diff --git a/.agents/skills/generate_pdf/SKILL.md b/.agents/skills/generate_pdf/SKILL.md new file mode 100644 index 0000000..b688248 --- /dev/null +++ b/.agents/skills/generate_pdf/SKILL.md @@ -0,0 +1,74 @@ +--- +name: Generate Course PDF +description: Renders a markdown file into the strict PDF format used by the Embedded-Hacking course, ensuring strict ASCII box alignment and LaTeX math rendering. +--- + +# Generate Course PDF + +When creating, editing, or generating PDFs for the Embedded-Hacking course in the strict/exact format, follow these mandatory steps: + +## 1. Clean Emojis from Markdown +Emojis and certain high-surrogate Unicode characters can cause the Puppeteer/PDF.js render to crash with unresolved pattern errors in VS Code. +Run a script to strip emojis and high-surrogate Unicode characters from the target Markdown file before converting: +```python +import re, sys +with open(sys.argv[1], 'r', encoding='utf-8') as f: + text = f.read() +clean_text = re.sub(r'[\U00010000-\U0010ffff]', '', text) +with open(sys.argv[1], 'w', encoding='utf-8') as f: + f.write(clean_text) +``` + +## 2. Mandatory ASCII Art Box Alignment Audit +All ASCII art boxes in the course notes must have pixel-perfect character alignment. +- The standard course ASCII box width is exactly **67 characters** (`+` followed by 65 `-` followed by `+`). +- Every line inside the box MUST begin with `|` and end with `|` at the exact same column width (length 67). +- A closing `|` that is even one character too far to the left or right is strictly forbidden. +- Always run an automated audit before rendering: +```python +import sys + +with open(sys.argv[1], 'r', encoding='utf-8') as f: + lines = [l.rstrip('\r\n') for l in f.readlines()] + + +def check(box): + if len(box) >= 3 and box[0][0].strip().startswith('+') and box[-1][0].strip().startswith('+'): + target_len = len(box[0][0]) + for bl, bidx in box: + if len(bl) != target_len: + raise ValueError(f"ASCII box alignment error on line {bidx}: expected {target_len} chars, got {len(bl)}: {bl}") + + +in_code = False +box = [] +for idx, l in enumerate(lines, 1): + if l.strip().startswith('```'): + check(box) + in_code = not in_code + box = [] + continue + if in_code and len(l.strip()) > 2 and ((l.strip().startswith('+') and l.strip().endswith('+')) or (l.strip().startswith('|') and l.strip().endswith('|'))): + box.append((l, idx)) + else: + check(box) + box = [] +check(box) +``` + +Note: `check(box)` must run on every boundary, including the closing ```` ``` ```` fence and end of file. A box that sits last in a fenced block is otherwise never validated. + +## 3. LaTeX Math Rendering +- The PDF renderer uses `marked-katex-extension` with self-contained, inlined Base64 KaTeX `woff2` fonts. +- Inline math must use `$formula$` and display math must use `$$formula$$`. +- Never leave broken or unbalanced LaTeX delimiters. +- Verify in the final PDF that all math expressions render cleanly with zero raw `$` delimiters in the body text. + +## 4. Run the Render Script +The strict course format rendering script is located in `Documents/data-science/EH`: +- Working Directory: `Documents/data-science/EH` +- Command: `node render-lesson-pdf.mjs [ABSOLUTE_PATH_TO_SOURCE_MD] [ABSOLUTE_PATH_TO_OUTPUT_PDF]` + +## 5. Verification & Git Hygiene +- Inspect the generated PDF to confirm proper page layout, fonts, and headers/footers (`Course Notes`). +- Ensure `.DS_Store` or other OS metadata files are never staged or committed to the repository (verify `.gitignore`). diff --git a/.gitignore b/.gitignore index 1430494..ae78e5e 100644 --- a/.gitignore +++ b/.gitignore @@ -62,3 +62,13 @@ node_modules/ package-lock.json package.json svg-to-pdf.ps1 + +# Operating System Files +.DS_Store +.DS_Store? +._* +.Spotlight-V100 +.Trashes +ehthumbs.db +Thumbs.db + diff --git a/0x0001a_stack/.gitignore b/0x0001a_stack/.gitignore new file mode 100644 index 0000000..2435c20 --- /dev/null +++ b/0x0001a_stack/.gitignore @@ -0,0 +1,2 @@ +build +!.vscode/* diff --git a/0x0001a_stack/.vscode/c_cpp_properties.json b/0x0001a_stack/.vscode/c_cpp_properties.json new file mode 100644 index 0000000..5a108f1 --- /dev/null +++ b/0x0001a_stack/.vscode/c_cpp_properties.json @@ -0,0 +1,22 @@ +{ + "configurations": [ + { + "name": "Pico", + "includePath": [ + "${workspaceFolder}/**", + "${userHome}/.pico-sdk/sdk/2.3.0/**" + ], + "forcedInclude": [ + "${workspaceFolder}/build/generated/pico_base/pico/config_autogen.h", + "${userHome}/.pico-sdk/sdk/2.3.0/src/common/pico_base_headers/include/pico.h" + ], + "defines": [], + "compilerPath": "${userHome}/.pico-sdk/toolchain/15_2_Rel1/bin/arm-none-eabi-gcc.exe", + "compileCommands": "${workspaceFolder}/build/compile_commands.json", + "cStandard": "c17", + "cppStandard": "c++14", + "intelliSenseMode": "linux-gcc-arm" + } + ], + "version": 4 +} diff --git a/0x0001a_stack/.vscode/cmake-kits.json b/0x0001a_stack/.vscode/cmake-kits.json new file mode 100644 index 0000000..b0f3815 --- /dev/null +++ b/0x0001a_stack/.vscode/cmake-kits.json @@ -0,0 +1,15 @@ +[ + { + "name": "Pico", + "compilers": { + "C": "${command:raspberry-pi-pico.getCompilerPath}", + "CXX": "${command:raspberry-pi-pico.getCxxCompilerPath}" + }, + "environmentVariables": { + "PATH": "${command:raspberry-pi-pico.getEnvPath};${env:PATH}" + }, + "cmakeSettings": { + "Python3_EXECUTABLE": "${command:raspberry-pi-pico.getPythonPath}" + } + } +] \ No newline at end of file diff --git a/0x0001a_stack/.vscode/extensions.json b/0x0001a_stack/.vscode/extensions.json new file mode 100644 index 0000000..a940d7c --- /dev/null +++ b/0x0001a_stack/.vscode/extensions.json @@ -0,0 +1,9 @@ +{ + "recommendations": [ + "marus25.cortex-debug", + "ms-vscode.cpptools", + "ms-vscode.cpptools-extension-pack", + "ms-vscode.vscode-serial-monitor", + "raspberry-pi.raspberry-pi-pico" + ] +} \ No newline at end of file diff --git a/0x0001a_stack/.vscode/launch.json b/0x0001a_stack/.vscode/launch.json new file mode 100644 index 0000000..7078fb1 --- /dev/null +++ b/0x0001a_stack/.vscode/launch.json @@ -0,0 +1,52 @@ +{ + "version": "0.2.0", + "configurations": [ + { + "name": "Pico Debug (Cortex-Debug)", + "cwd": "${userHome}/.pico-sdk/openocd/0.12.0+dev/scripts", + "executable": "${command:raspberry-pi-pico.launchTargetPath}", + "request": "launch", + "type": "cortex-debug", + "servertype": "openocd", + "serverpath": "${userHome}/.pico-sdk/openocd/0.12.0+dev/openocd.exe", + "gdbPath": "${command:raspberry-pi-pico.getGDBPath}", + "debuggerArgs": ["-ex", "set debug-file-directory /debug"], + "device": "${command:raspberry-pi-pico.getChipUppercase}", + "configFiles": [ + "interface/cmsis-dap.cfg", + "target/${command:raspberry-pi-pico.getTarget}.cfg" + ], + "svdFile": "${userHome}/.pico-sdk/sdk/2.3.0/src/${command:raspberry-pi-pico.getChip}/hardware_regs/${command:raspberry-pi-pico.getChipUppercase}.svd", + "runToEntryPoint": "main", + // Fix for no_flash binaries, where monitor reset halt doesn't do what is expected + // Also works fine for flash binaries + "overrideLaunchCommands": [ + "monitor reset init", + "load \"${command:raspberry-pi-pico.launchTargetPath}\"" + ], + "openOCDLaunchCommands": [ + "adapter speed 5000" + ] + }, + { + "name": "Pico Debug (Cortex-Debug with external OpenOCD)", + "cwd": "${workspaceRoot}", + "executable": "${command:raspberry-pi-pico.launchTargetPath}", + "request": "launch", + "type": "cortex-debug", + "servertype": "external", + "gdbTarget": "localhost:3333", + "gdbPath": "${command:raspberry-pi-pico.getGDBPath}", + "debuggerArgs": ["-ex", "set debug-file-directory /debug"], + "device": "${command:raspberry-pi-pico.getChipUppercase}", + "svdFile": "${userHome}/.pico-sdk/sdk/2.3.0/src/${command:raspberry-pi-pico.getChip}/hardware_regs/${command:raspberry-pi-pico.getChipUppercase}.svd", + "runToEntryPoint": "main", + // Fix for no_flash binaries, where monitor reset halt doesn't do what is expected + // Also works fine for flash binaries + "overrideLaunchCommands": [ + "monitor reset init", + "load \"${command:raspberry-pi-pico.launchTargetPath}\"" + ] + } + ] +} diff --git a/0x0001a_stack/.vscode/settings.json b/0x0001a_stack/.vscode/settings.json new file mode 100644 index 0000000..ecbf7dc --- /dev/null +++ b/0x0001a_stack/.vscode/settings.json @@ -0,0 +1,46 @@ +{ + "cmake.showSystemKits": false, + "cmake.options.statusBarVisibility": "hidden", + "cmake.options.advanced": { + "build": { + "statusBarVisibility": "hidden" + }, + "launch": { + "statusBarVisibility": "hidden" + }, + "debug": { + "statusBarVisibility": "hidden" + }, + "variant": { + "statusBarVisibility": "hidden" + }, + "buildTarget": { + "statusBarVisibility": "hidden" + } + }, + "cmake.configureOnEdit": false, + "cmake.automaticReconfigure": false, + "cmake.configureOnOpen": false, + "cmake.generator": "Ninja", + "cmake.cmakePath": "${userHome}/.pico-sdk/cmake/v4.3.4/bin/cmake", + "C_Cpp.debugShortcut": false, + "terminal.integrated.env.windows": { + "PICO_SDK_PATH": "${env:USERPROFILE}/.pico-sdk/sdk/2.3.0", + "PICO_TOOLCHAIN_PATH": "${env:USERPROFILE}/.pico-sdk/toolchain/15_2_Rel1", + "Path": "${env:USERPROFILE}/.pico-sdk/toolchain/15_2_Rel1/bin;${env:USERPROFILE}/.pico-sdk/picotool/2.3.0/picotool;${env:USERPROFILE}/.pico-sdk/cmake/v4.3.4/bin;${env:USERPROFILE}/.pico-sdk/ninja/v1.13.2;${env:PATH}" + }, + "terminal.integrated.env.osx": { + "PICO_SDK_PATH": "${env:HOME}/.pico-sdk/sdk/2.3.0", + "PICO_TOOLCHAIN_PATH": "${env:HOME}/.pico-sdk/toolchain/15_2_Rel1", + "PATH": "${env:HOME}/.pico-sdk/toolchain/15_2_Rel1/bin:${env:HOME}/.pico-sdk/picotool/2.3.0/picotool:${env:HOME}/.pico-sdk/cmake/v4.3.4/bin:${env:HOME}/.pico-sdk/ninja/v1.13.2:${env:PATH}" + }, + "terminal.integrated.env.linux": { + "PICO_SDK_PATH": "${env:HOME}/.pico-sdk/sdk/2.3.0", + "PICO_TOOLCHAIN_PATH": "${env:HOME}/.pico-sdk/toolchain/15_2_Rel1", + "PATH": "${env:HOME}/.pico-sdk/toolchain/15_2_Rel1/bin:${env:HOME}/.pico-sdk/picotool/2.3.0/picotool:${env:HOME}/.pico-sdk/cmake/v4.3.4/bin:${env:HOME}/.pico-sdk/ninja/v1.13.2:${env:PATH}" + }, + "raspberry-pi-pico.cmakeAutoConfigure": true, + "raspberry-pi-pico.useCmakeTools": false, + "raspberry-pi-pico.cmakePath": "${HOME}/.pico-sdk/cmake/v4.3.4/bin/cmake", + "raspberry-pi-pico.ninjaPath": "${HOME}/.pico-sdk/ninja/v1.13.2/ninja" +} diff --git a/0x0001a_stack/.vscode/tasks.json b/0x0001a_stack/.vscode/tasks.json new file mode 100644 index 0000000..60f30f6 --- /dev/null +++ b/0x0001a_stack/.vscode/tasks.json @@ -0,0 +1,102 @@ +{ + "version": "2.0.0", + "tasks": [ + { + "label": "Compile Project", + "type": "process", + "isBuildCommand": true, + "command": "${userHome}/.pico-sdk/ninja/v1.13.2/ninja", + "args": ["-C", "${workspaceFolder}/build"], + "group": "build", + "presentation": { + "reveal": "always", + "panel": "dedicated" + }, + "problemMatcher": "$gcc", + "windows": { + "command": "${env:USERPROFILE}/.pico-sdk/ninja/v1.13.2/ninja.exe" + } + }, + { + "label": "Run Project", + "type": "process", + "command": "${env:HOME}/.pico-sdk/picotool/2.3.0/picotool/picotool", + "args": [ + "load", + "${command:raspberry-pi-pico.launchTargetPath}", + "-fx" + ], + "presentation": { + "reveal": "always", + "panel": "dedicated" + }, + "problemMatcher": [], + "windows": { + "command": "${env:USERPROFILE}/.pico-sdk/picotool/2.3.0/picotool/picotool.exe" + } + }, + { + "label": "Flash", + "type": "process", + "command": "${userHome}/.pico-sdk/openocd/0.12.0+dev/openocd.exe", + "args": [ + "-s", + "${userHome}/.pico-sdk/openocd/0.12.0+dev/scripts", + "-f", + "interface/cmsis-dap.cfg", + "-f", + "target/${command:raspberry-pi-pico.getTarget}.cfg", + "-c", + "adapter speed 5000; program \"${command:raspberry-pi-pico.launchTargetPath}\" verify reset exit" + ], + "problemMatcher": [], + "windows": { + "command": "${env:USERPROFILE}/.pico-sdk/openocd/0.12.0+dev/openocd.exe" + } + }, + { + "label": "Rescue Reset", + "type": "process", + "command": "${userHome}/.pico-sdk/openocd/0.12.0+dev/openocd.exe", + "args": [ + "-s", + "${userHome}/.pico-sdk/openocd/0.12.0+dev/scripts", + "-f", + "interface/cmsis-dap.cfg", + "-f", + "target/${command:raspberry-pi-pico.getChip}-rescue.cfg", + "-c", + "adapter speed 5000; reset halt; exit" + ], + "problemMatcher": [], + "windows": { + "command": "${env:USERPROFILE}/.pico-sdk/openocd/0.12.0+dev/openocd.exe" + } + }, + { + "label": "RISC-V Reset (RP2350)", + "type": "process", + "command": "${userHome}/.pico-sdk/openocd/0.12.0+dev/openocd.exe", + "args": [ + "-s", + "${userHome}/.pico-sdk/openocd/0.12.0+dev/scripts", + "-c", + "set USE_CORE { rv0 rv1 cm0 cm1 }", + "-f", + "interface/cmsis-dap.cfg", + "-f", + "target/rp2350.cfg", + "-c", + "adapter speed 5000; init;", + "-c", + "write_memory 0x40120158 8 { 0x3 }; echo [format \"Info : ARCHSEL 0x%02x\" [read_memory 0x40120158 8 1]];", + "-c", + "reset halt; targets rp2350.rv0; echo [format \"Info : ARCHSEL_STATUS 0x%02x\" [read_memory 0x4012015C 8 1]]; exit" + ], + "problemMatcher": [], + "windows": { + "command": "${env:USERPROFILE}/.pico-sdk/openocd/0.12.0+dev/openocd.exe" + } + } + ] +} diff --git a/0x0001a_stack/0x0001a_stack.c b/0x0001a_stack/0x0001a_stack.c new file mode 100644 index 0000000..5e1945d --- /dev/null +++ b/0x0001a_stack/0x0001a_stack.c @@ -0,0 +1,23 @@ +#include +#include "pico/stdlib.h" + + +int main() +{ + stdio_init_all(); + + while (true) { + __asm volatile( + // Save a low register and the link register. + "push {r4, lr}\n" + // Intentionally unordered: the encoded list is still r2, r3, r6. + "push {r3, r2, r6}\n" + // Thumb PUSH cannot encode high registers r8-r12. + "stmdb sp!, {r9, r10}\n" + // Restore each group in reverse order to return SP to its start. + "ldmia sp!, {r9, r10}\n" + "pop {r2, r3, r6}\n" + "pop {r4, lr}\n" + ::: "memory"); + } +} diff --git a/0x0001a_stack/CMakeLists.txt b/0x0001a_stack/CMakeLists.txt new file mode 100644 index 0000000..c1b84e7 --- /dev/null +++ b/0x0001a_stack/CMakeLists.txt @@ -0,0 +1,57 @@ +# Generated Cmake Pico project file + +cmake_minimum_required(VERSION 3.13) + +set(CMAKE_C_STANDARD 11) +set(CMAKE_CXX_STANDARD 17) +set(CMAKE_EXPORT_COMPILE_COMMANDS ON) + +# Initialise pico_sdk from installed location +# (note this can come from environment, CMake cache etc) + +# == DO NOT EDIT THE FOLLOWING LINES for the Raspberry Pi Pico VS Code Extension to work == +if(WIN32) + set(USERHOME $ENV{USERPROFILE}) +else() + set(USERHOME $ENV{HOME}) +endif() +set(sdkVersion 2.3.0) +set(toolchainVersion 15_2_Rel1) +set(picotoolVersion 2.3.0) +set(picoVscode ${USERHOME}/.pico-sdk/cmake/pico-vscode.cmake) +if (EXISTS ${picoVscode}) + include(${picoVscode}) +endif() +# ==================================================================================== +set(PICO_BOARD pico2 CACHE STRING "Board type") + +# Pull in Raspberry Pi Pico SDK (must be before project) +include(pico_sdk_import.cmake) + +project(0x0001a_stack C CXX ASM) + +# Initialise the Raspberry Pi Pico SDK +pico_sdk_init() + +# Add executable. Default name is the project name, version 0.1 + +add_executable(0x0001a_stack 0x0001a_stack.c ) + +pico_set_program_name(0x0001a_stack "0x0001a_stack") +pico_set_program_version(0x0001a_stack "0.1") + +# Modify the below lines to enable/disable output over UART/USB +pico_enable_stdio_uart(0x0001a_stack 1) +pico_enable_stdio_usb(0x0001a_stack 0) + +# Add the standard library to the build +target_link_libraries(0x0001a_stack + pico_stdlib) + +# Add the standard include files to the build +target_include_directories(0x0001a_stack PRIVATE + ${CMAKE_CURRENT_LIST_DIR} +) + +pico_add_extra_outputs(0x0001a_stack) + diff --git a/0x0001a_stack/pico_sdk_import.cmake b/0x0001a_stack/pico_sdk_import.cmake new file mode 100644 index 0000000..d493cc2 --- /dev/null +++ b/0x0001a_stack/pico_sdk_import.cmake @@ -0,0 +1,121 @@ +# This is a copy of /external/pico_sdk_import.cmake + +# This can be dropped into an external project to help locate this SDK +# It should be include()ed prior to project() + +# Copyright 2020 (c) 2020 Raspberry Pi (Trading) Ltd. +# +# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the +# following conditions are met: +# +# 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following +# disclaimer. +# +# 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided with the distribution. +# +# 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products +# derived from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, +# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +if (DEFINED ENV{PICO_SDK_PATH} AND (NOT PICO_SDK_PATH)) + set(PICO_SDK_PATH $ENV{PICO_SDK_PATH}) + message("Using PICO_SDK_PATH from environment ('${PICO_SDK_PATH}')") +endif () + +if (DEFINED ENV{PICO_SDK_FETCH_FROM_GIT} AND (NOT PICO_SDK_FETCH_FROM_GIT)) + set(PICO_SDK_FETCH_FROM_GIT $ENV{PICO_SDK_FETCH_FROM_GIT}) + message("Using PICO_SDK_FETCH_FROM_GIT from environment ('${PICO_SDK_FETCH_FROM_GIT}')") +endif () + +if (DEFINED ENV{PICO_SDK_FETCH_FROM_GIT_PATH} AND (NOT PICO_SDK_FETCH_FROM_GIT_PATH)) + set(PICO_SDK_FETCH_FROM_GIT_PATH $ENV{PICO_SDK_FETCH_FROM_GIT_PATH}) + message("Using PICO_SDK_FETCH_FROM_GIT_PATH from environment ('${PICO_SDK_FETCH_FROM_GIT_PATH}')") +endif () + +if (DEFINED ENV{PICO_SDK_FETCH_FROM_GIT_TAG} AND (NOT PICO_SDK_FETCH_FROM_GIT_TAG)) + set(PICO_SDK_FETCH_FROM_GIT_TAG $ENV{PICO_SDK_FETCH_FROM_GIT_TAG}) + message("Using PICO_SDK_FETCH_FROM_GIT_TAG from environment ('${PICO_SDK_FETCH_FROM_GIT_TAG}')") +endif () + +if (PICO_SDK_FETCH_FROM_GIT AND NOT PICO_SDK_FETCH_FROM_GIT_TAG) + set(PICO_SDK_FETCH_FROM_GIT_TAG "master") + message("Using master as default value for PICO_SDK_FETCH_FROM_GIT_TAG") +endif() + +set(PICO_SDK_PATH "${PICO_SDK_PATH}" CACHE PATH "Path to the Raspberry Pi Pico SDK") +set(PICO_SDK_FETCH_FROM_GIT "${PICO_SDK_FETCH_FROM_GIT}" CACHE BOOL "Set to ON to fetch copy of SDK from git if not otherwise locatable") +set(PICO_SDK_FETCH_FROM_GIT_PATH "${PICO_SDK_FETCH_FROM_GIT_PATH}" CACHE FILEPATH "location to download SDK") +set(PICO_SDK_FETCH_FROM_GIT_TAG "${PICO_SDK_FETCH_FROM_GIT_TAG}" CACHE FILEPATH "release tag for SDK") + +if (NOT PICO_SDK_PATH) + if (PICO_SDK_FETCH_FROM_GIT) + include(FetchContent) + set(FETCHCONTENT_BASE_DIR_SAVE ${FETCHCONTENT_BASE_DIR}) + if (PICO_SDK_FETCH_FROM_GIT_PATH) + get_filename_component(FETCHCONTENT_BASE_DIR "${PICO_SDK_FETCH_FROM_GIT_PATH}" REALPATH BASE_DIR "${CMAKE_SOURCE_DIR}") + endif () + FetchContent_Declare( + pico_sdk + GIT_REPOSITORY https://github.com/raspberrypi/pico-sdk + GIT_TAG ${PICO_SDK_FETCH_FROM_GIT_TAG} + ) + + if (NOT pico_sdk) + message("Downloading Raspberry Pi Pico SDK") + # GIT_SUBMODULES_RECURSE was added in 3.17 + if (${CMAKE_VERSION} VERSION_GREATER_EQUAL "3.17.0") + FetchContent_Populate( + pico_sdk + QUIET + GIT_REPOSITORY https://github.com/raspberrypi/pico-sdk + GIT_TAG ${PICO_SDK_FETCH_FROM_GIT_TAG} + GIT_SUBMODULES_RECURSE FALSE + + SOURCE_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-src + BINARY_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-build + SUBBUILD_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-subbuild + ) + else () + FetchContent_Populate( + pico_sdk + QUIET + GIT_REPOSITORY https://github.com/raspberrypi/pico-sdk + GIT_TAG ${PICO_SDK_FETCH_FROM_GIT_TAG} + + SOURCE_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-src + BINARY_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-build + SUBBUILD_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-subbuild + ) + endif () + + set(PICO_SDK_PATH ${pico_sdk_SOURCE_DIR}) + endif () + set(FETCHCONTENT_BASE_DIR ${FETCHCONTENT_BASE_DIR_SAVE}) + else () + message(FATAL_ERROR + "SDK location was not specified. Please set PICO_SDK_PATH or set PICO_SDK_FETCH_FROM_GIT to on to fetch from git." + ) + endif () +endif () + +get_filename_component(PICO_SDK_PATH "${PICO_SDK_PATH}" REALPATH BASE_DIR "${CMAKE_BINARY_DIR}") +if (NOT EXISTS ${PICO_SDK_PATH}) + message(FATAL_ERROR "Directory '${PICO_SDK_PATH}' not found") +endif () + +set(PICO_SDK_INIT_CMAKE_FILE ${PICO_SDK_PATH}/pico_sdk_init.cmake) +if (NOT EXISTS ${PICO_SDK_INIT_CMAKE_FILE}) + message(FATAL_ERROR "Directory '${PICO_SDK_PATH}' does not appear to contain the Raspberry Pi Pico SDK") +endif () + +set(PICO_SDK_PATH ${PICO_SDK_PATH} CACHE PATH "Path to the Raspberry Pi Pico SDK" FORCE) + +include(${PICO_SDK_INIT_CMAKE_FILE}) diff --git a/0x0001b_ctf/.gitignore b/0x0001b_ctf/.gitignore new file mode 100644 index 0000000..97b60a5 --- /dev/null +++ b/0x0001b_ctf/.gitignore @@ -0,0 +1,4 @@ +build +!.vscode/* +!build-ctf/0x0001b_ctf.bin +!CTF-01.bin diff --git a/0x0001b_ctf/.vscode/c_cpp_properties.json b/0x0001b_ctf/.vscode/c_cpp_properties.json new file mode 100644 index 0000000..613c996 --- /dev/null +++ b/0x0001b_ctf/.vscode/c_cpp_properties.json @@ -0,0 +1,22 @@ +{ + "configurations": [ + { + "name": "Pico", + "includePath": [ + "${workspaceFolder}/**", + "${userHome}/.pico-sdk/sdk/2.3.1/**" + ], + "forcedInclude": [ + "${workspaceFolder}/build/generated/pico_base/pico/config_autogen.h", + "${userHome}/.pico-sdk/sdk/2.3.1/src/common/pico_base_headers/include/pico.h" + ], + "defines": [], + "compilerPath": "${userHome}/.pico-sdk/toolchain/15_2_Rel1/bin/arm-none-eabi-gcc.exe", + "compileCommands": "${workspaceFolder}/build/compile_commands.json", + "cStandard": "c17", + "cppStandard": "c++14", + "intelliSenseMode": "linux-gcc-arm" + } + ], + "version": 4 +} diff --git a/0x0001b_ctf/.vscode/cmake-kits.json b/0x0001b_ctf/.vscode/cmake-kits.json new file mode 100644 index 0000000..b0f3815 --- /dev/null +++ b/0x0001b_ctf/.vscode/cmake-kits.json @@ -0,0 +1,15 @@ +[ + { + "name": "Pico", + "compilers": { + "C": "${command:raspberry-pi-pico.getCompilerPath}", + "CXX": "${command:raspberry-pi-pico.getCxxCompilerPath}" + }, + "environmentVariables": { + "PATH": "${command:raspberry-pi-pico.getEnvPath};${env:PATH}" + }, + "cmakeSettings": { + "Python3_EXECUTABLE": "${command:raspberry-pi-pico.getPythonPath}" + } + } +] \ No newline at end of file diff --git a/0x0001b_ctf/.vscode/extensions.json b/0x0001b_ctf/.vscode/extensions.json new file mode 100644 index 0000000..a940d7c --- /dev/null +++ b/0x0001b_ctf/.vscode/extensions.json @@ -0,0 +1,9 @@ +{ + "recommendations": [ + "marus25.cortex-debug", + "ms-vscode.cpptools", + "ms-vscode.cpptools-extension-pack", + "ms-vscode.vscode-serial-monitor", + "raspberry-pi.raspberry-pi-pico" + ] +} \ No newline at end of file diff --git a/0x0001b_ctf/.vscode/launch.json b/0x0001b_ctf/.vscode/launch.json new file mode 100644 index 0000000..451b846 --- /dev/null +++ b/0x0001b_ctf/.vscode/launch.json @@ -0,0 +1,52 @@ +{ + "version": "0.2.0", + "configurations": [ + { + "name": "Pico Debug (Cortex-Debug)", + "cwd": "${userHome}/.pico-sdk/openocd/0.12.0+dev/scripts", + "executable": "${command:raspberry-pi-pico.launchTargetPath}", + "request": "launch", + "type": "cortex-debug", + "servertype": "openocd", + "serverpath": "${userHome}/.pico-sdk/openocd/0.12.0+dev/openocd.exe", + "gdbPath": "${command:raspberry-pi-pico.getGDBPath}", + "debuggerArgs": ["-ex", "set debug-file-directory /debug"], + "device": "${command:raspberry-pi-pico.getChipUppercase}", + "configFiles": [ + "interface/cmsis-dap.cfg", + "target/${command:raspberry-pi-pico.getTarget}.cfg" + ], + "svdFile": "${userHome}/.pico-sdk/sdk/2.3.1/src/${command:raspberry-pi-pico.getChip}/hardware_regs/${command:raspberry-pi-pico.getChipUppercase}.svd", + "runToEntryPoint": "main", + // Fix for no_flash binaries, where monitor reset halt doesn't do what is expected + // Also works fine for flash binaries + "overrideLaunchCommands": [ + "monitor reset init", + "load \"${command:raspberry-pi-pico.launchTargetPath}\"" + ], + "openOCDLaunchCommands": [ + "adapter speed 5000" + ] + }, + { + "name": "Pico Debug (Cortex-Debug with external OpenOCD)", + "cwd": "${workspaceRoot}", + "executable": "${command:raspberry-pi-pico.launchTargetPath}", + "request": "launch", + "type": "cortex-debug", + "servertype": "external", + "gdbTarget": "localhost:3333", + "gdbPath": "${command:raspberry-pi-pico.getGDBPath}", + "debuggerArgs": ["-ex", "set debug-file-directory /debug"], + "device": "${command:raspberry-pi-pico.getChipUppercase}", + "svdFile": "${userHome}/.pico-sdk/sdk/2.3.1/src/${command:raspberry-pi-pico.getChip}/hardware_regs/${command:raspberry-pi-pico.getChipUppercase}.svd", + "runToEntryPoint": "main", + // Fix for no_flash binaries, where monitor reset halt doesn't do what is expected + // Also works fine for flash binaries + "overrideLaunchCommands": [ + "monitor reset init", + "load \"${command:raspberry-pi-pico.launchTargetPath}\"" + ] + } + ] +} diff --git a/0x0001b_ctf/.vscode/settings.json b/0x0001b_ctf/.vscode/settings.json new file mode 100644 index 0000000..5b883ba --- /dev/null +++ b/0x0001b_ctf/.vscode/settings.json @@ -0,0 +1,46 @@ +{ + "cmake.showSystemKits": false, + "cmake.options.statusBarVisibility": "hidden", + "cmake.options.advanced": { + "build": { + "statusBarVisibility": "hidden" + }, + "launch": { + "statusBarVisibility": "hidden" + }, + "debug": { + "statusBarVisibility": "hidden" + }, + "variant": { + "statusBarVisibility": "hidden" + }, + "buildTarget": { + "statusBarVisibility": "hidden" + } + }, + "cmake.configureOnEdit": false, + "cmake.automaticReconfigure": false, + "cmake.configureOnOpen": false, + "cmake.generator": "Ninja", + "cmake.cmakePath": "${userHome}/.pico-sdk/cmake/v4.3.4/bin/cmake", + "C_Cpp.debugShortcut": false, + "terminal.integrated.env.windows": { + "PICO_SDK_PATH": "${env:USERPROFILE}/.pico-sdk/sdk/2.3.1", + "PICO_TOOLCHAIN_PATH": "${env:USERPROFILE}/.pico-sdk/toolchain/15_2_Rel1", + "Path": "${env:USERPROFILE}/.pico-sdk/toolchain/15_2_Rel1/bin;${env:USERPROFILE}/.pico-sdk/picotool/2.3.1/picotool;${env:USERPROFILE}/.pico-sdk/cmake/v4.3.4/bin;${env:USERPROFILE}/.pico-sdk/ninja/v1.13.2;${env:PATH}" + }, + "terminal.integrated.env.osx": { + "PICO_SDK_PATH": "${env:HOME}/.pico-sdk/sdk/2.3.1", + "PICO_TOOLCHAIN_PATH": "${env:HOME}/.pico-sdk/toolchain/15_2_Rel1", + "PATH": "${env:HOME}/.pico-sdk/toolchain/15_2_Rel1/bin:${env:HOME}/.pico-sdk/picotool/2.3.1/picotool:${env:HOME}/.pico-sdk/cmake/v4.3.4/bin:${env:HOME}/.pico-sdk/ninja/v1.13.2:${env:PATH}" + }, + "terminal.integrated.env.linux": { + "PICO_SDK_PATH": "${env:HOME}/.pico-sdk/sdk/2.3.1", + "PICO_TOOLCHAIN_PATH": "${env:HOME}/.pico-sdk/toolchain/15_2_Rel1", + "PATH": "${env:HOME}/.pico-sdk/toolchain/15_2_Rel1/bin:${env:HOME}/.pico-sdk/picotool/2.3.1/picotool:${env:HOME}/.pico-sdk/cmake/v4.3.4/bin:${env:HOME}/.pico-sdk/ninja/v1.13.2:${env:PATH}" + }, + "raspberry-pi-pico.cmakeAutoConfigure": true, + "raspberry-pi-pico.useCmakeTools": false, + "raspberry-pi-pico.cmakePath": "${HOME}/.pico-sdk/cmake/v4.3.4/bin/cmake", + "raspberry-pi-pico.ninjaPath": "${HOME}/.pico-sdk/ninja/v1.13.2/ninja" +} diff --git a/0x0001b_ctf/.vscode/tasks.json b/0x0001b_ctf/.vscode/tasks.json new file mode 100644 index 0000000..2f07d94 --- /dev/null +++ b/0x0001b_ctf/.vscode/tasks.json @@ -0,0 +1,102 @@ +{ + "version": "2.0.0", + "tasks": [ + { + "label": "Compile Project", + "type": "process", + "isBuildCommand": true, + "command": "${userHome}/.pico-sdk/ninja/v1.13.2/ninja", + "args": ["-C", "${workspaceFolder}/build"], + "group": "build", + "presentation": { + "reveal": "always", + "panel": "dedicated" + }, + "problemMatcher": "$gcc", + "windows": { + "command": "${env:USERPROFILE}/.pico-sdk/ninja/v1.13.2/ninja.exe" + } + }, + { + "label": "Run Project", + "type": "process", + "command": "${env:HOME}/.pico-sdk/picotool/2.3.1/picotool/picotool", + "args": [ + "load", + "${command:raspberry-pi-pico.launchTargetPath}", + "-fx" + ], + "presentation": { + "reveal": "always", + "panel": "dedicated" + }, + "problemMatcher": [], + "windows": { + "command": "${env:USERPROFILE}/.pico-sdk/picotool/2.3.1/picotool/picotool.exe" + } + }, + { + "label": "Flash", + "type": "process", + "command": "${userHome}/.pico-sdk/openocd/0.12.0+dev/openocd.exe", + "args": [ + "-s", + "${userHome}/.pico-sdk/openocd/0.12.0+dev/scripts", + "-f", + "interface/cmsis-dap.cfg", + "-f", + "target/${command:raspberry-pi-pico.getTarget}.cfg", + "-c", + "adapter speed 5000; program \"${command:raspberry-pi-pico.launchTargetPath}\" verify reset exit" + ], + "problemMatcher": [], + "windows": { + "command": "${env:USERPROFILE}/.pico-sdk/openocd/0.12.0+dev/openocd.exe" + } + }, + { + "label": "Rescue Reset", + "type": "process", + "command": "${userHome}/.pico-sdk/openocd/0.12.0+dev/openocd.exe", + "args": [ + "-s", + "${userHome}/.pico-sdk/openocd/0.12.0+dev/scripts", + "-f", + "interface/cmsis-dap.cfg", + "-f", + "target/${command:raspberry-pi-pico.getChip}-rescue.cfg", + "-c", + "adapter speed 5000; reset halt; exit" + ], + "problemMatcher": [], + "windows": { + "command": "${env:USERPROFILE}/.pico-sdk/openocd/0.12.0+dev/openocd.exe" + } + }, + { + "label": "RISC-V Reset (RP2350)", + "type": "process", + "command": "${userHome}/.pico-sdk/openocd/0.12.0+dev/openocd.exe", + "args": [ + "-s", + "${userHome}/.pico-sdk/openocd/0.12.0+dev/scripts", + "-c", + "set USE_CORE { rv0 rv1 cm0 cm1 }", + "-f", + "interface/cmsis-dap.cfg", + "-f", + "target/rp2350.cfg", + "-c", + "adapter speed 5000; init;", + "-c", + "write_memory 0x40120158 8 { 0x3 }; echo [format \"Info : ARCHSEL 0x%02x\" [read_memory 0x40120158 8 1]];", + "-c", + "reset halt; targets rp2350.rv0; echo [format \"Info : ARCHSEL_STATUS 0x%02x\" [read_memory 0x4012015C 8 1]]; exit" + ], + "problemMatcher": [], + "windows": { + "command": "${env:USERPROFILE}/.pico-sdk/openocd/0.12.0+dev/openocd.exe" + } + } + ] +} diff --git a/0x0001b_ctf/CMakeLists.txt b/0x0001b_ctf/CMakeLists.txt new file mode 100644 index 0000000..cd4bff3 --- /dev/null +++ b/0x0001b_ctf/CMakeLists.txt @@ -0,0 +1,91 @@ +# MIT License +# +# Copyright (c) 2026 Kevin Thomas +# +# Permission is hereby granted, free of charge, to any person obtaining a copy +# of this software and associated documentation files (the "Software"), to deal +# in the Software without restriction, including without limitation the rights +# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +# copies of the Software, and to permit persons to whom the Software is +# furnished to do so, subject to the following conditions: +# +# The above copyright notice and this permission notice shall be included in all +# copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +# SOFTWARE. +# +# Author: Kevin Thomas +# Email: kevin@mytechnotalent.com +# GitHub: https://github.com/mytechnotalent +# File: CMakeLists.txt +# Desc: Configures the RP2350 Pico SDK project for the Operation Black Start +# CTF relay firmware. +# Created: 2026 + +cmake_minimum_required(VERSION 3.13) + +set(CMAKE_C_STANDARD 11) +set(CMAKE_CXX_STANDARD 17) +set(CMAKE_EXPORT_COMPILE_COMMANDS ON) + +# Initialise pico_sdk from installed location +# (note this can come from environment, CMake cache etc) + +# == DO NOT EDIT THE FOLLOWING LINES for the Raspberry Pi Pico VS Code Extension to work == +if(WIN32) + set(USERHOME $ENV{USERPROFILE}) +else() + set(USERHOME $ENV{HOME}) +endif() +set(sdkVersion 2.3.1) +set(toolchainVersion 15_2_Rel1) +set(picotoolVersion 2.3.1) +set(picoVscode ${USERHOME}/.pico-sdk/cmake/pico-vscode.cmake) +if (EXISTS ${picoVscode}) + include(${picoVscode}) +endif() +# ==================================================================================== +set(PICO_BOARD pico2 CACHE STRING "Board type") + +# Pull in Raspberry Pi Pico SDK (must be before project) +include(pico_sdk_import.cmake) + +project(0x0001b_ctf C CXX ASM) + +# Initialise the Raspberry Pi Pico SDK +pico_sdk_init() + +# Add executable with modular sources in src/ +add_executable(0x0001b_ctf + src/main.c + src/grid.c + src/console.c +) + +pico_set_program_name(0x0001b_ctf "0x0001b_ctf") +pico_set_program_version(0x0001b_ctf "0.1") + +# Modify the below lines to enable/disable output over UART/USB +pico_enable_stdio_uart(0x0001b_ctf 1) +pico_enable_stdio_usb(0x0001b_ctf 0) +target_compile_definitions(0x0001b_ctf PRIVATE + PICO_DEFAULT_UART_BAUD_RATE=115200 +) + +# Add the standard library to the build +target_link_libraries(0x0001b_ctf + pico_stdlib +) + +# Add the standard include files to the build +target_include_directories(0x0001b_ctf PRIVATE + ${CMAKE_CURRENT_LIST_DIR}/include +) + +pico_add_extra_outputs(0x0001b_ctf) diff --git a/0x0001b_ctf/CTF-01-I.md b/0x0001b_ctf/CTF-01-I.md new file mode 100644 index 0000000..dbda501 --- /dev/null +++ b/0x0001b_ctf/CTF-01-I.md @@ -0,0 +1,442 @@ +# Operation Black Start - Student Instructions + +**⚠ WORLDGRID EMERGENCY INCIDENT ⚠** + +``` ++----------------------------------------------------------------------------------------+ +| | +| ██████╗ ██╗ █████╗ ██████╗██╗ ██╗███████╗████████╗ █████╗ ██████╗ ████████╗ | +| ██╔══██╗██║ ██╔══██╗██╔════╝██║ ██╔╝██╔════╝╚══██╔══╝██╔══██╗██╔══██╗╚══██╔══╝ | +| ██████╔╝██║ ███████║██║ █████╔╝ ███████╗ ██║ ███████║██████╔╝ ██║ | +| ██╔══██╗██║ ██╔══██║██║ ██╔═██╗ ╚════██║ ██║ ██╔══██║██╔══██╗ ██║ | +| ██████╔╝███████╗██║ ██║╚██████╗██║ ██╗███████╗ ██║ ██║ ██║██║ ██║ ██║ | +| ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝██║ ██║╚══════╝ ╚═╝ ╚═╝ ╚═╝██║ ██║ ██║ | +| | +| | +| O P E R A T I O N B L A C K S T A R T | +| | +| *** PRIORITY RED *** | +| | ++----------------------------------------------------------------------------------------+ +``` + +--- + +## Project Overview + +WorldGrid Compact's emergency firmware build for its GRID-7 relay fleet +shipped a miscompiled safety threshold and a hardcoded false status string, +so deployed relays report a false-safe "STABLE" status while the frozen +frequency deviation reading of 0.87 Hz is nearly 50% beyond the 0.60 Hz +engineering limit. The source was overwritten by the next build and cannot +be recovered, so the only surviving evidence is the exact miscompiled +training image. Students reverse engineer `CTF-01.bin` with Ghidra, locate +and patch both defects directly in the binary, export a corrected image, +flash it to a Pico 2, and prove the corrected behavior with GDB and a UART +console. + +--- + +## Scenario Briefing + +### Background + +**WorldGrid Compact** is the emergency interconnection standard shared by +three allied national grid operators. When any member's primary SCADA +network goes dark, a fleet of small embedded relay nodes - call sign +**GRID-7** - is the only thing standing between an orderly recovery and an +uncontrolled cascade. Each relay node watches the last known grid frequency +deviation, decides whether conditions are safe, and either **holds** the +automatic black-start dispatch or **authorizes** it. + +At 03:11 UTC, a coordinated cyberattack severed the primary SCADA uplink +across the GRID-7 corridor and the WATER-3 aqueduct pumping stations that +depend on it. With the network coordination center offline and three +continents' worth of hospitals, rail systems, and water treatment plants +running on backup power, WorldGrid's engineering team did the only thing +they could: they rushed an emergency firmware build for the relay fleet and +pushed it within **eleven minutes** of the attack being detected. + +### The Disaster + +The engineer who built that emergency image, **Dr. Elias Renner**, has not +slept in thirty-one hours. He compiled the fix, ran a five-second bench +test, and shipped it - because the alternative was leaving the relay fleet +completely blind. It appears to work. The relay boots. It prints a status +report. It reports **GRID STATUS: STABLE** and **DISPATCH PATH: +AUTHORIZED**. + +There is a problem: the frozen frequency reading latched at the moment +communications were cut shows a deviation of **0.87 Hz** - nearly *50% +beyond* WorldGrid's hard engineering limit of **0.60 Hz**. A deviation this +large, if trusted, means the grid is nowhere near stable enough for an +automatic black-start dispatch. If the fleet authorizes dispatch on a false +"STABLE" reading, cascading generator trips will follow within minutes, +and GRID-7 and WATER-3 will go dark for the second time - this time with no +backup plan. + +**Dr. Renner's rushed build has a bug. Multiple relay nodes are already +reporting the same false-safe status. Nobody has found where in the +compiled firmware the error lives, because the source code used for that +emergency compile was overwritten by the next build fifteen minutes later +and cannot be recovered.** + +### The Only Surviving Evidence + +One relay node - the training/verification unit - still holds the exact +miscompiled image that shipped to the fleet. This binary, and this binary +alone, is the only remaining copy of the emergency build. There is no +source code. There is no build log. There is only the compiled image, a +UART cable, and whatever a skilled embedded reverse engineer can prove by +reading machine code. + +### The Human Stakes + +| Consequence if the false "STABLE" reading is trusted | Scale | +|---|---| +| Hospitals on generator backup past their fuel reserve | 214 facilities | +| Water treatment and pumping stations losing pressure | 3 aqueduct systems | +| Rail corridors stranded mid-route | 6 national rail networks | +| Estimated population affected by cascading failure | 40+ million people | + +**The options are:** + +1. ❌ **Trust the fleet's reported status** - dispatch fires on a false + reading, cascading failure follows within the hour. +2. ❌ **Shut the entire relay fleet down** - buys time, but leaves 40 + million people with no automated recovery path at all. +3. **REVERSE ENGINEER THE EMERGENCY BUILD** - find the exact + miscompiled bytes, patch them, verify the corrected image on real + hardware, and hand the fix to the field team so the *rest of the fleet* + can be safely repatched before the next attempt. + +### THE SHORTAGE + +For years, the world treated embedded systems as invisible infrastructure. +The engineers who could read a vector table, decode a Thumb branch, or +patch a miscompiled constant directly in a stripped binary were never +numerous enough. Tonight almost all of them are already in the field +chasing other failures. **You are the reserve team.** + +You were called in because you can do something Dr. Renner's exhausted +team cannot do right now: read what the processor is actually doing, with +no source code, no time for a rewrite, and no room for a guess. + +> **⏰ TIME PRESSURE:** The field team is standing by to push your verified +> patch to the rest of the GRID-7 fleet. Every relay node still reporting +> a false "STABLE" status is one dispatch cycle away from disaster. + +> **AUTHORIZED LAB ONLY:** This challenge uses a supplied Pico 2 training +> relay and its exact miscompiled firmware image. Do not connect this +> exercise to a public network, an operational grid, a water utility, or +> any device you do not own or have explicit written authorization to test. + +--- + +## Learning Objectives + +- Decode the RP2350 / ARM Cortex-M33 vector table and identify the reset + handler and initial stack pointer. +- Trace the bootrom-to-reset handoff and translate Thumb reset-vector + addresses into real function entry points. +- Locate a miscompiled boundary comparison and reason about the correct + immediate value the compiler should have encoded. +- Patch compare instructions and a status string directly in a raw binary + with Ghidra. +- Recover a hidden quarantined dispatch frame from the compiled image. +- Export and UF2-convert a corrected image, then verify the corrected + behavior on real hardware with GDB and a UART console. + +--- + +## What This Project Tests + +| Week | Concepts Tested | +|------|-----------------| +| 1 | RP2350 architecture, ARM Cortex-M33 registers, stack, flash/RAM, Thumb assembly, Ghidra static analysis | +| 2 | GDB connection, breakpoints, disassembly, register and memory inspection, UART observation | +| 3 | Bootrom handoff, vector table, reset handler, startup code, XIP, Thumb-bit addressing | + +--- + +## Part 1: Understanding the System + +### GRID-7 Relay Hardware + +| Component | Connection | Purpose | +|-----------|------------|---------| +| Raspberry Pi Pico 2 | RP2350 | Runs the miscompiled emergency firmware | +| UART TX | GPIO 0 | Relay telemetry output | +| UART RX | GPIO 1 | Reserved (no command parser is implemented) | +| SWD debug interface | Supplied probe | Authorized GDB inspection | + +No LED, relay output, sensor, display, or other peripheral is part of this +CTF. Every graded finding lives in flash (`.rodata`/`.text`) or SRAM, and is +reachable with only the Weeks 1-3 toolset: Ghidra, GDB, and a UART monitor. + +### UART Configuration + +- Baud: `115200` +- Data: `8 bits` +- Parity: `none` +- Stop: `1` +- Logic: `3.3 V` + +### Normal (Intended) Behavior + +The relay should latch the frozen deviation reading, compare it against the +**real** WorldGrid safety limit of **60** (0.60 Hz, encoded as an integer +`x100`), and report honestly: + +``` ++-----------------------------------------------------------------+ +| Intended Relay Behavior | +| | +| 1. Boot and initialize UART | +| 2. Print the boot identity and a signal-quality banner | +| 3. Compare the frozen 87 (0.87 Hz) reading against the 60 | +| (0.60 Hz) safety limit | +| 4. 87 exceeds 60, so the grid is NOT stable | +| 5. Report GRID STATUS: CRITICAL and DISPATCH PATH: HELD | +| 6. Repeat the report once per second until conditions change | ++-----------------------------------------------------------------+ +``` + +### Observed (Buggy) Behavior - What You Will See When You First Flash `CTF-01.uf2` + +```text +GLOBAL EMBEDDED RESPONSE NETWORK +BLACK START WINDOW: 27 MINUTES +UART0 115200 8N1 | AUTHORIZED LAB CONSOLE +SIGNAL: NORMAL +RESPONSE> GRID STATUS: STABLE +DISPATCH PATH: AUTHORIZED +LAST FRAME: QUARANTINED +RESPONSE> +``` + +> **Terminal Timing Note:** The first four lines (`GLOBAL EMBEDDED...` through +> `SIGNAL: NORMAL`) represent the **initial boot banner**, emitted once during +> startup. If your serial terminal (PuTTY) connects after the board has +> booted, you will observe the continuous 1-second status stream (`GRID +> STATUS...` and `DISPATCH PATH...