auto-loaded by hardware when the system boots.
This area can be programmed in byte (8bits). The default value for the auto-loaded register is 0x00. e.g. If you want only to disable Boot log (0x3[0]), 0x3 should be programmed with the value 0x01. Logical zone layout table is illustrated below.
Start address |
End address |
Size (bytes) |
Description |
|---|---|---|---|
0x000 |
0x01F |
32 |
System data to be auto-loaded to the system registers |
0x020 |
0x13F |
288 |
Wi-Fi calibration data and MAC address |
0x140 |
0x16F |
48 |
Reserved |
0x170 |
0x19F |
48 |
User-defined MTP(Multi_time Program) |
0x1A0 |
0x1AF |
16 |
RSVD for Cap-Touch |
0x1B0 |
0x1FF |
80 |
Bluetooth parameters |
0x200 |
0x29F |
160 |
HCI_SDIO |
0x2A0 |
0x2FF |
96 |
HCI_USB |
0x300 |
0x305 |
6 |
Ethernet MAC address |
0x306 |
0x3FF |
250 |
Reserved |
System Data
Offset |
Bit |
Symbol |
Description |
HW address |
INI |
|---|---|---|---|---|---|
0x0 |
[0] |
SW_RSVD |
Reserved for software |
0x40800100 |
0 |
0x0 |
[2:1] |
BOOT_SRC_SEL |
Choose Boot Source 0/3: boot from Flash 1: boot from USB 2: boot from SDIO |
0x40800100 |
0 |
0x0 |
[3] |
BT_Function_EN |
Enable BT function for NIC mode |
0x40800100 |
0 |
0x0 |
[5:4] |
SDIO_PINMUX |
0:PINMUX Index 0 (group 1: PA4-PA5,PA18-PA21) 1:PINMUX Index 1 (group 6: PC2-PC7) 2:PINMUX Index 2 (rsvd) 3:PINMUX Index 3 (rsvd) |
0x40800100 |
0 |
0x0 |
[7:6] |
BOOT_INT_FLASH |
Boot from internal flash or external flash. 0/3: determined by power-on latch 1: internal flash 2: external flash |
0x40800100 |
0 |
0x1 |
[7:0] |
SW_RSVD |
Reserved for software |
0x40800101 |
0 |
0x2 |
[0] |
FLASH_DEEP_SLEEP_EN |
Flash deep-sleep enable |
0x40800102 |
0 |
0x2 |
[1] |
SPIC_ADDR_4BYTE_EN |
SPIC address 4-byte enable |
0x40800102 |
0 |
0x2 |
[2] |
SPIC_BOOT_SPEEDUP_DIS |
SPIC boot speed up disable |
0x40800102 |
0 |
0x2 |
[3] |
BOOT_FLASH_BAUD_SEL |
Boot Flash clock selection. Baudrate = 40/(2*(1+x)) 0: 20M 1: 10M |
0x40800102 |
0 |
0x2 |
[4] |
SPIC_NAND_PAGE_SIZE |
SPIC_NAND_PAGE_SIZE 0: auto detection 1: 4KB |
0x40800102 |
0 |
0x2 |
[5] |
BOOT_CNT_LMT_EN |
Enable boot count limit |
0x40800102 |
|
0x2 |
[7:6] |
BOOT_NOR_FLASH |
Boot from Nor flash, or Nand flash, or try. 0/3: determined by power-on latch 1: Nor flash 2: Nand flash |
0x40800102 |
0 |
0x3 |
[0] |
DIS_BOOT_LOG_EN |
Boot log disable |
0x40800103 |
0 |
0x3 |
[1] |
LOW_BAUD_LOG_EN |
LOGUART baud rate selection 1: 115200bps 0: 1.5Mbps |
0x40800103 |
0 |
0x3 |
[2] |
LOGIC_SECURE_BOOT_EN |
Secure boot enable |
0x40800103 |
0 |
0x3 |
[3] |
LOGIC_RSIP_EN |
RSIP enable |
0x40800103 |
0 |
0x3 |
[4] |
LOGIC_RDP_EN |
RDP enable |
0x40800103 |
0 |
0x3 |
[5] |
SW_RSVD |
Reserved for software |
0x40800103 |
0 |
0x3 |
[6] |
USB_CLK_CAL_EN |
Enable SoC clock calibration for USB |
0x40800103 |
0 |
0x3 |
[7] |
USB_DOWNLOAD_EN |
Enable USB Download |
0x40800103 |
0 |
0x4 |
[7:0] |
SW_RSVD |
Reserved for software |
0x40800104 |
0 |
0x5 |
[7:0] |
SW_RSVD |
Reserved for software |
0x40800105 |
0 |
0x6 |
[7:0] |
SW_RSVD |
Reserved for software |
0x40800106 |
0 |
0x7 |
[7:0] |
SW_RSVD |
Reserved for software |
0x40800107 |
0 |
0x8 |
[7:0] |
SW_RSVD |
Reserved for software |
0x40800108 |
0 |
0x9 |
[7:0] |
SW_RSVD |
Reserved for software |
0x40800109 |
0 |
0xA |
[7:0] |
SW_RSVD |
Reserved for software |
0x4080010A |
0 |
0xB |
[7:0] |
SW_RSVD |
Reserved for software |
0x4080010B |
0 |
0xC |
[7:0] |
SW_RSVD |
Reserved for software |
0x4080010C |
0 |
0xD |
[7:0] |
SW_RSVD |
Reserved for software |
0x4080010D |
0 |
0xE |
[7:0] |
SW_RSVD |
Reserved for software |
0x4080010E |
0 |
0xF |
[7:0] |
SW_RSVD |
Reserved for software |
0x4080010F |
0 |
0x10 ~ 0x1E |
RSVD |
Reserved |
- |
- |
|
0x1F |
[6:0] |
SW_RSVD |
Reserved for software |
0x4080011F |
0 |
0x1F |
[7] |
BOOT_VOL_SEL |
BOOT Voltage Selection 0: 0.9V 1: 1.0V |
0x4080011F |
0 |
Wi-Fi Calibration Data
Offset |
Name |
Bit |
INI |
Description |
|---|---|---|---|---|
0x20 |
Path A/S0 2.4G CCK TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 2.4G CCK TSSI offset for channel 1/2. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
0x21 |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 2.4G CCK TSSI offset for channel 3/4/5. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x22 |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 2.4G CCK TSSI offset for channel 6/7/8. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x23 |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 2.4G CCK TSSI offset for channel 9/10/11. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x24 |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 2.4G CCK TSSI offset for channel 12/13. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x25 |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 2.4G CCK TSSI offset for channel 14. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x26 |
Path A/S0 2.4G BW20-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 2.4G BW20-1S TSSI offset for channel 1/2. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
0x27 |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 2.4G BW20-1S TSSI offset for channel 3/4/5. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x28 |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 2.4G BW20-1S TSSI offset for channel 6/7/8. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x29 |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 2.4G BW20-1S TSSI offset for channel 9/10/11. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x2A |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 2.4G BW20-1S TSSI offset for channel 12/13/14. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x2B |
RSVD |
[7:0] |
Reserved |
|
0x2C |
RSVD |
[7:0] |
Reserved |
|
0x2D |
RSVD |
[7:0] |
Reserved |
|
0x2E |
RSVD |
[7:0] |
Reserved |
|
0x2F |
RSVD |
[7:0] |
Reserved |
|
0x30 |
RSVD |
[7:0] |
Reserved |
|
0x31 |
RSVD |
[7:0] |
Reserved |
|
0x32 |
Path A/S0 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 5G BW40-1S TSSI offset for channel 36/38/40. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
0x33 |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 5G BW40-1S TSSI offset for channel 44/46/48. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x34 |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 5G BW40-1S TSSI offset for channel 52/54/56. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x35 |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 5G BW40-1S TSSI offset for channel 60/62/64. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x36 |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 5G BW40-1S TSSI offset for channel 100/102/104. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x37 |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 5G BW40-1S TSSI offset for channel 108/110/112. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x38 |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 5G BW40-1S TSSI offset for channel 116/118/120. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x39 |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 5G BW40-1S TSSI offset for channel 124/126/128. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x3A |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 5G BW40-1S TSSI offset for channel 132/134/136. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x3B |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 5G BW40-1S TSSI offset for channel 140/142/144. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x3C |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 5G BW40-1S TSSI offset for channel 149/151/153. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x3D |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 5G BW40-1S TSSI offset for channel 157/159/161. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x3E |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 5G BW40-1S TSSI offset for channel 165/167/169. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x3F |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path A 5G BW40-1S TSSI offset for channel 173/175/177. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x40 |
