Lifecycle

Overview

The chip lifecycle is a security mechanism that manages the chip’s states throughout the entire process from production, end-user deployment, repair and maintenance, to final decommission. Through lifecycle management, appropriate security policies can be enabled at different stages of the chip, ensuring security requirements during normal use while protecting user sensitive data from leakage during repair scenarios.

Ameba SoC lifecycle uses OTP (One-Time Programmable memory) bits to identify and switch states, providing hardware-level tamper resistance. The chip supports the following three lifecycle states:

State	Description
Normal state	The chip is used in the customer’s actual application with all security policies enabled. This is the default working state after the chip leaves the factory.
RMA state (Return Material Authorization)	The repair or failure analysis state. In this state, the chip can be debugged and analyzed by the original manufacturer or authorized institutions, while protecting user sensitive data from being read.
Decommission state (Decommission/EOL)	The state after the end of the chip’s lifecycle. Once entered, it is irreversible, the OTP data is physically invalidated, and the chip is completely scrapped.

The lifecycle state transition process is shown in the figure below:

Lifecycle State Determination and Transition

RTL8721DxRTL8720ERTL8710ERTL8726ERTL8713ERTL8730ERTL8721FRTL8720F

RTL8721Dx:

The chip identifies its current lifecycle state by the value of 0x700 bit[7:0] in OTP. The determination is based on the number of bit 1 in this byte:

Number of bit 1	Current state	OTP value examples
Even (and not 0)	Normal state	0xFF (8 ones), 0xFC (6 ones), 0xF0 (4 ones)
Odd	RMA state	0xFE (7 ones), 0xF8 (5 ones), 0xE0 (3 ones)
0	Decommission state	0x00

RMA state is entered and exited by modifying this OTP value. Each transition changes the number of bit 1 between odd and even: program to an odd number to enter RMA, and to an even number to exit. Since OTP can only be programmed from 1 to 0 (irreversible), each programming can only reduce the number of bit 1, so two adjacent transitions must be programmed to different values. The table below lists the recommended programming sequence for 4 complete rounds of RMA entry/exit starting from the initial state:

Step	Target state	OTP value	Description
Initial	Normal state	0xFF	Factory default, 8 ones, even
1st RMA entry	RMA state	0xFE	7 ones, odd
1st RMA exit	Normal state	0xFC	6 ones, even
2nd RMA entry	RMA state	0xF8	5 ones, odd
2nd RMA exit	Normal state	0xF0	4 ones, even
3rd RMA entry	RMA state	0xE0	3 ones, odd
3rd RMA exit	Normal state	0xC0	2 ones, even
4th RMA entry	RMA state	0x80	1 one, odd
Exceeding 4 times	Decommission state	0x00	Triggered automatically or programmed manually

RMA Operation Process

RMA Count Limit

RTL8721DxRTL8720ERTL8710ERTL8726ERTL8713ERTL8730ERTL8721FRTL8720F

RTL8721Dx:

Ameba SoCs allow a maximum of 4 complete rounds of RMA entry/exit. When attempting to enter RMA for the 5th time, the OTP needs to be programmed to 0x00, and the chip will enter the decommission state. This operation is irreversible. Therefore, the number of RMA cycles of each chip must be strictly recorded to avoid accidentally entering the decommission state.

Operation Steps

RTL8721DxRTL8720ERTL8710ERTL8726ERTL8713ERTL8730ERTL8721FRTL8720F

RTL8721Dx:

Enter RMA state:

1. Confirm the chip is in the normal state.

2. Program 0x700 bit[7:0] to the corresponding value (see the programming sequence table above).

   AT+OTP=WRAW,0x700,1,FE
   

3. Reset the chip. The chip enters RMA state.

Exit RMA state:

1. After the RMA process is completed, program 0x700 bit[7:0] to the corresponding value (see the programming sequence table above).

   AT+OTP=WRAW,0x700,1,FC
   

2. Reset the chip. The chip exits RMA state.

Decommission State (EOL/Decommission)

The decommission state is the end of the chip’s lifecycle, used for chip scrapping, failure, or active security destruction scenarios. After entering the decommission state:

• All OTP bits are erased or invalidated.

• The chip’s boot phase is completely locked and cannot be recovered to any other lifecycle state.

• The chip cannot be debugged or unlocked.

• When the chip powers on, it can only output a decommission signature via LOG_UART and cannot execute any application programs.

Trigger Conditions

There are two ways for the chip to enter the decommission state:

Method 1: Exceeding the RMA count limit

After the number of RMA entry/exit cycles exceeds 3, the chip needs to be manually programmed to enter the decommission state.

Method 2: Active security destruction

Users can actively enter the decommission state by programming the physical OTP:

RTL8721DxRTL8720ERTL8710ERTL8726ERTL8713ERTL8730ERTL8721FRTL8720F

RTL8721Dx:

Users have to implement the decommission state logic by themselves. Realtek recommends: If the User Define area of the OTP is not locked, this OTP area must be fully erased by writing zeros to protect sensitive data from leakage.

Security Mechanisms in RMA State

To protect user data security during the RMA process, the chip enables the following security mechanisms:

OTP Data Protection

After the chip enters RMA state, part of the OTP area becomes inaccessible:

RTL8721DxRTL8720ERTL8710ERTL8726ERTL8713ERTL8730ERTL8721FRTL8720F

RTL8721Dx:

In RMA mode, the security area 0x200 ~ 0x37F and all user-defined physical areas 0x380 ~ 0x4FF are inaccessible.

Since the security area is unreadable, all data encryption and identity authentication that depend on HUK will be terminated, effectively preventing user sensitive data from leaking during the RMA process.

RMA Secure Boot

To prevent running unauthorized firmware during the RMA process, the chip implements an RMA secure boot mechanism. The user must pre-program the RMA Public Key Hash, after which only firmware signed with this key can run in RMA state.

For the detailed mechanism, refer to Secure Boot .

RMA SWD Debug Protection

SWD (Serial Wire Debug) is the main interface for chip debugging. To prevent malicious use in RMA state, the chip enables the SWD password protection mechanism in RMA state, requiring the correct RMA SWD Key to be entered before connecting the debugger. The RMA SWD Key is generated and programmed to OTP by the user, and it is recommended to complete the configuration in the normal state. If the RMA SWD Key is lost, debugging in RMA state will not be possible.

For the detailed mechanism, refer to SWD Protection .

Caution

• All production lines, after-sales, and maintenance stages must strictly record and audit the decommissioning process and confirm its irreversibility.

• Unlike the general RMA state, after entering the decommission state, the chip is completely scrapped, with a higher security level, and cannot be used for analysis or recovery.