/* 設置Backplane地址的高17位 */
static void WiFi_SetBackplaneWindow(uint32_t addr)
{
  addr &= 0xffff8000;
  WiFi_LowLevel_WriteReg(1, 0x1000c, addr >> 24);
  WiFi_LowLevel_WriteReg(1, 0x1000b, (addr >> 16) & 0xff);
  WiFi_LowLevel_WriteReg(1, 0x1000a, (addr >> 8) & 0xff);
}

/* 讀取Backplane值 */
void WiFi_ReadBackplaneValue(uint32_t addr, void *buffer, uint8_t len)
{
  uint8_t *p = buffer;
 
  WiFi_SetBackplaneWindow(addr);
 
  // 取Backplane地址的低15位
  addr &= 0x7fff; // sb offset addr is <= 15 bits, 32k
  if (len == 4)
    addr |= 0x8000; // with b15, maps to 32-bit SB access
 
  while (len > 0)
  {
    *p = WiFi_LowLevel_ReadReg(1, addr);
    addr++;
    p++;
    len--;
  }
  WiFi_SetBackplaneWindow(0x18000000);
}

uint16_t value;
printf("----------------------------------------------\n");
WiFi_ReadBackplaneValue(0x18000000, &value, 2);
printf("Chip ID: %d\n", value);

讀出來的chip id是43430。

另外，SDIO CIS信息裡面的0xa9a6換算成十進位也是43430。