RSVD |
[7:0] |
Reserved |
|
0x41 |
RSVD |
[7:0] |
Reserved |
|
0x42 |
RSVD |
[7:0] |
Reserved |
|
0x43 |
RSVD |
[7:0] |
Reserved |
|
0x44 |
RSVD |
[7:0] |
Reserved |
|
0x45 |
RSVD |
[7:0] |
Reserved |
|
0x46 |
RSVD |
[7:0] |
Reserved |
|
0x47 |
RSVD |
[7:0] |
Reserved |
|
0x48 |
RSVD |
[7:0] |
Reserved |
|
0x49 |
RSVD |
[7:0] |
Reserved |
|
0x4A |
Path B/S1 2.4G CCK TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 2.4G CCK TSSI offset for channel 1/2. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x4B |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 2.4G CCK TSSI offset for channel 3/4/5. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x4C |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 2.4G CCK TSSI offset for channel 6/7/8. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x4D |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 2.4G CCK TSSI offset for channel 9/10/11. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x4E |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 2.4G CCK TSSI offset for channel 12/13. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x4F |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 2.4G CCK TSSI offset for channel 14. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x50 |
Path B/S1 2.4G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 2.4G BW40-1S TSSI offset for channel 1/2. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x51 |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 2.4G BW40-1S TSSI offset for channel 3/4/5. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x52 |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 2.4G BW40-1S TSSI offset for channel 6/7/8. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x53 |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 2.4G BW40-1S TSSI offset for channel 9/10/11. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x54 |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 2.4G BW40-1S TSSI offset for channel 12/13/14. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x55 |
RSVD |
[7:0] |
Reserved |
|
0x56 |
RSVD |
[7:0] |
Reserved |
|
0x57 |
RSVD |
[7:0] |
Reserved |
|
0x58 |
RSVD |
[7:0] |
Reserved |
|
0x59 |
RSVD |
[7:0] |
Reserved |
|
0x5A |
RSVD |
[7:0] |
Reserved |
|
0x5B |
RSVD |
[7:0] |
Reserved |
|
0x5C |
Path B 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 5G BW40-1S TSSI offset for channel 36/38/40. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x5D |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 5G BW40-1S TSSI offset for channel 44/46/48. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x5E |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 5G BW40-1S TSSI offset for channel 52/54/56. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x5F |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 5G BW40-1S TSSI offset for channel 60/62/64. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x60 |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 5G BW40-1S TSSI offset for channel 100/102/104. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x61 |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 5G BW40-1S TSSI offset for channel 108/110/112. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x62 |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 5G BW40-1S TSSI offset for channel 116/118/120. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x63 |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 5G BW40-1S TSSI offset for channel 124/126/128. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x64 |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 5G BW40-1S TSSI offset for channel 132/134/136. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x65 |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 5G BW40-1S TSSI offset for channel 140/142/144. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x66 |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 5G BW40-1S TSSI offset for channel 149/151/153. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x67 |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 5G BW40-1S TSSI offset for channel 157/159/161. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x68 |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 5G BW40-1S TSSI offset for channel 165/167/169. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x69 |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path B 5G BW40-1S TSSI offset for channel 173/175/177. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
||
0x6A |
RSVD |
[7:0] |
Reserved |
|
0x6B |
RSVD |
[7:0] |
Reserved |
|
0x6C |
RSVD |
[7:0] |
Reserved |
|
0x6D |
RSVD |
[7:0] |
Reserved |
|
0x6E |
RSVD |
[7:0] |
Reserved |
|
0x6F |
RSVD |
[7:0] |
Reserved |
|
0x70 |
RSVD |
[7:0] |
Reserved |
|
0x71 |
RSVD |
[7:0] |
Reserved |
|
0x72 |
RSVD |
[7:0] |
Reserved |
|
0x73 |
RSVD |
[7:0] |
Reserved |
|
0x74 |
Path C 2.4G CCK TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 2.4G CCK TSSI offset for channel 1/2. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
0x75 |
Path C 2.4G CCK TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 2.4G CCK TSSI offset for channel 3/4/5. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
0x76 |
Path C 2.4G CCK TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 2.4G CCK TSSI offset for channel 6/7/8. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
0x77 |
Path C 2.4G CCK TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 2.4G CCK TSSI offset for channel 9/10/11. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
0x78 |
Path C 2.4G CCK TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 2.4G CCK TSSI offset for channel 12/13. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
0x79 |
Path C 2.4G CCK TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
00h |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 2.4G CCK TSSI offset for channel 14. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
0x7A |
Path C 2.4G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 2.4G BW40-1S TSSI offset for channel 1/2. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x7B |
