# 10GBASE-T module PHY Register Access

Converted from the Wiitek-provided Word file `10GBase-T PHY Register Operation .doc` in this directory (vendor document, last saved 2018-11-07). The original is bilingual, an English section and a Chinese section covering the same protocol; this document merges them, translated to English. Details that appear only in the Chinese section are folded in: the password is called PW2 and 0xFF 0xFF 0xFF 0xFF is the Wiitek (源拓) factory default, and the A2.120 link-rate register at the end is Chinese-section-only.

A bridge from I2C to MDIO is designed into the 10GBASE-T module. The PHY's registers can be indirectly accessed through a set of I2C registers in A2 Table 3.

## Register map

The original "I2C table" is a Visio figure (identical in both sections): a box "switch table: A2.127 == 3" with an arrow labeled PW2 pointing into a "Table 3" stack of six registers, addressed 128–133, followed by "………" (further registers not shown):

| A2 (Table 3) address | Field | Meaning |
|---|---|---|
| 128 | CMD | 0: idle; 1: write operation; 2: read operation; 3: operation in progress; 4: operation completed |
| 129 | Device Addr | MDIO device address |
| 130 | Reg High | MDIO register address, high byte |
| 131 | Reg Low | MDIO register address, low byte |
| 132 | Value High | MDIO data, high byte |
| 133 | Value Low | MDIO data, low byte |

Before accessing these indirect-control registers, switch tables by setting A2.127 = 3, then write the 4-byte PW2 password to A2.123~A2.126 to obtain PW2 permission. The Wiitek factory default password is 0xFF 0xFF 0xFF 0xFF.

## Write operation (Device: 0x01, Register: 0xC001, value: 0xAA55)

1. Change to Table 3: set A2.127 = 3
2. Write password: set A2.123~A2.126 = 0xFF 0xFF 0xFF 0xFF
3. Set MDIO device address: set A2.129 = 0x01
4. Set MDIO register address high: set A2.130 = 0xC0
5. Set MDIO register address low: set A2.131 = 0x01
6. Set MDIO register data high: set A2.132 = 0xAA
7. Set MDIO register data low: set A2.133 = 0x55
8. Execute write operation: set A2.128 = 0x01
9. Check A2.128 until the operation is completed (A2.128 = 0x4)

## Read operation (Device: 1, Register: 0xC001)

1. Change to Table 3: set A2.127 = 3
2. Write password: set A2.123~A2.126 = 0xFF 0xFF 0xFF 0xFF
3. Set MDIO device address: set A2.129 = 0x01
4. Set MDIO register address high: set A2.130 = 0xC0
5. Set MDIO register address low: set A2.131 = 0x01
6. Execute read operation: set A2.128 = 0x02
7. Check A2.128 until the operation is completed (A2.128 = 0x4)
8. Get MDIO register data high: read A2.132
9. Get MDIO register data low: read A2.133

The Chinese section states the results explicitly: after CMD reads 4, A2.132 and A2.133 are the high and low bytes of register 1.0xC001.

## PHY part number

The part number of the PHY in the module can be read from I2C register A2.250 in Table 3:

1. Change to Table 3: set A2.127 = 3
2. Write password: set A2.123~A2.126 = 0xFF 0xFF 0xFF 0xFF
3. Read A2.250. Value = 1: MV_88X3310; other values: to be defined in the future

## Link rate (A2.120)

Reads the copper-port link rate. Present on AQR and RTL8221 modules, and on firmware 377 v4.5 or later. (Chinese section only.)

| Value | Rate |
|---|---|
| 0x0 | link down |
| 0x1 | 100BASE-T |
| 0x2 | 1000BASE-T |
| 0x3 | 10G |
| 0x4 | 2.5G |
| 0x5 | 5G |
| 0xA | 10M |
