CH592 radio register reference

I've spent some time reverse engineering the radio peripheral of the CH592 microcontroller. The other WCH BLE microcontrollers are broadly similar. My long term goal is better support in the open source ch32fun library. There is some API design work still needed for that. In the meantime, here are my work-in-progress register level docs. These are undoubtedly both incomplete and in places incorrect. However, they are enough to implement the basics of BLE.

If you have questions about the WCH radios, the best place to ask is the ch32fun discord. The reverse engineering effort has been taking place there. Thanks to @beimster, @montemonte, and others there for their help with this.

Radio

The radio hardware is organized into 4 memory mapped peripheral blocks.

The BB and LLE blocks have interrupt requests associated with them.

Interrupt lines: BB_IRQn = 20, LLE_IRQn = 21.

Notation

Register names match docs for the few that WCH has named publicly. Most are my own invention, matching ch32fun names when reasonable.

BB (BB_BASE = 0x4000C100) -- BaseBand controller

CTRL_CFG (BB0) -- BaseBand Controller Config

I think this register controls the RF frequency iff bit 1 of RF11 is cleared.

CRCINIT (BB1) -- Initial CRC register value

ACCESSADDR (BB2) -- Access Address

32-bit access address used for both TX and RX

BB4 -- Unknown

Increasing [5:0] narrows the acceptable frequency offset. Reception breaks above 0x1c, the blob sets 0x0e.

BB6 -- Unknown

BB9 -- Unknown

CTRL_TX (BB11) -- TX Control

RSSI (BB12) -- Signal Stats

Written repeatedly while demodulating a packet. Updates continuously in receive when BB9 bit 15 is set. Between updates it holds the last value.

Uncertain if bit 0 is the LSB of the CFO, but I think it is. The carrier frequency offset scale is relative to the symbol rate: 19.3 Hz per count at 1M and 38.7 Hz per count at 2M.

BBINT_EN (BB13) -- Baseband Interrupt Enable

BBSTATUS (BB14) -- Baseband Status

Bits [28:25] read 1 while the radio is idle.

Packet-processing state [23:16] advances through a fixed sequence, 0x00 being idle.

Observed states:

BB15 -- Unknown

Looks like four 5 bit fields?

BB22, BB24 -- RSSI Sample Counters

Two independent 32-bit up-counters. Both increment at about 29.0 kHz, once for each RSSI sample.

CTE (BB26) -- Constant Tone Extension?

I think this is BB25 on the CH58x.

Bits 22:19 are 0x0010_0000 on CH59x and 0x0028_0000 on CH58x

Sets RB_RF_ANT_SW_EN in R16_PIN_ALTERNATE if param_1 != 0:

RF antenna switch control output enable:

1: Switch control output to PA[4]~PA[5], PA[12]~PA[15];

LL (LL_BASE = 0x4000C200) -- Link Layer Engine

CTRL_CMD (LL0) -- Link Layer Engine Command

Write 1 for RX, 2 for TX. 8 is probably STOP, 4 might be SHUT (untested). STOP is intended to exit automatic mode from the ISR. SHUT resets the entire LLE state machine (c.f. CH579DS1).

LL_CFG (LL1) -- Link Layer Engine Configuration

[31:16] is a 2 MHz counter, 0.5 us per count. It sets a delay between the LL0 command and the TX/RX in both manual and auto mode. Values above about 256 destabilise transmission?

LLSTATUS (LL2) -- Link Layer Engine Status

Bits [25:0] are latched IRQ flags, cleared by writing 1. Bits [31:26] are read-only live state and clear themselves.

LLINT_EN (LL3) -- Link Layer Engine Interrupt Enable

Auto Mode Delay Pairs (LL5/LL7 - LL17/LL19)

Four pairs of 32-bit timing registers. In auto mode, the spacing between the two phases is determined by one of these four pairs. Which pair is used seems to match the choice of IRQs in 7:4 and 11:8. The values work out to either 129 us or 125 us. I suspect this is so the RX starts a little early?

The even indexed LL registers in-between (LL6 - LL18) appear unused?

CTRL_MOD (LL20) -- LLE Module Control?

LL21 -- Unknown

LLTMRn (LL24-LL29) -- LLE Timers

Six independent 32-bit count down timers. Value decrements every 0.5 us (2 MHz) until it reaches 0. The decrement of the count from 1 to 0 triggers the corresponding LL IRQ (16 - 21).

TXBUF (LL30) -- Transmit data buffer

Pointer to the transmit data, formatted as a PDU including header PDU (plaintext) length is determined from TXBUF[1]. When hardware packet encryption is enabled the on-air packet includes four additional MIC bytes.

Address must be in RAM and word aligned. The value in the register is masked by 0x00007ffc.