Path C 2.4G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 2.4G BW40-1S TSSI offset for channel 3/4/5. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x7C |
Path C 2.4G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 2.4G BW40-1S TSSI offset for channel 6/7/8. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x7D |
Path C 2.4G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 2.4G BW40-1S TSSI offset for channel 9/10/11. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x7E |
Path C 2.4G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 2.4G BW40-1S TSSI offset for channel 12/13/14. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x7F |
RSVD |
[7:0] |
Reserved |
|
0x80 |
RSVD |
[7:0] |
Reserved |
|
0x81 |
RSVD |
[7:0] |
Reserved |
|
0x82 |
RSVD |
[7:0] |
Reserved |
|
0x83 |
RSVD |
[7:0] |
Reserved |
|
0x84 |
RSVD |
[7:0] |
Reserved |
|
0x85 |
RSVD |
[7:0] |
Reserved |
|
0x86 |
Path C 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 5G BW40-1S TSSI offset for channel 36/38/40. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x87 |
Path C 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 5G BW40-1S TSSI offset for channel 44/46/48. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x88 |
Path C 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 5G BW40-1S TSSI offset for channel 52/54/56. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x89 |
Path C 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 5G BW40-1S TSSI offset for channel 60/62/64. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x8A |
Path C 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 5G BW40-1S TSSI offset for channel 100/102/104. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x8B |
Path C 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 5G BW40-1S TSSI offset for channel 108/110/112. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x8C |
Path C 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 5G BW40-1S TSSI offset for channel 116/118/120. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x8D |
Path C 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 5G BW40-1S TSSI offset for channel 124/126/128. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x8E |
Path C 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 5G BW40-1S TSSI offset for channel 132/134/136. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x8F |
Path C 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 5G BW40-1S TSSI offset for channel 140/142/144. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x90 |
Path C 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 5G BW40-1S TSSI offset for channel 149/151/153. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x91 |
Path C 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 5G BW40-1S TSSI offset for channel 157/159/161. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x92 |
Path C 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 5G BW40-1S TSSI offset for channel 165/167/169. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x93 |
Path C 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path C 5G BW40-1S TSSI offset for channel 173/175/177. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x94 |
RSVD |
[7:0] |
Reserved |
|
0x95 |
RSVD |
[7:0] |
Reserved |
|
0x96 |
RSVD |
[7:0] |
Reserved |
|
0x97 |
RSVD |
[7:0] |
Reserved |
|
0x98 |
RSVD |
[7:0] |
Reserved |
|
0x99 |
RSVD |
[7:0] |
Reserved |
|
0x9A |
RSVD |
[7:0] |
Reserved |
|
0x9B |
RSVD |
[7:0] |
Reserved |
|
0x9C |
RSVD |
[7:0] |
Reserved |
|
0x9D |
RSVD |
[7:0] |
Reserved |
|
0x9E |
Path D 2.4G CCK TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 2.4G CCK TSSI offset for channel 1/2. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0x9F |
Path D 2.4G CCK TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 2.4G CCK TSSI offset for channel 3/4/5. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xA0 |
Path D 2.4G CCK TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 2.4G CCK TSSI offset for channel 6/7/8. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xA1 |
Path D 2.4G CCK TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 2.4G CCK TSSI offset for channel 9/10/11. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xA2 |
Path D 2.4G CCK TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 2.4G CCK TSSI offset for channel 12/13. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xA3 |
Path D 2.4G CCK TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 2.4G CCK TSSI offset for channel 14. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xA4 |
Path D 2.4G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 2.4G BW40-1S TSSI offset for channel 1/2. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xA5 |
Path D 2.4G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 2.4G BW40-1S TSSI offset for channel 3/4/5. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xA6 |
Path D 2.4G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 2.4G BW40-1S TSSI offset for channel 6/7/8. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xA7 |
Path D 2.4G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 2.4G BW40-1S TSSI offset for channel 9/10/11. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xA8 |
Path D 2.4G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 2.4G BW40-1S TSSI offset for channel 12/13/14. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xA9 |
RSVD |
[7:0] |
Reserved |
|
0xAA |
RSVD |
[7:0] |
Reserved |
|
0xAB |
RSVD |
[7:0] |
Reserved |
|
0xAC |
RSVD |
[7:0] |
Reserved |
|
0xAD |
RSVD |
[7:0] |
Reserved |
|
0xAE |
RSVD |
[7:0] |
Reserved |
|
0xAF |
RSVD |
[7:0] |
Reserved |
|
0xB0 |
Path D 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 5G BW40-1S TSSI offset for channel 36/38/40. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xB1 |
Path D 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 5G BW40-1S TSSI offset for channel 44/46/48. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xB2 |
Path D 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 5G BW40-1S TSSI offset for channel 52/54/56. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xB3 |
Path D 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 5G BW40-1S TSSI offset for channel 60/62/64. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xB4 |
Path D 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 5G BW40-1S TSSI offset for channel 100/102/104. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xB5 |
Path D 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 5G BW40-1S TSSI offset for channel 108/110/112. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xB6 |
Path D 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 5G BW40-1S TSSI offset for channel 116/118/120. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xB7 |
Path D 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 5G BW40-1S TSSI offset for channel 124/126/128. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xB8 |
Path D 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 5G BW40-1S TSSI offset for channel 132/134/136. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xB9 |