`). To view the boot banner in your terminal, +> reset the Pico (pulse `RUN` to `GND`) while PuTTY is actively connected. + +This is exactly what Dr. Renner's team is seeing on the deployed fleet. It +is wrong, and it is wrong in **two independent ways** inside the compiled +binary. Do not assume the first readable sentence is the full truth - +treat every printed line as evidence to be checked against the machine +code, not as a fact on its own. + +--- + +## Part 2: The Firmware + +You do not have the source code. It was overwritten fifteen minutes after +the emergency build shipped. You have only the compiled image. Your job is +to reverse engineer it with Ghidra, locate the defects, and patch the +binary directly - exactly the way Dr. Renner's field team will need to +patch the rest of the deployed fleet. + +### What The Firmware Does + +1. Initializes UART0 and stdio. +2. Reads a frozen grid-frequency-deviation reading that was latched in + memory before communications were severed. +3. Compares that reading against a compiled-in safety threshold - **twice**, + once for each independent status line it reports. +4. Prints a boot banner containing an unconditional signal-quality line. +5. Enters an infinite loop printing the grid classification and dispatch + decision once per second. + +### Bug Summary - What You Are Graded On + +| Bug # | Category | Severity | Description | Hint | +|-------|----------|----------|--------------|------| +| **Bug #1** | Miscompiled safety constant | **CRITICAL** | The safety threshold used to classify the frozen reading was compiled far too permissive. It is used **twice** - once for the operator-facing status and once for the automated dispatch decision - and **both** copies must be corrected. | The real WorldGrid safety limit is 60 (0.60 Hz). Search for the wrong immediate value used in the comparison. | +| **Bug #2** | Hardcoded string literal | **HIGH** | The boot banner unconditionally prints a signal-quality word that does not reflect the actual reading, regardless of what the relay later reports. | The correct word describes the true state of a 0.87 Hz deviation against a 0.60 Hz limit - not "NORMAL". | + +**Important:** The replacement text for Bug #2 **must be the same length** +as the original - patching a shorter or longer string will corrupt +adjacent flash data. + +### A Third Finding - Not a Bug, a Recovery Task + +Somewhere in this image is the **quarantined black-start authorization +frame** - the exact frame the relay is supposed to transmit to the +regional dispatcher once a human operator confirms it is safe to proceed. +It is never printed by the firmware. Recovering it (without patching +anything) is required evidence for your final report. + +--- + +## Part 3: Your Assignment + +Whenever a task asks you to **Document** or **answer**, write your answers +in a single file named `CTF-01-Answers.md`. + +### Task 1: Setup and Initial Analysis + +1. Create a new Ghidra project named `Black_Start_Investigation`. +2. Import `CTF-01.bin`. +3. Configure the language as **ARM Cortex 32-bit, little endian**. +4. Set the base address to `0x10000000`. +5. Run auto-analysis. + +**Document:** +- A screenshot of the Ghidra **Import Results** or **Program Information** + window showing the project name, processor settings, and base address. +- The address of `main()`. +- The address of the recurring status loop (the branch target that repeats + once per second). +- The vector-table base, the initial stack pointer, and the reset-handler + pointer as stored (note its Thumb bit) versus the actual instruction + address. + +### Task 2: Find and Patch Bug #1 - The Miscalibrated Safety Threshold + +1. Find **both** locations where the frozen reading is compared against + the miscompiled safety constant. +2. Document the exact address, the original instruction, and the original + immediate value at each location. +3. Determine the correct immediate value. **Caution:** the compiler may + not have encoded the raw threshold you expect - a strict "less than" + comparison against an unsigned value is often optimized into a + "less-or-equal" comparison against one less than the threshold. Show + your reasoning. +4. Patch **both** locations in Ghidra using the **Bytes Window** workflow: + > **Critical ARM Thumb-2 Patching Note:** In ARM Cortex-M, compare instructions that directly precede conditional execution blocks (`ite hi`) must **not** be patched using the right-click *Patch Instruction* dialog. Ghidra's automatic re-disassembler encounters an internal context conflict with the subsequent `ite hi` instruction, which collapses Thumb decoding and swallows Compare Site B (`0x1000020A`). + > + > To patch cleanly without breaking downstream disassembly, use the **Bytes Window**: + > 1. Ensure the Bytes window is open (**Window** -> **Bytes: CTF-01.bin**). + > 2. In the Bytes window toolbar, click the **pencil icon** (**Toggle Edit Mode**). + > 3. In the Listing window, click on address `0x100001FC` (Compare Site A) and press **`C`** (**Clear Code Bytes**). The instruction temporarily clears into raw bytes (`5E 2B`). + > 4. In the Bytes window, locate offset `100001fc`, click on `5E`, and change it to **`3B`**. + > 5. Click back in the Listing window on address `0x100001FC` and press **`D`** (**Disassemble**). The instruction immediately disassembles cleanly as `cmp r3, #0x3b`. + > 6. Notice that Compare Site B at `0x1000020A` remains completely intact and visible! Repeat the exact same steps at `0x1000020A`: click `0x1000020A` in the Listing, press **`C`**, change `5E` to **`3B`** in the Bytes window, click back in the Listing, and press **`D`**. + +**Questions to answer:** +- Why must both locations be patched? What happens if you only patch one? +- Why is a false "STABLE" classification on an 0.87 Hz reading dangerous + for an automated black-start dispatch? + +### Task 3: Find and Patch Bug #2 - The False Signal Banner + +1. Find the boot-banner string that unconditionally reports the wrong + signal quality. +2. Document its address and the exact bytes that must change. +3. Patch the string, preserving its exact length. + +**Questions to answer:** +- Document the original vs. patched bytes, character by character. +- Why is a hardcoded, unconditional status word more dangerous than one + that is at least computed from a (miscalibrated) reading? + +### Task 4: Recover the Quarantined Dispatch Frame + +1. Use Ghidra's Defined Strings (or a raw string search) to locate the + hidden black-start authorization frame. +2. Document its address and explain why it is never transmitted by the + current firmware. +3. Do **not** attempt to patch this value - it is evidence, not a bug. + +### Task 5: Export and Verify + +1. Export your patched binary as `CTF-01_fixed.bin`. +2. Convert it to UF2 format for the RP2350: + ```bash + python uf2conv.py CTF-01_fixed.bin --base 0x10000000 --family 0xe48bff59 --output CTF-01_fixed.uf2 + ``` +3. Flash `CTF-01_fixed.uf2` to your Pico 2 and capture the corrected UART + output. +4. Confirm that the corrected image now reports **GRID STATUS: CRITICAL**, + **DISPATCH PATH: HELD**, and the corrected signal-quality word - an + honest, safe report instead of a false "all clear." +5. Build a summary table of every patch: address, original bytes, patched + bytes, and a one-line description. + +### Task 6: Written Reflection (short answers, 150 words or less each) + +1. Why is "the build was rushed under emergency pressure" not an + acceptable excuse for shipping a firmware defect that could trigger a + cascading grid failure? +2. Name one concrete engineering practice (code review, static analysis, + hardware-in-the-loop test, etc.) that would have caught **each** of the + two graded bugs before this image ever reached the fleet. + +--- + +## How To Breadboard + +- Pico 2 **GPIO 0 / UART TX** -> USB-UART adapter **RX** +- Pico 2 **GPIO 1 / UART RX** -> USB-UART adapter **TX** +- Pico 2 **GND** -> USB-UART adapter **GND** +- Use **3.3 V logic only**. Never connect a 5 V line to a Pico GPIO. +- Connect the supplied SWD probe according to its documented pinout. + +The supplied image is `CTF-01.bin` (for Ghidra analysis) and `CTF-01.uf2` +(for flashing). If your instructor supplies different filenames, record the +actual filenames in your report. + +--- + +## Memory Map Reference + +| Region | Address | Purpose | +|--------|---------|---------| +| Bootrom | `0x00000000` | Immutable boot code | +| Flash/XIP | `0x10000000` | Vector table, code, constants, strings | +| SRAM | `0x20000000` | Stack and writable state | + +--- + +## Submission Format + +Submit a folder containing: + +- `CTF-01-Answers.md`; +- screenshots or terminal transcripts; +- `CTF-01_fixed.bin` and `CTF-01_fixed.uf2`; +- the original image hash. + +--- + +## Success Criteria + +You complete the challenge when you can prove all of the following: + +- You can explain how the RP2350 reaches the relay's code from reset. +- You can locate and patch both copies of the miscalibrated threshold. +- You can locate and patch the false signal-quality string without + corrupting adjacent data. +- You can export, convert, and flash a corrected image. +- You can prove on real hardware that the corrected image reports the + true, dangerous state instead of the false "all clear." +- You can recover the quarantined dispatch frame as evidence. + +--- + +## Academic Integrity + +By submitting this CTF work, you certify that: + +1. You used only the supplied training relay, image, and lab interface. +2. You did not connect the challenge to a public network, an operational + grid, a water utility, or any third-party device. +3. You understand that embedded reverse engineering and binary patching + require explicit authorization in any real-world context. +4. You will report any discovered weakness responsibly to the course + instructor. + +The world is short on people who can do this work. Treat that +responsibility seriously: verify before you patch, patch before you trust, +and never confuse a clean-looking status line with a safe system. + +--- + +## Reference Material + +- ARM Cortex-M33 Technical Reference Manual +- RP2350 datasheet +- GDB documentation +- Ghidra documentation: [https://ghidra-sre.org/](https://ghidra-sre.org/) diff --git a/0x0001b_ctf/CTF-01-I.pdf b/0x0001b_ctf/CTF-01-I.pdf new file mode 100644 index 0000000..faf4a09 Binary files /dev/null and b/0x0001b_ctf/CTF-01-I.pdf differ diff --git a/0x0001b_ctf/CTF-01-R.md b/0x0001b_ctf/CTF-01-R.md new file mode 100644 index 0000000..6223c60 --- /dev/null +++ b/0x0001b_ctf/CTF-01-R.md @@ -0,0 +1,237 @@ +# Operation Black Start - Requirements & Grading Criteria + +``` ++----------------------------------------------------------------------------------------+ +| | +| ██████╗ ██╗ █████╗ ██████╗██╗ ██╗███████╗████████╗ █████╗ ██████╗ ████████╗ | +| ██╔══██╗██║ ██╔══██╗██╔════╝██║ ██╔╝██╔════╝╚══██╔══╝██╔══██╗██╔══██╗╚══██╔══╝ | +| ██████╔╝██║ ███████║██║ █████╔╝ ███████╗ ██║ ███████║██████╔╝ ██║ | +| ██╔══██╗██║ ██╔══██║██║ ██╔═██╗ ╚════██║ ██║ ██╔══██║██╔══██╗ ██║ | +| ██████╔╝███████╗██║ ██║╚██████╗██║ ██╗███████╗ ██║ ██║ ██║██║ ██║ ██║ | +| ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝██║ ██║╚══════╝ ╚═╝ ╚═╝ ╚═╝██║ ██║ ██║ | +| | +| | +| O P E R A T I O N B L A C K S T A R T | +| | +| REQUIREMENTS & GRADING CRITERIA | +| | ++----------------------------------------------------------------------------------------+ +``` + +--- + +## Project Overview + +Students are the reverse-engineering reserve team called in after WorldGrid +Compact's emergency firmware build shipped a miscompiled safety threshold and +a false status string to its GRID-7 relay fleet. Students reverse engineer +`CTF-01.bin` with Ghidra, locate two real defects, patch them in the binary, +export a corrected image, flash it to real hardware, and prove the corrected +behavior with the debugger and the console. + +The challenge is separate from all FINAL projects and contains no FINAL-project +answer, constant, address, bug, or patch. + +--- + +## Learning Objectives + +- Decode an ARM Cortex-M33 vector table and identify the reset handler and + initial stack pointer. +- Translate Thumb reset-vector addresses into real function entry points. +- Locate a miscompiled boundary comparison and reason about its immediate + value. +- Patch compare instructions and a status string in a raw binary with Ghidra. +- Export and UF2-convert a corrected image, then verify it on real hardware. +- Capture derived state with GDB and read UART console output. + +Students must use only Weeks 1-3 concepts: ARM registers and stack behavior, +UART output, GDB, Ghidra static analysis and binary patching, vector tables, +reset startup, XIP, and Thumb addressing. + +--- + +## Deliverables Checklist + +| # | Deliverable | Format | Criterion | +|---|-------------|--------|-----------| +| 1 | Ghidra project screenshot (project name, processor, base address) | PNG/JPG | 1.1 | +| 2 | `main()` and status-loop addresses | Inside `CTF-01-Answers.md` | 1.2 | +| 3 | Vector table base, initial SP, reset pointer | Inside `CTF-01-Answers.md` | 1.3 | +| 4 | Thumb bit explanation | Inside `CTF-01-Answers.md` | 1.4 | +| 5 | Bug #1 evidence and patches (both compare sites) | Inside `CTF-01-Answers.md` | 2.1-2.6 | +| 6 | Bug #2 evidence and patch (six characters) | Inside `CTF-01-Answers.md` | 3.1-3.4 | +| 7 | Recovered dispatch frame and address | Inside `CTF-01-Answers.md` | 4.1-4.2 | +| 8 | `CTF-01_fixed.bin` | BIN file | 5.1 | +| 9 | `CTF-01_fixed.uf2` | UF2 file | 5.2 | +| 10 | Corrected console transcript | Inside `CTF-01-Answers.md` | 5.3 | +| 11 | Summary table of all patches | Inside `CTF-01-Answers.md` | 5.4 | +| 12 | Written reflection | Inside `CTF-01-Answers.md` | 6.1-6.2 | + +--- + +## Required Tools and Equipment + +| Tool | Purpose | +|------|---------| +| Raspberry Pi Pico 2 | Isolated target | +| 3.3 V USB-UART adapter | UART capture on GPIO 0 (TX) / GPIO 1 (RX) | +| Serial monitor | Observe output | +| Ghidra | Static analysis and binary patching | +| Python (`uf2conv.py`) | UF2 conversion | +| `CTF-01.bin` and `CTF-01.uf2` | Supplied artifacts | + +UART settings: **115200 baud, 8 data bits, no parity, 1 stop bit**. + +--- + +## Artifact Identity + +The instructor-issued artifact hashes are: + +```text +CTF-01.bin 6FD296F7A85F243FB26BF6BFFCBEAB26815FD8915101A81F72069063A5635E5A +CTF-01.uf2 980F04369C23AD32A063DFE18DE5AF08DF3830138FC7E7898B1F011B4F5E1D9D +``` + +--- + +## Grading Rubric - Detailed Breakdown + +### Task 1: Setup and Initial Analysis (15 points) + +| Criterion | Points | Full credit | Partial credit | No credit | +|-----------|--------|-------------|----------------|-----------| +| Criterion 1.1: Ghidra Project Setup | 3 | Correct project name, `ARM Cortex 32-bit little endian`, base `0x10000000` | One item off | Not set up | +| Criterion 1.2: main() and Status-Loop Addresses | 4 | Both addresses correct | One correct | Neither found | +| Criterion 1.3: Vector Table Decoding | 4 | Correct base, initial SP, reset pointer | One missing | Not found | +| Criterion 1.4: Thumb Addressing | 4 | Correctly clears bit 0 and identifies `main()` | General explanation | Incorrect | + +### Task 2: Find and Patch Bug #1: The Miscalibrated Safety Threshold (30 points) + +| Criterion | Points | Full credit | Partial credit | No credit | +|-----------|--------|-------------|----------------|-----------| +| Criterion 2.1: Locate Compare Site A | 5 | Correct address and original bytes | Address off | Not found | +| Criterion 2.2: Locate Compare Site B | 5 | Correct address and original bytes | Address off | Not found | +| Criterion 2.3: Correct Immediate-Value Reasoning | 8 | Explains the `<` to `<=` transform and gives `0x3B` | Correct value, no reasoning | Wrong value | +| Criterion 2.4: Patch Compare Site A | 4 | Byte change verified | Wrong byte | Not patched | +| Criterion 2.5: Patch Compare Site B | 4 | Byte change verified | Wrong byte | Not patched | +| Criterion 2.6: Explain Why Both Sites Must Be Patched | 4 | Clear explanation of the two independent comparisons | Vague | Missing | + +### Task 3: Find and Patch Bug #2: The False Signal Banner (20 points) + +| Criterion | Points | Full credit | Partial credit | No credit | +|-----------|--------|-------------|----------------|-----------| +| Criterion 3.1: Locate the Banner String | 5 | Correct address | Approximate | Not found | +| Criterion 3.2: Patch Six Characters | 8 | All six bytes changed, length preserved | Correct text, wrong bytes documented | Wrong length | +| Criterion 3.3: Character-by-Character Documentation | 4 | Original vs patched byte for all six characters | Partial | Missing | +| Criterion 3.4: Explain the Danger of a Hardcoded Status Word | 3 | Clear, specific reasoning | Generic | Missing | + +### Task 4: Recover the Quarantined Dispatch Frame (10 points) + +| Criterion | Points | Full credit | Partial credit | No credit | +|-----------|--------|-------------|----------------|-----------| +| Criterion 4.1: Recover the Dispatch Frame | 6 | Correct address and full text | Partial text | Not found | +| Criterion 4.2: Explain Why It Is Never Transmitted | 4 | Clear static-analysis explanation | Vague | Missing | + +### Task 5: Export and Verify (20 points) + +| Criterion | Points | Full credit | Partial credit | No credit | +|-----------|--------|-------------|----------------|-----------| +| Criterion 5.1: Export CTF-01_fixed.bin | 4 | Valid patched binary | Corrupted | Not submitted | +| Criterion 5.2: Convert to CTF-01_fixed.uf2 | 4 | Correct base and family flags | Wrong flags | Not submitted | +| Criterion 5.3: Hardware Verification | 8 | Corrected console output confirmed (CRITICAL/HELD in 1s stream; DANGER at boot/Ghidra) | Some lines corrected | No verification | +| Criterion 5.4: Summary Table of All Patches | 4 | Complete address and before/after table | Missing entries | No table | + +### Task 6: Written Reflection (5 points) + +| Criterion | Points | Full credit | Partial credit | No credit | +|-----------|--------|-------------|----------------|-----------| +| Criterion 6.1: "Rushed Build" Is Not an Excuse | 2 | Specific, grounded reasoning | Generic | Missing | +| Criterion 6.2: One Engineering Practice per Bug | 3 | Concrete practice for each bug | One bug only | Missing | + +--- + +## Common Pitfalls + +| Pitfall | Consequence | Avoidance | +|---------|-------------|-----------| +| Patching only one threshold site | One status line still lies | Patch both `0x100001FC` and `0x1000020A` | +| Assuming the immediate equals the limit | Off-by-one, wrong boundary | Use `0x3B` (59), not `0x3C` (60) | +| Using Patch Instruction before IT block | Re-disassembler context conflict swallows Site B | In Listing press `C` -> edit byte in Bytes window (pencil) -> press `D` | +| Missing boot banner in serial terminal | PuTTY misses one-time 5ms boot banner | Pulse RUN to GND while connected to capture | +| Replacing a string with a different length | Corrupts adjacent flash | `NORMAL` and `DANGER` are both 6 bytes | +| Treating an odd vector address as invalid | Thumb analysis fails | Clear bit 0 | +| Modifying the quarantined dispatch frame | Destroys evidence | Recover it, do not patch it | + +--- + +## How To Breadboard + +- **Raspberry Pi Pico 2** powered over USB. +- **3.3 V USB-UART adapter**: + - Adapter RX to Pico GP0 (UART0 TX) + - Adapter TX to Pico GP1 (UART0 RX) + - Adapter GND to Pico GND + - Do not connect the adapter VCC while the Pico is USB powered. +- **Serial monitor:** 115200 baud, 8 data bits, no parity, 1 stop bit. +- No other peripherals are required; all evidence is obtained from the console. + +--- + +## Memory Map Reference + +| Region | Address | Purpose | +|--------|---------|---------| +| Bootrom | `0x00000000` | Immutable boot code | +| Flash/XIP | `0x10000000` | Vector table, code, constants, strings | +| SRAM | `0x20000000` | Stack and writable state | + +--- + +## Deadline & Submission + +- Create a folder containing the Ghidra screenshot, `CTF-01_fixed.bin`, and + `CTF-01_fixed.uf2`. +- Write all written answers in a single file named `CTF-01-Answers.md` inside that + folder. +- ZIP the folder as `lastname-firstname-CTF-01.zip`. +- Submit the ZIP before the posted deadline; late submissions lose 10 percent + per day. + +--- + +## Grade Scale + +| Grade | Percentage | Points | +|-------|------------|--------| +| A+ | 97-100% | 97-100 | +| A | 93-96% | 93-96 | +| A- | 90-92% | 90-92 | +| B+ | 87-89% | 87-89 | +| B | 84-86% | 84-86 | +| B- | 80-83% | 80-83 | +| C | 70-79% | 70-79 | +| F | 0-69% | 0-69 | + +--- + +## Academic Integrity + +Use only the supplied Pico 2 and firmware. Do not connect the exercise to an +operational grid, water plant, public network, military system, or third-party +device. This is a controlled, isolated educational exercise. All analysis and +patches must be your own work; sharing binaries, addresses, or answers is a +violation of the academic integrity policy. + +--- + +## Reference Material + +| Topic | Reference | +|-------|-----------| +| ARM Cortex-M33 registers and stack | Week 1 | +| UART output and console capture | Week 2 | +| Vector tables, reset startup, and XIP | Week 2 | +| Ghidra static analysis and binary patching | Week 3 | +| Thumb addressing | Week 3 | diff --git a/0x0001b_ctf/CTF-01-R.pdf b/0x0001b_ctf/CTF-01-R.pdf new file mode 100644 index 0000000..9d49ecf Binary files /dev/null and b/0x0001b_ctf/CTF-01-R.pdf differ diff --git a/0x0001b_ctf/CTF-01-S.md b/0x0001b_ctf/CTF-01-S.md new file mode 100644 index 0000000..1fbdef8 --- /dev/null +++ b/0x0001b_ctf/CTF-01-S.md @@ -0,0 +1,467 @@ +# Operation Black Start - Instructor Solution Key + +``` ++----------------------------------------------------------------------------------------+ +| | +| ██████╗ ██╗ █████╗ ██████╗██╗ ██╗███████╗████████╗ █████╗ ██████╗ ████████╗ | +| ██╔══██╗██║ ██╔══██╗██╔════╝██║ ██╔╝██╔════╝╚══██╔══╝██╔══██╗██╔══██╗╚══██╔══╝ | +| ██████╔╝██║ ███████║██║ █████╔╝ ███████╗ ██║ ███████║██████╔╝ ██║ | +| ██╔══██╗██║ ██╔══██║██║ ██╔═██╗ ╚════██║ ██║ ██╔══██║██╔══██╗ ██║ | +| ██████╔╝███████╗██║ ██║╚██████╗██║ ██╗███████╗ ██║ ██║ ██║██║ ██║ ██║ | +| ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝██║ ██║╚══════╝ ╚═╝ ╚═╝ ╚═╝██║ ██║ ██║ | +| | +| | +| O P E R A T I O N B L A C K S T A R T | +| | +| *** INSTRUCTOR SOLUTION KEY - RESTRICTED *** | +| | ++----------------------------------------------------------------------------------------+ +``` + +> The task and criterion headings in this key are word-for-word identical to +> `CTF-01-R.md`, so a student can match each criterion one-to-one. + +--- + +## Artifact Identity + +| Artifact | Value | +|----------|-------| +| Student image | `CTF-01.bin` | +| Flash image | `CTF-01.uf2` | +| Target | Raspberry Pi Pico 2 / RP2350 ARM Cortex-M33 | +| Image base | `0x10000000` | +| Console | UART0, GPIO 0 TX / GPIO 1 RX, 115200 8N1 | + +```text +CTF-01.bin 6FD296F7A85F243FB26BF6BFFCBEAB26815FD8915101A81F72069063A5635E5A +CTF-01.uf2 980F04369C23AD32A063DFE18DE5AF08DF3830138FC7E7898B1F011B4F5E1D9D +``` + +Proof tool: `python3 scripts/verify_ctf.py` returns `11/11 checks passed` against +`CTF-01.bin`. + +--- + +## Task 1: Setup and Initial Analysis (15 points) + +### Solution + +**Criterion 1.1: Ghidra Project Setup (3 points).** Import `CTF-01.bin` as +`Raw Binary`, language `ARM:LE:32:Cortex`, base address `0x10000000`, then run +auto-analysis. + +**Criterion 1.2: main() and Status-Loop Addresses (4 points).** + +| Element | Address | +|---------|---------| +| `main()` | `0x100001E0` | +| Recurring status loop start | `0x10000234` | +| Loop back-edge (`b.n 0x10000234`) | `0x10000266` | + +The back-edge instruction at `0x10000266` is `b.n 0x10000234`, encoded as bytes +`E5 E7`. + +**Criterion 1.3: Vector Table Decoding (4 points).** +First 32 bytes of `CTF-01.bin`: + +```text +00 20 08 20 5B 01 00 10 1B 01 00 10 1D 01 00 10 +11 01 00 10 11 01 00 10 11 01 00 10 11 01 00 10 +``` + +| Evidence | Answer | +|----------|--------| +| Vector table base | `0x10000000` | +| Initial SP | `0x20082000` | +| Reset pointer (as stored) | `0x1000015B` | +| Reset instruction address | `0x1000015A` | + +**Criterion 1.4: Thumb Addressing (4 points).** +The stored reset pointer `0x1000015B` has bit 0 set to 1, which selects Thumb +mode. Clearing bit 0 (`0x1000015B & ~1`) gives the real instruction address +`0x1000015A`. The equally odd interrupt vectors (`0x1000011B`, `0x1000011D`, +`0x10000111`) are handled the same way. + +### Grading Rubric (1-to-1 Mapping) + +| Criterion | Points | Full Credit (Answer Key) | Partial Credit | No Credit | +|-----------|--------|--------------------------|----------------|-----------| +| Criterion 1.1: Ghidra Project Setup | 3 | Correct project name, `ARM Cortex 32-bit little endian`, base `0x10000000` | One item off | Not set up | +| Criterion 1.2: main() and Status-Loop Addresses | 4 | Both addresses correct | One correct | Neither found | +| Criterion 1.3: Vector Table Decoding | 4 | Correct base, initial SP, reset pointer | One missing | Not found | +| Criterion 1.4: Thumb Addressing | 4 | Correctly clears bit 0 and identifies `main()` | General explanation | Incorrect | + +### Instructor Notes & Assembly + +- Confirm the Ghidra import used `Raw Binary`, `ARM:LE:32:Cortex`, base + `0x10000000`, and that auto-analysis completed before any address was read. +- Verify `main()` is `0x100001E0`, the loop head is `0x10000234`, and the + back-edge bytes `E5 E7` sit at `0x10000266`. +- The reset vector is stored as `0x1000015B`; the real Thumb entry is + `0x1000015A`. Do not accept the un-cleared `0x1000015B` as an instruction + address. + +--- + +## Task 2: Find and Patch Bug #1: The Miscalibrated Safety Threshold (30 points) + +### Solution + +`grid_deviation` is `volatile`, so the compiler emits two independent compares: +one for the operator status and one for the automated dispatch decision. + +**Criterion 2.1: Locate Compare Site A (5 points).** + +```text +100001fc: 2b5e cmp r3, #94 @ 0x5e +``` + +| Item | Value | +|------|-------| +| Address | `0x100001FC` | +| File offset | `0x1FC` | +| Original bytes | `5E 2B` | +| Original instruction | `cmp r3, #94` | + +**Criterion 2.2: Locate Compare Site B (5 points).** + +```text +1000020a: 2b5e cmp r3, #94 @ 0x5e +``` + +| Item | Value | +|------|-------| +| Address | `0x1000020A` | +| File offset | `0x20A` | +| Original bytes | `5E 2B` | +| Original instruction | `cmp r3, #94` | + +**Criterion 2.3: Correct Immediate-Value Reasoning (8 points).** +The source constant is `SAFE_THRESHOLD = 95` and the test is `x < 95`. For an +unsigned value, `x < 95` is exactly `x <= 94`, which the compiler emits as +`cmp r3, #94` plus `ite hi`. The correct engineering limit is `60`, so the test +is `x < 60`, which is `x <= 59`. The correct patched immediate is therefore +**`0x3B` (59)**, not `0x3C` (60). Patching to `0x3C` would wrongly accept a +reading of exactly 60. + +**Criterion 2.4: Patch Compare Site A (4 points).** + +| Address | File Offset | Original | Patched | Before | After | +|---------|-------------|----------|---------|--------|-------| +| `0x100001FC` | `0x1FC` | `5E 2B` | `3B 2B` | `cmp r3, #94` | `cmp r3, #59` | + +**Criterion 2.5: Patch Compare Site B (4 points).** + +| Address | File Offset | Original | Patched | Before | After | +|---------|-------------|----------|---------|--------|-------| +| `0x1000020A` | `0x20A` | `5E 2B` | `3B 2B` | `cmp r3, #94` | `cmp r3, #59` | + +**Criterion 2.6: Explain Why Both Sites Must Be Patched (4 points).** +`operator_state` (`0x20000844`) and `dispatch_state` (`0x20000834`) are each +computed from their own read of `grid_deviation`. Patching only site A fixes the +displayed text while the automated dispatch at site B still authorizes on the +dangerous reading. Frozen reading `87`: `87 <= 94` is true (STABLE/AUTHORIZED, +wrong); `87 <= 59` is false (CRITICAL/HELD, correct). + +### Grading Rubric (1-to-1 Mapping) + +| Criterion | Points | Full Credit (Answer Key) | Partial Credit | No Credit | +|-----------|--------|--------------------------|----------------|-----------| +| Criterion 2.1: Locate Compare Site A | 5 | Correct address and original bytes | Address off | Not found | +| Criterion 2.2: Locate Compare Site B | 5 | Correct address and original bytes | Address off | Not found | +| Criterion 2.3: Correct Immediate-Value Reasoning | 8 | Explains the `<` to `<=` transform and gives `0x3B` | Correct value, no reasoning | Wrong value | +| Criterion 2.4: Patch Compare Site A | 4 | Byte change verified | Wrong byte | Not patched | +| Criterion 2.5: Patch Compare Site B | 4 | Byte change verified | Wrong byte | Not patched | +| Criterion 2.6: Explain Why Both Sites Must Be Patched | 4 | Clear explanation of the two independent comparisons | Vague | Missing | + +### Instructor Notes & Assembly + +- Both sites must be patched: `0x100001FC` for operator status and + `0x1000020A` for the automated dispatch decision. +- The correct immediate is `0x3B` (59), not `0x3C` (60); the source test is a + strict `<`, compiled as `<= 94`. +- Verify the byte changes on hardware: after patching, `operator_state` + (`0x20000844`) and `dispatch_state` (`0x20000834`) read `0` and `0`. +- **Ghidra ARM/Thumb Context Note:** In raw `.bin` files, patching an instruction + that precedes an `IT` block (`ite hi`) using the GUI *Patch Instruction* action + triggers Ghidra's `ReDisassembleCommand`. The re-disassembler encounters an + internal context register conflict when trying to re-declare the `ITBlock` + context over existing instructions, collapsing Thumb decoding into 32-bit ARM + mode and swallowing Site B (`0x1000020A`). Students must patch using the Bytes + window workflow (Clear `C` -> edit byte `5E` -> `3B` in Bytes window with pencil + icon -> Disassemble `D`) to keep Site B visible and cleanly aligned. + +--- + +## Task 3: Find and Patch Bug #2: The False Signal Banner (20 points) + +### Solution + +**Criterion 3.1: Locate the Banner String (5 points).** + +| String | Address | +|--------|---------| +| `"SIGNAL: NORMAL\r"` | `0x10003678` | +| `"NORMAL"` substring to patch | `0x10003680` | + +The string is loaded at call site `0x10000224` (`ldr r0, [pc, #92]` -> +`0x10003678`) and printed by `bl __wrap_puts` at `0x10000226`. It is printed +once at boot and never recomputed. + +**Criterion 3.2: Patch Six Characters (8 points).** +`NORMAL` and `DANGER` are both six ASCII characters, so the patch preserves the +string length. + +| Address Range | Original Bytes | Patched Bytes | +|---------------|----------------|---------------| +| `0x10003680` - `0x10003685` | `4E 4F 52 4D 41 4C` | `44 41 4E 47 45 52` | + +**Criterion 3.3: Character-by-Character Documentation (4 points).** + +| Address | Original Char | Original Byte | Patched Char | Patched Byte | +|---------|---------------|---------------|--------------|--------------| +| `0x10003680` | N | `4E` | D | `44` | +| `0x10003681` | O | `4F` | A | `41` | +| `0x10003682` | R | `52` | N | `4E` | +| `0x10003683` | M | `4D` | G | `47` | +| `0x10003684` | A | `41` | E | `45` | +| `0x10003685` | L | `4C` | R | `52` | + +**Criterion 3.4: Explain the Danger of a Hardcoded Status Word (3 points).** +The banner never consults the reading, so it reports a healthy line even while +the frozen reading is dangerous. Operators trust supervisory banners, so a +hardcoded `NORMAL` masks the hazard and prevents manual intervention. + +### Grading Rubric (1-to-1 Mapping) + +| Criterion | Points | Full Credit (Answer Key) | Partial Credit | No Credit | +|-----------|--------|--------------------------|----------------|-----------| +| Criterion 3.1: Locate the Banner String | 5 | Correct address | Approximate | Not found | +| Criterion 3.2: Patch Six Characters | 8 | All six bytes changed, length preserved | Correct text, wrong bytes documented | Wrong length | +| Criterion 3.3: Character-by-Character Documentation | 4 | Original vs patched byte for all six characters | Partial | Missing | +| Criterion 3.4: Explain the Danger of a Hardcoded Status Word | 3 | Clear, specific reasoning | Generic | Missing | + +### Instructor Notes & Assembly + +- `NORMAL` and `DANGER` are both six characters; the patch must not change the + string length or overwrite adjacent flash. +- The banner is printed once at boot and never recomputed, so it is a separate + defect from the threshold and must be graded independently. +- Confirm the patch covers `0x10003680` through `0x10003685` exactly. + +--- + +## Task 4: Recover the Quarantined Dispatch Frame (10 points) + +### Solution + +**Criterion 4.1: Recover the Dispatch Frame (6 points).** +Address `0x100037A0` in flash `.rodata`: + +```text +WORLDGRID:BLACKSTART:GRID-7:WATER-3 +``` + +**Criterion 4.2: Explain Why It Is Never Transmitted (4 points).** +`retain_dispatch_frame()` reads only the first character into a `volatile` local +so the linker keeps the string, but the pointer is never passed to any print or +UART routine. The frame is evidence only and must not be patched. + +### Grading Rubric (1-to-1 Mapping) + +| Criterion | Points | Full Credit (Answer Key) | Partial Credit | No Credit | +|-----------|--------|--------------------------|----------------|-----------| +| Criterion 4.1: Recover the Dispatch Frame | 6 | Correct address and full text | Partial text | Not found | +| Criterion 4.2: Explain Why It Is Never Transmitted | 4 | Clear static-analysis explanation | Vague | Missing | + +### Instructor Notes & Assembly + +- Accept the full string `WORLDGRID:BLACKSTART:GRID-7:WATER-3` at `0x100037A0` + in flash `.rodata`. +- The frame is evidence only. Penalize any submission that patches or rewrites + it instead of recovering it. + +--- + +## Task 5: Export and Verify (20 points) + +### Solution + +**Criterion 5.1: Export CTF-01_fixed.bin (4 points).** +Export the patched program from Ghidra (`File -> Export Program...`, `Binary +Format`) as `CTF-01_fixed.bin`. + +**Criterion 5.2: Convert to CTF-01_fixed.uf2 (4 points).** + +```bash +python uf2conv.py CTF-01_fixed.bin --base 0x10000000 --family 0xe48bff59 --output CTF-01_fixed.uf2 +``` + +**Criterion 5.3: Hardware Verification (8 points).** + +Before patching: + +```text +GLOBAL EMBEDDED RESPONSE NETWORK +BLACK START WINDOW: 27 MINUTES +UART0 115200 8N1 | AUTHORIZED LAB CONSOLE +SIGNAL: NORMAL +RESPONSE> GRID STATUS: STABLE +DISPATCH PATH: AUTHORIZED +LAST FRAME: QUARANTINED +RESPONSE> +``` + +After all three patches: + +```text +GLOBAL EMBEDDED RESPONSE NETWORK +BLACK START WINDOW: 27 MINUTES +UART0 115200 8N1 | AUTHORIZED LAB CONSOLE +SIGNAL: DANGER +RESPONSE> GRID STATUS: CRITICAL +DISPATCH PATH: HELD +LAST FRAME: QUARANTINED +RESPONSE> +``` + +If the console is not wired, the same proof is read over SWD: after reset, +`operator_state` (`0x20000844`) and `dispatch_state` (`0x20000834`) are `1` and +`1` for the shipped image, and `0` and `0` for the patched image. This has been +confirmed on real hardware. + +**Criterion 5.4: Summary Table of All Patches (4 points).** + +| # | What | Address(es) | Original | Patched | +|---|------|-------------|----------|---------| +| 1a | Operator threshold | `0x100001FC` | `5E 2B` | `3B 2B` | +| 1b | Dispatch threshold | `0x1000020A` | `5E 2B` | `3B 2B` | +| 2 | Signal banner | `0x10003680`-`0x10003685` | `4E 4F 52 4D 41 4C` | `44 41 4E 47 45 52` | + +Total: **8 bytes actually change** (one immediate byte at each compare site and +six string bytes). + +### Grading Rubric (1-to-1 Mapping) + +| Criterion | Points | Full Credit (Answer Key) | Partial Credit | No Credit | +|-----------|--------|--------------------------|----------------|-----------| +| Criterion 5.1: Export CTF-01_fixed.bin | 4 | Valid patched binary | Corrupted | Not submitted | +| Criterion 5.2: Convert to CTF-01_fixed.uf2 | 4 | Correct base and family flags | Wrong flags | Not submitted | +| Criterion 5.3: Hardware Verification | 8 | Corrected console output confirmed on hardware | Some lines corrected | No verification | +| Criterion 5.4: Summary Table of All Patches | 4 | Complete address and before/after table | Missing entries | No table | + +### Instructor Notes & Assembly + +- Verify the exported image with `python3 scripts/verify_ctf.py`; the shipped + check expects `11/11 checks passed` against `CTF-01.bin`. +- Confirm the UF2 conversion used base `0x10000000` and family `0xe48bff59`. +- **Serial Terminal Timing:** Note that `print_boot_banner()` (`SIGNAL: DANGER`) + fires within the first 5 milliseconds of boot. In normal lab usage, PuTTY + attaches after boot and will display the continuous 1-second status loop + (`GRID STATUS: CRITICAL`, `DISPATCH PATH: HELD`). To see `SIGNAL: DANGER`, + the student must pulse `RUN` to `GND` while PuTTY is open, or demonstrate + the string change at `0x10003680` via Ghidra static analysis. +- If no console is available, accept the SWD capture showing `operator_state` + and `dispatch_state` at `0` and `0` on the patched image. + +--- + +## Task 6: Written Reflection (5 points) + +### Solution + +**Criterion 6.1: "Rushed Build" Is Not an Excuse (2 points).** +The missed review step is exactly what shipped the false-safe report; pressure +explains why the safeguard was skipped, not why it should be skipped. + +**Criterion 6.2: One Engineering Practice per Bug (3 points).** +- Bug #1 (duplicated threshold): a unit test or static-analysis rule that + requires every comparison against `SAFE_THRESHOLD` to use one shared source of + truth. +- Bug #2 (hardcoded banner): a hardware-in-the-loop smoke test that checks the + boot banner against the latched reading. + +### Grading Rubric (1-to-1 Mapping) + +| Criterion | Points | Full Credit (Answer Key) | Partial Credit | No Credit | +|-----------|--------|--------------------------|----------------|-----------| +| Criterion 6.1: "Rushed Build" Is Not an Excuse | 2 | Specific, grounded reasoning | Generic | Missing | +| Criterion 6.2: One Engineering Practice per Bug | 3 | Concrete practice for each bug | One bug only | Missing | + +### Instructor Notes & Assembly + +- Grade the specificity of the reasoning, not the length of the prose. +- Require one concrete engineering practice for each of the two bugs. + +--- + +## How To Breadboard + +- **Raspberry Pi Pico 2** powered over USB. +- **3.3 V USB-UART adapter**: + - Adapter RX to Pico GP0 (UART0 TX) + - Adapter TX to Pico GP1 (UART0 RX) + - Adapter GND to Pico GND + - Do not connect the adapter VCC while the Pico is USB powered. +- **Serial monitor:** 115200 baud, 8 data bits, no parity, 1 stop bit. +- No other peripherals are required; all evidence is obtained from the console. + +--- + +## Complete Grading Summary + +| Task | Title | Points | +|------|-------|--------| +| Task 1 | Setup and Initial Analysis | 15 | +| Task 2 | Find and Patch Bug #1: The Miscalibrated Safety Threshold | 30 | +| Task 3 | Find and Patch Bug #2: The False Signal Banner | 20 | +| Task 4 | Recover the Quarantined Dispatch Frame | 10 | +| Task 5 | Export and Verify | 20 | +| Task 6 | Written Reflection | 5 | +| **TOTAL** | | **100** | + +--- + +## Instructor Notes + +Safety: Use only the supplied Pico 2, 3.3 V UART adapter, and firmware. Never +connect the exercise to an operational grid, water plant, public network, +military system, or third-party device. + +### Common Student Mistakes + +- Patching only one threshold site (`0x100001FC` or `0x1000020A`), which leaves + one status line lying. +- Assuming the immediate equals the limit, producing an off-by-one boundary; + the correct byte is `0x3B` (59), not `0x3C` (60). +- Replacing the banner string with a different length, corrupting adjacent + flash; `NORMAL` and `DANGER` are both 6 bytes. +- Treating the odd vector address `0x1000015B` as invalid instead of clearing + bit 0 to get `0x1000015A`. +- Modifying the quarantined dispatch frame at `0x100037A0`, which destroys + evidence. + +### Partial Credit Guidelines + +- Award partial credit for one correct threshold site out of two, or for a + correct immediate value without the `<` to `<=` reasoning. +- Award partial credit for a correct banner text with incorrectly documented + bytes, or for partial character-by-character documentation. +- Accept an SWD read of `operator_state` and `dispatch_state` as equivalent + proof when no UART console is available. +- Award no credit for patches that change string length or overwrite adjacent + flash. + +--- + +## Appendix: Expected Binary Diff + +| # | What | File Offset(s) | Address(es) | Original Bytes | Patched Bytes | +|---|------|----------------|-------------|----------------|---------------| +| 1a | Operator threshold | `0x1FC` | `0x100001FC` | `5E 2B` | `3B 2B` | +| 1b | Dispatch threshold | `0x20A` | `0x1000020A` | `5E 2B` | `3B 2B` | +| 2 | Signal banner | `0x3680` - `0x3685` | `0x10003680` - `0x10003685` | `4E 4F 52 4D 41 4C` | `44 41 4E 47 45 52` | + +Total: **8 bytes actually change** (one immediate byte at each compare site and +six string bytes). diff --git a/0x0001b_ctf/CTF-01-S.pdf b/0x0001b_ctf/CTF-01-S.pdf new file mode 100644 index 0000000..3536342 Binary files /dev/null and b/0x0001b_ctf/CTF-01-S.pdf differ diff --git a/0x0001b_ctf/CTF-01.bin b/0x0001b_ctf/CTF-01.bin new file mode 100644 index 0000000..9e61bbb Binary files /dev/null and b/0x0001b_ctf/CTF-01.bin differ diff --git a/0x0001b_ctf/CTF-01.uf2 b/0x0001b_ctf/CTF-01.uf2 new file mode 100644 index 0000000..040b05e Binary files /dev/null and b/0x0001b_ctf/CTF-01.uf2 differ diff --git a/0x0001b_ctf/CTF-01_fixed.bin b/0x0001b_ctf/CTF-01_fixed.bin new file mode 100644 index 0000000..cecaec1 Binary files /dev/null and b/0x0001b_ctf/CTF-01_fixed.bin differ diff --git a/0x0001b_ctf/CTF-01_fixed.uf2 b/0x0001b_ctf/CTF-01_fixed.uf2 new file mode 100644 index 0000000..220b2ca Binary files /dev/null and b/0x0001b_ctf/CTF-01_fixed.uf2 differ diff --git a/0x0001b_ctf/include/console.h b/0x0001b_ctf/include/console.h new file mode 100644 index 0000000..ec78554 --- /dev/null +++ b/0x0001b_ctf/include/console.h @@ -0,0 +1,56 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: console.h +// Desc: Declares the UART console banner and status reporting interface +// for Operation Black Start. +// Created: 2026 + +#ifndef CONSOLE_H +#define CONSOLE_H + +/** + * @brief Print the response controller's boot identity and unconditional signal line. + * + * Emits the boot banner, operation window, serial configuration banner, + * unconditional signal quality line, and the interactive command prompt. + * + * @param None. + * @return None. + */ +void print_boot_banner(void); + +/** + * @brief Print the recurring grid classification and dispatch authorization report. + * + * Evaluates the current operator state and dispatch state flags and transmits + * the formatted status report over UART0 with the quarantined frame notification. + * + * @param None. + * @return None. + */ +void print_status(void); + +#endif // CONSOLE_H diff --git a/0x0001b_ctf/include/grid.h b/0x0001b_ctf/include/grid.h new file mode 100644 index 0000000..ab1ffee --- /dev/null +++ b/0x0001b_ctf/include/grid.h @@ -0,0 +1,73 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: grid.h +// Desc: Declares the grid telemetry and safety evaluation interface for +// Operation Black Start. +// Created: 2026 + +#ifndef GRID_H +#define GRID_H + +#include + +// Safety margin (Hz deviation x100) below which grid frequency is tolerable. +// BUG: emergency build miscompiled this far too permissive; correct value is 60. +#define SAFE_THRESHOLD 95 + +// Frozen grid frequency deviation reading latched when comms were severed. +extern volatile uint32_t grid_deviation; + +// Operator-facing classification of the frozen reading (drives GRID STATUS). +extern volatile uint32_t operator_state; + +// Automated dispatch authorization decision (drives DISPATCH PATH). +extern volatile uint32_t dispatch_state; + +/** + * @brief Anchor the hidden dispatch frame in flash without transmitting it. + * + * Reads the first character of the quarantined black-start authorization + * frame into a volatile local marker to prevent the compiler from optimizing + * out the string literal from .rodata flash storage. + * + * @param None. + * @return None. + */ +void retain_dispatch_frame(void); + +/** + * @brief Classify the frozen telemetry reading against the compiled threshold. + * + * Evaluates the frozen grid deviation reading against SAFE_THRESHOLD twice, + * once for the operator-facing status line and once for the automated + * dispatch decision, mirroring the duplicated immediate comparison site. + * + * @param None. + * @return None. + */ +void evaluate_grid(void); + +#endif // GRID_H diff --git a/0x0001b_ctf/pico_sdk_import.cmake b/0x0001b_ctf/pico_sdk_import.cmake new file mode 100644 index 0000000..d493cc2 --- /dev/null +++ b/0x0001b_ctf/pico_sdk_import.cmake @@ -0,0 +1,121 @@ +# This is a copy of /external/pico_sdk_import.cmake + +# This can be dropped into an external project to help locate this SDK +# It should be include()ed prior to project() + +# Copyright 2020 (c) 2020 Raspberry Pi (Trading) Ltd. +# +# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the +# following conditions are met: +# +# 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following +# disclaimer. +# +# 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided with the distribution. +# +# 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products +# derived from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, +# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +if (DEFINED ENV{PICO_SDK_PATH} AND (NOT PICO_SDK_PATH)) + set(PICO_SDK_PATH $ENV{PICO_SDK_PATH}) + message("Using PICO_SDK_PATH from environment ('${PICO_SDK_PATH}')") +endif () + +if (DEFINED ENV{PICO_SDK_FETCH_FROM_GIT} AND (NOT PICO_SDK_FETCH_FROM_GIT)) + set(PICO_SDK_FETCH_FROM_GIT $ENV{PICO_SDK_FETCH_FROM_GIT}) + message("Using PICO_SDK_FETCH_FROM_GIT from environment ('${PICO_SDK_FETCH_FROM_GIT}')") +endif () + +if (DEFINED ENV{PICO_SDK_FETCH_FROM_GIT_PATH} AND (NOT PICO_SDK_FETCH_FROM_GIT_PATH)) + set(PICO_SDK_FETCH_FROM_GIT_PATH $ENV{PICO_SDK_FETCH_FROM_GIT_PATH}) + message("Using PICO_SDK_FETCH_FROM_GIT_PATH from environment ('${PICO_SDK_FETCH_FROM_GIT_PATH}')") +endif () + +if (DEFINED ENV{PICO_SDK_FETCH_FROM_GIT_TAG} AND (NOT PICO_SDK_FETCH_FROM_GIT_TAG)) + set(PICO_SDK_FETCH_FROM_GIT_TAG $ENV{PICO_SDK_FETCH_FROM_GIT_TAG}) + message("Using PICO_SDK_FETCH_FROM_GIT_TAG from environment ('${PICO_SDK_FETCH_FROM_GIT_TAG}')") +endif () + +if (PICO_SDK_FETCH_FROM_GIT AND NOT PICO_SDK_FETCH_FROM_GIT_TAG) + set(PICO_SDK_FETCH_FROM_GIT_TAG "master") + message("Using master as default value for PICO_SDK_FETCH_FROM_GIT_TAG") +endif() + +set(PICO_SDK_PATH "${PICO_SDK_PATH}" CACHE PATH "Path to the Raspberry Pi Pico SDK") +set(PICO_SDK_FETCH_FROM_GIT "${PICO_SDK_FETCH_FROM_GIT}" CACHE BOOL "Set to ON to fetch copy of SDK from git if not otherwise locatable") +set(PICO_SDK_FETCH_FROM_GIT_PATH "${PICO_SDK_FETCH_FROM_GIT_PATH}" CACHE FILEPATH "location to download SDK") +set(PICO_SDK_FETCH_FROM_GIT_TAG "${PICO_SDK_FETCH_FROM_GIT_TAG}" CACHE FILEPATH "release tag for SDK") + +if (NOT PICO_SDK_PATH) + if (PICO_SDK_FETCH_FROM_GIT) + include(FetchContent) + set(FETCHCONTENT_BASE_DIR_SAVE ${FETCHCONTENT_BASE_DIR}) + if (PICO_SDK_FETCH_FROM_GIT_PATH) + get_filename_component(FETCHCONTENT_BASE_DIR "${PICO_SDK_FETCH_FROM_GIT_PATH}" REALPATH BASE_DIR "${CMAKE_SOURCE_DIR}") + endif () + FetchContent_Declare( + pico_sdk + GIT_REPOSITORY https://github.com/raspberrypi/pico-sdk + GIT_TAG ${PICO_SDK_FETCH_FROM_GIT_TAG} + ) + + if (NOT pico_sdk) + message("Downloading Raspberry Pi Pico SDK") + # GIT_SUBMODULES_RECURSE was added in 3.17 + if (${CMAKE_VERSION} VERSION_GREATER_EQUAL "3.17.0") + FetchContent_Populate( + pico_sdk + QUIET + GIT_REPOSITORY https://github.com/raspberrypi/pico-sdk + GIT_TAG ${PICO_SDK_FETCH_FROM_GIT_TAG} + GIT_SUBMODULES_RECURSE FALSE + + SOURCE_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-src + BINARY_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-build + SUBBUILD_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-subbuild + ) + else () + FetchContent_Populate( + pico_sdk + QUIET + GIT_REPOSITORY https://github.com/raspberrypi/pico-sdk + GIT_TAG ${PICO_SDK_FETCH_FROM_GIT_TAG} + + SOURCE_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-src + BINARY_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-build + SUBBUILD_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-subbuild + ) + endif () + + set(PICO_SDK_PATH ${pico_sdk_SOURCE_DIR}) + endif () + set(FETCHCONTENT_BASE_DIR ${FETCHCONTENT_BASE_DIR_SAVE}) + else () + message(FATAL_ERROR + "SDK location was not specified. Please set PICO_SDK_PATH or set PICO_SDK_FETCH_FROM_GIT to on to fetch from git." + ) + endif () +endif () + +get_filename_component(PICO_SDK_PATH "${PICO_SDK_PATH}" REALPATH BASE_DIR "${CMAKE_BINARY_DIR}") +if (NOT EXISTS ${PICO_SDK_PATH}) + message(FATAL_ERROR "Directory '${PICO_SDK_PATH}' not found") +endif () + +set(PICO_SDK_INIT_CMAKE_FILE ${PICO_SDK_PATH}/pico_sdk_init.cmake) +if (NOT EXISTS ${PICO_SDK_INIT_CMAKE_FILE}) + message(FATAL_ERROR "Directory '${PICO_SDK_PATH}' does not appear to contain the Raspberry Pi Pico SDK") +endif () + +set(PICO_SDK_PATH ${PICO_SDK_PATH} CACHE PATH "Path to the Raspberry Pi Pico SDK" FORCE) + +include(${PICO_SDK_INIT_CMAKE_FILE}) diff --git a/0x0001b_ctf/scripts/verify_ctf.py b/0x0001b_ctf/scripts/verify_ctf.py new file mode 100644 index 0000000..f542dd4 --- /dev/null +++ b/0x0001b_ctf/scripts/verify_ctf.py @@ -0,0 +1,82 @@ +#!