RXBUF (LL31) -- Receive data buffer

Pointer to the receive buffer. Will be filled with received PDU including header. PDU (plaintext) length is in RXBUF[1]. When hardware packet encryption is enabled the length in the buffer does not include the four additional MIC bytes.

Address must be in RAM and word aligned. The value in the register is masked by 0x00007ffc.

Buffer contents

The hardware appends four status bytes to the end of the RX buffer. Here n is the length on-air, which is BUF[1]+4 when AES is enabled.

When AES CCM is enabled, RXBUF[LENGTH + 9] bit 7 set indicates MIC failure.

AES (AES_BASE = 0x4000C300) -- AES Accelerator

128-bit AES engine with two modes selected by CTRL bit 7: ECB block mode over the register file, and CCM packet mode inline in the radio datapath. Register addresses are the same in both modes; the roles of AES2-AES5, DATA and KEY differ.

Clocked by the BLE clock (R8_SLP_CLK_OFF1.RB_SLP_CLK_BLE). Serviced by BB_IRQn; there is no dedicated AES interrupt line.

CTRL (AES0) -- AES Control

STAT (AES1) -- AES Status

When bit 0 is set, AES completion triggers a BB interrupt.

AES2 -- CCM Nonce IV Low

AES3 -- CCM Nonce IV High

AES4 -- CCM Packet Counter Low

AES5 -- CCM Packet Counter High

DATA (AES6-AES9) -- Data Block / CCM SKD

Four 32-bit words, DATA[0] at offset 0x18. Words are packed little-endian: the byte at DATA[0] bits [7:0] is FIPS-197 block byte 0.

ECB mode: the input block. The result overwrites it in place, and is valid once STAT bit 1 is set.

CCM mode: the 16-byte session key diversifier (SKD). Not modified by the engine.

KEY (AES10-AES17) -- Key / CCM LTK

Four, six, or eight 32-bit words, KEY[0] at offset 0x28. Pack like DATA: the byte at KEY[0] bits [7:0] is FIPS-197 key byte 0. Retained across operations.

ECB mode: the 128-bit / 192-bit / 256-bit key. Length determined by CTRL.

CCM mode: the long term key (LTK). The engine derives the session key internally as AES-128-ECB(KEY, DATA). The derived key is not written back to any register.

AES18 - AES21 -- Scratch

Updated by AES operations but has no visible impact.

ECB operation

Write KEY, write CTRL with bit 1 selecting the direction, write DATA, then set CTRL bit 0. Then wait for STAT bit 1 to set. DATA read back before STAT bit 1 sets is stale. One block takes approximately 39 core cycles.

CCM operation

Write CTRL with bit 7 set and bit 5 selecting the direction, write AES4, AES5, DATA, KEY, AES2 and AES3, then set CTRL bit 6. The engine then waits for one packet in one direction. LL->CTRL_MOD bit 5 must be set for that packet to be routed through the engine. Completion is indicated by CTRL bit 6 clearing and STAT bit 1 setting. Raises no interrupt of its own, unclear if a BB interrupt is tied to this.

LENGTH is the plaintext length in both directions. The additional authenticated data is the PDU header octet with NESN, SN and MD masked to zero. Data is encrypted/decrypted on the fly. TXBUF is not modified. On reception the plaintext is written to RXBUF whether or not authentication succeeded. A status byte is appended at RXBUF[RXBUF[1] + 9] with bit 7 set on MIC failure.

RFEND (RFEND_BASE = 0x4000D000) -- RF FrontEND

RF11

RF17 -- Manual Tune

F_hz = COARSE * 64 MHz + FINE * 244.140625 Hz and 244.140625 Hz = 64 MHz / 2^18

I suspect the demodulator expects offset tuning by data rate, e.g. tune to 2401 MHz to receive 2402 MHz in 1M PHY mode.

if (tune-by-channel) {
    RFEND->RF11 &= ~(1 << 1);
    BB->CTRL_CFG = (BB->CTRL_CFG & ~0x7f) | chan & 0x7f;
} else {
    // Probably needed for whitening sequence
    BB->CTRL_CFG = (BB->CTRL_CFG & ~0x7f) | chan & 0x7f;
    if (tune-by-channel) {
        if (2M PHY) {
            freq = freq - 2000;
        }
        else {
            freq = freq - 1000;
        }
    }
    RFEND->RF11 |= (1 << 1);
    RFEND->RF17 = (RFEND->RF17 & 0xfe0fffff) | (freq / 64000 & 0x1f) << 20;
    RFEND->RF17 = (RFEND->RF17 & 0xfffc0000) | (freq % 64000 << 10) / 250 & 0x3ffff;
}

RF20 -- Receive Settings

POR value 0x00017010. Writable mask 0x1031f71f.

Increasing 4:0 lowers the upper edge of the channel filter. Setting 20 / 21 negates I / Q, mirroring the signal. Can't determine which is I vs Q, doesn't really matter.