Path D 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 5G BW40-1S TSSI offset for channel 140/142/144. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xBA |
Path D 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 5G BW40-1S TSSI offset for channel 149/151/153. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xBB |
Path D 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 5G BW40-1S TSSI offset for channel 157/159/161. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xBC |
Path D 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 5G BW40-1S TSSI offset for channel 165/167/169. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xBD |
Path D 5G BW40-1S TSSI offset (Obtained from MP tool while performing power calibration) |
[7:0] |
Bit[7]: Sign-bit for TSSI offset (0 for plus and 1 for minus) Bit[6:0]: Path D 5G BW40-1S TSSI offset for channel 173/175/177. The calculation is 2’s complement. Ex: FF=-1, 1=+1 |
|
0xBE |
RSVD |
[7:0] |
Reserved |
|
0xBF |
RSVD |
[7:0] |
Reserved |
|
0xC0 |
RSVD |
[7:0] |
Reserved |
|
0xC1 |
RSVD |
[7:0] |
Reserved |
|
0xC2 |
RSVD |
[7:0] |
Reserved |
|
0xC3 |
Channel Plan Page |
[7:6] |
Defined Channel Plan Page 0/1/2/3. 11: Page 0 10: Page 1 01: Page 2 00: Page 3 |
|
0xC3 |
Channel Plan Page |
[5:0] |
Reserved |
|
0xC4 |
RSVD |
[7:0] |
Reserved |
|
0xC5 |
RSVD |
[7:0] |
Reserved |
|
0xC6 |
RSVD |
[7:0] |
Reserved |
|
0xC7 |
RSVD |
[7:0] |
Reserved |
|
0xC8 |
Channel Plan |
[7:0] |
7Fh |
Refer to the document with the topic “Channel Plan Domain Code” |
0xC9 |
Crystal Calibration |
[6:0] |
3Fh |
XTAL_K value Xi=Xo, Range: 0~7Fh. Note If in the case without assigned value, 0x3F will be used by the driver. |
0xC9 |
Crystal Calibration |
[7] |
0h |
Reserved |
0xCA |
Thermal Meter |
[7:0] |
20h |
Thermal Meter Value System maker will calibrate a value and save it in EEPROM. 0xFF: Disable Tx power tracking function |
0xCB |
IQ Calibration and LC Calibration |
[1:0] |
0h |
Do IQK by Thermal Meter ∆value. 0h: Mode 1 1h: Mode 2 2h: Mode 3 3h: Don’t IQK |
0xCB |
IQ Calibration and LC Calibration |
[3:2] |
0h |
Do LCK by Thermal Meter ∆value. 0h: Mode 1 1h: Mode 2 2h: Mode 3 3h: Don’t LCK |
0xCB |
IQ Calibration and LC Calibration |
[7:4] |
0h |
Reserved |
0xCC |
2.4G and 5G PA Type |
[7:0] |
||
0xCD |
2.4G LNA Type and Gain Selection |
[7:0] |
||
0xCE |
2.4G LNA Type and Gain Selection |
[7:0] |
||
0xCF |
5G LNA Type and Gain Selection |
[7:0] |
||
0x130 |
5G LNA Type and Gain Selection |
[7:0] |
||
0x131 |
Board Options |
[1:0] |
1h |
Regulatory selection 0h: Tx output power varies according to the power-by-rate table. (Power-limit table takes no effect on output power, non-regular use) 1h: Tx output power varies according to both the power-by-rate table and the power-limit table. (Power-by-rate table is generally provided by Realtek according to optimized through-put test, power-limit table is based on certification-pass criterion) (Default setting to satisfy both of the two purposed) 2h: Disable power-by-rate function. |
0x131 |
Board Options |
[2] |
0h |
Tx diversity 0: Disable or multi-Tx-path 1: Enable (de-featured to 1 Tx/stream) |
0x131 |
Board Options |
[3] |
0h |
Rx diversity 0: Disable or multi-Rx-path (Rx MRC) 1: Enable (de-featured to 1 Rx/stream) |
0x131 |
Board Options |
[4] |
0h |
Option for 11ac mode 0: Enable 11ac mode 1: Disable 11ac mode |
0x131 |
Board Options |
[7:5] |
1h |
Module type 0h: Wi-Fi solo module 1h: Wi-Fi/BT combo module 2~7h: Reserved |
0x132 |
Feature Options |
[1:0] |
0h |
Function configuration of pin_LED0 and pin_LED1 |
0x132 |
Feature Options |
[3:2] |
0h |
Link Speed shown in OS 0h: Current Tx PHY Rate 1h: Current Rx PHY Rate 2h: Maximum RX PHY Rate 3h: Reserved |
0x132 |
Feature Options |
[4] |
0h |
WLAN disable mode selection 0: Radio off 1: Power down |
0x132 |
Feature Options |
[7:5] |
0h |
Reserved |
x133 |
BT Setting (From BT’s point of view, not concerned with Wi-Fi) |
[0] |
0h |
Total antenna number 0: BT/Wi-Fi use dedicated antenna 1: BT/Wi-Fi use shared antenna |
x133 |
BT Setting (From BT’s point of view, not concerned with Wi-Fi) |
[3:1] |
0h |
Co-existence type 0h: Internal Mailbox 1h: Realtek BT I2C Mailbox (contact FAE for more information) |
x133 |
BT Setting (From BT’s point of view, not concerned with Wi-Fi) |
[4] |
1h |
Antenna isolation 0: High isolation (>35dB) 1: Low |
x133 |
BT Setting (From BT’s point of view, not concerned with Wi-Fi) |
[5] |
0h |
Radio on/off type 0: Combine with Wi-Fi 1: Individual |
x133 |
BT Setting (From BT’s point of view, not concerned with Wi-Fi) |
[6] |
0h |
BT AFE 0: BT SEL WLAFE 1: BT SEL BTAFE |
x133 |
BT Setting (From BT’s point of view, not concerned with Wi-Fi) |
[7] |
0h |
Reserved |
0x134 |
Version |
[7:0] |
00h |
EEPROM content version |
0x135 |
Customer ID |
[7:0] |
00h |
Customer ID Note 0x00 and 0xFF are reserved for Realtek. |
0x136 |
2.4G Tx BB Swing Setting |
[1:0] |
0h |
2.4G Path A OFDM 0h: 0dB 1h: -3dB 2h: -6dB 3h: -9dB |
0x136 |
2.4G Tx BB Swing Setting |
[3:2] |
0h |
2.4G Path B OFDM 0h: 0dB 1h: -3dB 2h: -6dB 3h: -9dB |
0x136 |
2.4G Tx BB Swing Setting |
[5:4] |
0h |
2.4G Path C OFDM 0h: 0dB 1h: -3dB 2h: -6dB 3h: -9dB |
0x136 |
2.4G Tx BB Swing Setting |
[7:6] |
0h |
2.4G Path D OFDM 0h: 0dB 1h: -3dB 2h: -6dB 3h: -9dB |
0x137 |
5G Tx BB Swing Setting |
[1:0] |
0h |
5G Path A OFDM 0h: 0dB 1h: -3dB 2h: -6dB 3h: -9dB |
0x137 |
5G Tx BB Swing Setting |
[3:2] |
0h |
5G Path B OFDM 0h: 0dB 1h: -3dB 2h: -6dB 3h: -9dB |
0x137 |
5G Tx BB Swing Setting |
[5:4] |
0h |
5G Path C OFDM 0h: 0dB 1h: -3dB 2h: -6dB 3h: -9dB |
0x137 |
5G Tx BB Swing Setting |
[7:6] |
0h |
5G Path D OFDM 0h: 0dB 1h: -3dB 2h: -6dB 3h: -9dB |
0x138 |
Tx Power Calibration Rate & Tx Power Tracking Mode |
[0] |
0h |
Power Calibration: 2.4G 40M Tx Power Calibrator Rate 0h: HT40, MCS7 64QAM 1h: VHT40, MCS9 256QAM |
0x138 |
Tx Power Calibration Rate & Tx Power Tracking Mode |
[1] |
0h |
Power Calibration: 5G 40M Tx Power Calibrator Rate 0h: HT40, MCS7 64QAM 1h: VHT40, MCS9 256QAM |
0x138 |
Tx Power Calibration Rate & Tx Power Tracking Mode |
[3:2] |
0h |
Reserved |
0x138 |
Tx Power Calibration Rate & Tx Power Tracking Mode |
[7:4] |
1h |
Power Tracking 0x0h ~ 0x3h: Power tracking by thermal 0x4h ~ 0x7h: Power tracking by TSSI |
0x139 |
Tx/Rx Path Selection |
[3:0] |
1h |
Rx path assignment Bit[3]: Path S3 Bit[2]: Path S2 Bit[1]: Path S1 Bit[0]: Path S0
Note The ability for maximum Tx/Rx paths would be constrained by real physical limitation. |
0x139 |
Tx/Rx Path Selection |
[7:4] |
1h |
Tx path assignment Bit[7]: Path S3 Bit[6]: Path S2 Bit[5]: Path S1 Bit[4]: Path S0
|
0x13A |
RFE Type (RF Front-end Type) (Concerned with hardware parameter) |
[6:0] |
1h |
RFE Type Contact FAE to get the right RFE type for individual hardware design. |
0x13A |
RFE Type (RF Front-end Type) (Concerned with hardware parameter) |
[7] |
0h |
Determined RFE type selection by driver or eFuse 1h: RFE type defined by the driver (discard the below setting of 0x13A[6:0]) 0h: RFE type defined by 0x13A[6:0] |
0x13B |
Country code |
[7:0] |