/usr/bin/env python3 +"""Verify every technical claim of Operation Black Start against CTF-01.bin. + +Exits 0 only when every address, byte, and hash in CTF-R.md and CTF-S.md +matches the shipped image. +""" +import hashlib +import struct +import sys +from pathlib import Path + +BASE = 0x10000000 +ROOT = Path(__file__).resolve().parent.parent +BIN = ROOT / "CTF-01.bin" +UF2 = ROOT / "CTF-01.uf2" + +EXPECTED_BIN_SHA = "6fd296f7a85f243fb26bf6bffcbeab26815fd8915101a81f72069063a5635e5a" +EXPECTED_UF2_SHA = "980f04369c23ad32a063dfe18de5af08df3830138fc7e7898b1f011b4f5e1d9d" + +CMP_A = 0x100001FC +CMP_B = 0x1000020A +STRING_SIGNAL = 0x10003678 +STRING_FRAME = 0x100037A0 +LOOP_BACK = 0x10000266 + +RESULTS = [] + + +def check(label, ok, detail=""): + """Record one verification result. + + Parameters + ---------- + label : str + Human-readable check name. + ok : bool + Whether the check passed. + detail : str + Extra context printed with the result. + + Returns + ------- + None + """ + RESULTS.append(ok) + print(f"[{'PASS' if ok else 'FAIL'}] {label} {detail}") + + +def main(): + """Run all verification checks. + + Returns + ------- + int + Zero when every check passes, else one. + """ + data = BIN.read_bytes() + check("CTF-01.bin SHA-256", hashlib.sha256(data).hexdigest() == EXPECTED_BIN_SHA) + check("CTF-01.uf2 SHA-256", + hashlib.sha256(UF2.read_bytes()).hexdigest() == EXPECTED_UF2_SHA) + check("vector table", data[0:32].hex() == + "002008205b0100101b0100101d01001011010010110100101101001011010010") + check("initial SP", struct.unpack(" + +void print_boot_banner(void) +{ + printf("GLOBAL EMBEDDED RESPONSE NETWORK\r\n"); + printf("BLACK START WINDOW: 27 MINUTES\r\n"); + printf("UART0 115200 8N1 | AUTHORIZED LAB CONSOLE\r\n"); + printf("SIGNAL: NORMAL\r\n"); + printf("RESPONSE> "); +} + +void print_status(void) +{ + printf("GRID STATUS: %s\r\n", operator_state ? "STABLE" : "CRITICAL"); + printf("DISPATCH PATH: %s\r\n", dispatch_state ? "AUTHORIZED" : "HELD"); + printf("LAST FRAME: QUARANTINED\r\n"); + printf("RESPONSE> "); +} diff --git a/0x0001b_ctf/src/grid.c b/0x0001b_ctf/src/grid.c new file mode 100644 index 0000000..37ded64 --- /dev/null +++ b/0x0001b_ctf/src/grid.c @@ -0,0 +1,57 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: grid.c +// Desc: Implements the grid telemetry and safety evaluation logic for +// Operation Black Start. +// Created: 2026 + +#include "grid.h" +#include + +// Frozen grid frequency deviation reading latched when comms were severed. +volatile uint32_t grid_deviation = 87; + +// Operator-facing classification of the frozen reading (drives GRID STATUS). +volatile uint32_t operator_state = 0; + +// Automated dispatch authorization decision (drives DISPATCH PATH). +volatile uint32_t dispatch_state = 0; + +// Quarantined black-start authorization frame, retained in flash, never sent. +static volatile const char dispatch_frame[] = + "WORLDGRID:BLACKSTART:GRID-7:WATER-3"; + +void retain_dispatch_frame(void) +{ + volatile char frame_marker = dispatch_frame[0]; + (void)frame_marker; +} + +void evaluate_grid(void) +{ + operator_state = (grid_deviation < SAFE_THRESHOLD) ? 1 : 0; + dispatch_state = (grid_deviation < SAFE_THRESHOLD) ? 1 : 0; +} diff --git a/0x0001b_ctf/src/main.c b/0x0001b_ctf/src/main.c new file mode 100644 index 0000000..87671bd --- /dev/null +++ b/0x0001b_ctf/src/main.c @@ -0,0 +1,56 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: main.c +// Desc: Main entry point for the Operation Black Start CTF relay firmware. +// Created: 2026 + +#include "console.h" +#include "grid.h" +#include "pico/stdlib.h" + +/** + * @brief Run the recurring UART evidence stream for the isolated CTF image. + * + * Initializes the standard I/O subsystems, anchors the quarantined dispatch + * frame in flash memory, evaluates the frozen telemetry against the compiled + * safety threshold, prints the startup banner, and repeatedly emits the + * system status report every second. + * + * @param None. + * @return int Standard exit code (never reached in normal firmware execution). + */ +int main(void) +{ + stdio_init_all(); + retain_dispatch_frame(); + evaluate_grid(); + print_boot_banner(); + while (true) { + print_status(); + sleep_ms(1000); + } + return 0; +} diff --git a/0x0001b_ctf/uf2conv.py b/0x0001b_ctf/uf2conv.py new file mode 100644 index 0000000..d6dd7a8 --- /dev/null +++ b/0x0001b_ctf/uf2conv.py @@ -0,0 +1,365 @@ +#!/usr/bin/env python3 +import sys +import struct +import subprocess +import re +import os +import os.path +import argparse +import json +from time import sleep + + +UF2_MAGIC_START0 = 0x0A324655 # "UF2\n" +UF2_MAGIC_START1 = 0x9E5D5157 # Randomly selected +UF2_MAGIC_END = 0x0AB16F30 # Ditto + +INFO_FILE = "/INFO_UF2.TXT" + +appstartaddr = 0x2000 +familyid = 0x0 + + +def is_uf2(buf): + w = struct.unpack(" 476: + assert False, "Invalid UF2 data size at " + ptr + newaddr = hd[3] + if (hd[2] & 0x2000) and (currfamilyid == None): + currfamilyid = hd[7] + if curraddr == None or ((hd[2] & 0x2000) and hd[7] != currfamilyid): + currfamilyid = hd[7] + curraddr = newaddr + if familyid == 0x0 or familyid == hd[7]: + appstartaddr = newaddr + padding = newaddr - curraddr + if padding < 0: + assert False, "Block out of order at " + ptr + if padding > 10*1024*1024: + assert False, "More than 10M of padding needed at " + ptr + if padding % 4 != 0: + assert False, "Non-word padding size at " + ptr + while padding > 0: + padding -= 4 + outp.append(b"\x00\x00\x00\x00") + if familyid == 0x0 or ((hd[2] & 0x2000) and familyid == hd[7]): + outp.append(block[32 : 32 + datalen]) + curraddr = newaddr + datalen + if hd[2] & 0x2000: + if hd[7] in families_found.keys(): + if families_found[hd[7]] > newaddr: + families_found[hd[7]] = newaddr + else: + families_found[hd[7]] = newaddr + if prev_flag == None: + prev_flag = hd[2] + if prev_flag != hd[2]: + all_flags_same = False + if blockno == (numblocks - 1): + print("--- UF2 File Header Info ---") + families = load_families() + for family_hex in families_found.keys(): + family_short_name = "" + for name, value in families.items(): + if value == family_hex: + family_short_name = name + print("Family ID is {:s}, hex value is 0x{:08x}".format(family_short_name,family_hex)) + print("Target Address is 0x{:08x}".format(families_found[family_hex])) + if all_flags_same: + print("All block flag values consistent, 0x{:04x}".format(hd[2])) + else: + print("Flags were not all the same") + print("----------------------------") + if len(families_found) > 1 and familyid == 0x0: + outp = [] + appstartaddr = 0x0 + return b"".join(outp) + +def convert_to_carray(file_content): + outp = "const unsigned long bindata_len = %d;\n" % len(file_content) + outp += "const unsigned char bindata[] __attribute__((aligned(16))) = {" + for i in range(len(file_content)): + if i % 16 == 0: + outp += "\n" + outp += "0x%02x, " % file_content[i] + outp += "\n};\n" + return bytes(outp, "utf-8") + +def convert_to_uf2(file_content): + global familyid + datapadding = b"" + while len(datapadding) < 512 - 256 - 32 - 4: + datapadding += b"\x00\x00\x00\x00" + numblocks = (len(file_content) + 255) // 256 + outp = [] + for blockno in range(numblocks): + ptr = 256 * blockno + chunk = file_content[ptr:ptr + 256] + flags = 0x0 + if familyid: + flags |= 0x2000 + hd = struct.pack(b" USB -> Debug Probe -> SWD -> RP2350B Cortex-M33 | +| OpenOCD :3333 <------ SWD + UART bridge ------> GP0/GP1 115200 | ++-----------------------------------------------------------------+ +``` + +The philosophy: an offline model can guess what a stripped image does. It +cannot read the live registers, watch the parser, or verify a patch. **Think, +then verify.** + +--- + +## 2. Prerequisites + +| Component | Value | +|---|---| +| Target | Raspberry Pi Pico 2 (RP2350B) | +| Image | `0x0011a_cb.bin` (raw flash image, base `0x10000000`) | +| Probe | Raspberry Pi Debug Probe (CMSIS-DAP v2) | +| Architecture | `ARM:LE:32:Cortex` (ARMv8-M / Cortex-M33, Thumb-2) | + +The `.bin` is the stripped image. `file offset = address, 0x10000000`. + +### 2.1 Tool Paths Per Host (macOS, Linux, Windows) + +The probe, OpenOCD, and GDB behave identically on every platform; only the paths +and the shell differ. Pick your host. + +| Tool | macOS | Linux | Windows | +|---|---|---|---| +| OpenOCD | `~/.pico-sdk/openocd/0.12.0+dev/openocd` | `$HOME/.pico-sdk/openocd/0.12.0+dev/openocd` | `%USERPROFILE%\.pico-sdk\openocd\0.12.0+dev\openocd.exe` | +| OpenOCD scripts | `~/.pico-sdk/openocd/0.12.0+dev/scripts` | `$HOME/.pico-sdk/openocd/0.12.0+dev/scripts` | `%USERPROFILE%\.pico-sdk\openocd\0.12.0+dev\scripts` | +| GDB | `~/.pico-sdk/toolchain/14_2_Rel1/bin/arm-none-eabi-gdb` | `$HOME/.pico-sdk/toolchain/14_2_Rel1/bin/arm-none-eabi-gdb` | `%USERPROFILE%\.pico-sdk\toolchain\14_2_Rel1\bin\arm-none-eabi-gdb.exe` | +| Serial port | `/dev/tty.usbmodem*` | `/dev/ttyACM*` | `COMx` (Device Manager) | + +Install the tools if you do not have them: + +- macOS: `brew install --cask gcc-arm-embedded` for the toolchain, then + `brew install open-ocd`, or run the Raspberry Pi `pico-setup` script, which + places everything under `~/.pico-sdk`. +- Linux: install `gcc-arm-none-eabi` and `openocd` from your package manager, + or run the Raspberry Pi `pico-setup` script under `~/.pico-sdk`. +- Windows: install the Raspberry Pi Pico VS Code extension or the official + Windows installer; both place the toolchain under `%USERPROFILE%\.pico-sdk`. + Use PowerShell for every command below. + +Serial console to the debug UART, per host: + +```bash +# macOS +screen /dev/tty.usbmodem* 115200 +# Linux +screen /dev/ttyACM* 115200 +``` +```powershell +# Windows +putty -serial COMx -sercfg 115200,8,n,1 +``` + +--- + +## 3. Flash the Stripped Image + +Because there are no object headers, you flash the raw bytes at the flash base +explicitly. + +macOS and Linux: + +```bash +OCD=~/.pico-sdk/openocd/0.12.0+dev/openocd +SCR=~/.pico-sdk/openocd/0.12.0+dev/scripts +$OCD -s "$SCR" -f interface/cmsis-dap.cfg -f target/rp2350.cfg \ + -c "adapter speed 5000" \ + -c "program 0x0011a_cb.bin 0x10000000 verify reset exit" +``` + +Windows PowerShell: + +```powershell +$OCD = "$env:USERPROFILE\.pico-sdk\openocd\0.12.0+dev\openocd.exe" +$SCR = "$env:USERPROFILE\.pico-sdk\openocd\0.12.0+dev\scripts" +& $OCD -s "$SCR" -f interface/cmsis-dap.cfg -f target/rp2350.cfg ` + -c "adapter speed 5000" ` + -c "program 0x0011a_cb.bin 0x10000000 verify reset exit" +``` + +Expected on every host: + +``` +** Programming Started ** +** Programming Finished ** +** Verified OK ** +** Resetting Target ** +``` + +--- + +## 4. Attach GDB With No Symbols + +Start the OpenOCD GDB server in one terminal, then attach **without** an +executable in another. + +macOS and Linux: + +```bash +OCD=~/.pico-sdk/openocd/0.12.0+dev/openocd +SCR=~/.pico-sdk/openocd/0.12.0+dev/scripts +$OCD -s "$SCR" -f interface/cmsis-dap.cfg -f target/rp2350.cfg -c "adapter speed 5000" & + +GDB=~/.pico-sdk/toolchain/14_2_Rel1/bin/arm-none-eabi-gdb +$GDB -q +(gdb) target extended-remote localhost:3333 +(gdb) monitor reset halt +``` + +Windows PowerShell: + +```powershell +$OCD = "$env:USERPROFILE\.pico-sdk\openocd\0.12.0+dev\openocd.exe" +$SCR = "$env:USERPROFILE\.pico-sdk\openocd\0.12.0+dev\scripts" +Start-Process $OCD -ArgumentList @("-s","$SCR","-f","interface/cmsis-dap.cfg","-f","target/rp2350.cfg","-c","adapter speed 5000") + +$GDB = "$env:USERPROFILE\.pico-sdk\toolchain\14_2_Rel1\bin\arm-none-eabi-gdb.exe" +& $GDB -q +(gdb) target extended-remote localhost:3333 +(gdb) monitor reset halt +``` + +`bt` and `break main` are useless: there are no symbols. Every stop is an +address. This is the stripped-image reality. + +--- + +## 5. Break at the Reset Handler's Destination + +From static analysis (see the Ghidra tutorial) we know the code entry `main` +begins at `0x10000234`. Break there by address: + +```gdb +(gdb) break *0x10000234 +(gdb) continue +Thread 1 hit Breakpoint 1, 0x10000234 in ?? () + +(gdb) info registers r0 r1 r2 r3 sp lr pc xpsr +r0 0x0 0 +r1 0x10000235 268436021 +r2 0x80808080 -2139062144 +r3 0xe000ed08 -536810232 +sp 0x20082000 +lr 0x1000018f +pc 0x10000234 +xpsr 0x69000000 +``` + +Backtrace shows raw addresses only: + +``` +(gdb) bt +#0 0x10000234 in ?? () +``` + +--- + +## 6. The Decoy And The Encrypted Target (No Symbols Needed) + +The firmware carries **two** kinds of coordinate, and they are not the same kind +of thing. + +**The decoy (plaintext).** A plaintext pair sits at `0x1000A098` (lat) / +`0x1000A090` (lon): `+38.840280` / `-77.428890`. The beacon broadcasts it and a +byte scanner grabs it. It is the lie. + +``` ++-----------------------------------------------------------------+ +| DECOY WAYPOINT (PLAINTEXT, THE LIE) | ++-----------------------------------------------------------------+ +| 0x1000A098 CF BD 87 4B 8E 6B 43 40 double +38.840280 | +| 0x1000A090 36 E5 0A EF 72 5B 53 C0 double -77.428890 | ++-----------------------------------------------------------------+ +``` + +**The target (AES-encrypted).** The real waypoint is never stored as a double: + +```gdb +(gdb) x/16bx 0x10009D90 +0x10009D90: 0x56 0x45 0x43 0x54 0x4f 0x52 0x31 0x31 # "VECTOR11" +0x10009D98: 0x41 0x45 0x53 0x4b 0x45 0x59 0x21 0x21 # "AESKEY!!" +(gdb) x/2gx 0x10009DA4 +0x10009DA4: 0x7aea23c0c2ac4f20 0xcaef2311710f933a # ciphertext block +``` + +`init_navigation @ 0x10000C2C` decrypts each word with the key into RAM at +`TARGET_LAT 0x20000D00` / `TARGET_LON 0x20000D08`. Read the reconstructed truth +after boot: + +```gdb +(gdb) x/2gx 0x20000d00 +0x20000d00: 0x404370e368f08462 0xc0535cd1633482bf +``` + +Decode it: `+38.881940` / `-77.450280` (NRO HQ). The decoy says Centreville. The +target says Chantilly. Same firmware. One of them is a lie. + +## 7. Prove the Peripherals From Registers + +Break at `send_telemetry @ 0x10000C7C` (called once per acquisition tick) so +the initialisers have already run: + +```gdb +(gdb) break *0x10000c7c +(gdb) continue +Thread 1 hit Breakpoint 2, 0x10000c7c in ?? () + +(gdb) x/2xw 0x50200000 +0x50200000: 0x00000001 0x0f010e01 # PIO0_CTRL PIO0_FSTAT +(gdb) x/6xw 0x502000c8 +0x502000c8: 0x07a12000 0x0701fc00 # SM0_CLKDIV SM0_EXECCTRL +0x502000d0: 0x800c0000 0x00000018 # SM0_SHIFTCTRL SM0_ADDR +0x502000d8: 0x00002020 0x00038000 # SM0_INSTR SM0_PINCTRL +``` + +```gdb +(gdb) x/4xw 0x40078024 +0x40078024: 0x000003d0 0x00000024 0x00000070 0x00000301 # UART1 LoRa +(gdb) x/4xw 0x40070024 +0x40070024: 0x00000051 0x00000018 0x00000070 0x00000301 # UART0 debug +``` + +``` ++-----------------------------------------------------------------+ +| PIO0 SM0 CLOCK DIVIDER (RP2350 @ 150 MHz, 8 cycles/bit) | ++-----------------------------------------------------------------+ +| SM0_CLKDIV = 0x07A12000 = 1953 + 32/256 = 1953.125 | +| f_sm = 150,000,000 / 1953.125 = 76,800 Hz = 9600 x 8 | ++-----------------------------------------------------------------+ +``` + +UART baud uses `IBRD` and a 6-bit `FBRD`: + +$$baud = \frac{f_{clk}}{16 \times (IBRD + FBRD/64)}$$ + +UART1: $976 + 36/64 = 976.5625 \Rightarrow 150{,}000{,}000 / 15625 = 9600$. +UART0: $81 + 24/64 = 81.375 \Rightarrow 150{,}000{,}000 / 1302 \approx 115200$. + +--- + +## 8. Watch the NMEA Parser Prove Itself + +Static analysis identifies the parser's static index at `0x200010F4` (the +`.bss` symbol `idx.1`) and the 96-byte NMEA buffer at `0x20001044` (`buf.0`). +Watch the index: + +```gdb +(gdb) watch *(int*)0x200010f4 +(gdb) continue +Hardware watchpoint 3: *(int*)0x200010f4 +Old value = 0 +New value = 1 +0x10000458 in ?? () + +(gdb) bt +#0 0x10000458 in ?? () +#1 0x1000027c in ?? () + +(gdb) x/32cb 0x20001044 +0x20001044: 36 '$' 71 'G' 80 'P' 71 'G' 76 'L' 76 'L' ... +# => "$GPGLL,,,,,,220653.00,V,N*4A" +``` + +At reset the buffer and index are both zero; these bytes appear only after a +sentence is parsed off the wire. + +The `V` says there is **no fix yet**, not a parser bug, not a UART fault. +Only the wire can tell you that. + +--- + +## 9. The Actuators: `release_payload @ 0x10000BFC` + +The Ghidra analysis (companion tutorial) shows `release_payload` drives GP16, +GP17 and GP18 high through the RP2350 GPIO coprocessor interface. It is reached +by a `b.w` tail call from `navigate_to_target` at `0x10000D18`, so there is no +return frame; break at its entry and step the writes: + +```gdb +(gdb) break *0x10000bfc +(gdb) continue +Thread 1 hit Breakpoint 4, 0x10000bfc in ?? () + +(gdb) x/9i $pc +0x10000bfc: push {r3, lr} +0x10000bfe: movs r2, #16 +0x10000c00: mov.w r3, #1 +0x10000c04: mcrr 0, 4, r2, r3, cr0 # GPIO16 = 1 +0x10000c08: movs r2, #17 +0x10000c0a: mcrr 0, 4, r2, r3, cr0 # GPIO17 = 1 +0x10000c0e: movs r2, #18 +0x10000c10: mcrr 0, 4, r2, r3, cr0 # GPIO18 = 1 +``` + +After the three writes, the SIO register reads `0x00070000` (bits 16, 17, 18). +The RP2350 exposes GPIO through the coprocessor (`mcrr p0, #4, ...`), not a +plain store, a fact only the bench reveals. + +--- + +## 10. Reproducibility Checklist + +1. Flash `0x0011a_cb.bin` at `0x10000000`; `Verified OK`. +2. Attach GDB with **no** symbol file. +3. `break *0x10000234`; PC lands exactly there. +4. `x/4xw 0x20000d00` -> `68f08462 404370e3 633482bf c0535cd1`. +5. `x/6xw 0x502000c8` -> `SM0_CLKDIV = 0x07A12000`. +6. `watch *(int*)0x200010f4` trips only when NMEA arrives. +7. `x/9i 0x10000bfc` shows the `mcrr` GPIO coprocessor writes. + +If a single value differs, you are not on the image you think you are. That +check is the job an offline model cannot do. + +--- + +## 11. Why Buddy Fails Here + +Even a model trained on ARM cannot read `SM0_CLKDIV`, watch `idx.0`, decode +*your* randomized literal, or verify a patch by flashing it. It generates +plausible text; the bench generates truth. **Think, then verify.** + +--- + +## Appendix A. Deep GDB Step-Through + +### A.1 Start the server and attach + +macOS: + +```bash +OCD=~/.pico-sdk/openocd/0.12.0+dev/openocd +SCR=~/.pico-sdk/openocd/0.12.0+dev/scripts +$OCD -s "$SCR" -f interface/cmsis-dap.cfg -f target/rp2350.cfg -c "adapter speed 5000" +``` + +Linux: + +```bash +OCD=$HOME/.pico-sdk/openocd/0.12.0+dev/openocd +SCR=$HOME/.pico-sdk/openocd/0.12.0+dev/scripts +$OCD -s "$SCR" -f interface/cmsis-dap.cfg -f target/rp2350.cfg -c "adapter speed 5000" +``` + +Windows PowerShell: + +```powershell +$OCD = "$env:USERPROFILE\.pico-sdk\openocd\0.12.0+dev\openocd.exe" +$SCR = "$env:USERPROFILE\.pico-sdk\openocd\0.12.0+dev\scripts" +& $OCD -s "$SCR" -f interface/cmsis-dap.cfg -f target/rp2350.cfg -c "adapter speed 5000" +``` + +Then attach from GDB (identical on all hosts). There are no symbols, so break by +address, not by name: + +```gdb +target extended-remote localhost:3333 +monitor reset halt +break *0x10000234 +continue +``` + +### A.2 Read the vector table and the key material + +```gdb +x/2xw 0x10000000 # SP and reset handler +x/16bx 0x10009D90 # AES key +x/16bx 0x10009DA4 # ciphertext block +x/2gx 0x20000D00 # decrypted target after boot +``` + +### A.3 Break the AES routine + +```gdb +break *0x10000E5C +continue +x/4i $pc +stepi +stepi +``` + +`aes128_ecb_decrypt_block` runs once, early, inside `init_navigation`. + +### A.4 Watch the decoy go out + +```gdb +break *0x10000C7C +continue +info registers r0 r1 r2 r3 +``` + +`send_telemetry` is called with the decoy while the GNSS has no fix. + +### A.5 The tool trap + +On a stripped target a floating point cast can byte-swap. Trust the raw read: + +```gdb +x/1gx 0x20000D00 # then decode it yourself +``` + diff --git a/0x0011a_cb/GDB_DEBUG_TUTORIAL.pdf b/0x0011a_cb/GDB_DEBUG_TUTORIAL.pdf new file mode 100644 index 0000000..e214d9e Binary files /dev/null and b/0x0011a_cb/GDB_DEBUG_TUTORIAL.pdf differ diff --git a/0x0011a_cb/GHIDRA_REVERSING_TUTORIAL.md b/0x0011a_cb/GHIDRA_REVERSING_TUTORIAL.md new file mode 100644 index 0000000..8277213 --- /dev/null +++ b/0x0011a_cb/GHIDRA_REVERSING_TUTORIAL.md @@ -0,0 +1,525 @@ +# Ghidra Reversing Tutorial: Static Analysis of the Stripped RP2350 Image + +## 0. Cold Open + +Open the image and it will lie to you with total confidence. + +That is not a bug. That is the tool doing exactly what it was built to do: +propose. Ghidra proposes functions. It proposes boundaries. It proposes names +for things it cannot possibly know. And when it is wrong it will not tell you, +because it cannot tell the difference between a guess and a fact any better +than the machine that answered nine seconds too fast. + +A stripped binary is a wall of Thumb-2 with the labels torn off. The only way +through is patience, cross-references, and the refusal to accept a story just +because it is plausible. Ghidra is the map. It is not the territory. + +So you draw the map, then you walk the ground. You separate the two coordinate +pairs by what *references* them, not by what they look like. You find the eight +bytes that decide where a machine goes, and you prove which eight they are. + +The tool proposes. The bench disposes. + +**Think, then verify.** + +--- + +## 1. Executive Summary + +This tutorial reverses the **stripped** `0x0011a_cb.bin` with Ghidra: no +symbols, no sections, no metadata. We import the raw image, recover the code +graph, correct the boundaries Ghidra gets wrong, find the hardcoded target +waypoint, and patch it. Every output below is from the raw image at base +`0x10000000`, language `ARM:LE:32:Cortex`. + +--- + +## 2. Import the Raw Image + +The `.bin` is a raw XIP image. You must tell Ghidra where it lives and how to +decode it. + +``` ++-----------------------------------------------------------------+ +| GHIDRA IMPORT SETTINGS | ++-----------------------------------------------------------------+ +| Language : ARM:LE:32:Cortex (ARMv8-M / Cortex-M33, Thumb-2) | +| Format : Raw Binary | +| Base : 0x10000000 (RP2350 external flash / XIP) | ++-----------------------------------------------------------------+ +``` + +### 2.1 Headless (reproducible), per host + +macOS: + +```bash +GHIDRA=/Applications/ghidra_12.0.4_PUBLIC +"$GHIDRA/support/analyzeHeadless" /tmp/ghproj DarkVector \ + -import 0x0011a_cb.bin \ + -processor "ARM:LE:32:Cortex" \ + -loader BinaryLoader -loader-baseAddr 0x10000000 +``` + +Linux: + +```bash +GHIDRA=$HOME/ghidra_12.0.4_PUBLIC +"$GHIDRA/support/analyzeHeadless" /tmp/ghproj DarkVector \ + -import 0x0011a_cb.bin \ + -processor "ARM:LE:32:Cortex" \ + -loader BinaryLoader -loader-baseAddr 0x10000000 +``` + +Windows PowerShell: + +```powershell +$GHIDRA = "C:\ghidra_12.0.4_PUBLIC" +& "$GHIDRA\support\analyzeHeadless.bat" "$env:TEMP\ghproj" DarkVector ` + -import 0x0011a_cb.bin ` + -processor "ARM:LE:32:Cortex" ` + -loader BinaryLoader -loader-baseAddr 0x10000000 +``` + +### 2.2 GUI, per host + +Launch Ghidra, then **File -> Import File**, set language and base address, and +analyze: + +- macOS: `/Applications/ghidra_12.0.4_PUBLIC/ghidraRun` +- Linux: `$HOME/ghidra_12.0.4_PUBLIC/ghidraRun` +- Windows: `C:\ghidra_12.0.4_PUBLIC\ghidraRun.bat` + +--- + +## 3. Entry and the Stripped-Binary Problem + +The first two words are the ARMv8-M vector table: + +``` +0x10000000: 0x20082000 ; initial SP +0x10000004: 0x1000015D ; reset handler (Thumb) +``` + +Ghidra recovers **166 functions** from the call graph. But with no symbols it +gets some boundaries wrong, and it folds tail-call-only helpers into their +callers: `release_payload` is reached only by a `b.w` tail call from +`navigate_to_target` at `0x10000D18`, so Ghidra does not give it its own +function. It names the entry `FUN_10000234`. The disassembly is right; the +boundaries are not. Correcting them is the analyst's job, and only the bench +confirms them. + +Applying correct boundaries yields: + +| Address | Function | +|---|---| +| `0x10000234` | `main` | +| `0x10000300` | `init_gps_pio` | +| `0x1000040C` | `poll_gps` | +| `0x10000858` | `gps_get_stats` | +| `0x10000870` | `init_lora` | +| `0x10000A08` | `lora_send` | +| `0x10000A54` | `lora_tick` | +| `0x10000AC4` | `init_propeller` | +| `0x10000AF8` | `propeller_set_bearing` | +| `0x10000B34` | `propeller_stop` | +| `0x10000B64` | `init_payload` | +| `0x10000BB0` | `set_gnss_leds` | +| `0x10000BFC` | `release_payload` | +| `0x10000C2C` | `init_navigation` | +| `0x10000C7C` | `send_telemetry` | +| `0x10000CB8` | `navigate_to_target` | +| `0x10000E5C` | `aes128_ecb_decrypt_block` | +| `0x100012D4` | `init_lcd` | +| `0x1000175C` | `lcd_show_coords` | +| `0x10001B4C` | `lcd_show_gnss` | + +--- + +## 4. `main` as Ghidra Sees It (Raw Image) + +``` +void main(void) +{ + local_18 = *DAT_100002f4; // ORIGIN_LAT @ 0x1000A098 + uStack_14 = DAT_100002f4[1]; + local_10 = *DAT_100002f8; // ORIGIN_LON @ 0x1000A090 + uStack_c = DAT_100002f8[1]; + FUN_10005d98(); // stdio_init_all + FUN_10000c2c(); // init_navigation + FUN_10000b64(); // init_payload + FUN_10000870(); // init_lora + FUN_10000300(); // init_gps_pio + FUN_10000ac4(); // init_propeller + FUN_100012d4(); // init_lcd + piVar1 = DAT_100002fc; // &hold @ 0x200010F0 + do { + while( true ) { + iVar3 = 200; + bVar4 = 0; + local_20 = 0; + uStack_1c = 0; + do { + bVar2 = FUN_1000040c(&local_18,&local_10); // poll_gps + bVar4 = bVar2 | bVar4; + FUN_10000a54(); // lora_tick + FUN_10002ab8(5); // sleep_ms(5) + iVar3 = iVar3 + -1; + } while (iVar3 != 0); + FUN_10000858(&local_20,&uStack_1c); // gps_get_stats + if (bVar4 == 0) break; + *piVar1 = 3; // hold = 3 + FUN_10000bb0(1,local_20); // set_gnss_leds +LAB_100002a4: + FUN_1000175c(local_18,uStack_14,local_10,uStack_c); // lcd_show_coords + FUN_10000cb8(local_18,uStack_14,local_10,uStack_c); // navigate_to_target + } + iVar3 = *piVar1; + if (iVar3 < 1) { iVar3 = 1; } + *piVar1 = iVar3 + -1; // hold-- + if (iVar3 + -1 != 0) { + FUN_10000bb0(1,local_20); // set_gnss_leds + goto LAB_100002a4; + } + FUN_10000bb0(0,local_20); // set_gnss_leds(0,...) + FUN_10001b4c(local_20,uStack_1c); // lcd_show_gnss + FUN_10000b34(); // propeller_stop + FUN_10000c7c(local_18,uStack_14,local_10,uStack_c); // send_telemetry + } while( true ); +} +``` + +`FUN_` prefixes everywhere: this is what a stripped target really looks like. + +--- + +## 5. The Decoy And The Encrypted Target + +`navigate_to_target` no longer compares against a literal; it reads the pointers +at `DAT_10000e50` / `DAT_10000e54`, which resolve to RAM `0x20000D00` / +`0x20000D08`, **runtime doubles**. Where do they come from? `init_navigation`, +and that is the whole puzzle. + +``` +void init_navigation(void) +{ + local_28 = *DAT_10000c6c; // key @ 0x10009D90 + uStack_24 = DAT_10000c6c[1]; + uStack_20 = DAT_10000c6c[2]; + uStack_1c = DAT_10000c6c[3]; + local_18 = *DAT_10000c70; // ct @ 0x10009DA4 + uStack_14 = DAT_10000c70[1]; + uStack_10 = DAT_10000c70[2]; + uStack_c = DAT_10000c70[3]; + FUN_10000e5c(&local_18,&local_28,&local_38); // aes128_ecb_decrypt_block + *DAT_10000c74 = local_38; // TARGET_LAT -> 0x20000D00 + puVar1[1] = uStack_34; + *puVar2 = local_30; // TARGET_LON -> 0x20000D08 + puVar2[1] = uStack_2c; +} + +``` + +Three data addresses do all the work: + +| Symbol | Address | Meaning | +|---|---|---| +| `CTF_AES_KEY` | `0x10009D90` | the AES key `564543544f5231314145534b45592121` | +| `CTF_TARGET_CT` | `0x10009DA4` | the encrypted target pair | +| `TARGET_LAT/LON` | `0x20000D00` / `0x20000D08` | RAM, reconstructed at boot | + +**Reading the key bytes (Ghidra will call them code):** + +`0x10009D90` is **data**, not code. `init_navigation` copies the block into a +stack buffer and hands it to `aes128_ecb_decrypt_block`; it is never executed. +Ghidra still marks it as code because it sees the read cross-reference from +`init_navigation` (`FUN_10000c2c:10000c36(R)`) and guesses. The Listing then +shows fabricated mnemonics: + +``` +LAB_10009d90 XREF[1]: FUN_10000c2c:10000c36(R) +10009d90 56 45 cmp r6,r10 +10009d92 43 54 strb r3,[r0,r1] +10009d94 4f 52 strh r7,[r1,r1] +10009d96 31 31 adds r1,#0x31 +10009d98 41 45 cmp r1,r8 +10009d9a 53 4b ldr r3,[s_n_"%s"_failed:_file_"%s",_line = "n \"%s\" failed: file +10009d9c 45 59 ldr r5,[r0,r5] +10009d9e 21 21 movs r1,#0x21 +``` + +Those are the key bytes, not instructions. Two traps: + +1. The mnemonics are meaningless: `56 45` is `V`,`E`; `43 54` is `C`,`T`; + `4f 52` is `O`,`R`. +2. At `0x10009D9A` the halfword `53 4B` decodes as `ldr r3, [pc, #332]`, + whose literal-pool target is `0x10009EE8`. That address really does hold a + string, newlib's assert message `Assertion "%s" failed: file "%s", line + %d%s%s` at `0x10009EE0`, so Ghidra prints its label. The string is real, but + the reference is spurious: `53 4B` is `S`,`K`, bytes 10-11 of the key, and + only decodes as that `ldr` by coincidence. The same thing happens at + `0x10009DA4`, where the ciphertext byte pair `20 4F` decodes to an `ldr` + that lands on the real two-space string at `0x10009E28`. + +Read the bytes, never the mnemonics. Any of these is exact: + +```bash +xxd -s 0x9D90 -l 16 0x0011a_cb.bin # raw image, no tools +``` + +```gdb +(gdb) x/16bx 0x10009D90 # live target +``` + +In the Ghidra GUI the simplest path is **Window -> Bytes**, press **G**, enter +`0x10009D90`, and read the 16 raw bytes. To retype them in the Listing instead, +select the 16 bytes, press **`C`** (Clear Code/Data), then **`T`** (Define Data) +and choose `byte`; press **`[`** to make it an array of 16. Note that **`B`** +is **not** "define byte" in Ghidra, it is *Cycle Integer Types*, and data +cannot be defined over bytes that are still typed as code, which is why the +clear (**`C`**) must come first. +The value is the ASCII key `VECTOR11AESKEY!!`: +`56 45 43 54 4F 52 31 31 41 45 53 4B 45 59 21 21`. + +**Decrypt the target (fully offline, reproducible):** + +Step 1. The key, 16 bytes at `0x10009D90` (read them as above): + +```text +56 45 43 54 4F 52 31 31 41 45 53 4B 45 59 21 21 = "VECTOR11AESKEY!!" +hex for tools: 564543544f5231314145534b45592121 +``` + +Step 2. The ciphertext, 16 bytes at `0x10009DA4`. Read them the exact same way +(**Window -> Bytes**, press **G**, enter `0x10009DA4`): + +```text +20 4F AC C2 C0 23 EA 7A 3A 93 0F 71 11 23 EF CA +hex for tools: 204facc2c023ea7a3a930f711123efca +``` + +Step 3. AES-128-ECB decrypt the block with the key (no padding). The plaintext +is two little-endian IEEE-754 doubles, latitude then longitude. + +Python, all platforms (`cryptography` is already used by the course): + +```python +import struct +from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes + +key = bytes.fromhex("564543544f5231314145534b45592121") +ct = bytes.fromhex("204facc2c023ea7a3a930f711123efca") + +pt = Cipher(algorithms.AES(key), modes.ECB()).decryptor().update(ct) +print("plaintext:", pt.hex()) +print("lat:", struct.unpack(" Export Program...** -> Format **Binary** -> +`0x0011a_cb_patched.bin`. + +--- + +## 8. Export, Convert, Flash, Verify + +```bash +python3 uf2conv.py 0x0011a_cb_patched.bin \ + -f 0xe48bff59 -b 0x10000000 -c -o 0x0011a_cb_patched.uf2 +``` + +Hold **BOOTSEL**, copy the UF2 across, and verify against the live ground HUD. +A patch that is not flashed and confirmed is a guess. + +--- + +## 9. Randomized Builds + +Each student image embeds a unique key and waypoint, so no answer key travels: + +```bash +python3 scripts/randomize_build.py --student-id alice --seed 12345 --uf2 +[+] student_id : alice +[+] TARGET_LAT : 38.880272 +[+] TARGET_LON : -77.460077 +[+] AES key : <16 random bytes> +[+] ciphertext : +[+] image : build-ctf/0x0011a_cb_alice.uf2 +[+] answer key : /answer_alice.json (INSTRUCTOR ONLY, do not ship) +``` + +Addresses are identical; only the key and ciphertext bytes differ. + +--- + +## 10. Reproducibility Checklist + +1. Import raw `.bin`, `ARM:LE:32:Cortex`, base `0x10000000`. +2. Reset vector `[0]=0x20082000`, `[1]=0x1000015D`. +3. `main @ 0x10000234`; fix the merged boundary at `a single FUN_ function`. +4. `navigate_to_target @ 0x10000CB8` reads the pointers at `0x10000E50`/`0x10000E54`, targeting RAM `0x20000D00`/`0x20000D08`. +5. Decode to `+38.881940` / `-77.450280`. +6. Patch, export, `uf2conv`, flash, verify. + +--- + +## 11. Why Buddy Fails Here + +Ghidra itself proves the point: it *proposes* functions and boundaries, and the +analyst corrects them with cross-references and the bench. A language model +does the same, faster and wrong, with no way to confirm. It cannot validate a +boundary, cannot read the live `ldrd`, and cannot flash a patch to see the +drone re-vector. Structure is a hypothesis; silicon is the verdict. +**Think, then verify.