cabletest/docs/modules/fs/bcm84891l-sfp-registers.md

# FS SFP-10G-T-100 transport reference — transcription

Full visual transcription (tables intact) of a 4-page excerpt
`10GBase-T Coper SFP Registers Operation's Reference for BCM84891.pdf` (the pages are
numbered "Page N of 19", so this is a 4-page excerpt of a 19-page ODM document; PDF
metadata titles it "ABCU-5710RZ / ABCU-5700RZ"). Page banner:
"100/1000Base-T or 10/5/2.5GBase-T Copper SFP+ Transceiver; Cat 6a/7 up to 100 m at 10GBase;
Cat 5 or better up to 100 m at 100/1000Base; 0–70 °C or −40–85 °C."

Cabletest field notes (shipped-unit deviations from the reference values, and findings) are
marked **Field note**.

## 1. Serial ID Memory Contents (I2C A0h)

The 10GBase-T Copper SFP provides standard serial ID compliant with SFP MSA, accessed at
address A0h via the 2-wire serial CMOS EEPROM protocol.

### Base ID Fields

| Addr | Size (B) | Field | Description / Contents | Hex |
|---|---|---|---|---|
| 0 | 1 | Identifier | Type of Serial transceiver (SFP) | 03 |
| 1 | 1 | Ext. Identifier | Extended identifier of type serial transceiver (MOD4) | 04 |
| 2 | 1 | Connector | Code of optical connector type (Copper) | 21 |
| 3–10 | 8 | Transceiver | 10G Base-XFI to Copper or SGMII to Copper | 02 00 00 00 00 08 00 00 |
| 11 | 1 | Encoding | 64B/66B (or 8B/10B) | 00 |
| 12 | 1 | BR, Nominal | Nominal baud rate, unit of 100 MBd (10.3125 GBd for 10GBase-T) | 67 |
| 13 | 1 | Rate Identifier | Type of rate select functionality (Unspecified) | 00 |
| 14 | 1 | Length (SMF9um)-km | Link length supported for single mode fiber, units of km | 00 |
| 15 | 1 | Length (SMF9um) | Link length supported for 9/125um fiber, units of 100m | 00 |
| 16 | 1 | Length (50um) | Link length supported for 50/125um OM2 fiber, units of 10m | 00 |
| 17 | 1 | Length (62.5um) | Link length supported for 62.5/125um OM1 fiber, units of 10m | 00 |
| 18 | 1 | Length (OM4 or copper cable) | Link length for 50um OM4 fiber, units of 10m. Alternatively copper or direct-attach cable, units of m. For copper links, specifies minimum link length (30m) supported while operating in compliance with applicable standards using copper cable. | 64 |
| 19 | 1 | Length (OM3) | Link length supported for 50um OM3 fiber, units of 10m | 00 |
| 20–35 | 16 | Vendor Name | SFP vendor name (ASCII) "OEM " | 4F 45 4D 20 20 20 20 20 20 20 20 20 20 20 20 20 |
| 36 | 1 | Transceiver | Code for electronic or optical compatibility | 00 |
| 37–39 | 3 | Vendor OUI | SFP vendor IEEE company ID; all zero = unspecified | 00 00 00 |
| 40–55 | 16 | Vendor PN | Part number (ASCII) "10GBase-T C100m" | 31 30 47 42 61 73 65 2D 54 20 42 21 30 30 6D 20 |
| 56–59 | 4 | Vendor rev | Revision (ASCII); all zero = unspecified (1.0 revision) | 31 2E 30 20 |
| 60–61 | 2 | Wavelength | Laser wavelength (Passive/Active Cable Spec Compliance). 00 for both bytes = wavelength/cable spec compliance unspecified. | 00 00 |
| 62 | 1 | Unallocated | | 00 |
| 63 | 1 | CC_BASE | Check code for Base ID Fields — LSB of checksum of addresses 0–62 | xx |

### Extended ID Fields

| Addr | Size (B) | Field | Description / Contents | Hex |
|---|---|---|---|---|
| 64–65 | 2 | Option | Which optional transceiver signals are implemented: TX_DISABLE and RX_LOS are implemented | 00 12 |
| 66 | 1 | BR, max | Upper bit-rate margin, units of %; 00 = not specified | 00 |
| 67 | 1 | BR, min | Lower bit-rate margin, units of %; 00 = not specified | 00 |
| 68–83 | 16 | Vendor SN | Serial number (ASCII) | xx… |
| 84–91 | 8 | Date code | Manufacturing date: Year (2B), Month (2B), Day (2B), vendor lot code, may be blank (2B) | xx… |
| 92 | 1 | Diagnostic Monitoring Type | Which type of diagnostic monitoring is implemented (if any) | 00 |
| 93 | 1 | Enhanced Options | Which optional enhanced features are implemented (if any) | 00 |
| 94 | 1 | SFF-8472 Compliance | Which SFF-8472 revision the transceiver complies with; 00 = digital diagnostics not included/undefined | 00 |
| 95 | 1 | CC_EX | Check code for Extended ID Fields (addresses 64–94) | xx |

### Vendor Specific ID Fields

| Addr | Size (B) | Field | Description / Contents | Hex |
|---|---|---|---|---|
| 96–127 | 32 | Vendor specific | Vendor Specific EEPROM | all 00 |
| 128–255 | 128 | Reserved | Reserved for SFF-8079 | all 00 |

**Field note:** the shipped FS unit deviates from these reference values where it is *more*
honest about being copper — Connector reads 22 (RJ45) not 21; Vendor Name reads "FS";
Vendor PN reads "SFP-10G-T-100"; Options read 00 1A. Critically, address 92 (Diagnostic
Monitoring Type) = 00 → **no A2h DOM is implemented** (the "optical DOM" some tools expect
is absent; only the PHY command handler exposes temperature/voltage/SNR).