FFh |
Driver will set the ISO 3166-1 country code according to eFuse 0xC8 (channel plan) if the value is 0xFFFF. |
0x13C |
Country code |
[7:0] |
FFh |
Driver will set the ISO 3166-1 country code according to eFuse 0xC8 (channel plan) if the value is 0xFFFF. |
0x13D |
RSVD |
[7:0] |
Reserved |
|
0x13E |
RSVD |
[7:0] |
Reserved |
|
0x13F |
RSVD |
[7:0] |
Reserved |
HCI_SDIO Parameters
Offset (logical) |
name |
bit |
value |
description |
init value |
register offset |
|---|---|---|---|---|---|---|
0x200 |
SCSI |
[0] |
0x00 |
CCCR: 0x07 bit6 |
0x00 |
|
SDC |
[1] |
0x01 |
CCCR: 0x08 bit0 |
0x01 |
||
SMB |
[2] |
0x01 |
CCCR: 0x08 bit1 |
0x01 |
||
S4MI |
[3] |
0x01 |
CCCR: 0x08 bit4 |
0x01 |
||
SMPC |
[4] |
0x01 |
CCCR: 0x12 bit0 |
0x01 |
||
SHS |
[5] |
0x01 |
CCCR: 0x13 bit0 |
0x01 |
||
SSDR50 |
[6] |
0x01 |
CCCR: 0x14 bit0 |
0x00 |
||
SSDR104 |
[7] |
0x01 |
CCCR: 0x14 bit1 |
0x00 |
||
0x201 |
SDDR50 |
[0] |
0x01 |
CCCR: 0x14 bit2 |
0x00 |
|
SDTA |
[1] |
0x01 |
CCCR: 0x15 bit0 |
0x00 |
||
SDTC |
[2] |
0x01 |
CCCR: 0x15 bit1 |
0x00 |
||
SDTD |
[3] |
0x01 |
CCCR: 0x15 bit2 |
0x00 |
||
SAI |
[4] |
0x01 |
CCCR: 0x16 bit0 |
0x01 |
||
init_skip |
[5] |
0x00 |
0: need to use cmd 0 5 5 3 7 to enable Wifi, 1: skip |
0x00 |
SDIO Register 0x86[2] |
|
operating_voltage |
[6] |
0x01 |
Operating Voltage: 0=>3.3V; 1=>1.8V |
0x00 |
SDIO Register 0x86[3] |
|
intr_ctrl |
[7] |
0x01 |
1: enable intr ; 0: disable intr |
0x01 |
SDIO Register 0x86[4] |
|
0x202 |
FN1_SPS |
[0] |
0x01 |
FBR: 0x102 bit0 |
0x01 |
|
Reserved |
[3:1] |
0x00 |
0x00 |
|||
FN1_PS3 |
[7:4] |
0x00 |
FBR: 0x102 bit7~4 |
0x00 |
||
0x203 |
CCCR rev |
[3:0] |
0x03 |
CCCR:0 bit0~3 |
0x02 |
|
cmd_force_vld |
[4] |
0x00 |
when set to 1, reply any command at any SDIO status |
0x00 |
SDIO Register 0x00[5] |
|
Reply_S18A |
[5] |
0x01 |
Set S18A in response4 |
0x00 |
SDIO Register 0x00[6] |
|
Reserved |
[7:6] |
0x00 |
rsvd |
0x00 |
||
0x204 |
SDIO rev |
[3:0] |
0x04 |
CCCR:0 bit4~7 |
0x03 |
|
SD rev |
[7:4] |
0x03 |
CCCR:1 bit0~3 |
0x02 |
||
0x205 |
OCR |
[7:0] |
0xFF |
OCR[7:0] |
0xFF |
|
0x206 |
OCR |
[7:0] |
0xFF |
OCR[15:8] |
0xFF |
|
0x207 |
OCR |
[7:0] |
0xFF |
OCR[23:16] |
0xFF |
|
0x208 |
Common CIS Data |
[7:0] |
0x20 |
CISTPL_MANFID begin here |
0x20 |
|
0x209 |
[7:0] |
0x04 |
CISTPL_MANFID bytes |
0x04 |
||
0x20a |
[7:0] |
0x4C |
vendor id[7:0] |
0x4C |
||
0x20b |
[7:0] |
0x02 |
vendor id[15:8] |
0x02 |
||
0x20c |
[7:0] |
0x20 |
product_id[7:0] |
0x20 |
||
0x20d |
[7:0] |
0xB7 |
product_id[15:8] |
0xB7 |
||
0x20e |
[7:0] |
0x21 |
CISTPL_FUNCID begin here |
0x21 |
||
0x20f |
[7:0] |
0x02 |
CISTPL_FUNCID bytes |
0x02 |
||
0x210 |
[7:0] |
0x0C |
0x0C |
|||
0x211 |
[7:0] |
0x00 |
0x00 |
|||
0x212 |
[7:0] |
0x22 |
CISTPL_FUNCE begin here |
0x22 |
||
0x213 |
[7:0] |
0x04 |
CISTPL_FUNCE bytes |
0x04 |
||
0x214 |
[7:0] |
0x00 |
0x00 |
|||
0x215 |
[7:0] |
0x08 |
0x08 |
|||
0x216 |
[7:0] |
0x00 |
0x00 |
|||
0x217 |
[7:0] |
0x32 |
0x32 |
|||
0x218 |
[7:0] |
0xFF |
tuple chain end mark |
0xFF |
||
0x219 |
Function 1 CIS Data |
[7:0] |
0x21 |
CISTPL_FUNCID begin here |
0x21 |
|
0x21a |
[7:0] |
0x02 |
CISTPL_FUNCID bytes |
0x02 |
||
0x21b |
[7:0] |
0x0C |
0x0C |
|||
0x21c |
[7:0] |
0x00 |
0x00 |
|||
0x21d |
[7:0] |
0x22 |
CISTPL_FUNCE begin here |
0x22 |
||
0x21e |
[7:0] |
0x2A |
CISTPL_FUNCE bytes |
0x2A |
||
0x21f |
[7:0] |
0x01 |
0x01 |
|||
0x220 |
[7:0] |
0x01 |
0x01 |
|||
0x221 |
[7:0] |
0x00 |
0x00 |
|||
0x222 |
[7:0] |
0x00 |
0x00 |
|||
0x223 |
[7:0] |
0x00 |
0x00 |
|||
0x224 |
[7:0] |
0x00 |
0x00 |
|||
0x225 |
[7:0] |
0x00 |
0x00 |
|||
0x226 |
[7:0] |
0x00 |
0x00 |
|||
0x227 |
[7:0] |
0x00 |
0x00 |
|||
0x228 |
[7:0] |
0x00 |
0x00 |
|||
0x229 |
[7:0] |
0x00 |
0x00 |
|||
0x22a |
[7:0] |
0x00 |
0x00 |
|||
0x22b |
[7:0] |
0x00 |
0x00 |
|||
0x22c |
[7:0] |
0x02 |
0x02 |
|||
0x22d |
[7:0] |
0x00 |
0x00 |
|||
0x22e |
[7:0] |
0xFF |
0xFF |
|||
0x22f |
[7:0] |
0xFF |
0xFF |
|||
0x230 |
[7:0] |
0x00 |
0x00 |
|||
0x231 |
[7:0] |
0x00 |
0x00 |
|||
0x232 |
[7:0] |
0x00 |
0x00 |
|||
0x233 |
[7:0] |
0x00 |
0x00 |
|||
0x234 |
[7:0] |
0x00 |
0x00 |
|||
0x235 |
[7:0] |
0x00 |
0x00 |
|||
0x236 |
[7:0] |
0x00 |
0x00 |
|||
0x237 |
[7:0] |
0x00 |
0x00 |
|||
0x238 |
[7:0] |
0x00 |
0x00 |
|||
0x239 |
[7:0] |
0x00 |
0x00 |
|||
0x23a |
[7:0] |
0x00 |
0x00 |
|||
0x23b |
[7:0] |
0x00 |
0x00 |
|||
0x23c |
[7:0] |
0x00 |
0x00 |
|||
0x23d |
[7:0] |
0x00 |
0x00 |
|||
0x23e |
[7:0] |
0x00 |
0x00 |
|||
0x23f |
[7:0] |
0x00 |
0x00 |
|||
0x240 |
[7:0] |
0x00 |
0x00 |
|||
0x241 |
[7:0] |
0xEB |
0xEB |
|||
0x242 |
[7:0] |
0x00 |
0x00 |
|||
0x243 |
[7:0] |
0x6E |
0x6E |
|||
0x244 |
[7:0] |
0x01 |
0x01 |
|||
0x245 |
[7:0] |
0x00 |
0x00 |
|||
0x246 |
[7:0] |
0x00 |
0x00 |
|||
0x247 |
[7:0] |
0x00 |
0x00 |
|||
0x248 |
[7:0] |
0x00 |
0x00 |
|||
0x249 |
[7:0] |
0xFF |
tuple chain end mark |
0xFF |
||
0x24a |
Reserved |
[7:0] |
0xFF |
0xFF |
||
0x24b |
[7:0] |
0xFF |
0xFF |
|||
0x24c |
[7:0] |
0xFF |
0xFF |
|||
0x24d |
[7:0] |
0xFF |
0xFF |
|||
0x24e |
[7:0] |
0xFF |
0xFF |
|||
0x24f |
[7:0] |
0xFF |
0xFF |
|||
0x250 |
[7:0] |
0xFF |
0xFF |
|||
0x251 |
[7:0] |
0xFF |
0xFF |
|||
0x252 |
[7:0] |
0xFF |
0xFF |
|||
0x253 |
[7:0] |
0xFF |
0xFF |
|||
0x254 |
[7:0] |
0xFF |
0xFF |
|||
0x255 |
[7:0] |
0xFF |
0xFF |
|||
0x256 |
[7:0] |
0xFF |
0xFF |
|||
0x257 |
[7:0] |
0xFF |
0xFF |
|||
0x258 |
[7:0] |
0xFF |
0xFF |
|||
0x259 |
[7:0] |
0xFF |
0xFF |
|||
0x25a |
Function 2 CIS Data |
[7:0] |
0x21 |
CISTPL_FUNCID begin here |
0x21 |
|
0x25b |
[7:0] |
0x02 |
CISTPL_FUNCID bytes |
0x02 |
||
0x25c |
[7:0] |
0x0C |
0x0C |
|||
0x25d |
[7:0] |
0x00 |
0x00 |
|||
0x25e |
[7:0] |
0x22 |
CISTPL_FUNCE begin here |
0x22 |
||
0x25f |
[7:0] |
0x2A |
CISTPL_FUNCE bytes |
0x2A |
||
0x260 |
[7:0] |
0x01 |
0x01 |
|||
0x261 |
[7:0] |
0x01 |
0x01 |
|||
0x262 |
[7:0] |
0x00 |
0x00 |
|||
0x263 |
[7:0] |
0x00 |
0x00 |
|||
0x264 |
[7:0] |
0x00 |
0x00 |
|||
0x265 |
[7:0] |
0x00 |
0x00 |
|||
0x266 |
[7:0] |
0x00 |
0x00 |
|||
0x267 |
[7:0] |
0x00 |
0x00 |
|||
0x268 |
[7:0] |
0x00 |
0x00 |
|||
0x269 |
[7:0] |
0x00 |
0x00 |
|||
0x26a |
[7:0] |
0x00 |
0x00 |
|||
0x26b |
[7:0] |
0x00 |
0x00 |
|||
0x26c |
[7:0] |
0x00 |
0x00 |
|||
0x26d |
[7:0] |
0x02 |
0x02 |
|||
0x26e |
[7:0] |
0x00 |
0x00 |
|||
0x26f |
[7:0] |
0xFF |
0xFF |
|||
0x270 |
[7:0] |
0xFF |
0xFF |
|||
0x271 |
[7:0] |
0x00 |
0x00 |
|||
0x272 |
[7:0] |
0x00 |
0x00 |
|||
0x273 |
[7:0] |
0x00 |
0x00 |
|||
0x274 |
[7:0] |
0x00 |
0x00 |
|||
0x275 |
[7:0] |
0x00 |
0x00 |
|||
0x276 |
[7:0] |
0x00 |
0x00 |
|||
0x277 |
[7:0] |
0x00 |
0x00 |
|||
0x278 |
[7:0] |
0x00 |
0x00 |
|||
0x279 |
[7:0] |
0x00 |
0x00 |
|||
0x27a |
[7:0] |
0x00 |
0x00 |
|||
0x27b |
[7:0] |
0x00 |
0x00 |
|||
0x27c |
[7:0] |
0x00 |
0x00 |
|||
0x27d |
[7:0] |
0x00 |
0x00 |
|||
0x27e |
[7:0] |
0x00 |
0x00 |
|||
0x27f |
[7:0] |
0x00 |
0x00 |
|||
0x280 |
[7:0] |
0x00 |
0x00 |
|||
0x281 |
[7:0] |
0x00 |
0x00 |
|||
0x282 |
[7:0] |
0xEB |
0xEB |
|||
0x283 |
[7:0] |
0x00 |
0x00 |
|||
0x284 |
[7:0] |
0x6E |
0x6E |
|||
0x285 |
[7:0] |
0x01 |
0x01 |
|||
0x286 |
[7:0] |
0x00 |
0x00 |
|||
0x287 |
[7:0] |
0x00 |
0x00 |
|||
0x288 |
[7:0] |
0x00 |
0x00 |
|||
0x289 |
[7:0] |
0x00 |
0x00 |
|||
0x28a |
[7:0] |
0xFF |
tuple chain end mark |