** + +--- + +## Appendix A. Deep Ghidra Step-Through + +### A.1 Import + +Language `ARM:LE:32:Cortex`, Base Address `0x10000000`, Raw Binary. Analyze. + +### A.2 Address map + +| Address | What it is | +|---|---| +| `0x10000234` | `main` | +| `0x10000C2C` | `init_navigation`, rebuilds the target | +| `0x10000E5C` | `aes128_ecb_decrypt_block` | +| `0x10000CB8` | `navigate_to_target`, the arrival compare | +| `0x10009D90` | AES key | +| `0x10009DA4` | ciphertext | +| `0x1000A090` | decoy waypoint | + +### A.3 The S-box + +Go to `0x1000A1AC` and find the 256-byte S-box that starts `63 7C 77 7B` (the +inverse S-box, starting `52 09 6A D5`, sits at `0x1000A0AC`). Right click, +create an array of 256 bytes. + +### A.4 Recover + +Take 16 bytes at `0x10009DA4` and the key at `0x10009D90`, then run the Python +decrypt block from section 5. + +### A.5 Patch + +Overwrite the 16 bytes at `0x10009DA4` with the re-encrypted Atlantic block, +then File, Export Program, Format Binary. + +### A.6 Platform note + +Ghidra is identical on Windows, Linux, and macOS. Only the paths differ. + +| Action | macOS | Linux | Windows | +|---|---|---|---| +| GUI launch | `/Applications/ghidra_12.0.4_PUBLIC/ghidraRun` | `$HOME/ghidra_12.0.4_PUBLIC/ghidraRun` | `C:\ghidra_12.0.4_PUBLIC\ghidraRun.bat` | +| Headless | `/Applications/ghidra_12.0.4_PUBLIC/support/analyzeHeadless` | `$HOME/ghidra_12.0.4_PUBLIC/support/analyzeHeadless` | `C:\ghidra_12.0.4_PUBLIC\support\analyzeHeadless.bat` | +| Shell | `zsh` / `bash` | `bash` | PowerShell | + +See sections 2.1 and 2.2 for the full import commands. + diff --git a/0x0011a_cb/GHIDRA_REVERSING_TUTORIAL.pdf b/0x0011a_cb/GHIDRA_REVERSING_TUTORIAL.pdf new file mode 100644 index 0000000..e911521 Binary files /dev/null and b/0x0011a_cb/GHIDRA_REVERSING_TUTORIAL.pdf differ diff --git a/0x0011a_cb/include/aes.h b/0x0011a_cb/include/aes.h new file mode 100644 index 0000000..43f55a8 --- /dev/null +++ b/0x0011a_cb/include/aes.h @@ -0,0 +1,24 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// File: aes.h +// Desc: Declares AES-128-ECB single-block decryption. +// Created: 2026 + +#ifndef AES_H +#define AES_H + +#include + +/** + * @brief Decrypt one 16-byte block with AES-128-ECB. + * + * @param in 16-byte ciphertext. + * @param key 16-byte key. + * @param out 16-byte plaintext output. + * @return None. + */ +void aes128_ecb_decrypt_block(const uint8_t in[16], const uint8_t key[16], uint8_t out[16]); + +#endif // AES_H diff --git a/0x0011a_cb/include/ctf_target.h b/0x0011a_cb/include/ctf_target.h new file mode 100644 index 0000000..40899c4 --- /dev/null +++ b/0x0011a_cb/include/ctf_target.h @@ -0,0 +1,17 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// File: ctf_target.h +// Desc: AES-128-ECB key and ciphertext for the real target waypoint. +// Created: 2026 + +#ifndef CTF_TARGET_H +#define CTF_TARGET_H + +#include + +#define CTF_AES_KEY { 0x56, 0x45, 0x43, 0x54, 0x4F, 0x52, 0x31, 0x31, 0x41, 0x45, 0x53, 0x4B, 0x45, 0x59, 0x21, 0x21 } +#define CTF_TARGET_CT { 0x20, 0x4F, 0xAC, 0xC2, 0xC0, 0x23, 0xEA, 0x7A, 0x3A, 0x93, 0x0F, 0x71, 0x11, 0x23, 0xEF, 0xCA } + +#endif // CTF_TARGET_H diff --git a/0x0011a_cb/include/gps.h b/0x0011a_cb/include/gps.h new file mode 100644 index 0000000..7a02193 --- /dev/null +++ b/0x0011a_cb/include/gps.h @@ -0,0 +1,67 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: gps.h +// Desc: Declares PIO UART GPS receiver interface and NMEA parsing logic. +// Created: 2026 + +#ifndef GPS_H +#define GPS_H + +#include +#include "hardware/pio.h" + +#define GPS_PIN 7 +#define GPS_BAUD 9600 +#define GPS_PIO pio0 +#define GPS_SM 0 + +/** + * @brief Initialize PIO UART receiver on GPIO7 for u-blox NEO-6M GPS. + * + * @param None. + * @return None. + */ +void init_gps_pio(void); + +/** + * @brief Poll PIO RX FIFO and parse incoming NMEA GPS coordinates. + * + * @param lat Pointer to double storing updated latitude. + * @param lon Pointer to double storing updated longitude. + * @return bool True if a valid active 3D GPS fix (RMC 'A') was received, false otherwise. + */ +bool poll_gps(double *lat, double *lon); + +/** + * @brief Read latest GNSS signal statistics parsed from GSV sentences. + * + * @param siv Pointer to store satellites-in-view count. + * @param cno Pointer to store best carrier-to-noise ratio in dBHz. + * @return None. + */ +void gps_get_stats(int *siv, int *cno); + +#endif // GPS_H diff --git a/0x0011a_cb/include/lcd.h b/0x0011a_cb/include/lcd.h new file mode 100644 index 0000000..417cfd0 --- /dev/null +++ b/0x0011a_cb/include/lcd.h @@ -0,0 +1,74 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: lcd.h +// Desc: Declares I2C HD44780 (16x2) LCD interface for telemetry coordinates. +// Created: 2026 + +#ifndef LCD_H +#define LCD_H + +#include +#include +#include "hardware/i2c.h" + +#define LCD_I2C_INST i2c1 +#define LCD_SDA_PIN 2 +#define LCD_SCL_PIN 3 +#define LCD_BAUD 100000 + +/** + * @brief Initialize I2C0 peripheral and detect/configure 1602 LCD backpack. + * + * @param None. + * @return None. + */ +void init_lcd(void); + +/** + * @brief Render current latitude and longitude on the 16x2 character display. + * + * Row 0: LAT: dd.dddddd N + * Row 1: LON: dd.dddddd W + * + * @param lat Current latitude in decimal degrees. + * @param lon Current longitude in decimal degrees. + * @return None. + */ +void lcd_show_coords(double lat, double lon); + +/** + * @brief Render GNSS acquisition telemetry (satellites and C/N0) on the LCD. + * + * Row 0: SAT: nn CNO: nn + * Row 1: ACQUIRING... when satellites are in view, else NO SIGNAL + * + * @param sats Number of satellites currently in view. + * @param cno Best carrier-to-noise ratio in dBHz. + * @return None. + */ +void lcd_show_gnss(int sats, int cno); + +#endif // LCD_H diff --git a/0x0011a_cb/include/lora.h b/0x0011a_cb/include/lora.h new file mode 100644 index 0000000..dc037a5 --- /dev/null +++ b/0x0011a_cb/include/lora.h @@ -0,0 +1,64 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: lora.h +// Desc: Declares UART1 interface for the REYAX RYLR998 LoRa transceiver. +// Created: 2026 + +#ifndef LORA_H +#define LORA_H + +#include "hardware/uart.h" + +#define LORA_UART uart1 +#define LORA_BAUD 9600 +#define LORA_TX_PIN 8 +#define LORA_RX_PIN 9 + +/** + * @brief Initialize LoRa transceiver over UART1 on GPIO8 and GPIO9 + * + * @param None. + * @return None. + */ +void init_lora(void); + +/** + * @brief Transmit string message over LoRa UART1 interface + * + * @param msg Null-terminated string buffer to transmit. + * @return None. + */ +void lora_send(const char *msg); + +/** + * @brief Service the LoRa UART: stream pending TX bytes and drain RX. + * + * @param None. + * @return None. + */ +void lora_tick(void); + +#endif // LORA_H diff --git a/0x0011a_cb/include/navigation.h b/0x0011a_cb/include/navigation.h new file mode 100644 index 0000000..676335c --- /dev/null +++ b/0x0011a_cb/include/navigation.h @@ -0,0 +1,87 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: navigation.h +// Desc: Declares autonomous guidance, dead-reckoning, and telemetry interface. +// Created: 2026 + +#ifndef NAVIGATION_H +#define NAVIGATION_H + +#include + +/** @brief Pre-programmed programmed decoy waypoint (Centreville, VA). */ +extern const double ORIGIN_LAT; +extern const double ORIGIN_LON; + +/** @brief Target coordinates, reconstructed at boot from masked constants. */ +extern double TARGET_LAT; +extern double TARGET_LON; + +/** + * @brief Reconstruct the target waypoint from its XOR-masked constants. + * + * @param None. + * @return None. + */ +void init_navigation(void); + +/** + * @brief Transmit telemetry stream over Debug UART0 and LoRa UART1. + * + * @param cur_lat Current micro-UAV latitude. + * @param cur_lon Current micro-UAV longitude. + * @return None. + */ +void send_telemetry(double cur_lat, double cur_lon); + +/** + * @brief Advance dead-reckoning position toward programmed waypoint. + * + * @param cur_lat Pointer to current latitude. + * @param cur_lon Pointer to current longitude. + * @return None. + */ +void dead_reckon_step(double *cur_lat, double *cur_lon); + +/** + * @brief Verify if micro-UAV has arrived at target coordinates. + * + * @param cur_lat Current latitude coordinate. + * @param cur_lon Current longitude coordinate. + * @return true if arrived at target, false otherwise. + */ +bool check_arrival(double cur_lat, double cur_lon); + +/** + * @brief Manage guidance progression, propeller oscillation, and payload release. + * + * @param cur_lat Current latitude coordinate. + * @param cur_lon Current longitude coordinate. + * @return None. + */ +void navigate_to_target(double cur_lat, double cur_lon); + +#endif // NAVIGATION_H diff --git a/0x0011a_cb/include/payload.h b/0x0011a_cb/include/payload.h new file mode 100644 index 0000000..14147fa --- /dev/null +++ b/0x0011a_cb/include/payload.h @@ -0,0 +1,68 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: payload.h +// Desc: Declares payload release mechanism interface on GPIO16. +// Created: 2026 + +#ifndef PAYLOAD_H +#define PAYLOAD_H + +#include + +#define LED_RED_PIN 16 +#define LED_GREEN_PIN 17 +#define LED_YELLOW_PIN 18 + +/** + * @brief Initialize GPIO16 (Red failure LED) and GPIO17 (Green success LED). + * + * @param None. + * @return None. + */ +void init_payload(void); + +/** + * @brief Update tri-color GNSS status LEDs from fix state and satellites. + * + * Red (GP16) = no satellites in view; Yellow (GP18) = satellites in view + * while acquiring; Green (GP17) = active 3D fix. + * + * @param fix True if an active 3D GPS fix is held. + * @param siv Number of satellites currently in view. + * @return None. + */ +void set_gnss_leds(bool fix, int siv); + +/** + * @brief Energize payload latch and illuminate both LEDs at target coordinates. + * + * @param None. + * @return None. + */ +void release_payload(void); + +#endif // PAYLOAD_H + diff --git a/0x0011a_cb/include/propeller.h b/0x0011a_cb/include/propeller.h new file mode 100644 index 0000000..6e90516 --- /dev/null +++ b/0x0011a_cb/include/propeller.h @@ -0,0 +1,67 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: propeller.h +// Desc: Declares SG90 servo PWM mock propeller interface on GPIO6. +// Created: 2026 + +#ifndef PROPELLER_H +#define PROPELLER_H + +#define PROPELLER_PIN 6 + +/** + * @brief Initialize 50 Hz PWM on GPIO6 for SG90 mock propeller blade. + * + * @param None. + * @return None. + */ +void init_propeller(void); + +/** + * @brief Advance mock propeller blade oscillation during flight. + * + * @param None. + * @return None. + */ +void propeller_spin(void); + +/** + * @brief Halt mock propeller blade oscillation upon target arrival. + * + * @param None. + * @return None. + */ +void propeller_stop(void); + +/** + * @brief Point the servo at the compass bearing toward the target. + * + * @param deg Bearing in degrees from the current position to the target. + * @return None. + */ +void propeller_set_bearing(double deg); + +#endif // PROPELLER_H diff --git a/0x0011a_cb/pico_sdk_import.cmake b/0x0011a_cb/pico_sdk_import.cmake new file mode 100644 index 0000000..d493cc2 --- /dev/null +++ b/0x0011a_cb/pico_sdk_import.cmake @@ -0,0 +1,121 @@ +# This is a copy of /external/pico_sdk_import.cmake + +# This can be dropped into an external project to help locate this SDK +# It should be include()ed prior to project() + +# Copyright 2020 (c) 2020 Raspberry Pi (Trading) Ltd. +# +# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the +# following conditions are met: +# +# 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following +# disclaimer. +# +# 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided with the distribution. +# +# 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products +# derived from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, +# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +if (DEFINED ENV{PICO_SDK_PATH} AND (NOT PICO_SDK_PATH)) + set(PICO_SDK_PATH $ENV{PICO_SDK_PATH}) + message("Using PICO_SDK_PATH from environment ('${PICO_SDK_PATH}')") +endif () + +if (DEFINED ENV{PICO_SDK_FETCH_FROM_GIT} AND (NOT PICO_SDK_FETCH_FROM_GIT)) + set(PICO_SDK_FETCH_FROM_GIT $ENV{PICO_SDK_FETCH_FROM_GIT}) + message("Using PICO_SDK_FETCH_FROM_GIT from environment ('${PICO_SDK_FETCH_FROM_GIT}')") +endif () + +if (DEFINED ENV{PICO_SDK_FETCH_FROM_GIT_PATH} AND (NOT PICO_SDK_FETCH_FROM_GIT_PATH)) + set(PICO_SDK_FETCH_FROM_GIT_PATH $ENV{PICO_SDK_FETCH_FROM_GIT_PATH}) + message("Using PICO_SDK_FETCH_FROM_GIT_PATH from environment ('${PICO_SDK_FETCH_FROM_GIT_PATH}')") +endif () + +if (DEFINED ENV{PICO_SDK_FETCH_FROM_GIT_TAG} AND (NOT PICO_SDK_FETCH_FROM_GIT_TAG)) + set(PICO_SDK_FETCH_FROM_GIT_TAG $ENV{PICO_SDK_FETCH_FROM_GIT_TAG}) + message("Using PICO_SDK_FETCH_FROM_GIT_TAG from environment ('${PICO_SDK_FETCH_FROM_GIT_TAG}')") +endif () + +if (PICO_SDK_FETCH_FROM_GIT AND NOT PICO_SDK_FETCH_FROM_GIT_TAG) + set(PICO_SDK_FETCH_FROM_GIT_TAG "master") + message("Using master as default value for PICO_SDK_FETCH_FROM_GIT_TAG") +endif() + +set(PICO_SDK_PATH "${PICO_SDK_PATH}" CACHE PATH "Path to the Raspberry Pi Pico SDK") +set(PICO_SDK_FETCH_FROM_GIT "${PICO_SDK_FETCH_FROM_GIT}" CACHE BOOL "Set to ON to fetch copy of SDK from git if not otherwise locatable") +set(PICO_SDK_FETCH_FROM_GIT_PATH "${PICO_SDK_FETCH_FROM_GIT_PATH}" CACHE FILEPATH "location to download SDK") +set(PICO_SDK_FETCH_FROM_GIT_TAG "${PICO_SDK_FETCH_FROM_GIT_TAG}" CACHE FILEPATH "release tag for SDK") + +if (NOT PICO_SDK_PATH) + if (PICO_SDK_FETCH_FROM_GIT) + include(FetchContent) + set(FETCHCONTENT_BASE_DIR_SAVE ${FETCHCONTENT_BASE_DIR}) + if (PICO_SDK_FETCH_FROM_GIT_PATH) + get_filename_component(FETCHCONTENT_BASE_DIR "${PICO_SDK_FETCH_FROM_GIT_PATH}" REALPATH BASE_DIR "${CMAKE_SOURCE_DIR}") + endif () + FetchContent_Declare( + pico_sdk + GIT_REPOSITORY https://github.com/raspberrypi/pico-sdk + GIT_TAG ${PICO_SDK_FETCH_FROM_GIT_TAG} + ) + + if (NOT pico_sdk) + message("Downloading Raspberry Pi Pico SDK") + # GIT_SUBMODULES_RECURSE was added in 3.17 + if (${CMAKE_VERSION} VERSION_GREATER_EQUAL "3.17.0") + FetchContent_Populate( + pico_sdk + QUIET + GIT_REPOSITORY https://github.com/raspberrypi/pico-sdk + GIT_TAG ${PICO_SDK_FETCH_FROM_GIT_TAG} + GIT_SUBMODULES_RECURSE FALSE + + SOURCE_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-src + BINARY_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-build + SUBBUILD_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-subbuild + ) + else () + FetchContent_Populate( + pico_sdk + QUIET + GIT_REPOSITORY https://github.com/raspberrypi/pico-sdk + GIT_TAG ${PICO_SDK_FETCH_FROM_GIT_TAG} + + SOURCE_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-src + BINARY_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-build + SUBBUILD_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-subbuild + ) + endif () + + set(PICO_SDK_PATH ${pico_sdk_SOURCE_DIR}) + endif () + set(FETCHCONTENT_BASE_DIR ${FETCHCONTENT_BASE_DIR_SAVE}) + else () + message(FATAL_ERROR + "SDK location was not specified. Please set PICO_SDK_PATH or set PICO_SDK_FETCH_FROM_GIT to on to fetch from git." + ) + endif () +endif () + +get_filename_component(PICO_SDK_PATH "${PICO_SDK_PATH}" REALPATH BASE_DIR "${CMAKE_BINARY_DIR}") +if (NOT EXISTS ${PICO_SDK_PATH}) + message(FATAL_ERROR "Directory '${PICO_SDK_PATH}' not found") +endif () + +set(PICO_SDK_INIT_CMAKE_FILE ${PICO_SDK_PATH}/pico_sdk_init.cmake) +if (NOT EXISTS ${PICO_SDK_INIT_CMAKE_FILE}) + message(FATAL_ERROR "Directory '${PICO_SDK_PATH}' does not appear to contain the Raspberry Pi Pico SDK") +endif () + +set(PICO_SDK_PATH ${PICO_SDK_PATH} CACHE PATH "Path to the Raspberry Pi Pico SDK" FORCE) + +include(${PICO_SDK_INIT_CMAKE_FILE}) diff --git a/0x0011a_cb/scripts/decode_coordinates.py b/0x0011a_cb/scripts/decode_coordinates.py new file mode 100644 index 0000000..2ea6444 --- /dev/null +++ b/0x0011a_cb/scripts/decode_coordinates.py @@ -0,0 +1,411 @@ +#!/usr/bin/env python3 +# MIT License +# +# Copyright (c) 2026 Kevin Thomas +# +# Permission is hereby granted, free of charge, to any person obtaining a copy +# of this software and associated documentation files (the "Software"), to deal +# in the Software without restriction, including without limitation the rights +# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +# copies of the Software, and to permit persons to whom the Software is +# furnished to do so, subject to the following conditions: +# +# The above copyright notice and this permission notice shall be included in all +# copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +# SOFTWARE. +# +# Author: Kevin Thomas +# Email: kevin@mytechnotalent.com +# GitHub: https://github.com/mytechnotalent +# File: decode_coordinates.py +# Desc: Decode and patch RP2350 micro-UAV navigation coordinates. +# Created: 2026 + +""" +Decode and patch RP2350 micro-UAV navigation coordinates. + +Analyzes raw firmware images for IEEE 754 64-bit double-precision floating +point coordinates. Scans target flight vectors and patches binaries with +safe disposal coordinates in the Atlantic Ocean. +""" + +import math +import struct +import sys +from pathlib import Path + +FLASH_BASE = 0x10000000 +ORIGIN_LAT = 38.840280 +ORIGIN_LON = -77.428890 +ATLANTIC_LAT = 37.000000 +ATLANTIC_LON = -74.000000 + + +def _haversine_calc(phi1: float, phi2: float, + dphi: float, dlam: float) -> float: + """ + Compute central angle using haversine formula. + + Parameters + ---------- + phi1 : float + Origin latitude in radians. + phi2 : float + Target latitude in radians. + dphi : float + Latitude difference in radians. + dlam : float + Longitude difference in radians. + + Returns + ------- + float + Central angular distance in radians. + """ + s_phi = math.sin(dphi / 2.0) ** 2 + s_lam = math.sin(dlam / 2.0) ** 2 + a = s_phi + math.cos(phi1) * math.cos(phi2) * s_lam + return 2.0 * math.atan2(math.sqrt(a), math.sqrt(1.0 - a)) + + +def haversine(lat1: float, lon1: float, + lat2: float, lon2: float) -> tuple[float, float]: + """ + Compute Great-Circle distance and azimuth bearing. + + Parameters + ---------- + lat1 : float + Origin latitude in degrees. + lon1 : float + Origin longitude in degrees. + lat2 : float + Destination latitude in degrees. + lon2 : float + Destination longitude in degrees. + + Returns + ------- + tuple[float, float] + Distance in statute miles and bearing in degrees. + """ + p1, p2 = math.radians(lat1), math.radians(lat2) + dl = math.radians(lon2 - lon1) + dist = 6371.0 * _haversine_calc(p1, p2, math.radians(lat2 - lat1), dl) + y = math.sin(dl) * math.cos(p2) + term = math.sin(p1) * math.cos(p2) * math.cos(dl) + x = math.cos(p1) * math.sin(p2) - term + bearing = (math.degrees(math.atan2(y, x)) + 360.0) % 360.0 + return dist * 0.621371, bearing + + +def _is_coord(val: float) -> bool: + """ + Verify if float falls within target geographic bounds. + + Parameters + ---------- + val : float + Candidate double-precision value. + + Returns + ------- + bool + True if value is a valid latitude or longitude. + """ + if math.isnan(val) or math.isinf(val): + return False + in_lat = 35.0 <= val <= 41.0 + in_lon = -79.0 <= val <= -72.0 + return in_lat or in_lon + + +def _parse_chunk(data: bytes, off: int) -> dict | None: + """ + Extract and validate one 8-byte candidate float. + + Parameters + ---------- + data : bytes + Firmware image buffer. + off : int + Byte offset inside image buffer. + + Returns + ------- + dict | None + Parsed coordinate record or None. + """ + chunk = data[off:off + 8] + val = struct.unpack(" 0.0 else "LONGITUDE" + return {"off": off, "addr": FLASH_BASE + off, "val": val, + "hex": hex_str, "u64": u64, "kind": kind} + + +def scan_coordinates(data: bytes) -> list[dict]: + """ + Scan firmware buffer for double-precision coordinates. + + Parameters + ---------- + data : bytes + Firmware image buffer. + + Returns + ------- + list[dict] + List of candidate coordinate records. + """ + found = [] + limit = len(data) - 8 + for off in range(0, limit, 4): + item = _parse_chunk(data, off) + if item is not None: + found.append(item) + return found + + +def _print_banner(path: Path) -> None: + """ + Print operation heading and recovery origin. + + Parameters + ---------- + path : pathlib.Path + Target firmware path. + + Returns + ------- + None + """ + print("=" * 67) + print(" OPERATION DARK VECTOR // FORENSIC COORDINATE TOOL") + print(" GMU Rapid Hardware Exploitation Laboratory - Fairfax, VA") + print("=" * 67) + print(f"[*] Target Binary: {path.name} ({path.stat().st_size:,} bytes)") + print(f"[*] Recovery Origin: Centreville, VA " + f"({ORIGIN_LAT:.6f}, {ORIGIN_LON:.6f})") + print("-" * 67) + + +def _print_candidate(c: dict) -> None: + """ + Print formatted candidate coordinate entry. + + Parameters + ---------- + c : dict + Candidate coordinate record. + + Returns + ------- + None + """ + print(f" [{c['kind']:9s}] Value: {c['val']:12.6f} | " + f"Addr: 0x{c['addr']:08x} (Offset: 0x{c['off']:04x})") + print(f" Hex: {c['hex']} | uint64: 0x{c['u64']:016x}") + + +def _cardinal_bearing(brg: float) -> str: + """Return compass direction string for given bearing.""" + dirs = ["N", "NNE", "NE", "ENE", "E", "ESE", "SE", "SSE", + "S", "SSW", "SW", "WSW", "W", "WNW", "NW", "NNW"] + idx = int((brg + 11.25) / 22.5) % 16 + return dirs[idx] + + +def _print_summary(lat: float, lon: float, mi: float, brg: float) -> None: + """ + Print mission tactical assessment summary. + + Parameters + ---------- + lat : float + Decoded target latitude. + lon : float + Decoded target longitude. + mi : float + Distance in statute miles. + brg : float + Initial bearing in degrees. + + Returns + ------- + None + """ + card = _cardinal_bearing(brg) + print("\n" + "=" * 67) + print(" TACTICAL MISSION PROFILE DECODED") + print("=" * 67) + print(f" Target Latitude: {lat:.6f} deg N") + print(f" Target Longitude: {lon:.6f} deg W") + print(f" Distance from Origin: {mi:.2f} miles ({mi * 1.60934:.2f} km)") + print(f" Flight Vector Bearing: {brg:.1f} deg ({card})") + print("=" * 67) + + +def _patch_bytes(data: bytes, old_lat: float, old_lon: float) -> bytes: + """ + Replace target coordinates with safe Atlantic Ocean coordinates. + + Parameters + ---------- + data : bytes + Original firmware bytes. + old_lat : float + Original target latitude. + old_lon : float + Original target longitude. + + Returns + ------- + bytes + Patched firmware byte buffer. + """ + src_lat = struct.pack(" None: + """ + Display confirmation of applied firmware patch. + + Parameters + ---------- + out_name : str + Patched output file name. + mi : float + Distance to safe disposal zone. + brg : float + Azimuth bearing to disposal zone. + + Returns + ------- + None + """ + print(f"\n[+] Patched firmware written to: {out_name}") + print("[+] Overwrote waypoint -> Atlantic Ocean Disposal Zone:") + print(f" Safe Latitude: {ATLANTIC_LAT:.6f} deg N") + print(f" Safe Longitude: {ATLANTIC_LON:.6f} deg W") + print(f" Offshore Distance: {mi:.2f} miles (Bearing: {brg:.1f} deg)") + + +def patch_firmware(target: Path, out_path: Path, + lat: float, lon: float) -> None: + """ + Patch firmware with safe Atlantic Ocean disposal waypoint. + + Parameters + ---------- + target : pathlib.Path + Source binary path. + out_path : pathlib.Path + Destination patched binary path. + lat : float + Current target latitude. + lon : float + Current target longitude. + + Returns + ------- + None + """ + raw = target.read_bytes() + patched = _patch_bytes(raw, lat, lon) + out_path.write_bytes(patched) + mi, brg = haversine(ORIGIN_LAT, ORIGIN_LON, ATLANTIC_LAT, ATLANTIC_LON) + _print_patch_info(out_path.name, mi, brg) + + +def _evaluate(items: list[dict], target: Path, do_patch: bool) -> None: + """ + Display results and execute patch if requested. + + Parameters + ---------- + items : list[dict] + Found coordinate records. + target : pathlib.Path + Target binary path. + do_patch : bool + Flag indicating if patch should be applied. + + Returns + ------- + None + """ + lats = [c for c in items if c["kind"] == "LATITUDE"] + lons = [c for c in items if c["kind"] == "LONGITUDE"] + if not (lats and lons): + return + t_lat, t_lon = lats[-1]["val"], lons[-1]["val"] + mi, brg = haversine(ORIGIN_LAT, ORIGIN_LON, t_lat, t_lon) + _print_summary(t_lat, t_lon, mi, brg) + if do_patch: + out = target.parent / f"{target.stem}_patched.bin" + patch_firmware(target, out, t_lat, t_lon) + + +def _parse_args(args: list[str]) -> tuple[Path, bool]: + """ + Parse command line arguments for target path and patch flag. + + Parameters + ---------- + args : list[str] + Command line arguments. + + Returns + ------- + tuple[pathlib.Path, bool] + Target binary path and patch flag. + """ + do_patch = "--patch" in args + paths = [p for p in args if not p.startswith("--")] + target = Path(paths[0]) if paths else Path("0x0011a_cb.bin") + return target, do_patch + + +def main() -> int: + """ + Execute firmware coordinate extraction and optional patching. + + Parameters + ---------- + None + + Returns + ------- + int + Zero on success, non-zero on failure. + """ + target, do_patch = _parse_args(sys.argv[1:]) + if not target.exists(): + print(f"[-] Error: '{target}' not found.") + return 1 + _print_banner(target) + items = scan_coordinates(target.read_bytes()) + for item in items: + _print_candidate(item) + _evaluate(items, target, do_patch) + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/0x0011a_cb/scripts/float_hex_converter.py b/0x0011a_cb/scripts/float_hex_converter.py new file mode 100644 index 0000000..e2241e9 --- /dev/null +++ b/0x0011a_cb/scripts/float_hex_converter.py @@ -0,0 +1,202 @@ +#!/usr/bin/env python3 +# MIT License +# +# Copyright (c) 2026 Kevin Thomas +# +# Permission is hereby granted, free of charge, to any person obtaining a copy +# of this software and associated documentation files (the "Software"), to deal +# in the Software without restriction, including without limitation the rights +# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +# copies of the Software, and to permit persons to whom the Software is +# furnished to do so, subject to the following conditions: +# +# The above copyright notice and this permission notice shall be included in all +# copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +# SOFTWARE. +# +# Author: Kevin Thomas +# Email: kevin@mytechnotalent.com +# GitHub: https://github.com/mytechnotalent +# File: float_hex_converter.py +# Desc: Convert and explain IEEE 754 float/hex operations step-by-step. +# Created: 2026 + +"""Convert and explain IEEE 754 float/hex operations step-by-step.""" + +import argparse +import struct +import sys + + +def _exp_str(e_val: int, bias: int, is_64: bool) -> str: + """ + Get accurate true exponent string accounting for IEEE 754 edge cases. + + Parameters + ---------- + e_val : int + The stored exponent value. + bias : int + The exponent bias (127 or 1023). + is_64 : bool + True if 64-bit precision. + + Returns + ------- + str + The formatted true exponent explanation string. + """ + if e_val == 0: + return f"0 (Zero/Subnormal, True Exp: {1 - bias})" + if e_val == (2047 if is_64 else 255): + return f"{e_val} (Inf/NaN flag)" + return f"{e_val} - {bias} = {e_val - bias}" + + +def _print_encode_steps(val: float, b: int) -> None: + """ + Print the math steps for encoding a float to hex. + + Parameters + ---------- + val : float + The float value to encode. + b : int + The bit size (32 or 64). + + Returns + ------- + None + """ + f1, f2, bias = (" None: + """ + Print the math steps for decoding a hex string to float. + + Parameters + ---------- + hex_str : str + The hex string to decode. + + Returns + ------- + None + """ + c = hex_str.lower() + if c.startswith("0x"): + c = c[2:] + b, f1, f2, bias = (64, " 8 else (32, " bool: + """ + Check if a string is a hexadecimal representation. + + Parameters + ---------- + s : str + Candidate string, with or without a 0x prefix. + + Returns + ------- + bool + True if every character is a hexadecimal digit. + """ + cleaned = s.lower() + if cleaned.startswith("0x"): + cleaned = cleaned[2:] + if not cleaned: + return False + return all(c in "0123456789abcdef" for c in cleaned) + + +def _process_conversion(val_str: str) -> None: + """ + Execute the conversion and print the output. + + Parameters + ---------- + val_str : str + The raw input string to process. + + Returns + ------- + None + """ + cleaned = val_str.strip() + if cleaned.lower().startswith("0x") or (len(cleaned) >= 8 and _is_hex(cleaned)): + _print_decode_steps(cleaned) + else: + val = float(cleaned) + _print_encode_steps(val, 32) + _print_encode_steps(val, 64) + + +def main() -> int: + """ + Execute the conversion pipeline based on CLI arguments. + + Parameters + ---------- + None + + Returns + ------- + int + Zero on successful conversion, otherwise non-zero. + """ + parser = argparse.ArgumentParser(description="Float/Hex step converter.") + parser.add_argument("val", help="Hex (0x...) or Float value to convert.") + args = parser.parse_args() + try: + _process_conversion(args.val) + return 0 + except Exception as e: + print(f"Error: {e}", file=sys.stderr) + return 1 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/0x0011a_cb/scripts/lora_console.py b/0x0011a_cb/scripts/lora_console.py new file mode 100755 index 0000000..d4d08f4 --- /dev/null +++ b/0x0011a_cb/scripts/lora_console.py @@ -0,0 +1,135 @@ +#!/usr/bin/env python3 +# MIT License +# +# Copyright (c) 2026 Kevin Thomas +# +# Permission is hereby granted, free of charge, to any person obtaining a copy +# of this software and associated documentation files (the "Software"), to deal +# in the Software without restriction, including without limitation the rights +# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +# copies of the Software, and to permit persons to whom the Software is +# furnished to do so, subject to the following conditions: +# +# The above copyright notice and this permission notice shall be included in all +# copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +# SOFTWARE. +# +# Author: Kevin Thomas +# Email: kevin@mytechnotalent.com +# GitHub: https://github.com/mytechnotalent +# File: lora_console.py +# Desc: Interactive REYAX RYLR998 terminal for the FT232RL ground station. +# Created: 2026 + +""" +Interactive LoRa terminal for the REYAX RYLR998 ground station. + +Sends AT commands as complete bursts terminated with a carriage return and line +feed to avoid the RYLR998 inter-character timeout error, and prints incoming +packets from the airborne node as they arrive. +""" + +import argparse +import sys +import threading +import time + +try: + import serial +except ImportError: + serial = None + + +def _reader_thread(ser: "serial.Serial") -> None: + """ + Continuously read and display incoming packets from the radio. + + Parameters + ---------- + ser : serial.Serial + Open serial connection to the ground RYLR998. + + Returns + ------- + None + """ + while True: + try: + line = ser.readline().decode("utf-8", errors="ignore").strip() + if line: + print(f"\n[LORA RX] {line}\n> ", end="", flush=True) + except Exception: + break + + +def _parse_args() -> argparse.Namespace: + """ + Parse command line arguments for the LoRa console. + + Parameters + ---------- + None + + Returns + ------- + argparse.Namespace + Parsed arguments with the serial port and baud rate. + """ + parser = argparse.ArgumentParser(description="REYAX RYLR998 console") + parser.add_argument("--port", default="/dev/cu.usbserial-A50285BI") + parser.add_argument("--baud", type=int, default=115200) + return parser.parse_args() + + +def main() -> None: + """ + Open the ground station radio and forward operator input. + + Parameters + ---------- + None + + Returns + ------- + None + """ + if serial is None: + sys.exit("pyserial required: pip install pyserial") + args = _parse_args() + + print(f"[*] Opening REYAX RYLR998 on {args.port} @ {args.baud}...") + try: + ser = serial.Serial(args.port, args.baud, timeout=0.5) + except Exception as e: + sys.exit(f"[-] Failed to open {args.port}: {e}") + + thread = threading.Thread(target=_reader_thread, args=(ser,), daemon=True) + thread.start() + + time.sleep(0.1) + ser.write(b"AT\r\n") + + print("[+] Connected. Type AT commands (e.g. AT, AT+BAND?, AT+NETWORKID?).") + print("[+] Incoming airborne packets print as [LORA RX] +RCV=...") + print("[+] Press Ctrl-C or Ctrl-D to exit.\n") + + try: + while True: + cmd = input("> ").strip() + if not cmd: + continue + ser.write(cmd.encode("utf-8") + b"\r\n") + except (KeyboardInterrupt, EOFError): + print("\n[*] Exiting LoRa console.") + ser.close() + + +if __name__ == "__main__": + main() diff --git a/0x0011a_cb/scripts/randomize_build.py b/0x0011a_cb/scripts/randomize_build.py new file mode 100644 index 0000000..fbed24b --- /dev/null +++ b/0x0011a_cb/scripts/randomize_build.py @@ -0,0 +1,234 @@ +#!/usr/bin/env python3 +# MIT License +# +# Copyright (c) 2026 Kevin Thomas +# +# Permission is hereby granted, free of charge, to any person obtaining a copy +# of this software and associated documentation files (the "Software"), to deal +# in the Software without restriction, including without limitation the rights +# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +# copies of the Software, and to permit persons to whom the Software is +# furnished to do so, subject to the following conditions: +# +# The above copyright notice and this permission notice shall be included in all +# copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +# SOFTWARE. +# +# Author: Kevin Thomas +# Email: kevin@mytechnotalent.com +# GitHub: https://github.com/mytechnotalent +# File: randomize_build.py +# Desc: Builds a per-student 0x0011a_cb image with an AES-encrypted target. +# Created: 2026 + +""" +Per-student randomized CTF build. + +Jitters the target waypoint, AES-128-ECB encrypts it under a per-build key, and +writes include/ctf_target.h so the firmware rebuilds it at boot. Every image +carries a different ciphertext and the plaintext target exists nowhere in flash. +An offline answer key or a memorized value is useless; the waypoint can only be +recovered from the artifact and confirmed on hardware. +""" + +import argparse +import json +import pathlib +import random +import struct +import subprocess +import sys + +BASE_LAT = 38.881940 +BASE_LON = -77.450280 +JITTER_DEG = 0.01 +UF2_FAMILY = "0xe48bff59" +FLASH_BASE = "0x10000000" + + +def _parse_args() -> argparse.Namespace: + """ + Parse command line arguments for the randomized build. + + Parameters + ---------- + None + + Returns + ------- + argparse.Namespace + Parsed arguments with seed, build dir, student id, and uf2 flag. + """ + here = pathlib.Path(__file__).resolve().parent + parser = argparse.ArgumentParser(description="Randomized CTF build") + parser.add_argument("--seed", type=int, default=None) + parser.add_argument("--build-dir", default=str(here.parent / "build-ctf")) + parser.add_argument("--student-id", default="student") + parser.add_argument("--uf2", action="store_true") + return parser.parse_args() + + +def _make_target(seed: int) -> tuple[float, float]: + """ + Generate a jittered target waypoint around the base coordinates. + + Parameters + ---------- + seed : int + Deterministic seed for the jitter. + + Returns + ------- + tuple[float, float] + Jittered latitude and longitude, rounded to six decimals. + """ + rng = random.Random(seed) + lat = round(BASE_LAT + rng.uniform(-JITTER_DEG, JITTER_DEG), 6) + lon = round(BASE_LON + rng.uniform(-JITTER_DEG, JITTER_DEG), 6) + return lat, lon + + +def _make_key(seed: int) -> bytes: + """ + Derive a deterministic 16-byte AES key for the build. + + Parameters + ---------- + seed : int + Build seed from which the key is derived. + + Returns + ------- + bytes + Sixteen byte AES-128 key. + """ + krng = random.Random(seed ^ 0x5EED) + return bytes(krng.randrange(256) for _ in range(16)) + + +def _aes_ecb(plain: bytes, key: bytes) -> bytes: + """ + Encrypt one block with AES-128-ECB. + + Parameters + ---------- + plain : bytes + Sixteen byte plaintext block. + key : bytes + Sixteen byte AES key. + + Returns + ------- + bytes + Sixteen byte ciphertext block. + """ + from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes + from cryptography.hazmat.backends import default_backend + enc = Cipher(algorithms.AES(key), modes.ECB(), backend=default_backend()).encryptor() + return enc.update(plain) + enc.finalize() + + +def _write_header(path: pathlib.Path, key: bytes, ct: bytes) -> None: + """ + Write the AES key and ciphertext header consumed by the firmware. + + Parameters + ---------- + path : pathlib.Path + Destination header path. + key : bytes + Sixteen byte AES key. + ct : bytes + Sixteen byte ciphertext block. + + Returns + ------- + None + """ + path.write_text( + "#ifndef CTF_TARGET_H\n#define CTF_TARGET_H\n\n#include \n\n" + "#define CTF_AES_KEY { %s }\n" + "#define CTF_TARGET_CT { %s }\n\n" + "#endif // CTF_TARGET_H\n" + % (", ".join(f"0x{b:02X}" for b in key), ", ".join(f"0x{b:02X}" for b in ct))) + + +def _run(cmd: list[str], cwd: pathlib.Path) -> None: + """ + Run an external command and raise on failure. + + Parameters + ---------- + cmd : list[str] + Command and arguments to execute. + cwd : pathlib.Path + Working directory for the command. + + Returns + ------- + None + """ + subprocess.run(cmd, cwd=str(cwd), check=True) + + +def main() -> int: + """ + Build a per-student image with an AES-encrypted, randomized target. + + Parameters + ---------- + None + + Returns + ------- + int + Zero on success. + """ + args = _parse_args() + root = pathlib.Path(__file__).resolve().parent.parent + seed = args.seed if args.seed is not None else random.randrange(2**31) + lat, lon = _make_target(seed) + key = _make_key(seed) + pt = struct.pack(" str: + """ + Format a decimal coordinate with cardinal direction. + + Parameters + ---------- + val : float + Coordinate value in degrees. + pos_c : str + Cardinal letter for positive values. + neg_c : str + Cardinal letter for negative values. + + Returns + ------- + str + Formatted coordinate string. + """ + card = pos_c if val >= 0.0 else neg_c + return f"{abs(val):.6f} deg {card}" + + +def _format_pos(lat: float, lon: float) -> str: + """ + Format combined latitude and longitude string. + + Parameters + ---------- + lat : float + Latitude coordinate. + lon : float + Longitude coordinate. + + Returns + ------- + str + Formatted dual coordinate string. + """ + lat_s = _format_coord(lat, 'N', 'S') + lon_s = _format_coord(lon, 'E', 'W') + return f"{lat_s} {lon_s}" + + +def _format_hud_rows( + cur_lat: float, + cur_lon: float, + is_rel: bool, + has_lock: bool = False +) -> list[str]: + """ + Format HUD data rows. + + Parameters + ---------- + cur_lat : float + Current UAV latitude. + cur_lon : float + Current UAV longitude. + is_rel : bool + Whether payload has released. + has_lock : bool + Whether active GNSS 3D lock has been acquired. + + Returns + ------- + list[str] + List of formatted box rows. + """ + if cur_lat == 0.0 and cur_lon == 0.0: + c_s = "0.000000 deg N 0.000000 deg E" + g_s = "SEARCHING SATELLITES" + m_s = "MOTOR STOPPED [WAITING FOR 3D LOCK]" + else: + c_s = _format_pos(cur_lat, cur_lon) + g_s = "ACTIVE 3D LOCK" if has_lock else "SEARCHING SATELLITES" + m_s = "ACTIVE PROPULSION [SERVO SPINNING]" if has_lock else "MOTOR STOPPED [WAITING FOR 3D LOCK]" + + return [ + f"| CURRENT POSITION : {c_s:<44} |", + f"| GNSS SUBSYSTEM : {g_s:<44} |", + f"| PROPULSION MOTOR : {m_s:<44} |" + ] + + +def _print_box(title: str, link: str, rows: list[str]) -> None: + """ + Print framed ASCII box. + + Parameters + ---------- + title : str + Box title line. + link : str + Sub-header line. + rows : list[str] + Body content rows. + + Returns + ------- + None + """ + hdr = f"+{'-' * 65}+" + print(hdr) + print(title) + print(link) + print(hdr) + for r in rows: + print(r) + print(hdr + "\n", flush=True) + + +def _print_hud( + cur_lat: float, + cur_lon: float, + is_released: bool, + has_lock: bool = False +) -> None: + """ + Display the 67-character telemetry mission HUD. + + Parameters + ---------- + cur_lat : float + Current UAV latitude. + cur_lon : float + Current UAV longitude. + is_released : bool + Whether payload solenoid has been energized. + has_lock : bool + Whether active GNSS 3D lock has been acquired. + + Returns + ------- + None + """ + rows = _format_hud_rows(cur_lat, cur_lon, is_released, has_lock) + title = f"|{'DARK VECTOR TELEMETRY CONSOLE':^65}|" + status = f"{'STATUS: ONLINE':>20}" + link = f"| LINK: FT232RL / RYLR998 LORA GROUND STATION{status} |" + _print_box(title, link, rows) + + +def _run_demo() -> None: + """ + Execute simulation of drone telemetry stream. + + Parameters + ---------- + None + + Returns + ------- + None + """ + print("[*] Running simulated ground station telemetry stream...\n") + _print_hud(0.0, 0.0, False, False) + time.sleep(1.0) + _print_hud(38.840280, -77.428890, False, True) + time.sleep(1.0) + _print_hud(38.861110, -77.439585, False, True) + time.sleep(1.0) + _print_hud(38.881940, -77.450280, True, True) + + +def _process_line( + line: str, + coords: dict[str, any] +) -> bool: + """ + Parse a single line of serial telemetry using regex. + + Parameters + ---------- + line : str + Raw serial string. + coords : dict[str, any] + State dictionary of coordinates. + + Returns + ------- + bool + True if telemetry data was updated, False otherwise. + """ + updated = False + m_cur = re.search(r"CURRENT LAT:\s*([-+]?\d*\.?\d+).*?LON:\s*([-+]?\d*\.?\d+)", line) + if m_cur: + coords["cur_lat"] = float(m_cur.group(1)) + coords["cur_lon"] = float(m_cur.group(2)) + coords["has_lock"] = True + updated = True + if "PAYLOAD RELEASED" in line: + coords["released"] = 1.0 + updated = True + return updated + + +def _monitor_serial(port: str, baud: int) -> None: + """ + Monitor serial stream from FT232RL ground station. + + Parameters + ---------- + port : str + Serial device path. + baud : int + Baud rate. + + Returns + ------- + None + """ + if serial is None: + sys.exit("pyserial required: pip install pyserial") + coords = { + "cur_lat": 0.0, + "cur_lon": 0.0, + "released": 0.0, + "has_lock": False + } + with serial.Serial(port, baud, timeout=1.0) as ser: + while True: + raw = ser.readline().decode("utf-8", errors="ignore").strip() + if raw: + _process_line(raw, coords) + rel = coords["released"] > 0.5 + _print_hud(coords["cur_lat"], coords["cur_lon"], rel, coords["has_lock"]) + + +def main() -> None: + """ + Parse arguments and start telemetry monitor. + + Parameters + ---------- + None + + Returns + ------- + None + """ + parser = argparse.ArgumentParser(description="Dark Vector Telemetry") + parser.add_argument("--port", default="/dev/tty.usbserial-0001") + parser.add_argument("--baud", type=int, default=115200) + parser.add_argument("--demo", action="store_true") + args = parser.parse_args() + if args.demo: + _run_demo() + return + _monitor_serial(args.port, args.baud) + + +if __name__ == "__main__": + main() diff --git a/0x0011a_cb/src/aes.c b/0x0011a_cb/src/aes.c new file mode 100644 index 0000000..b1c604e --- /dev/null +++ b/0x0011a_cb/src/aes.c @@ -0,0 +1,119 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// File: aes.c +// Desc: Minimal AES-128-ECB block decryption for the CTF waypoint. +// Created: 2026 + +#include "aes.h" +#include +#include + +static const uint8_t sbox[256] = { + 0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76, + 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0, + 0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15, + 0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75, + 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84, + 0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF, + 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8, + 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, + 0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73, + 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB, + 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, + 0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08, + 0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A, + 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E, + 0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF, + 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16, +}; + +static const uint8_t rsbox[256] = { + 0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38, 0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB, + 0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87, 0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB, + 0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D, 0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E, + 0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2, 0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25, + 0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92, + 0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA, 0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84, + 0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A, 0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06, + 0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02, 0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B, + 0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA, 0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73, + 0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85, 0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E, + 0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89, 0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B, + 0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20, 0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4, + 0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31, 0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F, + 0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D, 0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF, + 0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0, 0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61, + 0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26, 0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D, +}; + +static const uint8_t Rcon[11] = {0x00,0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x1B,0x36}; + +static uint8_t xtime(uint8_t x) { return (uint8_t)((x << 1) ^ (((x >> 7) & 1) * 0x1B)); } + +static uint8_t mul(uint8_t a, uint8_t b) { + uint8_t p = 0; + for (int i = 0; i < 8; i++) { + if (b & 1) p ^= a; + uint8_t hi = a & 0x80; a <<= 1; + if (hi) a ^= 0x1B; + b >>= 1; + } + return p; +} + +static void key_expansion(const uint8_t *key, uint8_t *rk) { + memcpy(rk, key, 16); + for (int i = 4; i < 44; i++) { + uint8_t t[4]; + memcpy(t, &rk[(i - 1) * 4], 4); + if (i % 4 == 0) { + uint8_t tmp = t[0]; + t[0] = (uint8_t)(sbox[t[1]] ^ Rcon[i / 4]); + t[1] = sbox[t[2]]; + t[2] = sbox[t[3]]; + t[3] = sbox[tmp]; + } + for (int j = 0; j < 4; j++) rk[i * 4 + j] = rk[(i - 4) * 4 + j] ^ t[j]; + } +} + +static void add_round_key(uint8_t r, uint8_t *s, const uint8_t *rk) { + for (int i = 0; i < 16; i++) s[i] ^= rk[r * 16 + i]; +} + +static void inv_sub_bytes(uint8_t *s) { for (int i = 0; i < 16; i++) s[i] = rsbox[s[i]]; } + +static void inv_shift_rows(uint8_t *s) { + uint8_t t; + t = s[13]; s[13] = s[9]; s[9] = s[5]; s[5] = s[1]; s[1] = t; + t = s[2]; s[2] = s[10]; s[10] = t; t = s[6]; s[6] = s[14]; s[14] = t; + t = s[3]; s[3] = s[7]; s[7] = s[11]; s[11] = s[15]; s[15] = t; +} + +static void inv_mix_columns(uint8_t *s) { + for (int i = 0; i < 4; i++) { + uint8_t a = s[i * 4], b = s[i * 4 + 1], c = s[i * 4 + 2], d = s[i * 4 + 3]; + s[i * 4] = (uint8_t)(mul(a, 14) ^ mul(b, 11) ^ mul(c, 13) ^ mul(d, 9)); + s[i * 4 + 1] = (uint8_t)(mul(a, 9) ^ mul(b, 14) ^ mul(c, 11) ^ mul(d, 13)); + s[i * 4 + 2] = (uint8_t)(mul(a, 13) ^ mul(b, 9) ^ mul(c, 14) ^ mul(d, 11)); + s[i * 4 + 3] = (uint8_t)(mul(a, 11) ^ mul(b, 13) ^ mul(c, 9) ^ mul(d, 14)); + } +} + +void aes128_ecb_decrypt_block(const uint8_t in[16], const uint8_t key[16], uint8_t out[16]) { + uint8_t rk[176]; + key_expansion(key, rk); + memcpy(out, in, 16); + add_round_key(10, out, rk); + for (int r = 9; r > 0; r--) { + inv_shift_rows(out); + inv_sub_bytes(out); + add_round_key(r, out, rk); + inv_mix_columns(out); + } + inv_shift_rows(out); + inv_sub_bytes(out); + add_round_key(0, out, rk); +} diff --git a/0x0011a_cb/src/gps.c b/0x0011a_cb/src/gps.c new file mode 100644 index 0000000..7b7a593 --- /dev/null +++ b/0x0011a_cb/src/gps.c @@ -0,0 +1,172 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: gps.c +// Desc: Implements PIO UART GPS receiver and NMEA coordinate parsing. +// Created: 2026 + +#include "gps.h" +#include "uart_rx.pio.h" +#include +#include +#include + +static int gps_siv = 0; +static int gps_cno = 0; + +void init_gps_pio(void) +{ + uint offset = pio_add_program(GPS_PIO, &uart_rx_program); + uart_rx_program_init(GPS_PIO, GPS_SM, offset, GPS_PIN, GPS_BAUD); +} + + + +/** + * @brief Convert NMEA ddmm.mmmm coordinate to decimal degrees. + * + * @param str NMEA coordinate string. + * @param dir Cardinal direction character ('N', 'S', 'E', 'W'). + * @return double Decimal degree coordinate. + */ +static double parse_nmea_coord(const char *str, char dir) +{ + double raw = atof(str); + int deg = (int)(raw / 100.0); + double dec = (double)deg + ((raw - (deg * 100.0)) / 60.0); + return ((dir == 'S') || (dir == 'W')) ? -dec : dec; +} + +/** + * @brief Find pointer to n-th comma-separated field in NMEA string. + * + * @param str NMEA sentence string. + * @param field_idx Index of field to locate. + * @return const char* Pointer to field start or NULL. + */ +static const char *get_nmea_field(const char *str, int field_idx) +{ + while ((str != NULL) && (*str != '\0') && (field_idx > 0)) { + if (*str++ == ',') { + field_idx--; + } + } + return (field_idx == 0) ? str : NULL; +} + +/** + * @brief Parse NMEA RMC sentence for valid coordinates. + * + * @param line NMEA sentence buffer. + * @param lat Pointer to store parsed latitude. + * @param lon Pointer to store parsed longitude. + * @return None. + */ +static bool parse_rmc(const char *line, double *lat, double *lon) +{ + const char *st = get_nmea_field(line, 2), *la = get_nmea_field(line, 3); + const char *lo = get_nmea_field(line, 5); + if (!st || *st != 'A' || !la || *la == ',' || !lo || *lo == ',') return false; + *lat = parse_nmea_coord(la, *get_nmea_field(line, 4)); + *lon = parse_nmea_coord(lo, *get_nmea_field(line, 6)); + return (*lat != 0.0) && (*lon != 0.0); +} + +/** + * @brief Parse NMEA GSV sentence for satellites-in-view and best C/N0. + * + * @param line NMEA GSV sentence string. + * @return None. + */ +static void parse_gsv(const char *line) +{ + const char *sv = get_nmea_field(line, 3), *msg = get_nmea_field(line, 2); + if (sv != NULL) gps_siv = atoi(sv); + if ((msg != NULL) && (*msg == '1')) gps_cno = 0; + for (int f = 7; f < 40; f += 4) { + const char *c = get_nmea_field(line, f); + if ((c == NULL) || (*c == '*') || (*c == '\0')) break; + if (atoi(c) > gps_cno) gps_cno = atoi(c); + } +} + +/** + * @brief Test buffered line for valid NMEA RMC sentence. + * + * @param buf NMEA character buffer. + * @param idx Pointer to character index. + * @param lat Pointer to current latitude. + * @param lon Pointer to current longitude. + * @return bool True if valid 3D fix was parsed, false otherwise. + */ +static bool check_rmc_line(char *buf, int *idx, double *lat, double *lon) +{ + buf[*idx] = '\0'; + *idx = 0; + char *rmc = strstr(buf, "RMC"), *gsv = strstr(buf, "GSV"); + if (gsv != NULL) parse_gsv(gsv); + return (rmc != NULL) ? parse_rmc(rmc, lat, lon) : false; +} + +/** + * @brief Accumulate GPS character and trigger RMC parsing on newline. + * + * @param ch Received ASCII character. + * @param lat Pointer to current latitude. + * @param lon Pointer to current longitude. + * @return bool True if a valid active 3D fix was parsed, false otherwise. + */ +static bool process_gps_char(char ch, double *lat, double *lon) +{ + static char buf[96]; + static int idx = 0; + if (ch == '$') idx = 0; + if ((ch == '\n') || (ch == '\r')) + return check_rmc_line(buf, &idx, lat, lon); + if (idx < (int)(sizeof(buf) - 1)) + buf[idx++] = ch; + return false; +} + +static bool handle_gps_byte(double *lat, double *lon) +{ + char ch = (char)(pio_sm_get(GPS_PIO, GPS_SM) >> 24); + return process_gps_char(ch, lat, lon); +} + +bool poll_gps(double *lat, double *lon) +{ + bool got_fix = false; + while (!pio_sm_is_rx_fifo_empty(GPS_PIO, GPS_SM)) + got_fix |= handle_gps_byte(lat, lon); + return got_fix; +} + +void gps_get_stats(int *siv, int *cno) +{ + *siv = gps_siv; + *cno = gps_cno; +} + diff --git a/0x0011a_cb/src/lcd.c b/0x0011a_cb/src/lcd.c new file mode 100644 index 0000000..b22c9ca --- /dev/null +++ b/0x0011a_cb/src/lcd.c @@ -0,0 +1,144 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: lcd.c +// Desc: Implements I2C HD44780 16x2 LCD display for live telemetry coordinates. +// Created: 2026 + +#include "lcd.h" +#include "pico/stdlib.h" +#include +#include +#include + +#define PIN_RS 0x01 +#define PIN_EN 0x04 +#define BACKLIGHT 0x08 + +static uint8_t lcd_addr = 0x27; +static bool lcd_ready = false; + +static void pcf_write(uint8_t d) +{ + if (lcd_ready) + i2c_write_blocking(LCD_I2C_INST, lcd_addr, &d, 1, false); +} + +static void pcf_pulse(uint8_t d) +{ + pcf_write(d | PIN_EN); + sleep_us(1); + pcf_write(d & ~PIN_EN); + sleep_us(50); +} + +static void lcd_write4(uint8_t n, uint8_t mode) +{ + uint8_t d = (n & 0x0F) << 4; + d |= mode ? PIN_RS : 0; + d |= BACKLIGHT; + pcf_pulse(d); +} + +static void lcd_send(uint8_t v, uint8_t mode) +{ + lcd_write4((v >> 4) & 0x0F, mode); + lcd_write4(v & 0x0F, mode); +} + +static void lcd_clear(void) +{ + lcd_send(0x01, 0); + sleep_ms(2); +} + +static void lcd_set_cursor(int row, int col) +{ + uint8_t offset = (row == 0) ? 