## 2. SMI (I2C→MDIO) Communication Protocol for the SFP's PHY

The Copper SFP serial ID is at A0h. The physical IC (the PHY) is also accessible via 2-wire
bus at address **ACh** — the PHY address is `1010110x` where x is the R/W bit (0xAC write /
0xAD read).

- **PHY register write — one I2C frame:** after START, send 0xAC (PHY address), then
  `000+DevAD` (device address of PHY), then Reg_H and Reg_L (register address), then Data_H
  and Data_L, before STOP.
- **PHY register read — two I2C frames:** first frame sends 0xAC and `001+DevAD` with Reg_H,
  Reg_L before STOP. Second frame sends 0xAD after START, then reads Data_H, Data_L before
  STOP.

## 3. SMI Reading and Writing Time Sequence

**SMI Write register** (6 I2C bytes): `S [0xAC] [000+DevAD] [Reg_H] [Reg_L] [Data_H] [Data_L] P`
- 1st byte: 0xAC (8 bits)
- 2nd byte: 0b000 + DEVAD (5 bits)
- 3–4 bytes: Register Address (16 bits)
- 5–6 bytes: Write Data (16 bits)

**SMI Read register** (7 I2C bytes, two frames):
`S [0xAC] [001+DevAD] [Reg_H] [Reg_L] P` → **Delay > 1 mS** → `S [0xAD] [Data_H] [Data_L] P`
- 1st byte: 0xAC (8 bits)
- 2nd byte: 0b001 + DEVAD (5 bits)
- 3–4 bytes: Register Address (16 bits)
- **Delay > 1 mS (Important: for Host access Copper SFP PHY through I²C)**
- 5th byte: 0xAD (8 bits)
- 6–7 bytes: Read Data (16 bits)

**Bit-level examples** (colored waveform: Start / Master / Slave-ACK / Stop):
- *Write 0x55AA to DEVAD 1 Register 0xA820.*
- *Read 0x8542 from DEVAD 1 Register 0x0003* — note the final read data byte is **NAK**'d by
  the master before STOP, and the `Delay > 1 mS` sits between the address frame and the data
  read.

**Field note:** these diagrams are the authority for our `sff_i2c` framing — every written
byte is slave-ACKed, the final read byte is master-NAKed, and the >1 ms inter-frame delay is
mandatory (a single-byte read with no delay sees the bridge as inert/zero). Validated on
hardware; the compound `x` op holds the whole write→delay→read under one bus lock.

## 4. PHY Device Register Map Summary (Clause-45 MMDs)

| DEVAD | Block |
|---|---|
| 1 | 10GBASE-T PMA/PMD (Clause 45 MMD) |
| 3 | 10GBASE-T PCS (Clause 45 MMD); XFI_M (XGMII) block is DEVAD 3\* |
| 7 | AN (Clause 45 MMD); SGMII (XGMII) and 10/100/1000BASE-T PCS/PMA/PMD at Clause-45 MMD 0xFFE0–0xFFFF |
| 30 | Top Level (User-Defined) (Clause 45 MMD) |

Side blocks (below the MMD bus): JTAG, SPI, BSC, PLL/Clock, LED Controller.

## 5. Accessing PHY Device Register Instructions

Two host command primitives implement PHY register read/write (command 1 = configuration,
command 2 = check XGPHY status):

- **Command 1 — `Write_XGPHY_Register p1 p2 p3 p4`:** p1 = 0xAC (8b); p2 = 0b000 + DEVAD (5b);
  p3 = Register Address (16b, 2 bytes); p4 = Write Data (16b, 2 bytes).
- **Command 2 — `Read_XGPHY_Register p1 p2 p3 p4 p5 p6`:** p1 = 0xAC (8b); p2 = 0b001 + DEVAD
  (5b); p3 = Register Address (16b); p4 = Delay > 1 mS (Important: for Host access Copper SFP
  PHY through I2C); p5 = 0xAD (8b); p6 = Read Data (16b).

**Example — set PHY to work in 10GBE rate** (write these 8 frames one by one; the doc text
says "9 commands" but lists 8). The datasheet gives only the `Write_PHY_Register …` frames;
the `Register = value` column is a mechanical decode of the frame bytes, and the **Meaning
column is our annotation, not datasheet text**.

| Frame | Register = value | Meaning (our annotation) |
|---|---|---|
| `Write_PHY_Register AC 01 00 00 20 40` | 1.0x0000 = 0x2040 | PMA control: 10G speed select |
| `Write_PHY_Register AC 01 00 07 00 09` | 1.0x0007 = 0x0009 | PMA control 2: 10GBASE-T type |
| `Write_PHY_Register AC 07 00 10 10 01` | 7.0x0010 = 0x1001 | AN advertisement |
| `Write_PHY_Register AC 07 00 20 10 03` | 7.0x0020 = 0x1003 | 10GBASE-T AN control |
| `Write_PHY_Register AC 07 00 3C 00 08` | 7.0x003C = 0x0008 | EEE advertisement — advertises 10GBASE-T EEE |
| `Write_PHY_Register AC 07 00 40 00 00` | 7.0x0040 = 0x0000 | |
| `Write_PHY_Register AC 07 80 00 00 10` | 7.0x8000 = 0x0010 | vendor AN register |
| `Write_PHY_Register AC 07 00 00 B2 00` | 7.0x0000 = 0xB200 | AN control: enable + restart |

**Field note:** the EEE-advertisement line (7.0x003C = 0x0008) means the reference bring-up —
and possibly the module firmware's own defaults — leaves 10GBASE-T EEE negotiable. Verify and
force EEE/AutogrEEEn off for measurement runs (see the EEE-off recipe and probe results in
[README.md](README.md)).