0xFF |
||
0x28b |
Reserved |
[7:0] |
0xFF |
0xFF |
||
0x28c |
[7:0] |
0xFF |
0xFF |
|||
0x28d |
[7:0] |
0xFF |
0xFF |
|||
0x28e~0x29f |
[7:0] |
0xFF |
RSVD for SDIO |
0xFF |
HCI USB Parameters
offset (logical) |
name |
bit |
PG value |
description |
init value |
register offset |
|---|---|---|---|---|---|---|
0x2a0 |
[7:0] |
0xDA |
USB Vendor ID[7:0] |
0xDA |
FE60 |
|
0x2a1 |
[7:0] |
0x0B |
USB Vendor ID[15:8] |
0x0B |
FE61 |
|
0x2a2 |
[7:0] |
0x20 |
USB Product ID[7:0] |
0x20 |
FE62 |
|
0x2a3 |
[7:0] |
0x87 |
USB Product ID[15:8] |
0x87 |
FE63 |
|
0x2a4 |
USB optional function_0 (SIE) HW autoload |
[0] |
0x1 |
Bit[0]: Serial number 0 : Respond serial number from otp 1 : Respond serial number from internal ROM code(default value) |
0x1 |
FE64 |
0x2a4 |
USB optional function_0 (SIE) HW autoload |
[1] |
0x1 |
Bit[1]: USB remote wakeup function 0 : Do not support 1 : Support |
0x1 |
FE64 |
0x2a4 |
USB optional function_0 (SIE) HW autoload |
[2] |
0x0 |
Bit[2]: Device Power 0: Bus-Powered 1: Self-Powered |
0x0 |
FE64 |
0x2a4 |
USB optional function_0 (SIE) HW autoload |
[3] |
0x0 |
Bit[3]: Enable autoload UPHY 1 : enable： HW autoload UPHY parameter 0 : disable：default UPHY paramter in ROM code |
0x0 |
FE64 |
0x2a4 |
USB optional function_0 (SIE) HW autoload |
[4] |
0x0 |
Bit[4]: Enable SW load USB descriptor, PID/VID 1 : enable： SW read descriptor form efuse 0 : disable： SW using ROM code default value |
0x0 |
FE64 |
0x2a4 |
USB optional function_0 (SIE) HW autoload |
[7:5] |
0x7 |
RSVD |
0x1 |
FE64 |
0x2a5 |
Manufacture String & Product String & Serial Number |
[7:0] |
0x09 |
1.) Manufacture String (Autoload to 0xFE80~0xFE9F of SIE register) 2.) Product String (Autoload to 0xFEA0~0xFECF of SIE register) 3.) Serial Number(Autoload to 0xFED0~0xFEDF of SIE register) |
0x09 |
0xFE80~0xFE9F 0xFEA0~0xFECF 0xFED0~0xFEDF |
0x2a6 |
[7:0] |
0x03 |
0x03 |
|||
0x2a7 |
[7:0] |
0x52 |
0x52 |
|||
0x2a8 |
[7:0] |
0x65 |
0x65 |
|||
0x2a9 |
[7:0] |
0x61 |
0x61 |
|||
0x2aa |
[7:0] |
0x6C |
0x6C |
|||
0x2ab |
[7:0] |
0x74 |
0x74 |
|||
0x2ac |
[7:0] |
0x65 |
0x65 |
|||
0x2ad |
[7:0] |
0x6B |
0x6B |
|||
0x2ae |
[7:0] |
0x17 |
0x17 |
|||
0x2af |
[7:0] |
0x03 |
0x03 |
|||
0x2b0 |
[7:0] |
0x38 |
0x38 |
|||
0x2b1 |
[7:0] |
0x30 |
0x30 |
|||
0x2b2 |
[7:0] |
0x32 |
0x32 |
|||
0x2b3 |
[7:0] |
0x2E |
0x2E |
|||
0x2b4 |
[7:0] |
0x31 |
0x31 |
|||
0x2b5 |
[7:0] |
0x31 |
0x31 |
|||
0x2b6 |
[7:0] |
0x6E |
0x6E |
|||
0x2b7 |
[7:0] |
0x20 |
0x20 |
|||
0x2b8 |
[7:0] |
0x20 |
0x20 |
|||
0x2b9 |
[7:0] |
0x57 |
0x57 |
|||
0x2ba |
[7:0] |
0x4C |
0x4C |
|||
0x2bb |
[7:0] |
0x41 |
0x41 |
|||
0x2bc |
[7:0] |
0x4E |
0x4E |
|||
0x2bd |
[7:0] |
0x20 |
0x20 |
|||
0x2be |
[7:0] |
0x41 |
0x41 |
|||
0x2bf |
[7:0] |
0x64 |
0x64 |
|||
0x2c0 |
[7:0] |
0x61 |
0x61 |
|||
0x2c1 |
[7:0] |
0x70 |
0x70 |
|||
0x2c2 |
[7:0] |
0x74 |
0x74 |
|||
0x2c3 |
[7:0] |
0x65 |
0x65 |
|||
0x2c4 |
[7:0] |
0x72 |
0x72 |
|||
0x2c5 |
[7:0] |
0x0E |
0x0E |
|||
0x2c6 |
[7:0] |
0x03 |
0x03 |
|||
0x2c7 |
[7:0] |
0x30 |
0x30 |
|||
0x2c8 |
[7:0] |
0x30 |
0x30 |
|||
0x2c9 |
[7:0] |
0x65 |
0x65 |
|||
0x2ca |
[7:0] |
0x30 |
0x30 |
|||
0x2cb |
[7:0] |
0x34 |
0x34 |
|||
0x2cc |
[7:0] |
0x63 |
0x63 |
|||
0x2cd |
[7:0] |
0x30 |
0x30 |
|||
0x2ce |
[7:0] |
0x30 |
0x30 |
|||
0x2cf |
[7:0] |
0x30 |
0x30 |
|||
0x2d0 |
[7:0] |
0x30 |
0x30 |
|||
0x2d1 |
[7:0] |
0x30 |
0x30 |
|||
0x2d2 |
[7:0] |
0x31 |
0x31 |
|||
0x2d3 |
[7:0] |
0xFF |
0xFF |
|||
0x2d4 |
[7:0] |
0xFF |
0xFF |
|||
0x2d5 |
[7:0] |
0xFF |
0xFF |
|||
0x2d6 |
[7:0] |
0xFF |
0xFF |
|||
0x2d7 |
[7:0] |
0xFF |
0xFF |
|||
0x2d8 |
[7:0] |
0xFF |
0xFF |
|||
0x2d9 |
[7:0] |
0xFF |
0xFF |
|||
0x2da |
[7:0] |
0xFF |
0xFF |
|||
0x2db |
[7:0] |
0xFF |
0xFF |
|||
0x2dc |
[7:0] |
0xFF |
0xFF |
|||
0x2dd |
[7:0] |
0xFF |
0xFF |
|||
0x2de |
[7:0] |
0xFF |
0xFF |
|||
0x2df |
USB2 PHY Parameter |
[7:0] |
0x63 |
USB PHY Parameter : 0xE0 |
0x63 |
E0 |
0x2e0 |
USB2 PHY Parameter |
[7:0] |
0x18 |
USB PHY Parameter : 0xE1 |
0x18 |
E1 |
0x2e1 |
USB2 PHY Parameter |
[7:0] |
0xff |
USB PHY Parameter : 0xE2 |
0x00 |
E2 |
0x2e2 |
USB2 PHY Parameter |
[7:0] |
0xff |
USB PHY Parameter : 0xE3 |
0x00 |
E3 |
0x2e3 |
USB2 PHY Parameter |
[7:0] |
0x68 |
USB PHY Parameter : 0xE4 |
0x68 |
E4 |
0x2e4 |
USB2 PHY Parameter |
[7:0] |
0x00 |
USB PHY Parameter : 0xE5 |
0x00 |
E5 |
0x2e5 |
USB2 PHY Parameter |
[7:0] |
0x81 |
USB PHY Parameter : 0xE6 |
0x81 |
E6 |
0x2e6 |
USB2 PHY Parameter |
[7:0] |
0x81 |
USB PHY Parameter : 0xE7 |
0x81 |
E7 |
0x2e7 |
USB2 PHY Parameter |
[7:0] |
0x25 |
USB PHY Parameter : 0xE0 (Page 1) |
0x25 |
E8 |
0x2e8 |
USB2 PHY Parameter |
[7:0] |
0x77 |
USB PHY Parameter : 0xE1 (Page 1) |
0x77 |
E9 |
0x2e9 |
USB2 PHY Parameter |
[7:0] |
0xff |
USB PHY Parameter : 0xE2 (Page 1) |
0x00 |
EA |
0x2ea |
USB2 PHY Parameter |
[7:0] |
0xff |
USB PHY Parameter : 0xE3 (Page 1) |
0x00 |
EB |
0x2eb |
USB2 PHY Parameter |
[7:0] |
0xff |
USB PHY Parameter : 0xE4 (Page 1) |
0x00 |
EC |
0x2ec |
USB2 PHY Parameter |
[7:0] |
0xff |
USB PHY Parameter : 0xE5 (Page 1) |
0x00 |
ED |
0x2ed |
USB2 PHY Parameter |
[7:0] |
0xff |
USB PHY Parameter : 0xE6 (Page 1) |
0x00 |
EE |
0x2ee |
USB2 PHY Parameter |
[7:0] |
0x48 |
USB PHY Parameter : 0xE7 (Page 1) |
0x48 |
EF |
0x2ef |
USB2 PHY Parameter |
[7:0] |
0xec |
USB PHY Parameter : 0xF0 |
0xec |
F0 |
0x2f0 |
USB2 PHY Parameter |
[7:0] |
0x8c |
USB PHY Parameter : 0xF1 |
0x8c |
F1 |
0x2f1 |
USB2 PHY Parameter |
[7:0] |
0x00 |
USB PHY Parameter : 0xF2 |
0x00 |
F2 |
0x2f2 |
USB2 PHY Parameter |
[7:0] |
0x11 |
USB PHY Parameter : 0xF3 |
0x11 |
F3 |
0x2f3 |
USB2 PHY Parameter |
[7:0] |
0x9b |
USB PHY Parameter : 0xF4 |
0x9b |
F4 |
0x2f4 |
USB2 PHY Parameter |
[7:0] |
0x15 |
USB PHY Parameter : 0xF5 |
0x15 |
F5 |
0x2f5 |
USB2 PHY Parameter |
[7:0] |
0x00 |
USB PHY Parameter : 0xF6 |
0x00 |
F6 |
0x2f6 |
USB2 PHY Parameter |
[7:0] |
0x0a |
USB PHY Parameter : 0xF7 |
0x0a |
F7 |
0x2f7 |
USB2 PHY Parameter |
[7:4] |
0x4 |
USB PHY Parameter : 0xE7(Page2) Objective Value of dis-connect level calibration Current number = 87.5 +6.25*SEN(0) + 12.5*SEN(1) + 25*SEN(2) + 50*SEN(3) uA Default is 112,5uA reference Voltage = Ref.Current * 5Kohms, Therefoer, reference voltage = 562.5mV |
0x4 |
|
0x2f7 |
USB2 PHY Parameter |
[3:0] |
0x8 |
USB PHY Parameter : 0xE7(Page2) Objective Value of sensitivity calibration Current number = 87.5 +6.25*SEN(0) + 12.5*SEN(1) + 25*SEN(2) + 50*SEN(3) uA Default is 137,5uA reference Voltage = Ref.Current * 1 Kohms, Therefoer, reference voltage = 137.5mV |
0x8 |
|
0x2f7~0x2ff |
RSVD |
[7:0] |
0xff |
RSVD |
0xFF |
Ethernet Parameters
Offset (logical) |
name |
bit |
init value |
description |
|---|---|---|---|---|
0x300 |
Ethernet MAC address |
[7:0] |
00h |
Ethernet MAC address defined by customer |
0x301 |
[7:0] |
00h |
||
0x302 |
[7:0] |
00h |
||
0x303 |
[7:0] |
00h |
||
0x304 |
[7:0] |
00h |
||
0x305 |
[7:0] |
00h |
Security Zone
Security Zone Layout
Physical area 0x200~0x500 is used for security function, as illustrated in the following figure, and this security zone will be visited using a physical address directly. However, access to this zone is limited, and the whole zone will be protected in RMA mode.