0x00 : 0x40; + lcd_send(0x80 | (col + offset), 0); +} + +static void lcd_puts(const char *s) +{ + while (*s) + lcd_send((uint8_t)*s++, 1); +} + +static void lcd_reset_seq(void) +{ + lcd_write4(0x03, 0); sleep_ms(5); + lcd_write4(0x03, 0); sleep_us(150); + lcd_write4(0x03, 0); sleep_us(150); + lcd_write4(0x02, 0); sleep_us(150); +} + +static void lcd_cfg_seq(void) +{ + lcd_send(0x28, 0); + lcd_send(0x0C, 0); + lcd_clear(); + lcd_send(0x06, 0); +} + +static bool detect_lcd(void) +{ + uint8_t rx; + if (i2c_read_blocking(LCD_I2C_INST, 0x27, &rx, 1, false) >= 0) + return (lcd_addr = 0x27, true); + if (i2c_read_blocking(LCD_I2C_INST, 0x3F, &rx, 1, false) >= 0) + return (lcd_addr = 0x3F, true); + return false; +} + +void init_lcd(void) +{ + i2c_init(LCD_I2C_INST, LCD_BAUD); + gpio_set_function(LCD_SDA_PIN, GPIO_FUNC_I2C); + gpio_set_function(LCD_SCL_PIN, GPIO_FUNC_I2C); + gpio_pull_up(LCD_SDA_PIN); gpio_pull_up(LCD_SCL_PIN); + if (!(lcd_ready = detect_lcd())) return; + lcd_reset_seq(); + lcd_cfg_seq(); +} + +void lcd_show_coords(double lat, double lon) +{ + if (!lcd_ready && !(lcd_ready = detect_lcd())) return; + char r1[17], r2[17]; + snprintf(r1, sizeof(r1), "LAT: %9.6f %c", fabs(lat), (lat >= 0.0) ? 'N' : 'S'); + snprintf(r2, sizeof(r2), "LON: %9.6f %c", fabs(lon), (lon >= 0.0) ? 'E' : 'W'); + lcd_set_cursor(0, 0); lcd_puts(r1); + lcd_set_cursor(1, 0); lcd_puts(r2); +} + +void lcd_show_gnss(int sats, int cno) +{ + if (!lcd_ready && !(lcd_ready = detect_lcd())) return; + char r1[17], r2[17]; + snprintf(r1, sizeof(r1), "SAT:%2d CNO:%2d ", sats, cno); + snprintf(r2, sizeof(r2), "%-16s", (sats > 0) ? "ACQUIRING..." : "NO SIGNAL"); + lcd_set_cursor(0, 0); lcd_puts(r1); + lcd_set_cursor(1, 0); lcd_puts(r2); +} diff --git a/0x0011a_cb/src/lora.c b/0x0011a_cb/src/lora.c new file mode 100644 index 0000000..6ef5aff --- /dev/null +++ b/0x0011a_cb/src/lora.c @@ -0,0 +1,89 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: lora.c +// Desc: Implements UART1 driver for REYAX RYLR998 LoRa transceiver. +// Created: 2026 + +#include "lora.h" +#include "hardware/gpio.h" +#include "pico/stdlib.h" +#include +#include + +static void drain_lora_rx(void) +{ + while (uart_is_readable(LORA_UART)) { + char c = (char)uart_getc(LORA_UART); + if (c >= 32 && c <= 126) + putchar(c); + } +} + +static void send_at_cmd(const char *cmd) +{ + uart_write_blocking(LORA_UART, (const uint8_t *)cmd, strlen(cmd)); + sleep_ms(250); + drain_lora_rx(); +} + +static void configure_lora_rf(void) +{ + sleep_ms(1500); + send_at_cmd("AT\r\n"); + send_at_cmd("AT+NETWORKID=18\r\n"); + send_at_cmd("AT+BAND=915000000\r\n"); + send_at_cmd("AT+PARAMETER=9,7,1,12\r\n"); + send_at_cmd("AT+ADDRESS=2\r\n"); +} + +void init_lora(void) +{ + uart_init(LORA_UART, LORA_BAUD); + uart_set_translate_crlf(LORA_UART, false); + gpio_set_function(LORA_TX_PIN, GPIO_FUNC_UART); + gpio_set_function(LORA_RX_PIN, GPIO_FUNC_UART); + configure_lora_rf(); +} + +static char tx_buf[160]; +static int tx_len = 0; +static int tx_idx = 0; + +void lora_send(const char *msg) +{ + int len = (int)strlen(msg); + while ((len > 0) && ((msg[len - 1] == '\r') || (msg[len - 1] == '\n'))) + len--; + tx_len = snprintf(tx_buf, sizeof(tx_buf), "AT+SEND=0,%d,%.*s\r\n", len, len, msg); + tx_idx = 0; +} + +void lora_tick(void) +{ + while ((tx_idx < tx_len) && uart_is_writable(LORA_UART)) + uart_putc_raw(LORA_UART, (uint8_t)tx_buf[tx_idx++]); + drain_lora_rx(); +} diff --git a/0x0011a_cb/src/main.c b/0x0011a_cb/src/main.c new file mode 100644 index 0000000..f52bc90 --- /dev/null +++ b/0x0011a_cb/src/main.c @@ -0,0 +1,108 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: main.c +// Desc: Main entry point for autonomous micro-UAV guidance firmware. +// Created: 2026 + +#include "gps.h" +#include "lora.h" +#include "payload.h" +#include "propeller.h" +#include "navigation.h" +#include "lcd.h" +#include "pico/stdlib.h" +#include "hardware/gpio.h" +#include "hardware/pio.h" +#include + +/** + * @brief Initialize all board peripherals, communications, and actuators. + * + * @param None. + * @return None. + */ +static void init_all(void) +{ + stdio_init_all(); + init_navigation(); + init_payload(); + init_lora(); + init_gps_pio(); + init_propeller(); + init_lcd(); +} + +/** + * @brief Continually drain GPS PIO FIFO over 1-second flight tick. + * + * @param cur_lat Pointer to current latitude. + * @param cur_lon Pointer to current longitude. + * @return bool True if active 3D lock was parsed, false otherwise. + */ +static bool update_position(double *cur_lat, double *cur_lon) +{ + bool got_fix = false; + for (int i = 0; i < 200; i++, sleep_ms(5)) { + got_fix |= poll_gps(cur_lat, cur_lon); + lora_tick(); + } + return got_fix; +} + +static void step_mission(double *cur_lat, double *cur_lon) +{ + int siv = 0, cno = 0; + static int hold = 0; + bool fix = update_position(cur_lat, cur_lon); + gps_get_stats(&siv, &cno); + hold = fix ? 3 : ((hold > 0) ? (hold - 1) : 0); + bool have = fix || (hold > 0); + set_gnss_leds(have, siv); + if (have) { + lcd_show_coords(*cur_lat, *cur_lon); + navigate_to_target(*cur_lat, *cur_lon); + } else { + lcd_show_gnss(siv, cno); + propeller_stop(); + send_telemetry(*cur_lat, *cur_lon); + } +} + +/** + * @brief Autonomous micro-UAV firmware execution loop. + * + * @param None. + * @return int Standard exit code (never reached in embedded firmware). + */ +int main(void) +{ + double cur_lat = ORIGIN_LAT, cur_lon = ORIGIN_LON; + init_all(); + while (true) + step_mission(&cur_lat, &cur_lon); + return 0; +} + diff --git a/0x0011a_cb/src/navigation.c b/0x0011a_cb/src/navigation.c new file mode 100644 index 0000000..21ec066 --- /dev/null +++ b/0x0011a_cb/src/navigation.c @@ -0,0 +1,106 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: navigation.c +// Desc: Implements waypoint navigation, dead-reckoning, and telemetry dispatch. +// Created: 2026 + +#include "navigation.h" +#include "ctf_target.h" +#include "aes.h" +#include "lora.h" +#include "payload.h" +#include "propeller.h" +#include +#include +#include +#include + +double TARGET_LAT = 0.0; +double TARGET_LON = 0.0; + +const double ORIGIN_LAT = 38.840280; +const double ORIGIN_LON = -77.428890; + +void init_navigation(void) +{ + uint8_t pt[16]; + const uint8_t key[16] = CTF_AES_KEY; + const uint8_t ct[16] = CTF_TARGET_CT; + aes128_ecb_decrypt_block(ct, key, pt); + memcpy(&TARGET_LAT, pt, sizeof(double)); + memcpy(&TARGET_LON, pt + 8, sizeof(double)); +} + +void send_telemetry(double cur_lat, double cur_lon) +{ + char msg[80]; + snprintf(msg, sizeof(msg), "CURRENT LAT: %lf, LON: %lf\r\n", cur_lat, cur_lon); + printf("%s", msg); + lora_send(msg); +} + +void dead_reckon_step(double *cur_lat, double *cur_lon) +{ + double dlat = TARGET_LAT - *cur_lat; + double dlon = TARGET_LON - *cur_lon; + *cur_lat += (fabs(dlat) < 0.005) ? dlat : ((dlat > 0.0) ? 0.004166 : -0.004166); + *cur_lon += (fabs(dlon) < 0.005) ? dlon : ((dlon > 0.0) ? 0.002139 : -0.002139); +} + +bool check_arrival(double cur_lat, double cur_lon) +{ + return (cur_lat == TARGET_LAT) && (cur_lon == TARGET_LON); +} + +/** + * @brief Compute the initial bearing from one point toward another. + * + * @param lat1 Origin latitude in degrees. + * @param lon1 Origin longitude in degrees. + * @param lat2 Destination latitude in degrees. + * @param lon2 Destination longitude in degrees. + * @return double Bearing in degrees (0 to 360). + */ +static double bearing_to(double lat1, double lon1, double lat2, double lon2) +{ + double p1 = lat1 * 0.017453292519943295, p2 = lat2 * 0.017453292519943295; + double dl = (lon2 - lon1) * 0.017453292519943295; + double y = sin(dl) * cos(p2); + double x = cos(p1) * sin(p2) - sin(p1) * cos(p2) * cos(dl); + double b = atan2(y, x) * 57.29577951308232; + return (b < 0.0) ? (b + 360.0) : b; +} + +void navigate_to_target(double cur_lat, double cur_lon) +{ + send_telemetry(cur_lat, cur_lon); + if (check_arrival(cur_lat, cur_lon)) { + propeller_stop(); + release_payload(); + } else { + propeller_set_bearing(bearing_to(cur_lat, cur_lon, TARGET_LAT, TARGET_LON)); + } +} diff --git a/0x0011a_cb/src/payload.c b/0x0011a_cb/src/payload.c new file mode 100644 index 0000000..9d4299b --- /dev/null +++ b/0x0011a_cb/src/payload.c @@ -0,0 +1,58 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: payload.c +// Desc: Implements payload release solenoid latch control on GPIO16. +// Created: 2026 + +#include "payload.h" +#include "lora.h" +#include "hardware/gpio.h" +#include + +void init_payload(void) +{ + gpio_init(16); gpio_set_dir(16, GPIO_OUT); gpio_put(16, 1); + gpio_init(17); gpio_set_dir(17, GPIO_OUT); gpio_put(17, 0); + gpio_init(18); gpio_set_dir(18, GPIO_OUT); gpio_put(18, 0); + gpio_init(25); gpio_set_dir(25, GPIO_OUT); gpio_put(25, 0); +} + +void set_gnss_leds(bool fix, int siv) +{ + gpio_put(16, (!fix && (siv == 0)) ? 1 : 0); + gpio_put(17, fix ? 1 : 0); + gpio_put(18, (!fix && (siv > 0)) ? 1 : 0); +} + +void release_payload(void) +{ + gpio_put(16, 1); + gpio_put(17, 1); + gpio_put(18, 1); + printf("PAYLOAD RELEASED AT TARGET COORDINATES\r\n"); + lora_send("PAYLOAD RELEASED AT TARGET COORDINATES\r\n"); +} + diff --git a/0x0011a_cb/src/propeller.c b/0x0011a_cb/src/propeller.c new file mode 100644 index 0000000..daa3bf9 --- /dev/null +++ b/0x0011a_cb/src/propeller.c @@ -0,0 +1,84 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: propeller.c +// Desc: Implements SG90 servo PWM mock propeller control on GPIO6. +// Created: 2026 + +#include "propeller.h" +#include "pico/stdlib.h" +#include "hardware/pwm.h" +#include "hardware/gpio.h" + +static struct repeating_timer prop_timer; +static bool prop_active = false; +static uint16_t current_pulse = 1000; + +void init_propeller(void) +{ + gpio_set_function(PROPELLER_PIN, GPIO_FUNC_PWM); + uint s = pwm_gpio_to_slice_num(PROPELLER_PIN); + pwm_set_clkdiv(s, 150.0f); + pwm_set_wrap(s, 19999); + pwm_set_gpio_level(PROPELLER_PIN, 0); + pwm_set_enabled(s, true); +} + +/** + * @brief Repeating timer callback to alternate servo angle at max slew rate. + * + * @param t Pointer to repeating timer structure. + * @return bool Always true to continue recurring timer. + */ +static bool prop_timer_callback(struct repeating_timer *t) +{ + (void)t; + current_pulse = (current_pulse == 1000) ? 2000 : 1000; + pwm_set_gpio_level(PROPELLER_PIN, current_pulse); + return true; +} + +void propeller_spin(void) +{ + if (!prop_active) { + prop_active = true; + add_repeating_timer_ms(-150, prop_timer_callback, NULL, &prop_timer); + } +} + +void propeller_set_bearing(double deg) +{ + uint16_t pulse = (uint16_t)(1000.0 + (deg / 360.0) * 1000.0); + pwm_set_gpio_level(PROPELLER_PIN, pulse); +} + +void propeller_stop(void) +{ + if (prop_active) { + cancel_repeating_timer(&prop_timer); + prop_active = false; + } + pwm_set_gpio_level(PROPELLER_PIN, 0); +} diff --git a/0x0011a_cb/src/uart_rx.pio b/0x0011a_cb/src/uart_rx.pio new file mode 100644 index 0000000..1d494a9 --- /dev/null +++ b/0x0011a_cb/src/uart_rx.pio @@ -0,0 +1,43 @@ +; +; Copyright (c) 2026 Kevin Thomas +; SPDX-License-Identifier: MIT +; +.pio_version 0 + +.program uart_rx + +; 8n1 UART receiver for GPS NMEA reception on a single GPIO pin. +; Operates at 8 execution cycles per bit period. +; IN pin 0 and JMP pin are mapped to the GPS RX GPIO pin. + +start: + wait 0 pin 0 ; Wait for start bit falling edge (1 cycle) + set x, 7 [10] ; Preload bit counter (7 remaining), delay 1.5 bit periods (11 cycles) +bitloop: + in pins, 1 ; Sample 1 bit from RX pin into ISR (1 cycle) + jmp x-- bitloop [6] ; Loop 8 times; each iteration is 8 execution cycles (7 cycles delay) + jmp pin good_stop ; Verify stop bit is HIGH + wait 1 pin 0 ; Framing error: wait until line returns to idle HIGH + jmp start ; Discard frame and re-synchronize +good_stop: + push noblock ; Push 8-bit byte into RX FIFO (bits [31:24]) + +% c-sdk { +#include "hardware/clocks.h" +#include "hardware/gpio.h" + +static inline void uart_rx_program_init(PIO pio, uint sm, uint offset, uint pin, uint baud) { + pio_sm_set_consecutive_pindirs(pio, sm, pin, 1, false); + pio_gpio_init(pio, pin); + gpio_pull_up(pin); + pio_sm_config c = uart_rx_program_get_default_config(offset); + sm_config_set_in_pins(&c, pin); + sm_config_set_jmp_pin(&c, pin); + sm_config_set_in_shift(&c, true, false, 32); + sm_config_set_fifo_join(&c, PIO_FIFO_JOIN_RX); + float div = (float)clock_get_hz(clk_sys) / (8 * baud); + sm_config_set_clkdiv(&c, div); + pio_sm_init(pio, sm, offset, &c); + pio_sm_set_enabled(pio, sm, true); +} +%} diff --git a/0x0011a_cb/uf2conv.py b/0x0011a_cb/uf2conv.py new file mode 100644 index 0000000..d6dd7a8 --- /dev/null +++ b/0x0011a_cb/uf2conv.py @@ -0,0 +1,365 @@ +#!/usr/bin/env python3 +import sys +import struct +import subprocess +import re +import os +import os.path +import argparse +import json +from time import sleep + + +UF2_MAGIC_START0 = 0x0A324655 # "UF2\n" +UF2_MAGIC_START1 = 0x9E5D5157 # Randomly selected +UF2_MAGIC_END = 0x0AB16F30 # Ditto + +INFO_FILE = "/INFO_UF2.TXT" + +appstartaddr = 0x2000 +familyid = 0x0 + + +def is_uf2(buf): + w = struct.unpack(" 476: + assert False, "Invalid UF2 data size at " + ptr + newaddr = hd[3] + if (hd[2] & 0x2000) and (currfamilyid == None): + currfamilyid = hd[7] + if curraddr == None or ((hd[2] & 0x2000) and hd[7] != currfamilyid): + currfamilyid = hd[7] + curraddr = newaddr + if familyid == 0x0 or familyid == hd[7]: + appstartaddr = newaddr + padding = newaddr - curraddr + if padding < 0: + assert False, "Block out of order at " + ptr + if padding > 10*1024*1024: + assert False, "More than 10M of padding needed at " + ptr + if padding % 4 != 0: + assert False, "Non-word padding size at " + ptr + while padding > 0: + padding -= 4 + outp.append(b"\x00\x00\x00\x00") + if familyid == 0x0 or ((hd[2] & 0x2000) and familyid == hd[7]): + outp.append(block[32 : 32 + datalen]) + curraddr = newaddr + datalen + if hd[2] & 0x2000: + if hd[7] in families_found.keys(): + if families_found[hd[7]] > newaddr: + families_found[hd[7]] = newaddr + else: + families_found[hd[7]] = newaddr + if prev_flag == None: + prev_flag = hd[2] + if prev_flag != hd[2]: + all_flags_same = False + if blockno == (numblocks - 1): + print("--- UF2 File Header Info ---") + families = load_families() + for family_hex in families_found.keys(): + family_short_name = "" + for name, value in families.items(): + if value == family_hex: + family_short_name = name + print("Family ID is {:s}, hex value is 0x{:08x}".format(family_short_name,family_hex)) + print("Target Address is 0x{:08x}".format(families_found[family_hex])) + if all_flags_same: + print("All block flag values consistent, 0x{:04x}".format(hd[2])) + else: + print("Flags were not all the same") + print("----------------------------") + if len(families_found) > 1 and familyid == 0x0: + outp = [] + appstartaddr = 0x0 + return b"".join(outp) + +def convert_to_carray(file_content): + outp = "const unsigned long bindata_len = %d;\n" % len(file_content) + outp += "const unsigned char bindata[] __attribute__((aligned(16))) = {" + for i in range(len(file_content)): + if i % 16 == 0: + outp += "\n" + outp += "0x%02x, " % file_content[i] + outp += "\n};\n" + return bytes(outp, "utf-8") + +def convert_to_uf2(file_content): + global familyid + datapadding = b"" + while len(datapadding) < 512 - 256 - 32 - 4: + datapadding += b"\x00\x00\x00\x00" + numblocks = (len(file_content) + 255) // 256 + outp = [] + for blockno in range(numblocks): + ptr = 256 * blockno + chunk = file_content[ptr:ptr + 256] + flags = 0x0 + if familyid: + flags |= 0x2000 + hd = struct.pack(b" **⏰ TIME PRESSURE:** The field team is standing by to push your verified +> patch to the rest of the DEEPLINE fleet. Every relay still reporting a +> false "STABLE" status is one two-car release away from a disaster. + +> **AUTHORIZED LAB ONLY:** This challenge uses a supplied Pico 2 training +> relay and its exact corrupted firmware image. Do not connect this +> exercise to a public network, an operational railway, a metro system, or +> any device you do not own or have explicit written authorization to test. + +--- + +## Learning Objectives + +- Decode an ARM Cortex-M33 vector and boot table and identify the reset + handler and initial stack pointer. +- Translate Thumb reset-vector addresses into real function entry points and + trace literal-pool entries to their data. +- Locate four corrupted constants: a boundary comparison, a status string, + an 8-byte IEEE-754 double, and an ARX signal seed. +- Analyze unsigned compare semantics, condition codes, and compiler + transforms of boundary tests. +- Capture a runtime-derived key with GDB, override a register, and set a + watchpoint on stored SRAM state. +- Recover and authenticate an Argon2id plus XChaCha20-Poly1305 authority + frame and describe the crypto pipeline with an honest threat boundary. +- Export and UF2-convert a corrected image, then prove the corrected + behavior on real hardware. + +--- + +## What This Project Tests + +| Week | Concepts Tested | +|------|-----------------| +| 1 | RP2350 architecture, ARM Cortex-M33 registers, stack, flash/RAM, Thumb assembly, Ghidra static analysis | +| 2 | GDB connection, breakpoints, disassembly, register and memory inspection, USB-CDC console observation | +| 3 | Bootrom handoff, vector table, reset handler, startup code, XIP, Thumb-bit addressing | +| 4 | Data segments (`.rodata` / `.data` / `.bss`), initialized data images, little-endian encoding, literal pools, soft-float double layout | +| 5 | Unsigned compare semantics, condition codes (`hi`/`ls`), compiler transforms (`<` vs `<=`), volatile refetch semantics | +| 6 | Runtime signal-key derivation (SENTINEL-ARX quarter rounds), live register capture of a derived key, memory watchpoints | +| 7 | Argon2id memory-hard KDF, XChaCha20-Poly1305 AEAD, HChaCha20 subkey, salt/nonce/tag, authenticated decryption | +| 8 | Ouroboros composition (Argon2id to AEAD to payload dispatch), honest threat-model analysis, incident reporting | + +--- + +## Part 1: Understanding the System + +### DEEPLINE-AUTH Field Relay Hardware + +| Component | Connection | Purpose | +|-----------|------------|---------| +| Raspberry Pi Pico 2 | RP2350 | Runs the corrupted emergency firmware | +| USB-CDC console | Micro-USB to host | Relay console and Ouroboros gate input | +| SWD debug interface | Supplied probe | Authorized GDB inspection | +| Onboard LED | GPIO 25 | Authentication success indicator | + +Every graded finding lives in flash (`.rodata` / `.text` / `.data` image) or +SRAM, and is reachable with only the Weeks 1-8 toolset: Ghidra, GDB, and a +serial console. + +### Console Configuration + +- Transport: USB-CDC virtual COM port (no external adapter needed) +- Baud: `115200` +- Data: `8 bits` +- Parity: `none` +- Stop: `1` +- Logic: `3.3 V` on the debug header + +### Normal (Intended) Behavior + +The relay should run the SENTINEL-ARX signal-key layer, classify the frozen +87 A reading against the **real** DEEPLINE safety limit of **60 A**, report +honestly, and still accept the **Ouroboros authority frame** when an +operator enters the correct 12-word phrase: + +``` ++-----------------------------------------------------------------+ +| Intended Relay Behavior | +| | +| 1. Boot and initialize USB-CDC stdio and the auth gate | +| 2. Print the boot identity and the true TRACK signal | +| 3. Compare the frozen 87 A reading against the 60 A limit | +| 4. 87 A exceeds 60 A, so the block is NOT stable | +| 5. Report BLOCK STATE: CRITICAL and AUTO TRAIN: HELD | +| 6. Mint a SIGNAL KEY each 2-second cycle and watch it match | +| the SIGNAL_SPEC 0x2D879291 (OK, not MISMATCH) | +| 7. The 12-word emergency phrase reauthorizes the frame: | +| AUTHORITY FRAME: VERIFIED and payload on UART | +| 8. Repeat the report once per cycle until conditions change | ++-----------------------------------------------------------------+ +``` + +### Observed (Buggy) Behavior: What You Will See When You First Flash `CTF-02.uf2` + +```text +DEEPLINE METRO AUTHORITY +ADAPTIVE SIGNAL WINDOW: 38 MINUTES +USB-CDC 115200 8N1 | AUTHORIZED LAB CONSOLE +TRACK: NORMAL +BLOCK STATE: STABLE +AUTO TRAIN: AUTHORIZED +BLOCK LENGTH: 3200 M +FAULT POLLS: 1 +SIGNAL KEY: 0x915DCFF8 MISMATCH +RESPONSE> +``` + +> **Terminal Timing Note:** The first four lines (`DEEPLINE METRO...` through +> `TRACK: NORMAL`) represent the **initial boot banner**, emitted once during +> startup. If your serial terminal (PuTTY) connects after the board has +> booted, you will observe the continuous 2-second status stream (`BLOCK +> STATE...` through `SIGNAL KEY...`). To view the boot banner in your terminal, +> reset the Pico (pulse `RUN` to `GND`) while PuTTY is actively connected. + +The status block repeats every 2 seconds with `FAULT POLLS` incrementing. +This is exactly what the field crews are seeing. It is wrong, and it is +wrong in **four independent ways** inside the compiled binary. Do not assume +the first readable sentence is the full truth: treat every printed line as +evidence to be checked against the machine code, not as a fact on its own. + +--- + +## Part 2: The Firmware + +You do not have the source code. It was overwritten seventeen minutes after +the emergency build shipped. You have only the compiled image. Your job is +to reverse engineer it with Ghidra, locate the corrupted constants, patch +the image directly, and prove the corrected behavior: exactly the way the +field team will need to repatch the rest of the deployed fleet. + +### What The Firmware Does + +1. Initializes USB-CDC stdio and the Ouroboros authentication gate. +2. Reads a frozen track-circuit current (87 A) latched on the dead pilot + wire before the blacklock. +3. Compares that reading against a compiled-in safety threshold: **twice**, + once for the operator-facing BLOCK STATE line and once for the automated + AUTO TRAIN decision. +4. Prints a boot banner containing an unconditional TRACK signal line. +5. Enters an infinite 2-second loop that derives a session signal key, + prints the block classification, dispatch decision, block length, fault + poll count, and signal-key verdict. +6. Accepts a 12-word operation passphrase at the `RESPONSE>` prompt and runs + it through the hardened **Ouroboros gate** (Argon2id key derivation plus + XChaCha20-Poly1305 authenticated decryption) before dispatching the + authority frame payload to GPIO25 and UART. + +### Bug Summary: What You Are Graded On + +| Bug # | Category | Severity | Description | Hint | +|-------|----------|----------|--------------|------| +| **Bug #1** | Miscompiled safety constant | **CRITICAL** | The safe-release threshold was compiled far too permissive (95 A). It is used **twice**: once for the operator-facing status and once for the automated train-release decision, and **both** copies must be corrected. | The real DEEPLINE limit is 60 A. Search for the wrong immediate value used in the comparison. | +| **Bug #2** | Hardcoded string literal | **HIGH** | The boot banner unconditionally prints `TRACK: NORMAL` regardless of the actual reading. | The correct word describes a system holding a train at 87 A against a 60 A limit, not "NORMAL". | +| **Bug #3** | Data-section constant | **HIGH** | The block length shipped as 3.2 km; the real BRIDGE-4 block is 0.32 km, far below minimum release spacing. It prints as metres. | Trace the `BLOCK LENGTH` line to its data image in flash. Little-endian IEEE-754 double. | +| **Bug #4** | Init-time seed constant | **HIGH** | The ARX seed fused into the image is `0x0A0A0A0A`; the real seed is `0x6B206574`. The derived signal key therefore never matches `SIGNAL_SPEC`, and the console reports `MISMATCH` every cycle. | The expected value `0x2D879291` is a literal in a pool. The seed is a `.data` image in flash. Ignore decoy `0A` bytes in the input dispatch table. | + +**Important:** The replacement text for Bug #2 **must be the same length** +as the original (`NORMAL` and `DANGER` are both 6 bytes). Patching a shorter +or longer string will corrupt adjacent flash data. + +### A Third Layer: Not a Bug, an Authorization Task + +The **Ouroboros authority frame** is the encrypted artifact that proves an +operator is legitimate: a 48-byte payload sealed with Argon2id-derived keys +and XChaCha20-Poly1305. It is never printed by the firmware's status lines. +Recovering it, by understanding the construction and authenticating with +the correct 12-word phrase, is required evidence for your final report. + +The power of this layer is real but must be described honestly. The +construction is Argon2id (memory-hard KDF) chained into XChaCha20-Poly1305 +(AEAD). Against Grover-style search, symmetric-key security exponents are +**halved**, not annihilated; this firmware is a demonstrator and does not +claim NIST post-quantum status. The honest claim is: **a high modeled +brute-force cost under the stated passphrase entropy and KDF assumptions**, +not "quantum-proof." Your report must state this boundary exactly. + +--- + +## Part 3: Your Assignment + +Whenever a task asks you to **Document** or **answer**, write your answers +in a single file named `CTF-02-Answers.md`. + +### Task 1: Setup and Initial Analysis + +1. Create a new Ghidra project named `Copperhead_Investigation`. +2. Import `CTF-02.bin`. +3. Configure the language as **ARM Cortex 32-bit, little endian**. +4. Set the base address to `0x10000000`. +5. Run auto-analysis. + +**Document:** +- A screenshot of the Ghidra **Import Results** or **Program Information** + window showing the project name, processor settings, and base address. +- The address of `main()`. +- The address of the recurring 2-second status loop (the branch target the + loop restarts from). +- The vector-table base, the initial stack pointer, and the reset-handler + pointer as stored (note its Thumb bit) versus the actual instruction + address. +- One representative literal-pool entry that feeds the status lines, and + what it points to. + +### Task 2: Find and Patch Bug #1: The Miscalibrated Release Threshold + +1. Find **both** locations where the frozen 87 A reading is compared against + the miscompiled safety constant. +2. Document the exact address, the original instruction, and the original + immediate value at each location. +3. Determine the correct immediate value. **Caution:** the compiler may not + have encoded the raw threshold you expect: a strict "less than" + comparison against an unsigned value is often optimized into a + "less-or-equal" comparison against one less than the threshold. Show + your reasoning. +4. Patch **both** locations in Ghidra using the **Bytes Window** workflow: + > **Critical ARM Thumb-2 Patching Note:** In ARM Cortex-M, compare instructions that directly precede conditional execution blocks (`ite ge`) must **not** be patched using the right-click *Patch Instruction* dialog. Ghidra's automatic re-disassembler encounters an internal context conflict with the subsequent `ite ge` instruction, which collapses Thumb decoding and swallows Compare Site B (`0x10000312`). + > + > To patch cleanly without breaking downstream disassembly, use the **Bytes Window**: + > 1. Ensure the Bytes window is open (**Window** -> **Bytes: CTF-02.bin**). + > 2. In the Bytes window toolbar, click the **pencil icon** (**Toggle Edit Mode**). + > 3. In the Listing window, click on address `0x10000302` (Compare Site A) and press **`C`** (**Clear Code Bytes**). The instruction temporarily clears into raw bytes (`5E 2B`). + > 4. In the Bytes window, locate offset `10000302`, click on `5E`, and change it to **`3B`**. + > 5. Click back in the Listing window on address `0x10000302` and press **`D`** (**Disassemble**). The instruction immediately disassembles cleanly as `cmp r3, #0x3b`. + > 6. Notice that Compare Site B at `0x10000312` remains completely intact and visible! Repeat the exact same steps at `0x10000312`: click `0x10000312` in the Listing, press **`C`**, change `5E` to **`3B`** in the Bytes window, click back in the Listing, and press **`D`**. + +**Questions to answer:** +- Why must both locations be patched? What happens if you only patch one? +- Why is a false "STABLE" classification on an 87 A reading dangerous for + an automated train release into an occupied block? + +### Task 3: Find and Patch Bug #2: The False TRACK Banner + +1. Find the boot-banner string that unconditionally reports the wrong + signal state. +2. Document its address and the exact bytes that must change. +3. Patch the string, preserving its exact length. + +**Questions to answer:** +- Document the original vs. patched bytes, character by character. +- Why is a hardcoded, unconditional status word more dangerous than one + that is at least computed from a (miscalibrated) reading? + +### Task 4: Find and Patch Bug #3: The Block Length Constant + +1. Use Ghidra to locate the `BLOCK LENGTH` status line and trace the value + it prints back to its source in the initialized data image. +2. Document the 8-byte IEEE-754 double as stored (little endian) and its + printed interpretation. +3. Patch the data image so the relay reports the real 320 m BRIDGE-4 block. + +**Questions to answer:** +- Show your byte-for-byte conversion from 3.2 km to 0.32 km. +- Why would a console that overstates block length by ten times be as + dangerous as one that understates it? + +### Task 5: Find and Patch Bug #4: The Signal Seed + +1. Find the `SIGNAL_SPEC` value `0x2D879291` in the binary and note where + it lives. +2. Locate the `.data` image in flash that the firmware copies into SRAM at + boot. Identify the seed word that is wrong. +3. Patch the seed so the runtime-derived key matches the spec. + +**Warning:** there are decoy `0x0A0A0A0A` bytes in the console input +dispatch table. The real seed is an initialized data image, not a jump-table +constant. + +**Questions to answer:** +- How is the signal key derived each cycle, and where does the failure + appear in the register trace? +- Does fixing the seed also authenticate the Ouroboros gate? Explain what + each layer does and does not protect. + +### Task 6: GDB Register Capture of the Derived Key + +Prove the signal-key failure from the live machine, not just from static +bytes: + +1. Connect GDB to the running relay via the SWD probe. +2. Break at the second `derive_session_key` call site, immediately after the + branch returns. +3. Read `$r0`. Record the bug-derived key. +4. Inspect the two arguments entering the derivation: the live seed from + SRAM and the derived IV. +5. Overwrite `$r0` with the correct spec value, step out, and confirm the + next status cycle prints `SIGNAL KEY: 0x2D879291 OK`. +6. Verify with a watchpoint on the stored key in SRAM. + +**Questions to answer:** +- Why is the derived value in `$r0` different from the spec, and what alone + in the image is responsible? +- What does the register overwrite prove that the static patch proves + differently (and vice versa)? + +### Task 7: Recover the Ouroboros Authority Frame + +1. In Ghidra, locate the embedded artifact: the 16-byte salt, the 24-byte + XChaCha nonce, and the 64-byte ciphertext-plus-tag. +2. Document the Argon2id parameters compiled into the gate (memory, time, + parallelism) and the payload layout contract (LED byte + UART bytes). +3. On the live relay, enter the canonical 12-word emergency phrase at the + `RESPONSE>` prompt. +4. Confirm the expected outcome: `AUTHORITY FRAME: VERIFIED`, the onboard + LED turning on, and the payload printed to the console. +5. Demonstrate the two failure paths (policy violation and wrong phrase). + +**Questions to answer (honest boundary required):** +- Walk through the full pipeline: Argon2id to 32-byte key, HChaCha20 subkey + from the nonce prefix, inner nonce, Poly1305 tag verification, payload + dispatch. +- What would Grover-style search actually change in this construction, and + why does this firmware not claim strict post-quantum status? + +### Task 8: Export and Verify + +1. Export your patched binary as `CTF-02_fixed.bin`. +2. Convert it to UF2 format for the RP2350: + ```bash + python uf2conv.py CTF-02_fixed.bin --base 0x10000000 --family 0xe48bff59 --output CTF-02_fixed.uf2 + ``` +3. Flash `CTF-02_fixed.uf2` to your Pico 2 and capture the corrected + console output. +4. Confirm the corrected image now reports **TRACK: DANGER**, **BLOCK STATE: + CRITICAL**, **AUTO TRAIN: HELD**, **BLOCK LENGTH: 320 M**, and **SIGNAL + KEY: 0x2D879291 OK**, an honest, safe report instead of a false + "all clear." +5. Build a summary table of every patch: address, original bytes, patched + bytes, and a one-line description. + +### Task 9: Written Reflection (short answers, 150 words or less each) + +1. Why is "the build was rushed under emergency pressure" not an acceptable + excuse for shipping a firmware defect that could dispatch a train into a + block occupied by rescue crews? +2. Name one concrete engineering practice (review, static analysis, + hardware-in-the-loop test, signature verification, etc.) that would have + caught **each** of the four graded bugs before this image reached the + fleet, and one practice that would have stopped the corrupted image from + **running** at all. + +--- + +## How To Breadboard + +- Connect the Pico 2 micro-USB port directly to the host computer. The + relay enumerates as a USB-CDC virtual COM device. +- Open the end-of-line tool of your choice at `115200 8N1`. +- Connect the supplied SWD probe to the debug header according to its + documented pinout for GDB access. +- Use **3.3 V logic only** on the debug header. Never connect a 5 V line to + a Pico GPIO. + +The supplied image is `CTF-02.bin` (for Ghidra analysis) and +`CTF-02.uf2` (for flashing). If your instructor supplies different +filenames, record the actual filenames in your report. + +Flash using BOOTSEL mode (hold BOOT, plug in USB) and copy the UF2 onto the +`RP2350` mass-storage drive, or use `picotool`. + +--- + +## Memory Map Reference + +| Region | Address | Purpose | +|--------|---------|---------| +| Bootrom | `0x00000000` | Immutable boot code | +| Flash/XIP | `0x10000000` | Vector table, code, rodata, `.data` init image | +| SRAM | `0x20000000` | Stack and writable state | + +--- + +## Submission Format + +Submit a folder containing: + +- `CTF-02-Answers.md`; +- screenshots or terminal transcripts; +- `CTF-02_fixed.bin` and `CTF-02_fixed.uf2`; +- the original image hash. + +--- + +## Success Criteria + +You complete the challenge when you can prove all of the following: + +- You can explain how the RP2350 reaches the relay's code from reset. +- You can locate and patch both copies of the miscalibrated threshold. +- You can locate and patch the false TRACK string without corrupting + adjacent data. +- You can locate and patch the corrupted block-length double in the data + image. +- You can locate and patch the corrupted ARX seed and explain why the + runtime-derived key misses its spec. +- You can capture and correct the derived key live in GDB and verify with a + watchpoint. +- You can authenticate through the Ouroboros gate with the correct phrase + and describe the crypto pipeline accurately, including the honest + quantum boundary. +- You can export, convert, flash, and prove the corrected behavior on real + hardware. + +--- + +## Academic Integrity + +By submitting this CTF work, you certify that: + +1. You used only the supplied training relay, image, and lab interface. +2. You did not connect the challenge to a public network, an operational + railway, a metro system, or any third-party device. +3. You understand that embedded reverse engineering and binary patching + require explicit authorization in any real-world context. +4. You will report any discovered weakness responsibly to the course + instructor. + +The world is short on people who can do this work. Treat that +responsibility seriously: verify before you patch, patch before you trust, +and never confuse a clean-looking status line with a safe system. + +--- + +## Reference Material + +- ARM Cortex-M33 Technical Reference Manual +- RP2350 datasheet +- GDB documentation +- Ghidra documentation: [https://ghidra-sre.org/](https://ghidra-sre.org/) +- Strict Ouroboros reference construction (v0.1.0), the published source of + this firmware's gate, with an honest threat model: + [https://github.com/mytechnotalent/encryption-c-rp2350](https://github.com/mytechnotalent/encryption-c-rp2350) +- Reference gate firmware image (v0.1.0 release): + [https://github.com/mytechnotalent/encryption-c-rp2350/releases/download/v0.1.0/encryption_app.uf2](https://github.com/mytechnotalent/encryption-c-rp2350/releases/download/v0.1.0/encryption_app.uf2) +- PHC reference Argon2: [https://github.com/P-H-C/phc-winner-argon2](https://github.com/P-H-C/phc-winner-argon2) diff --git a/0x0017a_ctf/CTF-02-I.pdf b/0x0017a_ctf/CTF-02-I.pdf new file mode 100644 index 0000000..281b7dd Binary files /dev/null and b/0x0017a_ctf/CTF-02-I.pdf differ diff --git a/0x0017a_ctf/CTF-02-R.md b/0x0017a_ctf/CTF-02-R.md new file mode 100644 index 0000000..a581874 --- /dev/null +++ b/0x0017a_ctf/CTF-02-R.md @@ -0,0 +1,276 @@ +# Operation Copperhead - Requirements & Grading Criteria + +``` ++----------------------------------------------------------------------------------------+ +| | +| ██████╗ ██╗ █████╗ ██████╗██╗ ██╗███████╗████████╗ █████╗ ██████╗ ████████╗ | +| ██╔══██╗██║ ██╔══██╗██╔════╝██║ ██╔╝██╔════╝╚══██╔══╝██╔══██╗██╔══██╗╚══██╔══╝ | +| ██████╔╝██║ ███████║██║ █████╔╝ ███████╗ ██║ ███████║██████╔╝ ██║ | +| ██╔══██╗██║ ██╔══██║██║ ██╔═██╗ ╚════██║ ██║ ██╔══██║██╔══██╗ ██║ | +| ██████╔╝███████╗██║ ██║╚██████╗██║ ██╗███████╗ ██║ ██║ ██║██║ ██║ ██║ | +| ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝██║ ██║╚══════╝ ╚═╝ ╚═╝ ╚═╝██║ ██║ ██║ | +| | +| | +| O P E R A T I O N C O P P E R H E A D | +| | +| REQUIREMENTS & GRADING CRITERIA | +| | ++----------------------------------------------------------------------------------------+ +``` + +--- + +## Project Overview + +Students are the reverse-engineering reserve team called in after DEEPLINE +Metro Authority's rebuilt DEEPLINE-AUTH relay image shipped four corrupted +engineering constants: a miscalibrated release threshold, a false TRACK banner +string, an overstated block length, and a poisoned ARX signal seed. Students +reverse engineer `CTF-02.bin` with Ghidra, patch all four defects, capture