0x200 ~ 0x35F
Function |
Name |
Size (bits) |
Start offset |
End offset |
Load order |
Specific IP can read? |
|---|---|---|---|---|---|---|
IPSEC |
S_IPSEC_Key1 |
256 |
0x200 |
0x021F |
Negative |
Y (LALU/RSIP) |
IPSEC |
S_IPSEC_Key2 |
256 |
0x220 |
0x023F |
Negative |
Y (LALU/RSIP) |
IPSEC |
NS_IPSEC_Key1 |
256 |
0x240 |
0x025F |
Negative |
Y (LALU) |
IPSEC |
NS_IPSEC_Key2 |
256 |
0x260 |
0x027F |
Negative |
Y (LALU) |
PKE PRI |
PKE PRI_KEY1 |
256 |
0x280 |
0x029F |
Positive |
Y (PKE) |
PKE PRI |
PKE PRI_KEY2 |
256 |
0x2A0 |
0x02BF |
Positive |
Y (PKE) |
RSIP |
RSIP_ECB_KEY |
256 |
0x2C0 |
0x02DF |
Negative |
Y (LALU/RSIP) |
RSIP |
RSIP_CTR_KEY |
256 |
0x2E0 |
0x02FF |
Negative |
Y (LALU/RSIP) |
SWD |
SWD_PASSWORD |
128 |
0x300 |
0x030F |
Positive |
Y (SWD_PWD) |
PSA |
HUK |
128 |
0x310 |
0x031F |
Negative |
N (0x40800310) |
Secure Boot |
PK1 (ROTPK hash) |
256 |
0x320 |
0x033F |
Positive |
N (0x40800320) |
Secure Boot |
PK2 (ROTPK hash) |
256 |
0x340 |
0x035F |
Positive |
N (0x40800340) |
0x360 ~ 0x37F
Offset |
Bit |
Symbol |
Description |
HW address |
INI |
|---|---|---|---|---|---|
0x360 |
[31:0] |
SWD_ID |
SWDID use to mapping the Real SWD Key |
Core-Sight internal REG |
8’hff |
0x364 |
[0] |
SWD_PWD_EN |
SWD Password Enable |
Core-Sight internal REG |
1’h0 |
0x364 |
[1] |
SWD_DBGEN |
SWD external debug authentication |
No-readable REG |
1’h0 |
0x364 |
[2] |
SWD_NIDEN |
No-readable REG |
1’h0 |
|
0x364 |
[3] |
SWD_SPIDEN |
No-readable REG |
1’h0 |
|
0x364 |
[4] |
SWD_SPNIDEN |
No-readable REG |
1’h0 |
|
0x364 |
[5] |
SWD_PWD_R_Protection_EN |
Key write protection and read protections |
No-readable REG |
1’h0 |
0x364 |
[6] |
SWD_PWD_W_Forbidden_EN |
No-readable REG |
1’h0 |
|
0x364 |
[7] |
HUK_W_Forbidden_EN |
No-readable REG |
1’h0 |
|
0x365 |
[0] |
SWD_SoftWare_CTRL_EN |
No-readable REG |
1’h0 |
|
0x365 |
[1] |
PK1_W_Forbidden_EN |
No-readable REG |
1’h0 |
|
0x365 |
[2] |
PK2_W_Forbidden_EN |
No-readable REG |
1’h0 |
|
0x365 |
[3] |
S_IPSEC_Key1_R_Protection_EN |
No-readable REG |
1’h0 |
|
0x365 |
[4] |
S_IPSEC_Key1_W_Forbidden_EN |
No-readable REG |
1’h0 |
|
0x365 |
[5] |
S_IPSEC_Key2_R_Protection_EN |
No-readable REG |
1’h0 |
|
0x365 |
[6] |
S_IPSEC_Key2_W_Forbidden_EN |
No-readable REG |
1’h0 |
|
0x365 |
[7] |
NS_IPSEC_Key1_R_Protection_EN |
No-readable REG |
1’h0 |
|
0x366 |
[0] |
NS_IPSEC_Key1_W_Forbidden_EN |
No-readable REG |
1’h0 |
|
0x366 |
[1] |
NS_IPSEC_Key2_R_Protection_EN |
No-readable REG |
1’h0 |
|
0x366 |
[2] |
NS_IPSEC_Key2_W_Forbidden_EN |
No-readable REG |
1’h0 |
|
0x366 |
[3] |
PKE_PRI_KEY1_R_Protection_EN |
No-readable REG |
1’h0 |
|
0x366 |
[4] |
PKE_PRI_KEY1_W_Forbidden_EN |
No-readable REG |
1’h0 |
|
0x366 |
[5] |
PKE_PRI_KEY2_R_Protection_EN |
No-readable REG |
1’h0 |
|
0x366 |
[6] |
PKE_PRI_KEY2_W_Forbidden_EN |
No-readable REG |
1’h0 |
|
0x366 |
[7] |
RSIP_KEY1_R_Protection_EN |
No-readable REG |
1’h0 |
|
0x367 |
[0] |
RSIP_KEY1_W_Forbidden_EN |
No-readable REG |
1’h0 |
|
0x367 |
[1] |
RSIP_KEY2_R_Protection_EN |
No-readable REG |
1’h0 |
|
0x367 |
[2] |
RSIP_KEY2_W_Forbidden_EN |
No-readable REG |
1’h0 |
|
0x367 |
[3] |
RSIP_MODE_W_Forbidden_EN |
RSIP_MODE |
No-readable REG |
1’h0 |
0x367 |
[4] |
SIC_SECURE_EN |
No-readable REG |
1’h0 |
|
0x367 |
[5] |
CPU_PC_DBG_EN |
No-readable REG |
1’h0 |
|
0x367 |
[6] |
UDF1_TRUSTZONE_EN |
No-readable REG |
1’h0 |
|
0x367 |
[7] |
UDF2_TRUSTZONE_EN |
No-readable REG |
1’h0 |
|
0x368 |
[0] |
HWTRIG_UART_DOWNLOAD_DISABLE |
0x40800368[0] |
1’h0 |
|
0x368 |
[1] |
RSVD |
0x40800368[1] |
1’h0 |
|
0x368 |
[2] |
RSIP_EN |
0x40800368[2] |
1’h0 |
|
0x368 |
[3] |
SECURE_BOOT_EN |
0x40800368[3] |
1’h0 |
|
0x368 |
[4] |
SECURE_BOOT_HW_DIS |
0x40800368[4] |
1’h0 |
|
0x368 |
[5] |
RDP_EN |
0x40800368[5] |
1’h0 |
|
0x368 |
[6] |
Anti_Roback_EN |
0x40800368[6] |
1’h0 |
|
0x368 |
[7] |
FAULT_LOG_PRINT_DIS |
0x40800368[7] |
1’h0 |
|
0x369 |
[1:0] |
RSIP_MODE |
0x40800368[9:8] |
2’b00 |
|
0x369 |
[2] |
HUK_DERIV_EN |
0x40800368[10] |
1’b0 |
|
0x369 |
[3] |
UDF3_TRUSTZONE_EN |
0x40800368[11] |
1’h0 |
|
0x369 |
[4] |
UDF4_TRUSTZONE_EN |
0x40800368[12] |
1’h0 |
|
0x369 |
[5] |
PK_IDX (ROTPK hash Index) |
0x40800368[13] |
1’h0 |
|
0x369 |
[6] |
SWTRIG_UART_DOWNLOAD_DISABLE |
0x40800368[14] |
1’h0 |
|
0x369 |
[7] |
SPIC_PINMUX_IN_TESTMODE_DISABLE |
0x40800368[15] |
1’h0 |
|
0x36A |
[7:0] |
RSVD |
0x40800368[23:16] |
8’h00 |
|
0x36B |
[3:0] |
SECURE_BOOT_AUTH_ALG |
0x40800368[27:24] |
4’h0 |
|
0x36B |
[7:4] |
SECURE_BOOT_HASH_ALG |
0x40800368[31:28] |
4’h0 |
|
0x36C |
[15:0] |
OTA_ADDR |
OTA address, 4K aligned |
0x4080036C[15:0] |
16’hffff |
0x36E |
[15:0] |
RSVD |
RSVD |
0x4080036C[31:16] |
16’hffff |
0x370 |
[15:0] |
CRC0 |
CRC check |
0x40800370[15:0] |
16’hffff |
0x372 |
[15:0] |
CRC1 |
0x40800372[15:0] |
32’hffffffff |
|
0x374 |
[15:0] |
CRC2 |
0x40800374[15:0] |
32’hffffffff |
|
0x376 |
[15:0] |
CRC3 |
0x40800376[15:0] |
32’hffffffff |
|
0x378 |
[63:0] |
BOOTLOADER_VER |
Bootloader version |
0x40800378[63:0] |
64’hffffffffffffffff |
Note
If RSIP_MODE_W_Forbidden_EN is programed, 0x369[7:0] is not allowed to changed.
Security Area Auto-load
Auto-load Control
This security area can be divided into key area (0x200~0x35F), configuration area (0x360~0x37F) and user-defined area (0x380~0x4FF). The key area can also be divided into two groups: software inaccessible area (0x200~0x30F) and software accessible area (0x310~0x35F).
The auto-load software inaccessible data in a flip-flop can only be accessed by the special HW engine; there is no other way to access the flip-flop area. e.g. S_IPSEC_KEY can only be accessed by secure IPSEC, other HW engines even non-secure IPSEC cannot access this key.
The software accessible area will be loaded to the read-only area and can be accessed by CPU. This area contains two kinds of keys ─ HUK and Public key. The HUK is protected by the sticky bit. The ROM boot code will set the sticky bit after reading the HUK. After that, CPU cannot access the HUK any longer.
The configuration area will be auto-loaded to the internal read-only registers. The security auto-load control is illustrated below.
Note
The IPsec key located in
0x200~0x23Fcan only be accessed by secure IPsec with the corresponding Key ID.The IPsec key located in
0x240~0x27Fcan only be accessed by non-secure IPsec with the corresponding Key ID.The PKE key can only be accessed by PKE master with the corresponding Key ID.
The RSIP key can only be accessed by OTF master and IPsec with the corresponding Key ID.
The SWD key and SWD ID can only be accessed by SWD access point.
Configuration data located in
0x368~0x369will be auto-loaded to the internal read-only register.
Auto-load Data Access Flow
In this section, IPsec will be taken as an example to illustrate how auto-load keys work.
There are two types of IPsec keys, which are used for secure IPsec and non-secure IPsec respectively. Software should configure these Key IDs to the corresponding IPsec, and then enable IPsec when using these keys.
S_IPSEC_Key: the IPsec key located in
0x200~0x23Ffor secure IPsec. After configured and enabled by software, the secure IPsec will use this key to encrypt or decrypt the data.NS_IPSEC_Key: the IPsec key located in
0x240~0x27Ffor non-secure IPsec. After configured and enabled by software, the non-secure IPsec will use this key to encrypt or decrypt the data.RSIP key can also be loaded to IPSEC to achieve image encryption. Both Secure IPsec and non-secure IPsec can access the keys by correct Key ID.
Configuration Area
Security Area Read Access Control
In the configuration area, most of the bits are used to control the write enable or read enable of the key area. Hardware will autoloader these bits and use them as access permission control.
For the key zone, each key has a read forbidden control bit in the configuration area. If this bit is programmed to ‘0’, the key cannot be read anymore.
The HUK can only be read before a sticky bit written. In ROM boot code, software will read HUK and write the sticky bits. So the HUK can only be accessed in ROM boot code.
Each user-defined zone has a control bit. If this bit is programmed to ‘0’, this zone can only be accessed from secure word.
Security area read access control is illustrated below.
The SIC_EN bit is used to cut off the path of SIC interface to all internal registers, meaning that if SIC_EN is programmed, the SIC is totally disabled. The SIC_EN can’t read In RMA mode, so the SIC can access internal registers. however, the OTP area from 0x200~0x500 cannot be accessed in RMA mode, the system registers and other OTP regions can be accessed from SIC.
Security Area Write Access Control
For the key zone, each key has a write forbidden control bit in the configuration area. If this bit is programmed to ‘0’, the key cannot be programmed anymore.
The RSIP mode in the configuration area also has a write forbidden control bit. If this bit is programmed to ‘0’, RSIP cannot be programmed again.
Each user-defined zone has a control bit. If this bit is programmed to ‘0’, this zone can only be accessed from secure word.
Security area write access control is illustrated below.
User-defined Area
The user-defined zone can be used as a rollback counter private key or any other purposes freely.
The size of this area is 256 bytes, and can be divided into four areas: 0x380~0x3BF, 0x3C0~0x3F, 0x400~0x47F and 0x480~0x4FF. These areas can be defined to secure-only OTP areas by the configuration bits. The secure-only area is an area that can only be accessed from secure world, customers can put the keys with higher security level in this area.
By default, these two areas are non-secure. If the bit UDF1_Trustzone_EN (0x367[6]) is programmed, the 0x380~0x3BF area can only be operated in secure word. Thus, the write from non-secure word is invalid and read from non-secure word returns all 0xFF. The configuration bit UDF2_Trustzone_EN (0x367[7]), UDF3_TRUSTZONE_EN (0x369[3]) and UDF4_TRUSTZONE_EN (0x369[4]) has the same function.
CRC Check
To avoid the fault injection, an internal LDO is added as the power supply of OTP. The LDO can filter most of the glitches. From published information, a hacker may have the ability to influence one OTP bit, to prevent this problem from being our weakness, CRC16 check is added.
The CRC is comprised of four CRC entries, each entry is 16-bit CRC. CRC check passes only when the CRC value are matched. The process of CRC check is illustrated below.
If the CRC check fails, hardware will bypass this information to software. The information is stored in two 32-bit registers, which includes the compare result flag, expected CRC, valid CRC. SW will just print out the expected and real CRC value in ROM and go to an endless loop instead of normal boot.
By default, the value of all CRC entry is 0xFFFF, indicating that the CRC check is disabled; otherwise, CRC check is enabled.
If entry 0 is not 0xFFFF, entry 0 is enabled (actually CRC Bit15 = 0 means enabled). If entry 1 is not 0xFFFF, it indicates that entry 0 is disabled and entry1 is enabled; and so on until entry 3. If the last valid entry check fails, it means that CRC check fails.
Note
CRC check cannot be disabled once enabled.
If CRC entry 3 is enabled, any modification in security zone (
0x200~0x36F) will led to CRC check fails.
HW will auto-load the CRC entry twice with a random delay between them, and do OR operation to calculate the final load result. If the final result equals 0xFFFF, and all CRC entry equal to 0xFFFF, CRC check is disabled; otherwise, CRC check is enabled.
Whether CRC check needs to be done is related to the auto-load of security zone. Each time the system auto-loads the security zone when boot, CRC will be checked. All the reset types including CHIP_EN, POR, WDG, SYS_RET, BOR, Thermal_RST, and waking up from deep-sleep will trigger auto-load, thus CRC check will be performed by HW subsequently and automatically.
If customers want to enable CRC check, we suggest do it in the last step at factory. Hardware of Realtek already provides the ability to calculate the CRC even if the related keys are read-forbidden, for customers, software only needs to trigger hardware to do a calculation for all auto-load in security zone (0x200~0x36F), the CRC value is stored by HW and CPU cannot read it out, so software need to trigger hardware to write it into the corresponding CRC entry again.
Random Load
Some hackers may want to crack the OTP content by observing the current. Even the OTP principle is based on the difference of current, but it reads out 32 bits at the same time, also the OTP itself did the balance. From the technology we know now, it’s very hard to distinguish the difference. However, to achieve a supper secure level, a random seed is added to OTP auto-load flow. When HW does secure zone auto-load, the random seed comes from two different clocks, and the auto-load scheme is not published to the public.
Multi-time Load
The PSA area and CRC entries can’t be protected by the above strategy, here we use a multi-time load scheme to prevent it from being cracked. Both PSA and CRC will be loaded more than one time, and the final result is the “or operation” of multi-read.
Protected in RMA Mode
RMA means Return Material Authorization. When customers have already programmed their keys or security materials into the security zone, and then suspect that there are some defects with the chip, they need Realtek’s help to analyze, but do not want Realtek to touch any of their security materials. That is why this security area needs to be protected in RMA mode.
RMA mode can be achieved by programming the first byte of PSA (Life Status) in hidden OTP.
If the number of 1 in this byte is even, it means that the chip is in normal mode and the access permission to each zone is determined by configuration area.
If the number of 1 in this byte is odd, it means that the chip is in RMA mode, writing to security zone is forbidden and reading from this zone always returns 1.
If all bit is zero, enter decommissioned state and cannot exit.
Security zone access control is illustrated below.
In RMA mode, HW cannot access the whole security zone and user-defined physical zone, because the 0x200~0x4FF zone is all 0xFF, just like a new chip. However, we don’t want anyone to have the ability to look inside into the chip. So in this case, HW will always load SWD Key into core-sight, customers need to offer the SWD key to Realtek. Moreover, if the RMA Key is programmed (not all 0xFF), the ROM boot code will enable secure boot, customers also need to offer the secure boot key pair to Realtek or help Realtek do signature.
The PSA has 8 bits to control the life cycle of the device, because all zero is reserved for the decommissioned state, so one device can be programed to RMA mode 3 times at most. And customers need to program the chip to RMA mode before shipping the chip to Realtek, because Realtek cannot program OTP without the customer’s help.
The SWD key and SWD ID are designed to prevent from unexpected debug. You may write different keys to each device, and need to get the SWD ID by J-Link first, then find the SWD key in your database. Finally, use the SWD key to enable the debug function.
Note
It is the most convenient way to get SWD ID by J-Link.
Decommissioned Mode
When the PSA byte is programed with all bits cleared (0), the device transitions into a decommissioned status, and entering this state requires a system reset. In Decommissioned mode, the behavior is same as RMA mode, moreover, CPU always boot fail.
Load Order
When the Keys are auto-loaded to HW, some of them are using positive order while others using the negative order. The Keys that may be used by IPSEC all use negative order, so that it can get the same results with mbedtls. The definition of load order is illustrated in the following figures.
ROM Code Patch Zone
The ROM code patch zone stores the ROM code in a Realtek-defined format, and the format won’t be published to the public. This area is 512 bytes and divided into two parts. In case the ROM code patch only needs less than 256 bytes, another part can be used for other purposes.
ROM code patch can always be read. But in PSA area, the two bits ROM_PATCH_LWE and ROM_PATCH_HWE are used to control write permission to this zone.
If ROM_PATCH_LWE is programmed, the
0x500~0x5FFcannot be programmed anymore.If ROM_PATCH_HWE is programmed, the
0x600~0x6FFcannot be programmed anymore.
For secure concerns, the ROM_PATCH_LWE is always suggested to be programmed in the factory. The low 256 bytes of ROM code patch zone (0x500~0x5FF) is not allowed for other usages. If you want to use the high 256 bytes (0x600~0x6FF), you should guarantee that the bit ROM_PATCH_LWE is programmed and the last 4 bytes of the low 256 bytes is empty (0x5FC = 0xFFFFFFFF).
ROM code patch area is illustrated below.