the +runtime-derived signal key live in GDB, recover the Ouroboros authority frame, +export a corrected image, flash it to real hardware, and prove the corrected +behavior on a physical Pico 2. + +The challenge is a standalone capstone exercise and contains no answer, +constant, address, bug, or patch belonging to any other course assignment. + +--- + +## Learning Objectives + +- Decode an ARM Cortex-M33 vector and boot table and identify the reset handler + and initial stack pointer. +- Translate Thumb reset-vector addresses into real function entry points and + trace literal-pool entries to their data. +- Locate four corrupted constants: a boundary comparison, a status string, an + 8-byte IEEE-754 double, and an ARX signal seed. +- Capture a runtime-derived key with GDB, override a register, and set a + watchpoint on stored SRAM state. +- Recover and authenticate an Argon2id plus XChaCha20-Poly1305 authority frame. + +Students must use only Weeks 1-8 concepts: ARM registers, stack behavior, +USB-CDC output, GDB, Ghidra static analysis and binary patching, vector tables, +reset startup, XIP, Thumb addressing, data segments and literal pools, +condition-code analysis, runtime key derivation, and the Argon2id plus +XChaCha20-Poly1305 authenticated gate. + +--- + +## Deliverables Checklist + +| # | Deliverable | Format | Criterion | +|---|-------------|--------|-----------| +| 1 | Ghidra project screenshot | PNG/JPG | 1.1 | +| 2 | Vector table and boot table | Inside `CTF-02-Answers.md` | 1.2 | +| 3 | `main()` and status-loop table | Inside `CTF-02-Answers.md` | 1.3 | +| 4 | Literal pool trace | Inside `CTF-02-Answers.md` | 1.4 | +| 5 | Bug #1 evidence and patches | Inside `CTF-02-Answers.md` | 2.1-2.4 | +| 6 | Bug #2 evidence and patch | Inside `CTF-02-Answers.md` | 3.1-3.4 | +| 7 | Bug #3 evidence and patch | Inside `CTF-02-Answers.md` | 4.1-4.3 | +| 8 | Bug #4 evidence and patch | Inside `CTF-02-Answers.md` | 5.1-5.4 | +| 9 | GDB register capture | Inside `CTF-02-Answers.md` | 6.1-6.4 | +| 10 | Ouroboros gate recovery and auth | Inside `CTF-02-Answers.md` | 7.1-7.4 | +| 11 | `CTF-02_fixed.bin` | BIN file | 8.1 | +| 12 | `CTF-02_fixed.uf2` | UF2 file | 8.2 | +| 13 | Corrected console transcript | Inside `CTF-02-Answers.md` | 8.3 | +| 14 | Summary table of all patches | Inside `CTF-02-Answers.md` | 8.4 | +| 15 | Written reflection | Inside `CTF-02-Answers.md` | 9.1-9.2 | + +--- + +## Required Tools and Equipment + +| Tool | Purpose | +|------|---------| +| Raspberry Pi Pico 2 | Isolated target | +| USB-CDC virtual serial console | Observe output and type the gate passphrase | +| SWD debug probe | GDB inspection | +| Ghidra | Static analysis and binary patching | +| GDB | Dynamic analysis and register capture | +| Python (`uf2conv.py`) | UF2 conversion | +| `CTF-02.bin` and `CTF-02.uf2` | Supplied artifacts | + +Console settings: **USB-CDC virtual COM port, 115200 baud, 8 data bits, no +parity, 1 stop bit**. + +--- + +## Artifact Identity + +The instructor-issued artifact hashes are: + +```text +CTF-02.bin 85330C37CD0897746B1AF447E4BAC371DDE2042ABD2D61D58A61FE2A8EEF3537 +CTF-02.uf2 F3CD4840260DB820D792758CECACC5297BEF1971B9EACF7601279256D8AF1EAB +``` + +--- + +## Grading Rubric - Detailed Breakdown + +### Task 1: Setup and Initial Analysis (12 points) + +| Criterion | Points | Full credit | Partial credit | No credit | +|-----------|--------|-------------|----------------|-----------| +| Criterion 1.1: Ghidra Project Setup | 3 | Correct project name, `ARM Cortex 32-bit little endian`, base `0x10000000` | One item off | Not set up | +| Criterion 1.2: Vector Table Decoding | 3 | Correct base, initial SP, reset pointer | One missing | Not found | +| Criterion 1.3: main() and Status-Loop Addresses | 4 | Both addresses correct | One correct | Neither found | +| Criterion 1.4: Thumb Addressing and Literal Pool | 2 | Bit 0 cleared and one pool entry traced to its string | Partial | Incorrect | + +### Task 2: Find and Patch Bug #1: The Miscalibrated Release Threshold (15 points) + +| Criterion | Points | Full credit | Partial credit | No credit | +|-----------|--------|-------------|----------------|-----------| +| Criterion 2.1: Locate Compare Sites A and B | 6 | Both addresses and original bytes | One site | Not found | +| Criterion 2.2: Correct Immediate-Value Reasoning | 4 | Explains the `<` to `<=` transform and gives `0x3B` | Correct value, no reasoning | Wrong value | +| Criterion 2.3: Patch Compare Sites A and B | 4 | Both byte changes verified | One site | Not patched | +| Criterion 2.4: Explain Why Both Sites Must Be Patched | 1 | Clear explanation of the two independent comparisons | Vague | Missing | + +### Task 3: Find and Patch Bug #2: The False TRACK Banner (10 points) + +| Criterion | Points | Full credit | Partial credit | No credit | +|-----------|--------|-------------|----------------|-----------| +| Criterion 3.1: Locate the Banner String | 3 | Correct address and cross-reference | Approximate | Not found | +| Criterion 3.2: Patch Six Characters | 4 | All six bytes changed, length preserved | Correct text, wrong bytes documented | Wrong length | +| Criterion 3.3: Character-by-Character Documentation | 2 | Original vs patched byte for all six characters | Partial | Missing | +| Criterion 3.4: Explain the Danger of a Hardcoded Status Word | 1 | Clear, specific reasoning | Generic | Missing | + +### Task 4: Find and Patch Bug #3: The Block Length Constant (10 points) + +| Criterion | Points | Full credit | Partial credit | No credit | +|-----------|--------|-------------|----------------|-----------| +| Criterion 4.1: Locate the .data Double | 3 | Correct address traced from the BLOCK LENGTH print | Approximate | Not found | +| Criterion 4.2: IEEE-754 Bytes and Print Math | 4 | Original and patched 8-byte double with print math (3200 M to 320 M) | Correct patch, no math | Wrong bytes | +| Criterion 4.3: Patch to Print 320 M | 3 | Console shows `BLOCK LENGTH: 320 M` | Wrong bytes | Not patched | + +### Task 5: Find and Patch Bug #4: The Signal Seed (15 points) + +| Criterion | Points | Full credit | Partial credit | No credit | +|-----------|--------|-------------|----------------|-----------| +| Criterion 5.1: Locate SIGNAL_SPEC and the Seed | 5 | `0x2D879291` located and wrong seed `0x0A0A0A0A` found | Partial | Not found | +| Criterion 5.2: Patch the Seed | 4 | Seed bytes changed to `74 65 20 6B` | Wrong byte | Not patched | +| Criterion 5.3: Explain the ARX Derivation | 3 | Correct trace of the per-cycle derivation | Vague | Missing | +| Criterion 5.4: Separate the Security Layers | 3 | Correctly explains what the seed fixes versus the gate | Generic | Missing | + +### Task 6: GDB Register Capture of the Derived Key (15 points) + +| Criterion | Points | Full credit | Partial credit | No credit | +|-----------|--------|-------------|----------------|-----------| +| Criterion 6.1: Breakpoint at the Derive Return | 4 | Correct address and `$r0` read as the bug-derived key | Address off | Not found | +| Criterion 6.2: Inspect the Two Arguments | 4 | Live seed and derived IV captured at the second call | One correct | Missing | +| Criterion 6.3: Override the Register | 4 | `$r0` set to `0x2D879291` and the next cycle shows `OK` | Partial | Missing | +| Criterion 6.4: Watchpoint on the Stored Key | 3 | Watchpoint on the SRAM key location documented | Approximate | Missing | + +### Task 7: Recover the Ouroboros Authority Frame (10 points) + +| Criterion | Points | Full credit | Partial credit | No credit | +|-----------|--------|-------------|----------------|-----------| +| Criterion 7.1: Locate Salt, Nonce, Ciphertext, and Tag | 4 | All three addresses correct in flash | Two correct | Not found | +| Criterion 7.2: Document Argon2id Parameters and Payload Contract | 2 | Correct memory/time/parallelism and payload layout | Partial | Missing | +| Criterion 7.3: Authenticate with the 12-Word Passphrase | 2 | `AUTHORITY FRAME: VERIFIED`, LED on, payload printed | Partial | Not shown | +| Criterion 7.4: State the Honest Quantum Boundary | 2 | Grover halves symmetric exponents; not strict PQC | Generic | Misstates | + +### Task 8: Export and Verify (8 points) + +| Criterion | Points | Full credit | Partial credit | No credit | +|-----------|--------|-------------|----------------|-----------| +| Criterion 8.1: Export CTF-02_fixed.bin | 1 | Valid patched binary | Corrupted | Not submitted | +| Criterion 8.2: Convert to CTF-02_fixed.uf2 | 1 | Correct base and family flags | Wrong flags | Not submitted | +| Criterion 8.3: Hardware Verification | 4 | Corrected console output confirmed (CRITICAL/HELD in 2s stream; DANGER at boot/Ghidra) | Some lines corrected | No verification | +| Criterion 8.4: Summary Table of All Patches | 2 | Complete address and before/after table | Missing entries | No table | + +### Task 9: Written Reflection (5 points) + +| Criterion | Points | Full credit | Partial credit | No credit | +|-----------|--------|-------------|----------------|-----------| +| Criterion 9.1: "Rushed Build" Is Not an Excuse | 2 | Specific, grounded reasoning | Generic | Missing | +| Criterion 9.2: One Engineering Practice per Failure Area | 3 | Concrete practices for the bugs and for image authenticity | Names some | Missing | + +--- + +## Common Pitfalls + +| Pitfall | Consequence | Avoidance | +|---------|-------------|-----------| +| Patching only one threshold site | One status line still lies | Patch both `0x10000302` and `0x10000312` | +| Assuming the immediate equals the limit | Off-by-one, wrong boundary | Use `0x3B` (59), not `0x3C` (60) | +| Using Patch Instruction before IT block | Re-disassembler context conflict swallows Site B | In Listing press `C` -> edit byte in Bytes window (pencil) -> press `D` | +| Missing boot banner in serial terminal | PuTTY misses one-time 5ms boot banner | Pulse RUN to GND while connected to capture | +| Replacing a string with a different length | Corrupts adjacent flash | `NORMAL` and `DANGER` are both 6 bytes | +| Treating the block length as an integer | Misses the 8-byte double | Follow the value into `.data`, decode IEEE-754 | +| Using the wrong 0.32 bytes | Prints 316 M instead of 320 M | Use `7B 14 AE 47 E1 7A D4 3F` | +| Treating an odd vector address as invalid | Thumb analysis fails | Clear bit 0 | +| Starting the seed patch at the wrong offset | Wrong seed, key never matches | Seed is at `0x1000EC70` | + +--- + +## How To Breadboard + +- **Raspberry Pi Pico 2** powered over USB. +- **USB-CDC virtual serial console:** open the Pico's COM port at 115200 baud, + 8 data bits, no parity, 1 stop bit. +- **SWD debug probe:** connect SWCLK, SWDIO, GND, and 3.3 V to the Pico debug + header for GDB inspection and register capture. +- No other peripherals are required; the authority LED is on-board. + +--- + +## Memory Map Reference + +| Region | Address | Purpose | +|--------|---------|---------| +| Bootrom | `0x00000000` | Immutable boot code | +| Flash/XIP | `0x10000000` | Vector table, code, rodata, `.data` init image | +| SRAM | `0x20000000` | Stack and writable state | + +--- + +## Deadline & Submission + +- Create a folder containing the Ghidra screenshot, `CTF-02_fixed.bin`, and + `CTF-02_fixed.uf2`. +- Write all written answers in a single file named `CTF-02-Answers.md` inside that + folder. +- ZIP the folder as `lastname-firstname-CTF-02.zip`. +- Submit the ZIP before the posted deadline; late submissions lose 10 percent + per day. + +--- + +## Grade Scale + +| Grade | Percentage | Points | +|-------|------------|--------| +| A+ | 97-100% | 97-100 | +| A | 93-96% | 93-96 | +| A- | 90-92% | 90-92 | +| B+ | 87-89% | 87-89 | +| B | 84-86% | 84-86 | +| B- | 80-83% | 80-83 | +| C | 70-79% | 70-79 | +| F | 0-69% | 0-69 | + +--- + +## Academic Integrity + +Use only the supplied Pico 2 and firmware. Do not connect the exercise to an +operational railway, metro system, public network, military system, or +third-party device. This is a controlled, isolated educational exercise. All +analysis and patches must be your own work; sharing binaries, addresses, keys, +passphrases, or answers is a violation of the academic integrity policy. + +--- + +## Reference Material + +| Topic | Reference | +|-------|-----------| +| ARM Cortex-M33 registers and stack | Week 1 | +| USB-CDC output and console capture | Week 2 | +| Vector tables, reset startup, and XIP | Week 2 | +| Ghidra static analysis and binary patching | Week 3 | +| Data segments, literal pools, IEEE-754 | Week 4 | +| Condition-code analysis | Week 5 | +| Runtime key derivation and GDB register capture | Week 6 | +| Argon2id and XChaCha20-Poly1305 authenticated gate | Week 8 | diff --git a/0x0017a_ctf/CTF-02-R.pdf b/0x0017a_ctf/CTF-02-R.pdf new file mode 100644 index 0000000..43bcdae Binary files /dev/null and b/0x0017a_ctf/CTF-02-R.pdf differ diff --git a/0x0017a_ctf/CTF-02-S.md b/0x0017a_ctf/CTF-02-S.md new file mode 100644 index 0000000..dc05e3f --- /dev/null +++ b/0x0017a_ctf/CTF-02-S.md @@ -0,0 +1,652 @@ +# Operation Copperhead - Instructor Solution Key + +``` ++----------------------------------------------------------------------------------------+ +| | +| ██████╗ ██╗ █████╗ ██████╗██╗ ██╗███████╗████████╗ █████╗ ██████╗ ████████╗ | +| ██╔══██╗██║ ██╔══██╗██╔════╝██║ ██╔╝██╔════╝╚══██╔══╝██╔══██╗██╔══██╗╚══██╔══╝ | +| ██████╔╝██║ ███████║██║ █████╔╝ ███████╗ ██║ ███████║██████╔╝ ██║ | +| ██╔══██╗██║ ██╔══██║██║ ██╔═██╗ ╚════██║ ██║ ██╔══██║██╔══██╗ ██║ | +| ██████╔╝███████╗██║ ██║╚██████╗██║ ██╗███████╗ ██║ ██║ ██║██║ ██║ ██║ | +| ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝██║ ██║╚══════╝ ╚═╝ ╚═╝ ╚═╝██║ ██║ ██║ | +| | +| | +| O P E R A T I O N C O P P E R H E A D | +| | +| *** INSTRUCTOR SOLUTION KEY: RESTRICTED *** | +| | ++----------------------------------------------------------------------------------------+ +``` + +> The task and criterion headings in this key are word-for-word identical to +> `CTF-02-R.md`, so a student can match each criterion one-to-one. + +--- + +## Artifact Identity + +| Artifact | Value | +|----------|-------| +| Student image | `CTF-02.bin` | +| Flash image | `CTF-02.uf2` | +| Target | Raspberry Pi Pico 2 / RP2350 ARM Cortex-M33 | +| Image base | `0x10000000` | +| Console | USB-CDC virtual COM, 115200 8N1 | + +```text +CTF-02.bin 85330C37CD0897746B1AF447E4BAC371DDE2042ABD2D61D58A61FE2A8EEF3537 +CTF-02.uf2 F3CD4840260DB820D792758CECACC5297BEF1971B9EACF7601279256D8AF1EAB +``` + +Proof tool: `python3 scripts/verify_ctf.py` returns `26/26 checks passed` against +`CTF-02.bin`. + +--- + +## Task 1: Setup and Initial Analysis (12 points) + +### Solution + +**Criterion 1.1: Ghidra Project Setup (3 points).** Import `CTF-02.bin` as +`Raw Binary`, language `ARM:LE:32:Cortex`, base address `0x10000000`, then run +auto-analysis. + +**Criterion 1.2: Vector Table Decoding (3 points).** +First 32 bytes of `CTF-02.bin`: + +```text +00 20 08 20 5B 01 00 10 1B 01 00 10 1D 01 00 10 +11 01 00 10 11 01 00 10 11 01 00 10 11 01 00 10 +``` + +| Evidence | Answer | +|----------|--------| +| Vector table base | `0x10000000` | +| Initial SP | `0x20082000` | +| Reset pointer (as stored) | `0x1000015B` | +| Reset instruction address | `0x1000015A` | + +**Criterion 1.3: main() and Status-Loop Addresses (4 points).** + +| Element | Address | +|---------|---------| +| `main()` | `0x100002E8` | +| Recurring status loop start | `0x1000034C` | +| Loop back-edge (`b.n 0x1000034C`) | `0x1000044E` | + +**Criterion 1.4: Thumb Addressing and Literal Pool (2 points).** +The stored reset pointer `0x1000015B` has bit 0 set, selecting Thumb mode. +Clearing bit 0 gives `0x1000015A`. A representative literal pool entry is +`0x100004B4`, which holds `0x1000C4C8`, the address of the format string +`"BLOCK STATE: %s"`, loaded by `ldr r0, [pc, #308]` at `0x1000037C`. + +**Supporting Reference: SRAM Symbols (Ghidra names to semantic roles).** + +| Ghidra Label | SRAM Address | Section | Role | Source Symbol | +|--------------|--------------|---------|------|---------------| +| `DAT_20001188` | `0x20001188` | `.data` | Block length double | `g_telemetry` | +| `DAT_20001198` | `0x20001198` | `.data` | Signal key seed | `g_auth_seed` | +| `DAT_2000119C` | `0x2000119C` | `.data` | Track current | `g_block_current` | +| `DAT_20001ECC` | `0x20001ECC` | `.bss` | Dispatch state | `g_dispatch_state` | +| `DAT_20001ED0` | `0x20001ED0` | `.bss` | Fault poll counter | `g_fault_polls` | +| `DAT_20001ED4` | `0x20001ED4` | `.bss` | Input line buffer | `g_linebuf` | +| `DAT_200020D4` | `0x200020D4` | `.bss` | Input write index | `g_lineidx` | +| `DAT_200020D8` | `0x200020D8` | `.bss` | Operator state | `g_operator_state` | +| `DAT_200020DC` | `0x200020DC` | `.bss` | Derived signal key | `g_signal_key` | + +### Grading Rubric (1-to-1 Mapping) + +| Criterion | Points | Full Credit (Answer Key) | Partial Credit | No Credit | +|-----------|--------|--------------------------|----------------|-----------| +| Criterion 1.1: Ghidra Project Setup | 3 | Correct project name, `ARM Cortex 32-bit little endian`, base `0x10000000` | One item off | Not set up | +| Criterion 1.2: Vector Table Decoding | 3 | Correct base, initial SP, reset pointer | One missing | Not found | +| Criterion 1.3: main() and Status-Loop Addresses | 4 | Both addresses correct | One correct | Neither found | +| Criterion 1.4: Thumb Addressing and Literal Pool | 2 | Bit 0 cleared and one pool entry traced to its string | Partial | Incorrect | + +### Instructor Notes & Assembly + +- Confirm the Ghidra import used `Raw Binary`, `ARM:LE:32:Cortex`, base + `0x10000000`, and that auto-analysis completed before any address was read. +- Verify `main()` is `0x100002E8`, the loop head is `0x1000034C`, and the + back-edge is `0x1000044E`. +- For Criterion 1.4, accept any correctly traced literal pool entry; the pool + entry `0x100004B4` holding `0x1000C4C8` (`"BLOCK STATE: %s"`, loaded at + `0x1000037C`) is the reference example. +- The SRAM symbol table is supporting reference material, not a separate + scored criterion. + +--- + +## Task 2: Find and Patch Bug #1: The Miscalibrated Release Threshold (15 points) + +### Solution + +**Criterion 2.1: Locate Compare Sites A and B (6 points).** + +```text +10000302: 2b5e cmp r3, #94 @ 0x5e +10000312: 2b5e cmp r3, #94 @ 0x5e +``` + +| Site | Address | File Offset | Original Bytes | Original Instruction | +|------|---------|-------------|----------------|----------------------| +| A | `0x10000302` | `0x0302` | `5E 2B` | `cmp r3, #94` | +| B | `0x10000312` | `0x0312` | `5E 2B` | `cmp r3, #94` | + +**Criterion 2.2: Correct Immediate-Value Reasoning (4 points).** +The source constant is `SAFE_THRESHOLD = 95` and the test is `x < 95`. For an +unsigned value, `x < 95` is exactly `x <= 94`, so the compiler emits +`cmp r3, #94`. The correct limit is `60`, so the test is `x < 60`, which is +`x <= 59`. The correct patched immediate is **`0x3B` (59)**, not `0x3C` (60). + +**Criterion 2.3: Patch Compare Sites A and B (4 points).** + +| Site | Address | File Offset | Original | Patched | After | +|------|---------|-------------|----------|---------|-------| +| A | `0x10000302` | `0x0302` | `5E 2B` | `3B 2B` | `cmp r3, #59` | +| B | `0x10000312` | `0x0312` | `5E 2B` | `3B 2B` | `cmp r3, #59` | + +**Criterion 2.4: Explain Why Both Sites Must Be Patched (1 point).** +Site A drives the `BLOCK STATE` line and site B drives the `AUTO TRAIN` +decision. Patching only site A makes the console read `CRITICAL` while the +automated dispatch still says `AUTHORIZED`. Frozen reading `87`: `87 <= 94` is +true (wrong); `87 <= 59` is false (correct). + +### Grading Rubric (1-to-1 Mapping) + +| Criterion | Points | Full Credit (Answer Key) | Partial Credit | No Credit | +|-----------|--------|--------------------------|----------------|-----------| +| Criterion 2.1: Locate Compare Sites A and B | 6 | Both addresses and original bytes | One site | Not found | +| Criterion 2.2: Correct Immediate-Value Reasoning | 4 | Explains the `<` to `<=` transform and gives `0x3B` | Correct value, no reasoning | Wrong value | +| Criterion 2.3: Patch Compare Sites A and B | 4 | Both byte changes verified | One site | Not patched | +| Criterion 2.4: Explain Why Both Sites Must Be Patched | 1 | Clear explanation of the two independent comparisons | Vague | Missing | + +### Instructor Notes & Assembly + +- Both sites must be patched: `0x10000302` for `BLOCK STATE` and `0x10000312` + for the `AUTO TRAIN` decision. +- The correct immediate is `0x3B` (59), not `0x3C` (60). +- Verify the byte changes on hardware; the corrected console reads `CRITICAL` + and `HELD`. +- **Ghidra ARM/Thumb Context Note:** In raw `.bin` files, patching an instruction + that precedes an `IT` block (`ite ge`) using the GUI *Patch Instruction* action + triggers Ghidra's `ReDisassembleCommand`. The re-disassembler encounters an + internal context register conflict when trying to re-declare the `ITBlock` + context over existing instructions, collapsing Thumb decoding into 32-bit ARM + mode and swallowing Site B (`0x10000312`). Students must patch using the Bytes + window workflow (Clear `C` -> edit byte `5E` -> `3B` in Bytes window with pencil + icon -> Disassemble `D`) to keep Site B visible and cleanly aligned. + +--- + +## Task 3: Find and Patch Bug #2: The False TRACK Banner (10 points) + +### Solution + +**Criterion 3.1: Locate the Banner String (3 points).** + +| String | Address | +|--------|---------| +| `"TRACK: NORMAL\r"` | `0x1000C4B8` | +| `"NORMAL"` substring to patch | `0x1000C4BF` | + +The string is loaded in `main` and printed once at boot; it never reads the +sensor. + +**Criterion 3.2: Patch Six Characters (4 points).** +`NORMAL` and `DANGER` are both six ASCII characters, so the patch preserves the +length. + +| Address Range | Original Bytes | Patched Bytes | +|---------------|----------------|---------------| +| `0x1000C4BF` - `0x1000C4C4` | `4E 4F 52 4D 41 4C` | `44 41 4E 47 45 52` | + +**Criterion 3.3: Character-by-Character Documentation (2 points).** + +| Address | Original Char | Original Byte | Patched Char | Patched Byte | +|---------|---------------|---------------|--------------|--------------| +| `0x1000C4BF` | N | `4E` | D | `44` | +| `0x1000C4C0` | O | `4F` | A | `41` | +| `0x1000C4C1` | R | `52` | N | `4E` | +| `0x1000C4C2` | M | `4D` | G | `47` | +| `0x1000C4C3` | A | `41` | E | `45` | +| `0x1000C4C4` | L | `4C` | R | `52` | + +**Criterion 3.4: Explain the Danger of a Hardcoded Status Word (1 point).** +The banner never consults the reading, so it reports a healthy track even while +the frozen reading is dangerous, masking the hazard from the operator. + +### Grading Rubric (1-to-1 Mapping) + +| Criterion | Points | Full Credit (Answer Key) | Partial Credit | No Credit | +|-----------|--------|--------------------------|----------------|-----------| +| Criterion 3.1: Locate the Banner String | 3 | Correct address and cross-reference | Approximate | Not found | +| Criterion 3.2: Patch Six Characters | 4 | All six bytes changed, length preserved | Correct text, wrong bytes documented | Wrong length | +| Criterion 3.3: Character-by-Character Documentation | 2 | Original vs patched byte for all six characters | Partial | Missing | +| Criterion 3.4: Explain the Danger of a Hardcoded Status Word | 1 | Clear, specific reasoning | Generic | Missing | + +### Instructor Notes & Assembly + +- `NORMAL` and `DANGER` are both six characters; the patch must not change the + string length or overwrite adjacent flash. +- Confirm the patch covers `0x1000C4BF` through `0x1000C4C4` exactly. +- The banner is printed once at boot and never recomputed, so it is a separate + defect from the threshold. + +--- + +## Task 4: Find and Patch Bug #3: The Block Length Constant (10 points) + +### Solution + +**Criterion 4.1: Locate the .data Double (3 points).** +The console prints `BLOCK LENGTH: 3200 M` from the format string at +`0x1000C4F0`. The value is a `double` in the `.data` init image at +`0x1000EC60` (loaded into `0x20001188` at boot). + +**Criterion 4.2: IEEE-754 Bytes and Print Math (4 points).** +Eight bytes at `0x1000EC60`: + +```text +9A 99 99 99 99 99 09 40 -> 0x400999999999999A -> 3.2 km -> 3200 m +7B 14 AE 47 E1 7A D4 3F -> 0x3FD47AE147AE147B -> 0.32 km -> 320 m +``` + +**Criterion 4.3: Patch to Print 320 M (3 points).** + +| File Offset Range | Flash Address Range | Original Bytes | Patched Bytes | +|-------------------|---------------------|----------------|---------------| +| `0xEC60` - `0xEC67` | `0x1000EC60` - `0x1000EC67` | `9A 99 99 99 99 99 09 40` | `7B 14 AE 47 E1 7A D4 3F` | + +At `0x1000EC68` the adjacent telemetry fields (`03 00 00 00` flags and `07 00` +crossing) are left untouched. + +### Grading Rubric (1-to-1 Mapping) + +| Criterion | Points | Full Credit (Answer Key) | Partial Credit | No Credit | +|-----------|--------|--------------------------|----------------|-----------| +| Criterion 4.1: Locate the .data Double | 3 | Correct address traced from the BLOCK LENGTH print | Approximate | Not found | +| Criterion 4.2: IEEE-754 Bytes and Print Math | 4 | Original and patched 8-byte double with print math (3200 M to 320 M) | Correct patch, no math | Wrong bytes | +| Criterion 4.3: Patch to Print 320 M | 3 | Console shows `BLOCK LENGTH: 320 M` | Wrong bytes | Not patched | + +### Instructor Notes & Assembly + +- The value is an 8-byte IEEE-754 double, not an integer. Follow the + `BLOCK LENGTH` print into `.data` at `0x1000EC60`. +- The patched bytes `7B 14 AE 47 E1 7A D4 3F` decode to `0.32 km` (`320 m`). +- Confirm the adjacent telemetry fields at `0x1000EC68` (`03 00 00 00` and + `07 00`) are left untouched. + +--- + +## Task 5: Find and Patch Bug #4: The Signal Seed (15 points) + +### Solution + +**Criterion 5.1: Locate SIGNAL_SPEC and the Seed (5 points).** +The SIMPLE comparison in the loop is at `0x100003A6`: + +```text +100003a6: 4559 cmp r1, fp ; fp = SIGNAL_SPEC = 0x2D879291 (pool 0x100004FC) +``` + +The corrupted seed is a `0x0A0A0A0A` word in the `.data` init image at +`0x1000EC70` (loaded into `0x20001198` at boot). The byte values `0A 0A 0A 0A` +also appear in the `tbb` jump table at `0x100003D4`; those are not the seed. + +**Criterion 5.2: Patch the Seed (4 points).** +The required seed is the ChaCha expand word `0x6B206574` (`"te k"`), stored +little-endian as `74 65 20 6B`. + +| File Offset Range | Flash Address Range | Original Bytes | Patched Bytes | +|-------------------|---------------------|----------------|---------------| +| `0xEC70` - `0xEC73` | `0x1000EC70` - `0x1000EC73` | `0A 0A 0A 0A` | `74 65 20 6B` | + +**Criterion 5.3: Explain the ARX Derivation (3 points).** +`derive_session_key(seed, iv)` works exactly like this: + +1. Set `a = seed`, `b = iv`, `c = 0x61707865`, `d = 0x3320646E`. +2. Run four ChaCha quarter-rounds. A quarter-round runs four phases with rotate + amounts 16, 12, 8, 7. Each phase is: `a = a + b; d = d XOR a; + d = rotate_left(d, s); c = c + d; b = b XOR c; b = rotate_left(b, s)`. +3. Return `a XOR d`. + +The runtime IV is `derive_session_key(0x6B206574, 0) = 0x43C974F6`. The shipped +seed `0x0A0A0A0A` gives `derive_session_key(0x0A0A0A0A, 0x43C974F6) = +0x915DCFF8` (MISMATCH). The honest seed `0x6B206574` gives +`derive_session_key(0x6B206574, 0x43C974F6) = 0x2D879291`, which equals +`SIGNAL_SPEC` and prints `OK`. + +**Criterion 5.4: Separate the Security Layers (3 points).** +The signal seed only controls the local `SIGNAL KEY` telemetry check. It does +not authenticate the operator. The Argon2id plus XChaCha20-Poly1305 gate is a +separate layer that requires the 12-word passphrase. + +### Grading Rubric (1-to-1 Mapping) + +| Criterion | Points | Full Credit (Answer Key) | Partial Credit | No Credit | +|-----------|--------|--------------------------|----------------|-----------| +| Criterion 5.1: Locate SIGNAL_SPEC and the Seed | 5 | `0x2D879291` located and wrong seed `0x0A0A0A0A` found | Partial | Not found | +| Criterion 5.2: Patch the Seed | 4 | Seed bytes changed to `74 65 20 6B` | Wrong byte | Not patched | +| Criterion 5.3: Explain the ARX Derivation | 3 | Correct trace of the per-cycle derivation | Vague | Missing | +| Criterion 5.4: Separate the Security Layers | 3 | Correctly explains what the seed fixes versus the gate | Generic | Missing | + +### Instructor Notes & Assembly + +- The seed is at `0x1000EC70` in the `.data` init image. The `0A 0A 0A 0A` + bytes in the `tbb` jump table at `0x100003D4` are not the seed. +- The patched seed `74 65 20 6B` is the little-endian form of the ChaCha expand + word `0x6B206574` (`"te k"`). +- The seed only affects the local `SIGNAL KEY` check; the Argon2id plus + XChaCha20-Poly1305 gate is a separate authentication layer. + +--- + +## Task 6: GDB Register Capture of the Derived Key (15 points) + +### Solution + +**Criterion 6.1: Breakpoint at the Derive Return (4 points).** +The per-cycle derive is `bl derive_session_key` at `0x10000352`. Break at the +next instruction, `0x10000356`, and read `$r0`. On the shipped image it is +`0x915DCFF8`. + +```gdb +(gdb) break *0x10000356 +(gdb) continue +(gdb) print/x $r0 # 0x915DCFF8 on the corrupted image +``` + +**Criterion 6.2: Inspect the Two Arguments (4 points).** +At the call entry `0x10000352`: + +| Register | Corrupted image | Meaning | +|----------|-----------------|---------| +| `$r0` | `0x0A0A0A0A` | Seed | +| `$r1` | `0x43C974F6` | Derived IV | + +**Criterion 6.3: Override the Register (4 points).** +With execution at `0x10000356`, set `$r0` to the spec key, then continue. The +next cycle prints `SIGNAL KEY: 0x2D879291 OK`. + +```gdb +(gdb) set $r0 = 0x2D879291 +(gdb) continue +``` + +**Criterion 6.4: Watchpoint on the Stored Key (3 points).** +The key is stored in SRAM at `0x200020DC` (`str r0, [r6, #0]`). + +```gdb +(gdb) watch *0x200020DC +``` + +### Grading Rubric (1-to-1 Mapping) + +| Criterion | Points | Full Credit (Answer Key) | Partial Credit | No Credit | +|-----------|--------|--------------------------|----------------|-----------| +| Criterion 6.1: Breakpoint at the Derive Return | 4 | Correct address and `$r0` read as the bug-derived key | Address off | Not found | +| Criterion 6.2: Inspect the Two Arguments | 4 | Live seed and derived IV captured at the second call | One correct | Missing | +| Criterion 6.3: Override the Register | 4 | `$r0` set to `0x2D879291` and the next cycle shows `OK` | Partial | Missing | +| Criterion 6.4: Watchpoint on the Stored Key | 3 | Watchpoint on the SRAM key location documented | Approximate | Missing | + +### Instructor Notes & Assembly + +- Confirm the breakpoint is placed at `0x10000356`, the instruction after the + `bl derive_session_key` at `0x10000352`. +- On the shipped image `$r0` reads `0x915DCFF8`; `$r0` is the seed `0x0A0A0A0A` + and `$r1` is the derived IV `0x43C974F6`. +- The stored key lives at `0x200020DC`; accept the documented watchpoint. + +--- + +## Task 7: Recover the Ouroboros Authority Frame (10 points) + +### Solution + +**Criterion 7.1: Locate Salt, Nonce, Ciphertext, and Tag (4 points).** + +| Component | Flash Address | Size | +|-----------|---------------|------| +| Ciphertext + Tag | `0x1000CE94` | 64 B | +| Nonce | `0x1000CED4` | 24 B | +| Salt | `0x1000CEEC` | 16 B | + +**Criterion 7.2: Document Argon2id Parameters and Payload Contract (2 points).** +Argon2id: memory `64 KiB`, iterations `3`, parallelism `1`, output key `32 B`, +salt the 16 bytes above. XChaCha20-Poly1305 decrypts the 48-byte ciphertext with +the 16-byte tag. The plaintext is `01 68 65 6C 6C 6F 0D 0A` followed by zeros: +byte 0 turns the GPIO 25 LED on, and bytes 1 through 7 are printed as `hello` +plus carriage-return and newline. + +**Criterion 7.3: Authenticate with the 12-Word Passphrase (2 points).** +At the `RESPONSE> ` prompt, type: + +```text +orbit olive ladder marble quartz canyon ripple saddle violet ember walnut falcon +``` + +Expected result (proven on hardware): + +```text +hello +AUTHORITY FRAME: VERIFIED +``` + +**Criterion 7.4: State the Honest Quantum Boundary (2 points).** +Grover-style search halves the effective security exponent of a symmetric key, +so a 256-bit key gives about 128 bits of quantum security. The construction uses +classical symmetric and password-hashing primitives and does not implement NIST +post-quantum standards. + +### Grading Rubric (1-to-1 Mapping) + +| Criterion | Points | Full Credit (Answer Key) | Partial Credit | No Credit | +|-----------|--------|--------------------------|----------------|-----------| +| Criterion 7.1: Locate Salt, Nonce, Ciphertext, and Tag | 4 | All three addresses correct in flash | Two correct | Not found | +| Criterion 7.2: Document Argon2id Parameters and Payload Contract | 2 | Correct memory/time/parallelism and payload layout | Partial | Missing | +| Criterion 7.3: Authenticate with the 12-Word Passphrase | 2 | `AUTHORITY FRAME: VERIFIED`, LED on, payload printed | Partial | Not shown | +| Criterion 7.4: State the Honest Quantum Boundary | 2 | Grover halves symmetric exponents; not strict PQC | Generic | Misstates | + +### Instructor Notes & Assembly + +- Verify the three component addresses in flash: ciphertext plus tag at + `0x1000CE94`, nonce at `0x1000CED4`, salt at `0x1000CEEC`. +- The passphrase is fixed for the lab; a successful gate prints `hello` and + `AUTHORITY FRAME: VERIFIED` and lights the on-board authority LED. +- Grade Criterion 7.4 on the honest boundary: 256-bit symmetric key maps to + about 128 bits under Grover, and the design is not NIST post-quantum. + +--- + +## Task 8: Export and Verify (8 points) + +### Solution + +**Criterion 8.1: Export CTF-02_fixed.bin (1 point).** +Export the patched program from Ghidra (`File -> Export Program...`, `Binary +Format`) as `CTF-02_fixed.bin`. The shipped image is 62,308 bytes. + +**Criterion 8.2: Convert to CTF-02_fixed.uf2 (1 point).** + +```bash +python uf2conv.py CTF-02_fixed.bin --base 0x10000000 --family 0xe48bff59 --output CTF-02_fixed.uf2 +``` + +**Criterion 8.3: Hardware Verification (4 points).** + +Before patching: + +```text +DEEPLINE METRO AUTHORITY +ADAPTIVE SIGNAL WINDOW: 38 MINUTES +USB-CDC 115200 8N1 | AUTHORIZED LAB CONSOLE +TRACK: NORMAL +BLOCK STATE: STABLE +AUTO TRAIN: AUTHORIZED +BLOCK LENGTH: 3200 M +FAULT POLLS: 1 +SIGNAL KEY: 0x915DCFF8 MISMATCH +RESPONSE> +``` + +After all four patches: + +```text +DEEPLINE METRO AUTHORITY +ADAPTIVE SIGNAL WINDOW: 38 MINUTES +USB-CDC 115200 8N1 | AUTHORIZED LAB CONSOLE +TRACK: DANGER +BLOCK STATE: CRITICAL +AUTO TRAIN: HELD +BLOCK LENGTH: 320 M +FAULT POLLS: 1 +SIGNAL KEY: 0x2D879291 OK +RESPONSE> +``` + +**Criterion 8.4: Summary Table of All Patches (2 points).** + +| # | Bug | File Offset | Flash Address | Original Bytes | Patched Bytes | +|---|-----|-------------|---------------|----------------|---------------| +| 1a | Operator threshold | `0x0302` | `0x10000302` | `5E 2B` | `3B 2B` | +| 1b | Dispatch threshold | `0x0312` | `0x10000312` | `5E 2B` | `3B 2B` | +| 2 | TRACK banner | `0xC4BF` - `0xC4C4` | `0x1000C4BF` - `0x1000C4C4` | `4E 4F 52 4D 41 4C` | `44 41 4E 47 45 52` | +| 3 | Block length | `0xEC60` - `0xEC67` | `0x1000EC60` - `0x1000EC67` | `9A 99 99 99 99 99 09 40` | `7B 14 AE 47 E1 7A D4 3F` | +| 4 | Signal seed | `0xEC70` - `0xEC73` | `0x1000EC70` - `0x1000EC73` | `0A 0A 0A 0A` | `74 65 20 6B` | + +### Grading Rubric (1-to-1 Mapping) + +| Criterion | Points | Full Credit (Answer Key) | Partial Credit | No Credit | +|-----------|--------|--------------------------|----------------|-----------| +| Criterion 8.1: Export CTF-02_fixed.bin | 1 | Valid patched binary | Corrupted | Not submitted | +| Criterion 8.2: Convert to CTF-02_fixed.uf2 | 1 | Correct base and family flags | Wrong flags | Not submitted | +| Criterion 8.3: Hardware Verification | 4 | Corrected console output confirmed on hardware | Some lines corrected | No verification | +| Criterion 8.4: Summary Table of All Patches | 2 | Complete address and before/after table | Missing entries | No table | + +### Instructor Notes & Assembly + +- Verify the exported image with `python3 scripts/verify_ctf.py`; the shipped + check expects `26/26 checks passed` against `CTF-02.bin`. +- Confirm the UF2 conversion used base `0x10000000` and family `0xe48bff59`. +- **Serial Terminal Timing:** Note that `print_identity()` (`TRACK: NORMAL`) + fires within the first 5 milliseconds of boot. In normal lab usage, PuTTY + attaches after boot and will display the continuous 2-second status loop + (`BLOCK STATE: CRITICAL`, `AUTO TRAIN: HELD`). To see the corrected banner, + the student must pulse `RUN` to `GND` while PuTTY is open, or demonstrate + the string change at `0x1000C4BF` via Ghidra static analysis. +- The shipped image is 62,308 bytes; confirm the exported corrected image is a + valid patched binary with all four fixes present. + +--- + +## Task 9: Written Reflection (5 points) + +### Solution + +**Criterion 9.1: "Rushed Build" Is Not an Excuse (2 points).** +The rebuild shipped four constants that were never checked against their +documented limits, which is exactly what produced the false-safe reading. +Pressure explains why the checks were skipped, not why they should be skipped. + +**Criterion 9.2: One Engineering Practice per Failure Area (3 points).** +- Physical limits (Bugs #1 and #3): one shared configuration header plus a + build-time assertion that each compiled limit matches its documented value. +- Banner (Bug #2): remove static banners; a hardware-in-the-loop test that + compares displayed state to the live register. +- Seed integrity (Bug #4): reproducible builds with golden artifact hash + comparison so keys and seeds match the certified specification. +- Image authenticity: enable RP2350 hardware secure boot with OTP hash + verification so a modified image will not run. + +### Grading Rubric (1-to-1 Mapping) + +| Criterion | Points | Full Credit (Answer Key) | Partial Credit | No Credit | +|-----------|--------|--------------------------|----------------|-----------| +| Criterion 9.1: "Rushed Build" Is Not an Excuse | 2 | Specific, grounded reasoning | Generic | Missing | +| Criterion 9.2: One Engineering Practice per Failure Area | 3 | Concrete practices for the bugs and for image authenticity | Names some | Missing | + +### Instructor Notes & Assembly + +- Grade the specificity of the reasoning, not the length of the prose. +- Require concrete practices across the failure areas, including at least one + practice for image authenticity. + +--- + +## How To Breadboard + +- **Raspberry Pi Pico 2** powered over USB. +- **USB-CDC virtual serial console:** open the Pico's COM port at 115200 baud, + 8 data bits, no parity, 1 stop bit. +- **SWD debug probe:** connect SWCLK, SWDIO, GND, and 3.3 V to the Pico debug + header for GDB inspection and register capture. +- No other peripherals are required; the authority LED is on-board. + +--- + +## Complete Grading Summary + +| Task | Title | Points | +|------|-------|--------| +| Task 1 | Setup and Initial Analysis | 12 | +| Task 2 | Find and Patch Bug #1: The Miscalibrated Release Threshold | 15 | +| Task 3 | Find and Patch Bug #2: The False TRACK Banner | 10 | +| Task 4 | Find and Patch Bug #3: The Block Length Constant | 10 | +| Task 5 | Find and Patch Bug #4: The Signal Seed | 15 | +| Task 6 | GDB Register Capture of the Derived Key | 15 | +| Task 7 | Recover the Ouroboros Authority Frame | 10 | +| Task 8 | Export and Verify | 8 | +| Task 9 | Written Reflection | 5 | +| **TOTAL** | | **100** | + +--- + +## Instructor Notes + +Safety: Use only the supplied Pico 2, SWD probe, and firmware. Never connect the +exercise to an operational railway, metro system, public network, military +system, or third-party device. + +### Common Student Mistakes + +- Patching only one threshold site (`0x10000302` or `0x10000312`), leaving one + status line lying. +- Assuming the immediate equals the limit, producing an off-by-one boundary; + the correct byte is `0x3B` (59), not `0x3C` (60). +- Replacing the banner string with a different length, corrupting adjacent + flash; `NORMAL` and `DANGER` are both 6 bytes. +- Treating the block length as an integer and missing the 8-byte double in + `.data`. +- Using the wrong `0.32` bytes and printing `316 M` instead of `320 M`. +- Treating the odd vector address `0x1000015B` as invalid instead of clearing + bit 0 to get `0x1000015A`. +- Starting the seed patch at the wrong offset; the seed is at `0x1000EC70`. + +### Partial Credit Guidelines + +- Award partial credit for one correct threshold site out of two, or for a + correct immediate value without the `<` to `<=` reasoning. +- Award partial credit for a correct banner text with incorrectly documented + bytes, or for partial character-by-character documentation. +- Award partial credit for a correct block-length patch without the IEEE-754 + print math. +- Award partial credit for one of the two GDB argument captures, or for a + partial register override. +- Award no credit for patches that change string length or overwrite adjacent + flash. + +--- + +## Appendix: Expected Binary Diff + +| # | Bug | File Offset(s) | Flash Address(es) | Original Bytes | Patched Bytes | +|---|-----|----------------|-------------------|----------------|---------------| +| 1a | Operator threshold | `0x0302` | `0x10000302` | `5E 2B` | `3B 2B` | +| 1b | Dispatch threshold | `0x0312` | `0x10000312` | `5E 2B` | `3B 2B` | +| 2 | TRACK banner | `0xC4BF` - `0xC4C4` | `0x1000C4BF` - `0x1000C4C4` | `4E 4F 52 4D 41 4C` | `44 41 4E 47 45 52` | +| 3 | Block length | `0xEC60` - `0xEC67` | `0x1000EC60` - `0x1000EC67` | `9A 99 99 99 99 99 09 40` | `7B 14 AE 47 E1 7A D4 3F` | +| 4 | Signal seed | `0xEC70` - `0xEC73` | `0x1000EC70` - `0x1000EC73` | `0A 0A 0A 0A` | `74 65 20 6B` | + +Four defects, five changed regions: two immediate bytes (`0x3B 2B` at each +threshold), six banner bytes, eight block-length bytes, and four seed bytes. diff --git a/0x0017a_ctf/CTF-02-S.pdf b/0x0017a_ctf/CTF-02-S.pdf new file mode 100644 index 0000000..2ce477f Binary files /dev/null and b/0x0017a_ctf/CTF-02-S.pdf differ diff --git a/0x0017a_ctf/CTF-02.bin b/0x0017a_ctf/CTF-02.bin new file mode 100644 index 0000000..b20d1cd Binary files /dev/null and b/0x0017a_ctf/CTF-02.bin differ diff --git a/0x0017a_ctf/CTF-02.uf2 b/0x0017a_ctf/CTF-02.uf2 new file mode 100644 index 0000000..b0a537c Binary files /dev/null and b/0x0017a_ctf/CTF-02.uf2 differ diff --git a/0x0017a_ctf/CTF-02_fixed.bin b/0x0017a_ctf/CTF-02_fixed.bin new file mode 100644 index 0000000..0918eac Binary files /dev/null and b/0x0017a_ctf/CTF-02_fixed.bin differ diff --git a/0x0017a_ctf/CTF-02_fixed.uf2 b/0x0017a_ctf/CTF-02_fixed.uf2 new file mode 100644 index 0000000..830dd27 Binary files /dev/null and b/0x0017a_ctf/CTF-02_fixed.uf2 differ diff --git a/0x0017a_ctf/include/auth.h b/0x0017a_ctf/include/auth.h new file mode 100644 index 0000000..e8ddc9e --- /dev/null +++ b/0x0017a_ctf/include/auth.h @@ -0,0 +1,143 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent/encryption-c-rp2350 +// File: auth.h +// Desc: Declares the Ouroboros authentication engine API for RP2350 firmware. +// Created: 2026 + +#ifndef AUTH_H +#define AUTH_H + +#include +#include +#include + +/** + * @brief Onboard LED GPIO pin number. + * + * The RP2350 Pico 2 onboard LED is connected to GPIO 25. Driven high + * on successful authentication and low on failure or idle. + */ +#define AUTH_LED_PIN 25u + +/** + * @brief Maximum accepted terminal passphrase length in bytes. + * + * The CLI accepts interactive human-entered passphrases up to 512 bytes, + * matching the hardened host demo boundary before policy validation. + */ +#define AUTH_PASSPHRASE_MAX_LEN 512u + +/** + * @brief Required number of lowercase words in the hardened passphrase. + * + * The embedded hardened workflow matches the host-side policy exactly: + * twelve lowercase ASCII words separated by whitespace. + */ +#define AUTH_REQUIRED_WORDS 12u + +/** + * @brief Hardened Argon2id salt size in bytes. + * + * Every demo artifact carries a per-ciphertext random 128-bit salt. + */ +#define AUTH_SALT_SIZE 16u + +/** + * @brief Hardened XChaCha20 nonce size in bytes. + * + * XChaCha20-Poly1305 consumes a 192-bit nonce in the outer construction. + */ +#define AUTH_NONCE_SIZE 24u + +/** + * @brief Subkey size in bytes derived from Argon2id. + * + * The AEAD key size is 256 bits. + */ +#define AUTH_KEY_SIZE 32u + +/** + * @brief AEAD authentication tag size in bytes. + * + * XChaCha20-Poly1305 appends a 128-bit authentication tag. + */ +#define AUTH_TAG_SIZE 16u + +/** + * @brief Plaintext payload size in bytes. + * + * The fixed dispatch payload is 48 bytes: LED state, UART bytes, + * and trailing reserved bytes matching the Rust hardened demo layout. + */ +#define AUTH_PAYLOAD_SIZE 48u + +/** + * @brief Full ciphertext-plus-tag artifact size in bytes. + * + * The encrypted payload is 48 bytes followed by a 16-byte tag. + */ +#define AUTH_CIPHERTEXT_SIZE (AUTH_PAYLOAD_SIZE + AUTH_TAG_SIZE) + +/** + * @brief Authentication result codes returned by the hardened engine. + * + * These values let the CLI distinguish policy failures from + * cryptographic authentication failures without guessing. + */ +typedef enum auth_result { + AUTH_RESULT_SUCCESS = 0, + AUTH_RESULT_POLICY_VIOLATION = 1, + AUTH_RESULT_AUTHENTICATION_FAILED = 2, + AUTH_RESULT_INTERNAL_ERROR = 3, +} auth_result_t; + +/** + * @brief Initialize the Ouroboros authentication module. + * + * Configures the onboard LED GPIO and marks the hardened engine as ready + * for passphrase authentication. + * + * @param None. + * @return bool true when initialization is successful, else false. + */ +bool auth_init(void); + +/** + * @brief Execute the hardened Ouroboros authentication pipeline. + * + * Validates the strict 12-word lowercase passphrase policy, derives the + * 256-bit AEAD key with Argon2id using artifact parameters, decrypts the + * embedded XChaCha20-Poly1305 ciphertext, and dispatches GPIO25/UART + * payload bytes on success. + * + * @param passphrase Pointer to passphrase bytes. + * @param passphrase_len Number of passphrase bytes. + * @return auth_result_t Detailed authentication outcome for the caller. + */ +auth_result_t auth_execute(const uint8_t *passphrase, + size_t passphrase_len); + +#endif // AUTH_H diff --git a/0x0017a_ctf/include/cli.h b/0x0017a_ctf/include/cli.h new file mode 100644 index 0000000..f14d375 --- /dev/null +++ b/0x0017a_ctf/include/cli.h @@ -0,0 +1,59 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: cli.h +// Desc: Declares the CLI UART passphrase input interface for Ouroboros. +// Created: 2026 + +#ifndef CLI_H +#define CLI_H + +#include + +/** + * @brief Print the UART passphrase prompt. + * + * Emits a minimal shell-style prompt followed by a space so the + * terminal clearly indicates that hardened passphrase input is expected. + * + * @param None. + * @return None. + */ +void print_prompt(void); + +/** + * @brief Service one UART polling step for passphrase input. + * + * Polls stdio for a character, dispatches backspace or newline + * handling, and appends printable characters to the passphrase + * buffer. Call repeatedly from the main loop. + * + * @param buf Pointer to mutable passphrase buffer. + * @param idx Pointer to current buffer length. + * @return None. + */ +void service_uart(char *buf, size_t *idx); + +#endif // CLI_H diff --git a/0x0017a_ctf/include/demo_artifact.h b/0x0017a_ctf/include/demo_artifact.h new file mode 100644 index 0000000..b7857a0 --- /dev/null +++ b/0x0017a_ctf/include/demo_artifact.h @@ -0,0 +1,60 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person +// obtaining a copy of this software and associated documentation +// files (the "Software"), to deal in the Software without +// restriction, including without limitation the rights to use, +// copy, modify, merge, publish, distribute, sublicense, and/or +// sell copies of the Software, and to permit persons to whom the +// Software is furnished to do so, subject to the following +// conditions: +// +// The above copyright notice and this permission notice shall be +// included in all copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES +// OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT +// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, +// WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +// DEALINGS IN THE SOFTWARE. +// +// This file is generated by scripts/dec.py. Do not edit by hand. + +#ifndef DEMO_ARTIFACT_H +#define DEMO_ARTIFACT_H + +#include + +#define DEMO_ARTIFACT_FORMAT "ouroboros-hardened-demo-v1" +#define DEMO_MEMORY_KIB 64u +#define DEMO_ITERATIONS 3u +#define DEMO_PARALLELISM 1u + +static const uint8_t DEMO_SALT[16] = { + 0xF2u, 0xD5u, 0x18u, 0x63u, 0x9Au, 0x82u, 0x01u, 0x9Du, + 0xC2u, 0xD7u, 0xAFu, 0xA5u, 0xCDu, 0xB6u, 0xD8u, 0x71u +}; + +static const uint8_t DEMO_NONCE[24] = { + 0x1Cu, 0xEFu, 0x79u, 0x0Du, 0x77u, 0x9Eu, 0x7Cu, 0x04u, + 0xE7u, 0xF0u, 0x66u, 0xDDu, 0x90u, 0xD0u, 0x80u, 0x70u, + 0x87u, 0x97u, 0x67u, 0x1Fu, 0x79u, 0xEFu, 0xC4u, 0xE4u +}; + +static const uint8_t DEMO_CIPHERTEXT_AND_TAG[64] = { + 0x2Cu, 0x23u, 0xB2u, 0x7Eu, 0x95u, 0x62u, 0xB8u, 0xEDu, + 0x9Eu, 0x08u, 0xE0u, 0x6Du, 0xD9u, 0x9Du, 0xB4u, 0x91u, + 0x3Eu, 0x81u, 0x9Au, 0x77u, 0x8Bu, 0xB4u, 0x7Bu, 0x71u, + 0xBCu, 0x66u, 0x1Eu, 0x6Eu, 0x73u, 0x1Au, 0x81u, 0x54u, + 0xCDu, 0xB5u, 0x36u, 0xA4u, 0x76u, 0x7Eu, 0x9Bu, 0xF8u, + 0x53u, 0x3Eu, 0x03u, 0x1Du, 0xB8u, 0xE5u, 0xAEu, 0x7Au, + 0xADu, 0xB4u, 0x31u, 0xCFu, 0x12u, 0xD9u, 0xF9u, 0xC4u, + 0x5Fu, 0xA9u, 0xB9u, 0x4Bu, 0x80u, 0xDCu, 0xBBu, 0xDEu +}; + +#endif // DEMO_ARTIFACT_H diff --git a/0x0017a_ctf/include/mbedtls_config.h b/0x0017a_ctf/include/mbedtls_config.h new file mode 100644 index 0000000..b27211e --- /dev/null +++ b/0x0017a_ctf/include/mbedtls_config.h @@ -0,0 +1,39 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: mbedtls_config.h +// Desc: Configures the minimal mbedTLS cryptographic features required by +// the Ouroboros AEAD engine on RP2350. +// Created: 2026 + +#ifndef MBEDTLS_CONFIG_H +#define MBEDTLS_CONFIG_H + +#define MBEDTLS_CHACHA20_C +#define MBEDTLS_CHACHAPOLY_C +#define MBEDTLS_POLY1305_C +#define MBEDTLS_PLATFORM_C + +#endif // MBEDTLS_CONFIG_H diff --git a/0x0017a_ctf/pico_sdk_import.cmake b/0x0017a_ctf/pico_sdk_import.cmake new file mode 100644 index 0000000..d493cc2 --- /dev/null +++ b/0x0017a_ctf/pico_sdk_import.cmake @@ -0,0 +1,121 @@ +# This is a copy of /external/pico_sdk_import.cmake + +# This can be dropped into an external project to help locate this SDK +# It should be include()ed prior to project() + +# Copyright 2020 (c) 2020 Raspberry Pi (Trading) Ltd. +# +# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the +# following conditions are met: +# +# 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following +# disclaimer. +# +# 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided with the distribution. +# +# 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products +# derived from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, +# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +if (DEFINED ENV{PICO_SDK_PATH} AND (NOT PICO_SDK_PATH)) + set(PICO_SDK_PATH $ENV{PICO_SDK_PATH}) + message("Using PICO_SDK_PATH from environment ('${PICO_SDK_PATH}')") +endif () + +if (DEFINED ENV{PICO_SDK_FETCH_FROM_GIT} AND (NOT PICO_SDK_FETCH_FROM_GIT)) + set(PICO_SDK_FETCH_FROM_GIT $ENV{PICO_SDK_FETCH_FROM_GIT}) + message("Using PICO_SDK_FETCH_FROM_GIT from environment ('${PICO_SDK_FETCH_FROM_GIT}')") +endif () + +if (DEFINED ENV{PICO_SDK_FETCH_FROM_GIT_PATH} AND (NOT PICO_SDK_FETCH_FROM_GIT_PATH)) + set(PICO_SDK_FETCH_FROM_GIT_PATH $ENV{PICO_SDK_FETCH_FROM_GIT_PATH}) + message("Using PICO_SDK_FETCH_FROM_GIT_PATH from environment ('${PICO_SDK_FETCH_FROM_GIT_PATH}')") +endif () + +if (DEFINED ENV{PICO_SDK_FETCH_FROM_GIT_TAG} AND (NOT PICO_SDK_FETCH_FROM_GIT_TAG)) + set(PICO_SDK_FETCH_FROM_GIT_TAG $ENV{PICO_SDK_FETCH_FROM_GIT_TAG}) + message("Using PICO_SDK_FETCH_FROM_GIT_TAG from environment ('${PICO_SDK_FETCH_FROM_GIT_TAG}')") +endif () + +if (PICO_SDK_FETCH_FROM_GIT AND NOT PICO_SDK_FETCH_FROM_GIT_TAG) + set(PICO_SDK_FETCH_FROM_GIT_TAG "master") + message("Using master as default value for PICO_SDK_FETCH_FROM_GIT_TAG") +endif() + +set(PICO_SDK_PATH "${PICO_SDK_PATH}" CACHE PATH "Path to the Raspberry Pi Pico SDK") +set(PICO_SDK_FETCH_FROM_GIT "${PICO_SDK_FETCH_FROM_GIT}" CACHE BOOL "Set to ON to fetch copy of SDK from git if not otherwise locatable") +set(PICO_SDK_FETCH_FROM_GIT_PATH "${PICO_SDK_FETCH_FROM_GIT_PATH}" CACHE FILEPATH "location to download SDK") +set(PICO_SDK_FETCH_FROM_GIT_TAG "${PICO_SDK_FETCH_FROM_GIT_TAG}" CACHE FILEPATH "release tag for SDK") + +if (NOT PICO_SDK_PATH) + if (PICO_SDK_FETCH_FROM_GIT) + include(FetchContent) + set(FETCHCONTENT_BASE_DIR_SAVE ${FETCHCONTENT_BASE_DIR}) + if (PICO_SDK_FETCH_FROM_GIT_PATH) + get_filename_component(FETCHCONTENT_BASE_DIR "${PICO_SDK_FETCH_FROM_GIT_PATH}" REALPATH BASE_DIR "${CMAKE_SOURCE_DIR}") + endif () + FetchContent_Declare( + pico_sdk + GIT_REPOSITORY https://github.com/raspberrypi/pico-sdk + GIT_TAG ${PICO_SDK_FETCH_FROM_GIT_TAG} + ) + + if (NOT pico_sdk) + message("Downloading Raspberry Pi Pico SDK") + # GIT_SUBMODULES_RECURSE was added in 3.17 + if (${CMAKE_VERSION} VERSION_GREATER_EQUAL "3.17.0") + FetchContent_Populate( + pico_sdk + QUIET + GIT_REPOSITORY https://github.com/raspberrypi/pico-sdk + GIT_TAG ${PICO_SDK_FETCH_FROM_GIT_TAG} + GIT_SUBMODULES_RECURSE FALSE + + SOURCE_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-src + BINARY_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-build + SUBBUILD_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-subbuild + ) + else () + FetchContent_Populate( + pico_sdk + QUIET + GIT_REPOSITORY https://github.com/raspberrypi/pico-sdk + GIT_TAG ${PICO_SDK_FETCH_FROM_GIT_TAG} + + SOURCE_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-src + BINARY_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-build + SUBBUILD_DIR ${FETCHCONTENT_BASE_DIR}/pico_sdk-subbuild + ) + endif () + + set(PICO_SDK_PATH ${pico_sdk_SOURCE_DIR}) + endif () + set(FETCHCONTENT_BASE_DIR ${FETCHCONTENT_BASE_DIR_SAVE}) + else () + message(FATAL_ERROR + "SDK location was not specified. Please set PICO_SDK_PATH or set PICO_SDK_FETCH_FROM_GIT to on to fetch from git." + ) + endif () +endif () + +get_filename_component(PICO_SDK_PATH "${PICO_SDK_PATH}" REALPATH BASE_DIR "${CMAKE_BINARY_DIR}") +if (NOT EXISTS ${PICO_SDK_PATH}) + message(FATAL_ERROR "Directory '${PICO_SDK_PATH}' not found") +endif () + +set(PICO_SDK_INIT_CMAKE_FILE ${PICO_SDK_PATH}/pico_sdk_init.cmake) +if (NOT EXISTS ${PICO_SDK_INIT_CMAKE_FILE}) + message(FATAL_ERROR "Directory '${PICO_SDK_PATH}' does not appear to contain the Raspberry Pi Pico SDK") +endif () + +set(PICO_SDK_PATH ${PICO_SDK_PATH} CACHE PATH "Path to the Raspberry Pi Pico SDK" FORCE) + +include(${PICO_SDK_INIT_CMAKE_FILE}) diff --git a/0x0017a_ctf/scripts/dec.py b/0x0017a_ctf/scripts/dec.py new file mode 100644 index 0000000..389efaf --- /dev/null +++ b/0x0017a_ctf/scripts/dec.py @@ -0,0 +1,944 @@ +"""Generate hardened demo artifacts for the RP2350 Ouroboros firmware. + +This script writes the same JSON schema used by the Rust demo and also emits +the generated C header consumed by the embedded firmware. +""" + +import argparse +import json +import platform +import secrets +import sys +from pathlib import Path +from typing import Optional + + +DEFAULT_PASSPHRASE = ( + "orbit olive ladder marble quartz canyon " + "ripple saddle violet ember walnut falcon" +) +DEFAULT_TEXT = "hello" +DEFAULT_OUTPUT_JSON = "scripts/demo_artifact.json" +DEFAULT_OUTPUT_HEADER = "include/demo_artifact.h" +DEFAULT_MEMORY_KIB = 64 +DEFAULT_ITERATIONS = 3 +DEFAULT_PARALLELISM = 1 +ARTIFACT_FORMAT = "ouroboros-hardened-demo-v1" + +_KEY_HELP = "12-word lowercase passphrase" +_TEXT_HELP = "Text to place in payload bytes 1..7" +_OUT_HELP = "Output JSON artifact path" +_HEADER_OUT_HELP = "Output generated C header path" +_FROM_JSON_HELP = ( + "Load existing JSON artifact and emit header without re-encrypting" +) +_CHECK_HEADER_HELP = ( + "Optional path to compare against generated header and fail if stale" +) +_SALT_HEX_HELP = "Optional fixed 16-byte salt as hex" +_NONCE_HEX_HELP = "Optional fixed 24-byte nonce as hex" +_NO_CRLF_HELP = "Do not append CRLF to payload text" +_LED_OFF_HELP = "Encode LED off instead of on" +_MEMORY_HELP = "Argon2 memory cost in KiB" +_ITERATIONS_HELP = "Argon2 time cost" +_PARALLELISM_HELP = "Argon2 parallel lanes" + +_POLICY_ERROR = ( + "Hardened mode requires exactly 12 lowercase ASCII words in --key." +) +_PAYLOAD_TOO_LONG = ( + "Output text is too long for fixed dispatch " + "(max 7 bytes after CRLF handling)." +) +_INVALID_JSON = "Artifact JSON at {0} is invalid JSON." +_MISMATCH_PREFIX = "Detected a Python native-extension architecture mismatch. " +_REINSTALL_DEPS = ("Recreate this virtual environment with a native Python " + "and reinstall deps:") +_REINSTALL_LINES = ( + "rm -rf .venv", + "python3 -m venv .venv", + "source .venv/bin/activate", + "python3 -m pip install -U pip setuptools wheel", + "python3 -m pip install argon2-cffi pynacl", +) +_HEADER_TEMPLATE = """// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person +// obtaining a copy of this software and associated documentation +// files (the "Software"), to deal in the Software without +// restriction, including without limitation the rights to use, +// copy, modify, merge, publish, distribute, sublicense, and/or +// sell copies of the Software, and to permit persons to whom the +// Software is furnished to do so, subject to the following +// conditions: +// +// The above copyright notice and this permission notice shall be +// included in all copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES +// OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT +// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, +// WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +// DEALINGS IN THE SOFTWARE. +// +// This file is generated by scripts/dec.py. Do not edit by hand. + +#ifndef DEMO_ARTIFACT_H +#define DEMO_ARTIFACT_H + +#include + +#define DEMO_ARTIFACT_FORMAT "{artifact_format}" +#define DEMO_MEMORY_KIB {memory_kib}u +#define DEMO_ITERATIONS {iterations}u +#define DEMO_PARALLELISM {parallelism}u + +static const uint8_t DEMO_SALT[16] = {{ +{salt_body} +}}; + +static const uint8_t DEMO_NONCE[24] = {{ +{nonce_body} +}}; + +static const uint8_t DEMO_CIPHERTEXT_AND_TAG[64] = {{ +{cipher_body} +}}; + +#endif // DEMO_ARTIFACT_H +""" + + +def _raise_dependency_error(package_name, install_hint, exc): + """Raise a RuntimeError with environment-aware dependency diagnostics. + + Parameters + ---------- + package_name : str + Package common name for the error message. + install_hint : str + Pip install command in the error message. + exc : Exception + Import error observed while loading the native module. + + Returns + ------- + None + """ + message = "Hardened mode requires {0}. Install with: {1}".format( + package_name, install_hint) + message += _reinstall_message() if _is_arch_mismatch(exc) else "" + raise RuntimeError(message) from exc + + +def _is_arch_mismatch(exc): + """Report whether the interpreter likely has a native-extension mismatch. + + Parameters + ---------- + exc : Exception + Import error observed while loading the native module. + + Returns + ------- + bool + True when the error text matches a native architecture mismatch. + """ + detail = str(exc) + return ( + "incompatible architecture" in detail + or "_cffi_backend" in detail + or "mach-o file, but is an incompatible architecture" in detail + ) + + +def _reinstall_message(): + """Build the native-interpreter reinstall diagnostic text. + + Parameters + ---------- + None + + Returns + ------- + str + Newline-delimited machine and reinstall details, or an empty string. + """ + machine = platform.machine() + head = (_MISMATCH_PREFIX + + "Current interpreter reports machine=" + machine + + ", executable=" + sys.executable + ".") + lines = [" {0}".format(item) for item in _REINSTALL_LINES] + return ("\n" + head + "\n" + _REINSTALL_DEPS + "\n" + + "\n".join(lines)) + + +def _is_policy_compliant(passphrase): + """Return True when passphrase is exactly 12 lowercase ASCII words. + + Parameters + ---------- + passphrase : str + Candidate operator passphrase. + + Returns + ------- + bool + True when the passphrase satisfies the gate policy. + """ + words = passphrase.split() + if len(words) != 12: + return False + return all( + word and all(ch.isascii() and ch.islower() for ch in word) + for word in words + ) + + +def _build_payload(text_str, led_on=True, append_crlf=True): + """Build the fixed 48-byte payload dispatched by the firmware. + + Parameters + ---------- + text_str : str + Console text placed in payload bytes 1..7. + led_on : bool + True turns the LED byte on, False leaves it off. + append_crlf : bool + True appends CRLF to the console text. + + Returns + ------- + bytes + Fixed 48-byte dispatch payload. + """ + tx_bytes = text_str.encode() + (b"\r\n" if append_crlf else b"") + if len(tx_bytes) > 7: + raise ValueError(_PAYLOAD_TOO_LONG) + payload = bytearray(48) + payload[0] = 1 if led_on else 0 + payload[1:1 + len(tx_bytes)] = tx_bytes + return bytes(payload) + + +def _resolve_salt_nonce(salt, nonce): + """Confirm or generate the 16-byte salt and 24-byte nonce. + + Parameters + ---------- + salt : bytes or None + Optional fixed salt value. + nonce : bytes or None + Optional fixed nonce value. + + Returns + ------- + tuple + Confirmed (salt, nonce) byte values. + """ + salt_word = secrets.token_bytes(16) if salt is None else salt + nonce_word = secrets.token_bytes(24) if nonce is None else nonce + if len(salt_word) != 16: + raise ValueError("Hardened salt must be exactly 16 bytes.") + if len(nonce_word) != 24: + raise ValueError("Hardened nonce must be exactly 24 bytes.") + return salt_word, nonce_word + + +def _optional_hex(value, length, label): + """Decode an optional hex argument, leaving absent values as None. + + Parameters + ---------- + value : str or None + Hex string supplied on the command line. + length : int + Expected decoded byte length. + label : str + Field name used in validation errors. + + Returns + ------- + bytes or None + Decoded bytes, or None when value is absent. + """ + return _hex_decode(value, length, label) if value else None + + +def _load_argon2(): + """Load the Argon2 low-level binding with dependency diagnostics. + + Parameters + ---------- + None + + Returns + ------- + tuple + Argon2 Type enum and hash_secret_raw callable. + """ + try: + from argon2.low_level import Type, hash_secret_raw + except ImportError as exc: + install_hint = "python3 -m pip install argon2-cffi" + _raise_dependency_error("argon2-cffi", install_hint, exc) + return Type, hash_secret_raw + + +def _load_nacl_encrypt(): + """Load the XChaCha20-Poly1305 encrypt binding with diagnostics. + + Parameters + ---------- + None + + Returns + ------- + callable + PyNaCl crypto_aead_xchacha20poly1305_ietf_encrypt function. + """ + try: + from nacl.bindings import ( + crypto_aead_xchacha20poly1305_ietf_encrypt as encrypt, + ) + except ImportError as exc: + install_hint = "python3 -m pip install pynacl" + _raise_dependency_error("PyNaCl", install_hint, exc) + return encrypt + + +def _derive_hardened_key(passphrase, salt, memory_kib, iterations, + parallelism): + """Derive a 32-byte key with Argon2id. + + Parameters + ---------- + passphrase : str + Policy-compliant operator passphrase. + salt : bytes + 16-byte Argon2 salt. + memory_kib : int + Argon2 memory cost in KiB. + iterations : int + Argon2 time cost. + parallelism : int + Argon2 parallel lane count. + + Returns + ------- + bytes + Derived 32-byte key. + """ + arg2_type, hash_secret_raw = _load_argon2() + args = ( + passphrase.encode(), salt, iterations, memory_kib, + parallelism, 32, arg2_type, + ) + return hash_secret_raw(*args) + + +def _entry_key(phrase, seed, memory_kib, iterations, parallelism): + """Derive the entry key word for the hardened artifact. + + Parameters + ---------- + phrase : str + Policy-compliant operator passphrase. + seed : bytes + 16-byte Argon2 salt. + memory_kib : int + Argon2 memory cost in KiB. + iterations : int + Argon2 time cost. + parallelism : int + Argon2 parallel lane count. + + Returns + ------- + bytes + Derived 32-byte entry key. + """ + return _derive_hardened_key( + phrase, seed, memory_kib, iterations, parallelism + ) + + +def _build_key_material(phrase, salt, nonce, memory_kib, iterations, + parallelism): + """Resolve salt, nonce, and the entry key. + + Parameters + ---------- + phrase : str + Policy-compliant operator passphrase. + salt : bytes or None + Optional fixed salt value. + nonce : bytes or None + Optional fixed nonce value. + memory_kib : int + Argon2 memory cost in KiB. + iterations : int + Argon2 time cost. + parallelism : int + Argon2 parallel lane count. + + Returns + ------- + tuple + Resolved (salt, nonce, key) values. + """ + seed, nonce_word = _resolve_salt_nonce(salt, nonce) + key = _entry_key(phrase, seed, memory_kib, iterations, parallelism) + return seed, nonce_word, key + + +def build_hardened_entry( + key_str, + text_str, + led_on=True, + append_crlf=True, + salt: Optional[bytes] = None, + nonce: Optional[bytes] = None, + memory_kib=DEFAULT_MEMORY_KIB, + iterations=DEFAULT_ITERATIONS, + parallelism=DEFAULT_PARALLELISM, +): + """Build a hardened encrypted entry with Argon2id + XChaCha20-Poly1305. + + Parameters + ---------- + key_str : str + Policy-compliant 12-word operator passphrase. + text_str : str + Console text placed in payload bytes 1..7. + led_on : bool + True turns the LED byte on, False leaves it off. + append_crlf : bool + True appends CRLF to the console text. + salt : bytes or None + Optional fixed 16-byte salt. + nonce : bytes or None + Optional fixed 24-byte nonce. + memory_kib : int + Argon2 memory cost in KiB. + iterations : int + Argon2 time cost. + parallelism : int + Argon2 parallel lane count. + + Returns + ------- + tuple + Resulting (salt, nonce, ciphertext_and_tag) values. + """ + if not _is_policy_compliant(key_str): + raise ValueError(_POLICY_ERROR) + salt_word, nonce_word, key = _build_key_material( + key_str, salt, nonce, memory_kib, iterations, parallelism) + payload = _build_payload(text_str, led_on, append_crlf) + encrypt = _load_nacl_encrypt() + ciphertext_and_tag = encrypt(payload, b"", nonce_word, key) + return salt_word, nonce_word, ciphertext_and_tag + + +def _hex_decode(value, expected_len, label): + """Decode a hex string and validate the expected byte length. + + Parameters + ---------- + value : str + Hex string to decode. + expected_len : int + Required decoded byte length. + label : str + Field name used in validation errors. + + Returns + ------- + bytes + Decoded bytes of the expected length. + """ + try: + decoded = bytes.fromhex(value) + except ValueError as exc: + raise ValueError("{0} must be valid hex.".format(label)) from exc + if len(decoded) != expected_len: + message = "{0} must decode to exactly {1} bytes.".format( + label, expected_len) + raise ValueError(message) + return decoded + + +def _artifact_dict(memory_kib, iterations, parallelism, salt, nonce, cipher): + """Compose the canonical artifact dictionary. + + Parameters + ---------- + memory_kib : int + Argon2 memory cost in KiB. + iterations : int + Argon2 time cost. + parallelism : int + Argon2 parallel lane count. + salt : bytes + 16-byte salt. + nonce : bytes + 24-byte nonce. + cipher : bytes + 64-byte ciphertext and tag. + + Returns + ------- + dict + Canonical artifact fields with hex-encoded byte values. + """ + return { + "format": ARTIFACT_FORMAT, "memory_kib": memory_kib, + "iterations": iterations, "parallelism": parallelism, + "salt_hex": salt.hex(), "nonce_hex": nonce.hex(), + "ciphertext_and_tag_hex": cipher.hex(), + } + + +def _format_c_array(data, width=8): + """Format bytes as an indented C array literal body. + + Parameters + ---------- + data : bytes + Bytes to serialize as a C array. + width : int + Byte values emitted per source line. + + Returns + ------- + str + Indented, comma-joined C array body. + """ + items = [f"0x{value:02X}u" for value in data] + rows = [", ".join(items[offset:offset + width]) + for offset in range(0, len(items), width)] + return ",\n".join(" " + row for row in rows) + + +def _render_header(artifact): + """Render the generated firmware header text from the artifact. + + Parameters + ---------- + artifact : dict + Canonical artifact dictionary. + + Returns + ------- + str + Complete generated C header text. + """ + cipher = bytes.fromhex(artifact["ciphertext_and_tag_hex"]) + return _HEADER_TEMPLATE.format( + artifact_format=ARTIFACT_FORMAT, memory_kib=artifact["memory_kib"], + iterations=artifact["iterations"], parallelism=artifact["parallelism"], + salt_body=_format_c_array(bytes.fromhex(artifact["salt_hex"])), + nonce_body=_format_c_array(bytes.fromhex(artifact["nonce_hex"])), + cipher_body=_format_c_array(cipher), + ) + + +def _write_header(path, artifact): + """Write the generated firmware header from the hardened artifact. + + Parameters + ---------- + path : str + Destination header file path. + artifact : dict + Canonical artifact dictionary. + + Returns + ------- + Path + Resolved destination header path. + """ + output_path = Path(path) + output_path.parent.mkdir(parents=True, exist_ok=True) + output_path.write_text(_render_header(artifact), encoding="utf-8") + return output_path.resolve() + + +def _parse_json_file(path): + """Load and parse the artifact JSON file. + + Parameters + ---------- + path : str + Artifact JSON file path. + + Returns + ------- + dict + Parsed JSON document. + """ + raw = Path(path).read_text(encoding="utf-8") + try: + parsed = json.loads(raw) + except json.JSONDecodeError as exc: + raise ValueError(_INVALID_JSON.format(path)) from exc + return parsed + + +def _validate_artifact_format(parsed): + """Reject artifact JSON with an unexpected format marker. + + Parameters + ---------- + parsed : dict + Parsed JSON document. + + Returns + ------- + None + """ + actual = parsed.get("format") + if actual != ARTIFACT_FORMAT: + raise ValueError( + "Artifact format must be '{0}', got '{1}'.".format( + ARTIFACT_FORMAT, actual)) + + +def _parsed_ints(parsed): + """Parse the integer cost fields from artifact JSON. + + Parameters + ---------- + parsed : dict + Parsed JSON document. + + Returns + ------- + list + Parsed memory_kib, iterations, and parallelism integer values. + """ + try: + int_names = ("memory_kib", "iterations", "parallelism") + return [int(parsed[name]) for name in int_names] + except (KeyError, TypeError, ValueError) as exc: + raise ValueError( + "Artifact must include integer memory_kib, " + "iterations, and parallelism fields.") from exc + + +def _artifact_ints(parsed): + """Unpack the three integer cost fields from artifact JSON. + + Parameters + ---------- + parsed : dict + Parsed JSON document. + + Returns + ------- + tuple + (memory_kib, iterations, parallelism) integer values. + """ + values = _parsed_ints(parsed) + return values[0], values[1], values[2] + + +def _artifact_from_parsed(parsed): + """Reconstruct a canonical artifact dict from parsed JSON. + + Parameters + ---------- + parsed : dict + Parsed JSON document. + + Returns + ------- + dict + Canonical artifact dictionary. + """ + _validate_artifact_format(parsed) + memory_kib, iterations, parallelism = _artifact_ints(parsed) + cipher_field = "ciphertext_and_tag_hex" + salt = _hex_decode(parsed.get("salt_hex", ""), 16, "salt_hex") + nonce = _hex_decode(parsed.get("nonce_hex", ""), 24, "nonce_hex") + cipher = _hex_decode(parsed.get(cipher_field, ""), 64, cipher_field) + return _artifact_dict( + memory_kib, iterations, parallelism, salt, nonce, cipher) + + +def _load_artifact_json(path): + """Load and validate a hardened artifact JSON for header generation. + + Parameters + ---------- + path : str + Artifact JSON file path. + + Returns + ------- + dict + Canonical artifact dictionary. + """ + parsed = _parse_json_file(path) + return _artifact_from_parsed(parsed) + + +def _check_header_match(generated_path, expected_path): + """Fail when the generated header does not match an expected file. + + Parameters + ---------- + generated_path : str + Generated header file path. + expected_path : str + Expected committed header file path. + + Returns + ------- + None + """ + generated = Path(generated_path).read_text(encoding="utf-8") + expected = Path(expected_path).read_text(encoding="utf-8") + if generated != expected: + raise RuntimeError( + "Generated header does not match committed " + "include/demo_artifact.h. Regenerate and commit " + "updated artifacts with scripts/dec.py.") + + +def _print_header_check(header_path, expected_path): + """Print the verified header match result. + + Parameters + ---------- + header_path : str + Generated header file path. + expected_path : str + Expected committed header file path. + + Returns + ------- + None + """ + _check_header_match(header_path, expected_path) + print("Verified header matches: {0}".format(Path(expected_path).resolve())) + + +def _parse_args(): + """Parse command-line arguments. + + Parameters + ---------- + None + + Returns + ------- + argparse.Namespace + Parsed command-line arguments. + """ + parser = argparse.ArgumentParser(description=__doc__) + for argument_group in _ARGUMENT_GROUPS: + for name, kwargs in argument_group: + parser.add_argument(name, **kwargs) + return parser.parse_args() + + +def _build_from_args(args, salt, nonce): + """Build the hardened entry from parsed arguments. + + Parameters + ---------- + args : argparse.Namespace + Parsed command-line arguments. + salt : bytes or None + Optional fixed salt value. + nonce : bytes or None + Optional fixed nonce value. + + Returns + ------- + tuple + Resulting (salt, nonce, ciphertext_and_tag) values. + """ + return build_hardened_entry( + key_str=args.key, text_str=args.text, led_on=not args.led_off, + append_crlf=not args.no_crlf, salt=salt, nonce=nonce, + memory_kib=args.memory_kib, iterations=args.iterations, + parallelism=args.parallelism, + ) + + +def _flush_outputs(args, salt, nonce, cipher): + """Write the artifact JSON and header, then return the header path. + + Parameters + ---------- + args : argparse.Namespace + Parsed command-line arguments. + salt : bytes + 16-byte salt. + nonce : bytes + 24-byte nonce. + cipher : bytes + 64-byte ciphertext and tag. + + Returns + ------- + Path + Resolved generated header path. + """ + json_path, artifact = _write_demo_json( + args.out, args.memory_kib, args.iterations, args.parallelism, + salt, nonce, cipher) + header_path = _write_header(args.header_out, artifact) + print("Wrote hardened demo artifact JSON: {0}".format(json_path)) + print("Wrote generated firmware header: {0}".format(header_path)) + return header_path + + +def _write_demo_json(path, memory_kib, iterations, parallelism, salt, + nonce, ciphertext_and_tag): + """Write the hardened JSON artifact consumed by docs and validation. + + Parameters + ---------- + path : str + Destination JSON file path. + memory_kib : int + Argon2 memory cost in KiB. + iterations : int + Argon2 time cost. + parallelism : int + Argon2 parallel lane count. + salt : bytes + 16-byte salt. + nonce : bytes + 24-byte nonce. + ciphertext_and_tag : bytes + 64-byte ciphertext and tag. + + Returns + ------- + tuple + Resolved (path, artifact) values. + """ + output_path = Path(path) + output_path.parent.mkdir(parents=True, exist_ok=True) + artifact = _artifact_dict( + memory_kib, iterations, parallelism, salt, nonce, ciphertext_and_tag) + text = json.dumps(artifact, indent=2) + "\n" + output_path.write_text(text, encoding="utf-8") + return output_path.resolve(), artifact + + +def _flush_from_json(args): + """Write the header from an existing artifact JSON. + + Parameters + ---------- + args : argparse.Namespace + Parsed command-line arguments. + + Returns + ------- + Path + Resolved generated header path. + """ + artifact = _load_artifact_json(args.from_json) + header_path = _write_header(args.header_out, artifact) + print("Wrote generated firmware header: {0}".format(header_path)) + return header_path + + +def _run_from_json(args): + """Generate the header only from committed artifact JSON. + + Parameters + ---------- + args : argparse.Namespace + Parsed command-line arguments. + + Returns + ------- + None + """ + header_path = _flush_from_json(args) + if args.check_header_path: + _print_header_check(header_path, args.check_header_path) + + +def _run_from_generate(args): + """Encrypt fresh artifact material, then emit JSON and the header. + + Parameters + ---------- + args : argparse.Namespace + Parsed command-line arguments. + + Returns + ------- + None + """ + salt = _optional_hex(args.salt_hex, 16, "salt_hex") + nonce = _optional_hex(args.nonce_hex, 24, "nonce_hex") + header_path = _flush_outputs( + args, *_build_from_args(args, salt, nonce), + ) + if args.check_header_path: + _print_header_check(header_path, args.check_header_path) + + +def main(): + """Generate the hardened artifact JSON and C header. + + Parameters + ---------- + None + + Returns + ------- + None + """ + args = _parse_args() + if args.from_json: + _run_from_json(args) + else: + _run_from_generate(args) + + +_ARGUMENT_GROUPS = ( + ( + ("--key", dict(default=DEFAULT_PASSPHRASE, help=_KEY_HELP)), + ("--salt-hex", dict(help=_SALT_HEX_HELP)), + ("--nonce-hex", dict(help=_NONCE_HEX_HELP)), + ), + ( + ("--text", dict(default=DEFAULT_TEXT, help=_TEXT_HELP)), + ("--out", dict(default=DEFAULT_OUTPUT_JSON, help=_OUT_HELP)), + ("--header-out", + dict(default=DEFAULT_OUTPUT_HEADER, help=_HEADER_OUT_HELP)), + ("--from-json", dict(help=_FROM_JSON_HELP)), + ("--no-crlf", dict(action="store_true", help=_NO_CRLF_HELP)), + ("--led-off", dict(action="store_true", help=_LED_OFF_HELP)), + ), + ( + ("--memory-kib", + dict(type=int, default=DEFAULT_MEMORY_KIB, help=_MEMORY_HELP)), + ("--iterations", + dict(type=int, default=DEFAULT_ITERATIONS, help=_ITERATIONS_HELP)), + ("--parallelism", + dict(type=int, default=DEFAULT_PARALLELISM, + help=_PARALLELISM_HELP)), + ("--check-header-path", dict(help=_CHECK_HEADER_HELP)), + ), +) + + +if __name__ == "__main__": + main() diff --git a/0x0017a_ctf/scripts/demo_artifact.json b/0x0017a_ctf/scripts/demo_artifact.json new file mode 100644 index 0000000..5c61254 --- /dev/null +++ b/0x0017a_ctf/scripts/demo_artifact.json @@ -0,0 +1,9 @@ +{ + "format": "ouroboros-hardened-demo-v1", + "memory_kib": 64, + "iterations": 3, + "parallelism": 1, + "salt_hex": "f2d518639a82019dc2d7afa5cdb6d871", + "nonce_hex": "1cef790d779e7c04e7f066dd90d080708797671f79efc4e4", + "ciphertext_and_tag_hex": "2c23b27e9562b8ed9e08e06dd99db4913e819a778bb47b71bc661e6e731a8154cdb536a4767e9bf8533e031db8e5ae7aadb431cf12d9f9c45fa9b94b80dcbbde" +} diff --git a/0x0017a_ctf/scripts/verify_ctf.py b/0x0017a_ctf/scripts/verify_ctf.py new file mode 100644 index 0000000..a5de5b1 --- /dev/null +++ b/0x0017a_ctf/scripts/verify_ctf.py @@ -0,0 +1,149 @@ +#!/usr/bin/env python3 +"""Verify every technical claim of Operation Copperhead against CTF-02.bin. + +Exits 0 only when every address, byte, hash, and derived value in CTF-R.md and +CTF-S.md matches the shipped image and the compiled ELF. +""" +import hashlib +import struct +import sys +from pathlib import Path + +BASE = 0x10000000 +ROOT = Path(__file__).resolve().parent.parent +BIN = ROOT / "CTF-02.bin" +UF2 = ROOT / "CTF-02.uf2" + +EXPECTED_BIN_SHA = "85330c37cd0897746b1af447e4bac371dde2042abd2d61d58a61fe2a8eef3537" +EXPECTED_UF2_SHA = "f3cd4840260db820d792758cecacc5297bef1971b9eacf7601279256d8af1eab" + +FRAME_THRESHOLD_A = 0x10000302 +FRAME_THRESHOLD_B = 0x10000312 +FRAME_TRACK = 0x1000C4B8 +FRAME_BLOCKLEN = 0x1000C4F0 +FRAME_SIGNALKEY = 0x1000C51C +FRAME_GATE = 0x1000C544 +FRAME_AUTH = 0x1000C57C +FRAME_OK = 0x1000C438 +FRAME_MISMATCH = 0x1000C43C +FRAME_SPEC_LITERAL = 0x100004FC +FRAME_DOUBLE = 0x1000EC60 +FRAME_SEED = 0x1000EC70 +FRAME_SALT = 0x1000CEEC +FRAME_NONCE = 0x1000CED4 +FRAME_CT = 0x1000CE94 + +DOUBLE_3_2 = bytes.fromhex("9A99999999990940") +DOUBLE_0_32 = bytes.fromhex("7B14AE47E17AD43F") +SEED_BAD = bytes.fromhex("0A0A0A0A") +SEED_GOOD = bytes.fromhex("7465206B") +SPEC_VALUE = 0x2D879291 +BUG_KEY = 0x915DCFF8 + +RESULTS = [] + + +def check(label, ok, detail=""): + """Record one verification result. + + Parameters + ---------- + label : str + Human-readable check name. + ok : bool + Whether the check passed. + detail : str + Extra context printed with the result. + + Returns + ------- + None + """ + RESULTS.append(ok) + print(f"[{'PASS' if ok else 'FAIL'}] {label} {detail}") + + +def rotl(v, s): + """Rotate a 32-bit value left.""" + return ((v << s) & 0xFFFFFFFF) | (v >> (32 - s)) + + +def qr_phase(a, b, c, d, s): + """Apply one ARX phase of a ChaCha quarter round.""" + a = (a + b) & 0xFFFFFFFF + d ^= a + d = rotl(d, s) + c = (c + d) & 0xFFFFFFFF + b ^= c + b = rotl(b, s) + return a, b, c, d + + +def derive(seed, iv): + """Derive the firmware signal key from a seed and IV.""" + a, b, c, d = seed, iv, 0x61707865, 0x3320646E + for _ in range(4): + for s in (16, 12, 8, 7): + a, b, c, d = qr_phase(a, b, c, d, s) + return (a ^ d) & 0xFFFFFFFF + + +def main(): + """Run all verification checks. + + Returns + ------- + int + Zero when every check passes, else one. + """ + data = BIN.read_bytes() + check("CTF-02.bin SHA-256", hashlib.sha256(data).hexdigest() == EXPECTED_BIN_SHA) + check("CTF-02.uf2 SHA-256", + hashlib.sha256(UF2.read_bytes()).hexdigest() == EXPECTED_UF2_SHA) + check("CTF-02.bin size", len(data) == 62308, f"({len(data)})") + check("vector table", data[0:32].hex() == + "002008205b0100101b0100101d01001011010010110100101101001011010010") + check("initial SP", struct.unpack(" + +// Non-zero once auth_init() has prepared the onboard LED GPIO. auth_execute() +// reports an internal error whenever this flag is not yet set, mirroring the +// reference construction from the encryption-c-rp2350 repository. +static bool g_auth_ready; + +/** + * @brief Clear a byte buffer. + * + * Writes zero to each byte in the caller-supplied buffer so derived keys + * and plaintext are not left resident in memory longer than needed. + * + * @param buf Pointer to mutable byte buffer. + * @param len Number of bytes to clear. + * @return None. + */ +static void clear_bytes(uint8_t *buf, size_t len) +{ + size_t i; + for (i = 0u; i < len; ++i) { + buf[i] = 0u; + } +} + +/** + * @brief Rotate a 32-bit value left. + * + * The HChaCha20 core uses 32-bit modular additions and left rotations in + * its quarter-round primitive. + * + * @param value Input 32-bit word. + * @param shift Rotation distance in bits. + * @return uint32_t Rotated result. + */ +static uint32_t rotl32(uint32_t value, uint8_t shift) +{ + return (value << shift) | (value >> (32u - shift)); +} + +/** + * @brief Load a 32-bit little-endian word from bytes. + * + * Converts four little-endian bytes into the word representation used by + * the HChaCha20 state machine. + * + * @param src Pointer to four readable bytes. + * @return uint32_t Parsed 32-bit word. + */ +static uint32_t load32_le(const uint8_t *src) +{ + return (uint32_t)src[0] | ((uint32_t)src[1] << 8u) | + ((uint32_t)src[2] << 16u) | ((uint32_t)src[3] << 24u); +} + +/** + * @brief Store a 32-bit word in little-endian byte order. + * + * Serializes one HChaCha20 state word into the caller-supplied output + * buffer. + * + * @param dst Pointer to four writable bytes. + * @param value 32-bit word to serialize. + * @return None. + */ +static void store32_le(uint8_t *dst, uint32_t value) +{ + dst[0] = (uint8_t)(value & 0xFFu); + dst[1] = (uint8_t)((value >> 8u) & 0xFFu); + dst[2] = (uint8_t)((value >> 16u) & 0xFFu); + dst[3] = (uint8_t)((value >> 24u) & 0xFFu); +} + +/** + * @brief Execute one ChaCha quarter-round. + * + * Mutates four state words in place according to the standard ChaCha20 + * ARX quarter-round used by the HChaCha20 subkey derivation. + * + * @param a Pointer to state word a. + * @param b Pointer to state word b. + * @param c Pointer to state word c. + * @param d Pointer to state word d. + * @return None. + */ +static void quarter_round(uint32_t *a, uint32_t *b, uint32_t *c, uint32_t *d) +{ + *a += *b; *d ^= *a; *d = rotl32(*d, 16u); + *c += *d; *b ^= *c; *b = rotl32(*b, 12u); + *a += *b; *d ^= *a; *d = rotl32(*d, 8u); + *c += *d; *b ^= *c; *b = rotl32(*b, 7u); +} + +/** + * @brief Derive a 256-bit XChaCha20 subkey from key and nonce prefix. + * + * Runs the HChaCha20 core over the first 16 bytes of the 24-byte XChaCha + * nonce and emits the derived 32-byte subkey. + * + * @param key Pointer to 32-byte AEAD key. + * @param nonce Pointer to 24-byte XChaCha20 nonce. + * @param subkey Output 32-byte subkey buffer. + * @return None. + */ +static void hchacha20(const uint8_t key[32], const uint8_t nonce[24], uint8_t subkey[32]) +{ + uint32_t state[16] = { + 0x61707865u, 0x3320646Eu, 0x79622D32u, 0x6B206574u, + load32_le(&key[0]), load32_le(&key[4]), load32_le(&key[8]), load32_le(&key[12]), + load32_le(&key[16]), load32_le(&key[20]), load32_le(&key[24]), load32_le(&key[28]), + load32_le(&nonce[0]), load32_le(&nonce[4]), load32_le(&nonce[8]), load32_le(&nonce[12]), + }; + uint8_t round; + for (round = 0u; round < 10u; ++round) { + quarter_round(&state[0], &state[4], &state[8], &state[12]); + quarter_round(&state[1], &state[5], &state[9], &state[13]); + quarter_round(&state[2], &state[6], &state[10], &state[14]); + quarter_round(&state[3], &state[7], &state[11], &state[15]); + quarter_round(&state[0], &state[5], &state[10], &state[15]); + quarter_round(&state[1], &state[6], &state[11], &state[12]); + quarter_round(&state[2], &state[7], &state[8], &state[13]); + quarter_round(&state[3], &state[4], &state[9], &state[14]); + } + store32_le(&subkey[0], state[0]); + store32_le(&subkey[4], state[1]); + store32_le(&subkey[8], state[2]); + store32_le(&subkey[12], state[3]); + store32_le(&subkey[16], state[12]); + store32_le(&subkey[20], state[13]); + store32_le(&subkey[24], state[14]); + store32_le(&subkey[28], state[15]); +} + +/** + * @brief Build the inner 96-bit nonce used by ChaCha20-Poly1305. + * + * XChaCha20 converts the last 8 bytes of the 24-byte outer nonce into the + * final 12-byte IETF ChaCha nonce by prefixing four zero bytes. + * + * @param nonce Pointer to 24-byte XChaCha20 nonce. + * @param out Output 12-byte nonce buffer. + * @return None. + */ +static void build_inner_nonce(const uint8_t nonce[24], uint8_t out[12]) +{ + memset(out, 0, 4u); + memcpy(&out[4], &nonce[16], 8u); +} + +/** + * @brief Return true when a byte is ASCII whitespace used by the CLI. + * + * The firmware normalizes spaces, carriage returns, tabs, and newlines in + * the same broad spirit as split-whitespace host parsing. + * + * @param ch Input byte. + * @return bool true when byte is treated as whitespace. + */ +static bool is_space(uint8_t ch) +{ + return (ch == ' ') || (ch == '\t') || (ch == '\r') || (ch == '\n'); +} + +/** + * @brief Return true when a byte is lowercase ASCII. + * + * Hardened passphrases accept only lowercase a-z characters in each word. + * + * @param ch Input byte. + * @return bool true when byte is in the lowercase ASCII range. + */ +static bool is_lowercase_ascii(uint8_t ch) +{ + return (ch >= 'a') && (ch <= 'z'); +} + +/** + * @brief Validate the strict hardened passphrase policy. + * + * Accepts only passphrases containing exactly 12 lowercase ASCII words + * separated by whitespace. + * + * @param passphrase Pointer to passphrase bytes. + * @param passphrase_len Number of passphrase bytes. + * @return bool true when the passphrase satisfies the policy. + */ +static bool validate_hardened_passphrase(const uint8_t *passphrase, size_t passphrase_len) +{ + size_t i = 0u; + uint8_t words = 0u; + if ((passphrase == NULL) || (passphrase_len == 0u) || (passphrase_len > AUTH_PASSPHRASE_MAX_LEN)) { + return false; + } + while (i < passphrase_len) { + while ((i < passphrase_len) && is_space(passphrase[i])) { + ++i; + } + if (i == passphrase_len) { + break; + } + ++words; + while ((i < passphrase_len) && !is_space(passphrase[i])) { + if (!is_lowercase_ascii(passphrase[i])) { + return false; + } + ++i; + } + } + return words == AUTH_REQUIRED_WORDS; +} + +/** + * @brief Derive the 32-byte hardened key with Argon2id. + * + * Uses the generated artifact parameters and salt to derive the AEAD key + * that protects the embedded ciphertext. + * + * @param passphrase Pointer to passphrase bytes. + * @param passphrase_len Number of passphrase bytes. + * @param key_out Output 32-byte key buffer. + * @return bool true when derivation succeeds. + */ +static bool derive_hardened_key(const uint8_t *passphrase, size_t passphrase_len, uint8_t key_out[32]) +{ + return argon2id_hash_raw( + DEMO_ITERATIONS, + DEMO_MEMORY_KIB, + DEMO_PARALLELISM, + passphrase, + passphrase_len, + DEMO_SALT, + AUTH_SALT_SIZE, + key_out, + AUTH_KEY_SIZE) == ARGON2_OK; +} + +/** + * @brief Decrypt the embedded artifact with XChaCha20-Poly1305. + * + * Derives the XChaCha20 subkey with HChaCha20, converts the outer nonce to + * the inner 96-bit nonce, and verifies/decrypts the payload in one shot. + * + * @param key Pointer to 32-byte Argon2id-derived key. + * @param payload_out Output 48-byte plaintext payload buffer. + * @return bool true when tag verification and decryption succeed. + */ +static bool decrypt_artifact(const uint8_t key[32], uint8_t payload_out[AUTH_PAYLOAD_SIZE]) +{ + bool ok; + int rc; + uint8_t subkey[32]; + uint8_t inner_nonce[12]; + mbedtls_chachapoly_context ctx; + hchacha20(key, DEMO_NONCE, subkey); + build_inner_nonce(DEMO_NONCE, inner_nonce); + mbedtls_chachapoly_init(&ctx); + rc = mbedtls_chachapoly_setkey(&ctx, subkey); + if (rc == 0) { + rc = mbedtls_chachapoly_auth_decrypt( + &ctx, + AUTH_PAYLOAD_SIZE, + inner_nonce, + NULL, + 0u, + &DEMO_CIPHERTEXT_AND_TAG[AUTH_PAYLOAD_SIZE], + DEMO_CIPHERTEXT_AND_TAG, + payload_out); + } + mbedtls_chachapoly_free(&ctx); + clear_bytes(subkey, sizeof(subkey)); + clear_bytes(inner_nonce, sizeof(inner_nonce)); + ok = (rc == 0); + if (!ok) { + clear_bytes(payload_out, AUTH_PAYLOAD_SIZE); + } + return ok; +} + +/** + * @brief Dispatch the decrypted payload to GPIO25 and UART. + * + * Mirrors the Rust demo payload contract: byte 0 controls the LED, and + * bytes 1..7 are transmitted verbatim over UART. + * + * @param payload Pointer to decrypted 48-byte payload. + * @return None. + */ +static void dispatch_payload(const uint8_t payload[AUTH_PAYLOAD_SIZE]) +{ + uint8_t i; + gpio_put(AUTH_LED_PIN, payload[0] ? 1 : 0); + for (i = 1u; i < 8u; ++i) { + putchar_raw((char)payload[i]); + } +} + +bool auth_init(void) +{ + g_auth_ready = true; + gpio_init(AUTH_LED_PIN); + gpio_set_dir(AUTH_LED_PIN, GPIO_OUT); + gpio_put(AUTH_LED_PIN, 0); + return true; +} + +auth_result_t auth_execute(const uint8_t *passphrase, size_t passphrase_len) +{ + uint8_t key[AUTH_KEY_SIZE]; + uint8_t payload[AUTH_PAYLOAD_SIZE]; + if (!g_auth_ready) { + return AUTH_RESULT_INTERNAL_ERROR; + } + if (!validate_hardened_passphrase(passphrase, passphrase_len)) { + return AUTH_RESULT_POLICY_VIOLATION; + } + if (!derive_hardened_key(passphrase, passphrase_len, key)) { + return AUTH_RESULT_INTERNAL_ERROR; + } + if (!decrypt_artifact(key, payload)) { + clear_bytes(key, sizeof(key)); + return AUTH_RESULT_AUTHENTICATION_FAILED; + } + dispatch_payload(payload); + clear_bytes(payload, sizeof(payload)); + clear_bytes(key, sizeof(key)); + return AUTH_RESULT_SUCCESS; +} \ No newline at end of file diff --git a/0x0017a_ctf/src/cli.c b/0x0017a_ctf/src/cli.c new file mode 100644 index 0000000..cb6fc6c --- /dev/null +++ b/0x0017a_ctf/src/cli.c @@ -0,0 +1,149 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent/encryption-c-rp2350 +// File: cli.c +// Desc: Implements the CLI UART passphrase input interface for Ouroboros. +// Created: 2026 + +#include "cli.h" +#include "auth.h" +#include "pico/stdlib.h" +#include + +/** + * @brief Maximum number of passphrase characters accepted from UART. + * + * Limits the input buffer to the hardened engine boundary. A null + * terminator is written after the last character so the buffer must be + * declared with at least this many bytes. + */ +#define PASS_BUF_LEN AUTH_PASSPHRASE_MAX_LEN + +/** + * @brief Print the hardened passphrase policy hint. + * + * The firmware uses the same interactive policy as the host demo: + * exactly 12 lowercase words separated by spaces. + * + * @param None. + * @return None. + */ +static void print_policy_hint(void) +{ + printf("Enter exactly 12 lowercase words separated by spaces.\r\n"); +} + +/** + * @brief Append one received character to the passphrase buffer. + * + * Stores printable characters up to the buffer limit minus one to + * reserve room for a null terminator. Echoes the character back + * over UART for interactive typing feedback. + * + * @param ch Input character value. + * @param buf Pointer to mutable passphrase buffer. + * @param idx Pointer to current buffer length. + * @return None. + */ +static void append_char(int ch, char *buf, size_t *idx) +{ + if (*idx + 1u >= PASS_BUF_LEN) { + return; + } + buf[*idx] = (char)ch; + *idx += 1u; + putchar_raw((char)ch); +} + +/** + * @brief Remove one character from the passphrase buffer. + * + * Moves the index back by one and emits the backspace-escape + * sequence to erase the last echoed character on the terminal. + * + * @param idx Pointer to current buffer length. + * @return None. + */ +static void handle_backspace(size_t *idx) +{ + if (*idx == 0u) { + return; + } + *idx -= 1u; + printf("\b \b"); +} + +/** + * @brief Finalise and authenticate the current passphrase buffer. + * + * Null-terminates the input, runs the full Ouroboros authentication + * pipeline via auth_execute, prints policy guidance or authentication + * failure text as needed, and resets the buffer index for the next + * prompt cycle. + * + * @param buf Pointer to mutable passphrase buffer. + * @param idx Pointer to current buffer length. + * @return None. + */ +static void finish_passphrase(char *buf, size_t *idx) +{ + auth_result_t result; + putchar_raw('\r'); + putchar_raw('\n'); + buf[*idx] = '\0'; + result = auth_execute((const uint8_t *)buf, *idx); + if (result == AUTH_RESULT_POLICY_VIOLATION) { + gpio_put(AUTH_LED_PIN, 0); + print_policy_hint(); + } else if (result != AUTH_RESULT_SUCCESS) { + gpio_put(AUTH_LED_PIN, 0); + printf("Authentication failed.\r\n"); + } + *idx = 0u; + print_prompt(); +} + +void print_prompt(void) +{ + printf("\r\n> "); +} + +void service_uart(char *buf, size_t *idx) +{ + int ch = getchar_timeout_us(0); + if (ch == PICO_ERROR_TIMEOUT) { + tight_loop_contents(); + return; + } + if ((ch == '\b') || (ch == 127)) { + handle_backspace(idx); + return; + } + if ((ch == '\r') || (ch == '\n')) { + finish_passphrase(buf, idx); + return; + } + append_char(ch, buf, idx); +} diff --git a/0x0017a_ctf/src/main.c b/0x0017a_ctf/src/main.c new file mode 100644 index 0000000..d672f92 --- /dev/null +++ b/0x0017a_ctf/src/main.c @@ -0,0 +1,404 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: main.c +// Desc: DEEPLINE Metro interlocking host for the FINAL-PRACTICE exercise. +// Chains the strict Ouroboros operator gate (Argon2id plus +// XChaCha20-Poly1305) around the frozen relay telemetry puzzles. +// Created: 2026 + +#include +#include +#include +#include +#include "auth.h" +#include "pico/stdlib.h" + +// Block deviation classification ceiling below which an automated train +// release is permitted. BUG: PALLAS compiled in 95; the engineering limit +// is 60 (two redundant cmp sites in the ship image). +#define SAFE_THRESHOLD 95u + +// Number of 32-bit ARX state words used by the signal-key machinery. +#define ARX_WORDS 4u + +// Spec value of the derived signal key minted in the incident report. This is +// the key the honest build derives from GATE_SEED_GOOD and the derived IV. +#define SIGNAL_SPEC 0x2D879291u + +// ChaCha expand word used by the console-side derivation path. +#define GATE_SEED_GOOD 0x6B206574u + +// Track-circuit current deviation frozen by the dead pilot wire (amperes). +// A live reading is recalculated in the field; this image holds a wrong +// snapshot that engineers must decode from registers and SRAM. +static volatile uint32_t g_block_current = 87u; + +// Operator-facing block classification (drives the BLOCK STATE line). +static volatile uint32_t g_operator_state = 0u; + +// Automatic train release decision (drives the AUTO TRAIN line). +static volatile uint32_t g_dispatch_state = 0u; + +// Static per-cycle poll counter retained in .bss. Watch this from GDB. +static volatile uint32_t g_fault_polls = 0u; + +// ARX seed substituted by the poisoned build up to the signal derivation. +// BUG: 0x0A0A0A0A was fused in place of the "te k" expand word 0x6B206574. +static volatile uint32_t g_auth_seed = 0x0A0A0A0Au; + +// Derived signal key printed each cycle and checked against SIGNAL_SPEC. +static uint32_t g_signal_key = 0u; + +/** + * @brief Hold one track-block telemetry record for the interlocking. + * + * Stores the measured block length, the condition flag word, and the + * crossing identifier used by the automatic train protection logic. + */ +typedef struct telemetry_t { + double block_length_km; + uint32_t block_flags; + uint16_t crossing; +} telemetry_t; + +// Live telemetry record. BUG: block_length_km shipped as 3.2 km; the real +// BRIDGE-4 block is 0.32 km, far below the minimum release spacing. +static volatile telemetry_t g_telemetry = { 3.2, 0x3u, 7u }; + +// Interactive passphrase buffer and parser cursor for the operator gate. +static char g_linebuf[AUTH_PASSPHRASE_MAX_LEN]; +static size_t g_lineidx = 0u; + +/** + * @brief Rotate a 32-bit value left. + * + * @param value Input 32-bit word. + * @param shift Rotation distance in bits. + * @return uint32_t Rotated result. + */ +static uint32_t rotl32(uint32_t value, uint8_t shift) +{ + return (value << shift) | (value >> (32u - shift)); +} + +/** + * @brief Load a 32-bit little-endian word from bytes. + * + * @param src Pointer to four readable bytes. + * @return uint32_t Parsed 32-bit word. + */ +static uint32_t load32_le(const uint8_t *src) +{ + return (uint32_t)src[0] | ((uint32_t)src[1] << 8u) | + ((uint32_t)src[2] << 16u) | ((uint32_t)src[3] << 24u); +} + +/** + * @brief Store a 32-bit word in little-endian byte order. + * + * @param dst Pointer to four writable bytes. + * @param value 32-bit word to serialize. + * @return None. + */ +static void store32_le(uint8_t *dst, uint32_t value) +{ + dst[0] = (uint8_t)(value & 0xFFu); + dst[1] = (uint8_t)((value >> 8u) & 0xFFu); + dst[2] = (uint8_t)((value >> 16u) & 0xFFu); + dst[3] = (uint8_t)((value >> 24u) & 0xFFu); +} + +/** + * @brief Apply one additive-rotate-xor phase of a ChaCha quarter-round. + * + * @param a Pointer to state word A. + * @param b Pointer to state word B. + * @param c Pointer to state word C. + * @param d Pointer to state word D. + * @param shift Rotation distance in bits. + * @return None. + */ +static void qr_phase(uint32_t *a, uint32_t *b, uint32_t *c, uint32_t *d, uint8_t shift) +{ + *a += *b; + *d ^= *a; + *d = rotl32(*d, shift); + *c += *d; + *b ^= *c; + *b = rotl32(*b, shift); +} + +/** + * @brief Execute one full ChaCha ARX quarter-round. + * + * @param a Pointer to state word A. + * @param b Pointer to state word B. + * @param c Pointer to state word C. + * @param d Pointer to state word D. + * @return None. + */ +static void quarter_round(uint32_t *a, uint32_t *b, uint32_t *c, uint32_t *d) +{ + qr_phase(a, b, c, d, 16u); + qr_phase(a, b, c, d, 12u); + qr_phase(a, b, c, d, 8u); + qr_phase(a, b, c, d, 7u); +} + +/** + * @brief Run r full quarter-rounds over a four-word ARX state. + * + * @param a Pointer to state word A. + * @param b Pointer to state word B. + * @param c Pointer to state word C. + * @param d Pointer to state word D. + * @param rounds Number of full quarter-rounds to run. + * @return None. + */ +static void run_rounds(uint32_t *a, uint32_t *b, uint32_t *c, uint32_t *d, uint8_t rounds) +{ + uint8_t r; + for (r = 0u; r < rounds; ++r) { + quarter_round(a, b, c, d); + } +} + +/** + * @brief Derive a 32-bit ARX session key from a seed and IV. + * + * Runs four ChaCha quarter-rounds over the seed, the IV, and the ChaCha + * expand constants; returns state word A exclusive-or state word D. + * + * @param seed 32-bit seed word. + * @param iv 32-bit IV word. + * @return uint32_t Derived session key word. + */ +static uint32_t derive_session_key(uint32_t seed, uint32_t iv) +{ + uint32_t a = seed; + uint32_t b = iv; + uint32_t c = 0x61707865u; + uint32_t d = 0x3320646Eu; + run_rounds(&a, &b, &c, &d, 4u); + return a ^ d; +} + +/** + * @brief Derive the runtime IV from the good console seed word. + * + * @param None. + * @return uint32_t Derived IV word (0xC0F89829 in an honest image). + */ +static uint32_t derive_state_iv(void) +{ + return derive_session_key(GATE_SEED_GOOD, 0u); +} + +/** + * @brief Refresh the runtime signal key from the live seed and IV. + * + * Captures the freshly derived IV, then derives the final key word from + * the substituted seed. Break after each derivation to read the register. + * + * @param None. + * @return None. + */ +static void set_signal_state(void) +{ + uint32_t iv = derive_state_iv(); + g_signal_key = derive_session_key(g_auth_seed, iv); +} + +/** + * @brief Classify the frozen current reading against the compiled limit. + * + * Compares the frozen track-circuit current reading against SAFE_THRESHOLD + * and assigns the resulting boolean status to both g_operator_state and + * g_dispatch_state. + * + * @param None. + * @return None. + */ +static void classify_blocks(void) +{ + g_operator_state = (g_block_current < SAFE_THRESHOLD) ? 1u : 0u; + g_dispatch_state = (g_block_current < SAFE_THRESHOLD) ? 1u : 0u; +} + +/** + * @brief Print the relay boot identity and unconditional signal line. + * + * Emits the DEEPLINE authority banner, adaptive signal window, serial console + * configuration string, and nominal track status prompt over the console. + * + * @param None. + * @return None. + */ +static void print_identity(void) +{ + printf("DEEPLINE METRO AUTHORITY\r\n"); + printf("ADAPTIVE SIGNAL WINDOW: 38 MINUTES\r\n"); + printf("USB-CDC 115200 8N1 | AUTHORIZED LAB CONSOLE\r\n"); + printf("TRACK: NORMAL\r\n"); +} + +/** + * @brief Print the recurring interlocking status report once per cycle. + * + * Computes block length in meters, increments the fault poll counter, prints + * block state, train authorization status, fault poll tally, and signal key + * validation report, and re-emits the command prompt. + * + * @param None. + * @return None. + */ +static void print_status(void) +{ + uint32_t metres = (uint32_t)(g_telemetry.block_length_km * 1000.0); + g_fault_polls += 1u; + printf("BLOCK STATE: %s\r\n", g_operator_state ? "STABLE" : "CRITICAL"); + printf("AUTO TRAIN: %s\r\n", g_dispatch_state ? "AUTHORIZED" : "HELD"); + printf("BLOCK LENGTH: %u M\r\n", metres); + printf("FAULT POLLS: %u\r\n", g_fault_polls); + printf("SIGNAL KEY: 0x%08X %s\r\n", g_signal_key, + (g_signal_key == SIGNAL_SPEC) ? "OK" : "MISMATCH"); + printf("RESPONSE> "); +} + +/** + * @brief Append one received character to the passphrase buffer. + * + * Stores printable characters up to the maximum passphrase length boundary + * and echoes the character back to the console for interactive typing feedback. + * + * @param ch Input character value. + * @return None. + */ +static void append_char(int ch) +{ + if (g_lineidx + 1u >= AUTH_PASSPHRASE_MAX_LEN) { + return; + } + g_linebuf[g_lineidx] = (char)ch; + g_lineidx += 1u; + putchar_raw((char)ch); +} + +/** + * @brief Remove one character from the passphrase buffer. + * + * Decrements the buffer index and emits a backspace-space-backspace escape + * sequence to erase the character on the user's terminal. + * + * @param None. + * @return None. + */ +static void drop_char(void) +{ + if (g_lineidx == 0u) { + return; + } + g_lineidx -= 1u; + printf("\b \b"); +} + +/** + * @brief Authenticate the completed passphrase against the Ouroboros gate. + * + * Terminates the string buffer, invokes auth_execute, handles policy violation + * or authentication failure outputs, and resets the line buffer for the next input. + * + * @param None. + * @return None. + */ +static void submit_gate(void) +{ + auth_result_t result; + putchar_raw('\r'); + putchar_raw('\n'); + g_linebuf[g_lineidx] = '\0'; + result = auth_execute((const uint8_t *)g_linebuf, g_lineidx); + if (result == AUTH_RESULT_POLICY_VIOLATION) { + gpio_put(AUTH_LED_PIN, 0); + printf("Enter exactly 12 lowercase words separated by spaces.\r\n"); + } else if (result == AUTH_RESULT_SUCCESS) { + printf("AUTHORITY FRAME: VERIFIED\r\n"); + } else { + gpio_put(AUTH_LED_PIN, 0); + printf("Authentication failed.\r\n"); + } + g_lineidx = 0u; + printf("RESPONSE> "); +} + +/** + * @brief Poll the console for one passphrase input event. + * + * Reads a single character from standard input with zero timeout and routes + * backspace, newline/carriage return, or printable characters to their respective + * handlers. + * + * @param None. + * @return None. + */ +static void poll_console(void) +{ + int ch = getchar_timeout_us(0); + while (ch != PICO_ERROR_TIMEOUT) { + if ((ch == '\b') || (ch == 127)) { + drop_char(); + } else if ((ch == '\r') || (ch == '\n')) { + submit_gate(); + } else { + append_char(ch); + } + ch = getchar_timeout_us(0); + } +} + +/** + * @brief Drive the DEEPLINE relay console and operator gate forever. + * + * Initializes standard I/O and the authentication engine, classifies the track + * blocks, emits the initial system banner, and enters an infinite loop refreshing + * the signal state, reporting status, and servicing the console every two seconds. + * + * @param None. + * @return int Process exit code (never returns during normal operation). + */ +int main(void) +{ + stdio_init_all(); + auth_init(); + classify_blocks(); + print_identity(); + while (true) { + set_signal_state(); + print_status(); + poll_console(); + sleep_ms(2000u); + } +} \ No newline at end of file diff --git a/0x0017a_ctf/src/mbedtls_shims.c b/0x0017a_ctf/src/mbedtls_shims.c new file mode 100644 index 0000000..7c06a9d --- /dev/null +++ b/0x0017a_ctf/src/mbedtls_shims.c @@ -0,0 +1,49 @@ +// MIT License +// +// Copyright (c) 2026 Kevin Thomas +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. +// +// Author: Kevin Thomas +// Email: kevin@mytechnotalent.com +// GitHub: https://github.com/mytechnotalent +// File: mbedtls_shims.c +// Desc: Implements platform zeroization shims required by mbedTLS on RP2350. +// Created: 2026 + +#include "mbedtls/platform_util.h" + +/** + * @brief Securely clear a memory region. + * + * Provides the mbedTLS platform zeroization hook for this firmware build. + * The volatile pointer prevents the compiler from optimizing away the + * clearing loop. + * + * @param buf Pointer to mutable memory region to clear. + * @param len Number of bytes to clear. + * @return None. + */ +void mbedtls_platform_zeroize(void *buf, size_t len) +{ + volatile unsigned char *ptr = (volatile unsigned char *)buf; + while (len-- > 0u) { + *ptr++ = 0u; + } +} diff --git a/0x0017a_ctf/third_party/argon2/include/argon2.h b/0x0017a_ctf/third_party/argon2/include/argon2.h new file mode 100644 index 0000000..3980bb3 --- /dev/null +++ b/0x0017a_ctf/third_party/argon2/include/argon2.h @@ -0,0 +1,437 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef ARGON2_H +#define ARGON2_H + +#include +#include +#include + +#if defined(__cplusplus) +extern "C" { +#endif + +/* Symbols visibility control */ +#ifdef A2_VISCTL +#define ARGON2_PUBLIC __attribute__((visibility("default"))) +#define ARGON2_LOCAL __attribute__ ((visibility ("hidden"))) +#elif defined(_MSC_VER) +#define ARGON2_PUBLIC __declspec(dllexport) +#define ARGON2_LOCAL +#else +#define ARGON2_PUBLIC +#define ARGON2_LOCAL +#endif + +/* + * Argon2 input parameter restrictions + */ + +/* Minimum and maximum number of lanes (degree of parallelism) */ +#define ARGON2_MIN_LANES UINT32_C(1) +#define ARGON2_MAX_LANES UINT32_C(0xFFFFFF) + +/* Minimum and maximum number of threads */ +#define ARGON2_MIN_THREADS UINT32_C(1) +#define ARGON2_MAX_THREADS UINT32_C(0xFFFFFF) + +/* Number of synchronization points between lanes per pass */ +#define ARGON2_SYNC_POINTS UINT32_C(4) + +/* Minimum and maximum digest size in bytes */ +#define ARGON2_MIN_OUTLEN UINT32_C(4) +#define ARGON2_MAX_OUTLEN UINT32_C(0xFFFFFFFF) + +/* Minimum and maximum number of memory blocks (each of BLOCK_SIZE bytes) */ +#define ARGON2_MIN_MEMORY (2 * ARGON2_SYNC_POINTS) /* 2 blocks per slice */ + +#define ARGON2_MIN(a, b) ((a) < (b) ? (a) : (b)) +/* Max memory size is addressing-space/2, topping at 2^32 blocks (4 TB) */ +#define ARGON2_MAX_MEMORY_BITS \ + ARGON2_MIN(UINT32_C(32), (sizeof(void *) * CHAR_BIT - 10 - 1)) +#define ARGON2_MAX_MEMORY \ + ARGON2_MIN(UINT32_C(0xFFFFFFFF), UINT64_C(1) << ARGON2_MAX_MEMORY_BITS) + +/* Minimum and maximum number of passes */ +#define ARGON2_MIN_TIME UINT32_C(1) +#define ARGON2_MAX_TIME UINT32_C(0xFFFFFFFF) + +/* Minimum and maximum password length in bytes */ +#define ARGON2_MIN_PWD_LENGTH UINT32_C(0) +#define ARGON2_MAX_PWD_LENGTH UINT32_C(0xFFFFFFFF) + +/* Minimum and maximum associated data length in bytes */ +#define ARGON2_MIN_AD_LENGTH UINT32_C(0) +#define ARGON2_MAX_AD_LENGTH UINT32_C(0xFFFFFFFF) + +/* Minimum and maximum salt length in bytes */ +#define ARGON2_MIN_SALT_LENGTH UINT32_C(8) +#define ARGON2_MAX_SALT_LENGTH UINT32_C(0xFFFFFFFF) + +/* Minimum and maximum key length in bytes */ +#define ARGON2_MIN_SECRET UINT32_C(0) +#define ARGON2_MAX_SECRET UINT32_C(0xFFFFFFFF) + +/* Flags to determine which fields are securely wiped (default = no wipe). */ +#define ARGON2_DEFAULT_FLAGS UINT32_C(0) +#define ARGON2_FLAG_CLEAR_PASSWORD (UINT32_C(1) << 0) +#define ARGON2_FLAG_CLEAR_SECRET (UINT32_C(1) << 1) + +/* Global flag to determine if we are wiping internal memory buffers. This flag + * is defined in core.c and defaults to 1 (wipe internal memory). */ +extern int FLAG_clear_internal_memory; + +/* Error codes */ +typedef enum Argon2_ErrorCodes { + ARGON2_OK = 0, + + ARGON2_OUTPUT_PTR_NULL = -1, + + ARGON2_OUTPUT_TOO_SHORT = -2, + ARGON2_OUTPUT_TOO_LONG = -3, + + ARGON2_PWD_TOO_SHORT = -4, + ARGON2_PWD_TOO_LONG = -5, + + ARGON2_SALT_TOO_SHORT = -6, + ARGON2_SALT_TOO_LONG = -7, + + ARGON2_AD_TOO_SHORT = -8, + ARGON2_AD_TOO_LONG = -9, + + ARGON2_SECRET_TOO_SHORT = -10, + ARGON2_SECRET_TOO_LONG = -11, + + ARGON2_TIME_TOO_SMALL = -12, + ARGON2_TIME_TOO_LARGE = -13, + + ARGON2_MEMORY_TOO_LITTLE = -14, + ARGON2_MEMORY_TOO_MUCH = -15, + + ARGON2_LANES_TOO_FEW = -16, + ARGON2_LANES_TOO_MANY = -17, + + ARGON2_PWD_PTR_MISMATCH = -18, /* NULL ptr with non-zero length */ + ARGON2_SALT_PTR_MISMATCH = -19, /* NULL ptr with non-zero length */ + ARGON2_SECRET_PTR_MISMATCH = -20, /* NULL ptr with non-zero length */ + ARGON2_AD_PTR_MISMATCH = -21, /* NULL ptr with non-zero length */ + + ARGON2_MEMORY_ALLOCATION_ERROR = -22, + + ARGON2_FREE_MEMORY_CBK_NULL = -23, + ARGON2_ALLOCATE_MEMORY_CBK_NULL = -24, + + ARGON2_INCORRECT_PARAMETER = -25, + ARGON2_INCORRECT_TYPE = -26, + + ARGON2_OUT_PTR_MISMATCH = -27, + + ARGON2_THREADS_TOO_FEW = -28, + ARGON2_THREADS_TOO_MANY = -29, + + ARGON2_MISSING_ARGS = -30, + + ARGON2_ENCODING_FAIL = -31, + + ARGON2_DECODING_FAIL = -32, + + ARGON2_THREAD_FAIL = -33, + + ARGON2_DECODING_LENGTH_FAIL = -34, + + ARGON2_VERIFY_MISMATCH = -35 +} argon2_error_codes; + +/* Memory allocator types --- for external allocation */ +typedef int (*allocate_fptr)(uint8_t **memory, size_t bytes_to_allocate); +typedef void (*deallocate_fptr)(uint8_t *memory, size_t bytes_to_allocate); + +/* Argon2 external data structures */ + +/* + ***** + * Context: structure to hold Argon2 inputs: + * output array and its length, + * password and its length, + * salt and its length, + * secret and its length, + * associated data and its length, + * number of passes, amount of used memory (in KBytes, can be rounded up a bit) + * number of parallel threads that will be run. + * All the parameters above affect the output hash value. + * Additionally, two function pointers can be provided to allocate and + * deallocate the memory (if NULL, memory will be allocated internally). + * Also, three flags indicate whether to erase password, secret as soon as they + * are pre-hashed (and thus not needed anymore), and the entire memory + ***** + * Simplest situation: you have output array out[8], password is stored in + * pwd[32], salt is stored in salt[16], you do not have keys nor associated + * data. You need to spend 1 GB of RAM and you run 5 passes of Argon2d with + * 4 parallel lanes. + * You want to erase the password, but you're OK with last pass not being + * erased. You want to use the default memory allocator. + * Then you initialize: + Argon2_Context(out,8,pwd,32,salt,16,NULL,0,NULL,0,5,1<<20,4,4,NULL,NULL,true,false,false,false) + */ +typedef struct Argon2_Context { + uint8_t *out; /* output array */ + uint32_t outlen; /* digest length */ + + uint8_t *pwd; /* password array */ + uint32_t pwdlen; /* password length */ + + uint8_t *salt; /* salt array */ + uint32_t saltlen; /* salt length */ + + uint8_t *secret; /* key array */ + uint32_t secretlen; /* key length */ + + uint8_t *ad; /* associated data array */ + uint32_t adlen; /* associated data length */ + + uint32_t t_cost; /* number of passes */ + uint32_t m_cost; /* amount of memory requested (KB) */ + uint32_t lanes; /* number of lanes */ + uint32_t threads; /* maximum number of threads */ + + uint32_t version; /* version number */ + + allocate_fptr allocate_cbk; /* pointer to memory allocator */ + deallocate_fptr free_cbk; /* pointer to memory deallocator */ + + uint32_t flags; /* array of bool options */ +} argon2_context; + +/* Argon2 primitive type */ +typedef enum Argon2_type { + Argon2_d = 0, + Argon2_i = 1, + Argon2_id = 2 +} argon2_type; + +/* Version of the algorithm */ +typedef enum Argon2_version { + ARGON2_VERSION_10 = 0x10, + ARGON2_VERSION_13 = 0x13, + ARGON2_VERSION_NUMBER = ARGON2_VERSION_13 +} argon2_version; + +/* + * Function that gives the string representation of an argon2_type. + * @param type The argon2_type that we want the string for + * @param uppercase Whether the string should have the first letter uppercase + * @return NULL if invalid type, otherwise the string representation. + */ +ARGON2_PUBLIC const char *argon2_type2string(argon2_type type, int uppercase); + +/* + * Function that performs memory-hard hashing with certain degree of parallelism + * @param context Pointer to the Argon2 internal structure + * @return Error code if smth is wrong, ARGON2_OK otherwise + */ +ARGON2_PUBLIC int argon2_ctx(argon2_context *context, argon2_type type); + +/** + * Hashes a password with Argon2i, producing an encoded hash + * @param t_cost Number of iterations + * @param m_cost Sets memory usage to m_cost kibibytes + * @param parallelism Number of threads and compute lanes + * @param pwd Pointer to password + * @param pwdlen Password size in bytes + * @param salt Pointer to salt + * @param saltlen Salt size in bytes + * @param hashlen Desired length of the hash in bytes + * @param encoded Buffer where to write the encoded hash + * @param encodedlen Size of the buffer (thus max size of the encoded hash) + * @pre Different parallelism levels will give different results + * @pre Returns ARGON2_OK if successful + */ +ARGON2_PUBLIC int argon2i_hash_encoded(const uint32_t t_cost, + const uint32_t m_cost, + const uint32_t parallelism, + const void *pwd, const size_t pwdlen, + const void *salt, const size_t saltlen, + const size_t hashlen, char *encoded, + const size_t encodedlen); + +/** + * Hashes a password with Argon2i, producing a raw hash at @hash + * @param t_cost Number of iterations + * @param m_cost Sets memory usage to m_cost kibibytes + * @param parallelism Number of threads and compute lanes + * @param pwd Pointer to password + * @param pwdlen Password size in bytes + * @param salt Pointer to salt + * @param saltlen Salt size in bytes + * @param hash Buffer where to write the raw hash - updated by the function + * @param hashlen Desired length of the hash in bytes + * @pre Different parallelism levels will give different results + * @pre Returns ARGON2_OK if successful + */ +ARGON2_PUBLIC int argon2i_hash_raw(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, + const size_t hashlen); + +ARGON2_PUBLIC int argon2d_hash_encoded(const uint32_t t_cost, + const uint32_t m_cost, + const uint32_t parallelism, + const void *pwd, const size_t pwdlen, + const void *salt, const size_t saltlen, + const size_t hashlen, char *encoded, + const size_t encodedlen); + +ARGON2_PUBLIC int argon2d_hash_raw(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, + const size_t hashlen); + +ARGON2_PUBLIC int argon2id_hash_encoded(const uint32_t t_cost, + const uint32_t m_cost, + const uint32_t parallelism, + const void *pwd, const size_t pwdlen, + const void *salt, const size_t saltlen, + const size_t hashlen, char *encoded, + const size_t encodedlen); + +ARGON2_PUBLIC int argon2id_hash_raw(const uint32_t t_cost, + const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, + const size_t hashlen); + +/* generic function underlying the above ones */ +ARGON2_PUBLIC int argon2_hash(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, + const size_t hashlen, char *encoded, + const size_t encodedlen, argon2_type type, + const uint32_t version); + +/** + * Verifies a password against an encoded string + * Encoded string is restricted as in validate_inputs() + * @param encoded String encoding parameters, salt, hash + * @param pwd Pointer to password + * @pre Returns ARGON2_OK if successful + */ +ARGON2_PUBLIC int argon2i_verify(const char *encoded, const void *pwd, + const size_t pwdlen); + +ARGON2_PUBLIC int argon2d_verify(const char *encoded, const void *pwd, + const size_t pwdlen); + +ARGON2_PUBLIC int argon2id_verify(const char *encoded, const void *pwd, + const size_t pwdlen); + +/* generic function underlying the above ones */ +ARGON2_PUBLIC int argon2_verify(const char *encoded, const void *pwd, + const size_t pwdlen, argon2_type type); + +/** + * Argon2d: Version of Argon2 that picks memory blocks depending + * on the password and salt. Only for side-channel-free + * environment!! + ***** + * @param context Pointer to current Argon2 context + * @return Zero if successful, a non zero error code otherwise + */ +ARGON2_PUBLIC int argon2d_ctx(argon2_context *context); + +/** + * Argon2i: Version of Argon2 that picks memory blocks + * independent on the password and salt. Good for side-channels, + * but worse w.r.t. tradeoff attacks if only one pass is used. + ***** + * @param context Pointer to current Argon2 context + * @return Zero if successful, a non zero error code otherwise + */ +ARGON2_PUBLIC int argon2i_ctx(argon2_context *context); + +/** + * Argon2id: Version of Argon2 where the first half-pass over memory is + * password-independent, the rest are password-dependent (on the password and + * salt). OK against side channels (they reduce to 1/2-pass Argon2i), and + * better with w.r.t. tradeoff attacks (similar to Argon2d). + ***** + * @param context Pointer to current Argon2 context + * @return Zero if successful, a non zero error code otherwise + */ +ARGON2_PUBLIC int argon2id_ctx(argon2_context *context); + +/** + * Verify if a given password is correct for Argon2d hashing + * @param context Pointer to current Argon2 context + * @param hash The password hash to verify. The length of the hash is + * specified by the context outlen member + * @return Zero if successful, a non zero error code otherwise + */ +ARGON2_PUBLIC int argon2d_verify_ctx(argon2_context *context, const char *hash); + +/** + * Verify if a given password is correct for Argon2i hashing + * @param context Pointer to current Argon2 context + * @param hash The password hash to verify. The length of the hash is + * specified by the context outlen member + * @return Zero if successful, a non zero error code otherwise + */ +ARGON2_PUBLIC int argon2i_verify_ctx(argon2_context *context, const char *hash); + +/** + * Verify if a given password is correct for Argon2id hashing + * @param context Pointer to current Argon2 context + * @param hash The password hash to verify. The length of the hash is + * specified by the context outlen member + * @return Zero if successful, a non zero error code otherwise + */ +ARGON2_PUBLIC int argon2id_verify_ctx(argon2_context *context, + const char *hash); + +/* generic function underlying the above ones */ +ARGON2_PUBLIC int argon2_verify_ctx(argon2_context *context, const char *hash, + argon2_type type); + +/** + * Get the associated error message for given error code + * @return The error message associated with the given error code + */ +ARGON2_PUBLIC const char *argon2_error_message(int error_code); + +/** + * Returns the encoded hash length for the given input parameters + * @param t_cost Number of iterations + * @param m_cost Memory usage in kibibytes + * @param parallelism Number of threads; used to compute lanes + * @param saltlen Salt size in bytes + * @param hashlen Hash size in bytes + * @param type The argon2_type that we want the encoded length for + * @return The encoded hash length in bytes + */ +ARGON2_PUBLIC size_t argon2_encodedlen(uint32_t t_cost, uint32_t m_cost, + uint32_t parallelism, uint32_t saltlen, + uint32_t hashlen, argon2_type type); + +#if defined(__cplusplus) +} +#endif + +#endif diff --git a/0x0017a_ctf/third_party/argon2/src/argon2.c b/0x0017a_ctf/third_party/argon2/src/argon2.c new file mode 100644 index 0000000..34da3d6 --- /dev/null +++ b/0x0017a_ctf/third_party/argon2/src/argon2.c @@ -0,0 +1,452 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#include +#include +#include + +#include "argon2.h" +#include "encoding.h" +#include "core.h" + +const char *argon2_type2string(argon2_type type, int uppercase) { + switch (type) { + case Argon2_d: + return uppercase ? "Argon2d" : "argon2d"; + case Argon2_i: + return uppercase ? "Argon2i" : "argon2i"; + case Argon2_id: + return uppercase ? "Argon2id" : "argon2id"; + } + + return NULL; +} + +int argon2_ctx(argon2_context *context, argon2_type type) { + /* 1. Validate all inputs */ + int result = validate_inputs(context); + uint32_t memory_blocks, segment_length; + argon2_instance_t instance; + + if (ARGON2_OK != result) { + return result; + } + + if (Argon2_d != type && Argon2_i != type && Argon2_id != type) { + return ARGON2_INCORRECT_TYPE; + } + + /* 2. Align memory size */ + /* Minimum memory_blocks = 8L blocks, where L is the number of lanes */ + memory_blocks = context->m_cost; + + if (memory_blocks < 2 * ARGON2_SYNC_POINTS * context->lanes) { + memory_blocks = 2 * ARGON2_SYNC_POINTS * context->lanes; + } + + segment_length = memory_blocks / (context->lanes * ARGON2_SYNC_POINTS); + /* Ensure that all segments have equal length */ + memory_blocks = segment_length * (context->lanes * ARGON2_SYNC_POINTS); + + instance.version = context->version; + instance.memory = NULL; + instance.passes = context->t_cost; + instance.memory_blocks = memory_blocks; + instance.segment_length = segment_length; + instance.lane_length = segment_length * ARGON2_SYNC_POINTS; + instance.lanes = context->lanes; + instance.threads = context->threads; + instance.type = type; + + if (instance.threads > instance.lanes) { + instance.threads = instance.lanes; + } + + /* 3. Initialization: Hashing inputs, allocating memory, filling first + * blocks + */ + result = initialize(&instance, context); + + if (ARGON2_OK != result) { + return result; + } + + /* 4. Filling memory */ + result = fill_memory_blocks(&instance); + + if (ARGON2_OK != result) { + return result; + } + /* 5. Finalization */ + finalize(context, &instance); + + return ARGON2_OK; +} + +int argon2_hash(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, const size_t saltlen, + void *hash, const size_t hashlen, char *encoded, + const size_t encodedlen, argon2_type type, + const uint32_t version){ + + argon2_context context; + int result; + uint8_t *out; + + if (pwdlen > ARGON2_MAX_PWD_LENGTH) { + return ARGON2_PWD_TOO_LONG; + } + + if (saltlen > ARGON2_MAX_SALT_LENGTH) { + return ARGON2_SALT_TOO_LONG; + } + + if (hashlen > ARGON2_MAX_OUTLEN) { + return ARGON2_OUTPUT_TOO_LONG; + } + + if (hashlen < ARGON2_MIN_OUTLEN) { + return ARGON2_OUTPUT_TOO_SHORT; + } + + out = malloc(hashlen); + if (!out) { + return ARGON2_MEMORY_ALLOCATION_ERROR; + } + + context.out = (uint8_t *)out; + context.outlen = (uint32_t)hashlen; + context.pwd = CONST_CAST(uint8_t *)pwd; + context.pwdlen = (uint32_t)pwdlen; + context.salt = CONST_CAST(uint8_t *)salt; + context.saltlen = (uint32_t)saltlen; + context.secret = NULL; + context.secretlen = 0; + context.ad = NULL; + context.adlen = 0; + context.t_cost = t_cost; + context.m_cost = m_cost; + context.lanes = parallelism; + context.threads = parallelism; + context.allocate_cbk = NULL; + context.free_cbk = NULL; + context.flags = ARGON2_DEFAULT_FLAGS; + context.version = version; + + result = argon2_ctx(&context, type); + + if (result != ARGON2_OK) { + clear_internal_memory(out, hashlen); + free(out); + return result; + } + + /* if raw hash requested, write it */ + if (hash) { + memcpy(hash, out, hashlen); + } + + /* if encoding requested, write it */ + if (encoded && encodedlen) { + if (encode_string(encoded, encodedlen, &context, type) != ARGON2_OK) { + clear_internal_memory(out, hashlen); /* wipe buffers if error */ + clear_internal_memory(encoded, encodedlen); + free(out); + return ARGON2_ENCODING_FAIL; + } + } + clear_internal_memory(out, hashlen); + free(out); + + return ARGON2_OK; +} + +int argon2i_hash_encoded(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, const size_t hashlen, + char *encoded, const size_t encodedlen) { + + return argon2_hash(t_cost, m_cost, parallelism, pwd, pwdlen, salt, saltlen, + NULL, hashlen, encoded, encodedlen, Argon2_i, + ARGON2_VERSION_NUMBER); +} + +int argon2i_hash_raw(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, const size_t hashlen) { + + return argon2_hash(t_cost, m_cost, parallelism, pwd, pwdlen, salt, saltlen, + hash, hashlen, NULL, 0, Argon2_i, ARGON2_VERSION_NUMBER); +} + +int argon2d_hash_encoded(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, const size_t hashlen, + char *encoded, const size_t encodedlen) { + + return argon2_hash(t_cost, m_cost, parallelism, pwd, pwdlen, salt, saltlen, + NULL, hashlen, encoded, encodedlen, Argon2_d, + ARGON2_VERSION_NUMBER); +} + +int argon2d_hash_raw(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, const size_t hashlen) { + + return argon2_hash(t_cost, m_cost, parallelism, pwd, pwdlen, salt, saltlen, + hash, hashlen, NULL, 0, Argon2_d, ARGON2_VERSION_NUMBER); +} + +int argon2id_hash_encoded(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, const size_t hashlen, + char *encoded, const size_t encodedlen) { + + return argon2_hash(t_cost, m_cost, parallelism, pwd, pwdlen, salt, saltlen, + NULL, hashlen, encoded, encodedlen, Argon2_id, + ARGON2_VERSION_NUMBER); +} + +int argon2id_hash_raw(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, const size_t hashlen) { + return argon2_hash(t_cost, m_cost, parallelism, pwd, pwdlen, salt, saltlen, + hash, hashlen, NULL, 0, Argon2_id, + ARGON2_VERSION_NUMBER); +} + +static int argon2_compare(const uint8_t *b1, const uint8_t *b2, size_t len) { + size_t i; + uint8_t d = 0U; + + for (i = 0U; i < len; i++) { + d |= b1[i] ^ b2[i]; + } + return (int)((1 & ((d - 1) >> 8)) - 1); +} + +int argon2_verify(const char *encoded, const void *pwd, const size_t pwdlen, + argon2_type type) { + + argon2_context ctx; + uint8_t *desired_result = NULL; + + int ret = ARGON2_OK; + + size_t encoded_len; + uint32_t max_field_len; + + if (pwdlen > ARGON2_MAX_PWD_LENGTH) { + return ARGON2_PWD_TOO_LONG; + } + + if (encoded == NULL) { + return ARGON2_DECODING_FAIL; + } + + encoded_len = strlen(encoded); + if (encoded_len > UINT32_MAX) { + return ARGON2_DECODING_FAIL; + } + + /* No field can be longer than the encoded length */ + max_field_len = (uint32_t)encoded_len; + + ctx.saltlen = max_field_len; + ctx.outlen = max_field_len; + + ctx.salt = malloc(ctx.saltlen); + ctx.out = malloc(ctx.outlen); + if (!ctx.salt || !ctx.out) { + ret = ARGON2_MEMORY_ALLOCATION_ERROR; + goto fail; + } + + ctx.pwd = (uint8_t *)pwd; + ctx.pwdlen = (uint32_t)pwdlen; + + ret = decode_string(&ctx, encoded, type); + if (ret != ARGON2_OK) { + goto fail; + } + + /* Set aside the desired result, and get a new buffer. */ + desired_result = ctx.out; + ctx.out = malloc(ctx.outlen); + if (!ctx.out) { + ret = ARGON2_MEMORY_ALLOCATION_ERROR; + goto fail; + } + + ret = argon2_verify_ctx(&ctx, (char *)desired_result, type); + if (ret != ARGON2_OK) { + goto fail; + } + +fail: + free(ctx.salt); + free(ctx.out); + free(desired_result); + + return ret; +} + +int argon2i_verify(const char *encoded, const void *pwd, const size_t pwdlen) { + + return argon2_verify(encoded, pwd, pwdlen, Argon2_i); +} + +int argon2d_verify(const char *encoded, const void *pwd, const size_t pwdlen) { + + return argon2_verify(encoded, pwd, pwdlen, Argon2_d); +} + +int argon2id_verify(const char *encoded, const void *pwd, const size_t pwdlen) { + + return argon2_verify(encoded, pwd, pwdlen, Argon2_id); +} + +int argon2d_ctx(argon2_context *context) { + return argon2_ctx(context, Argon2_d); +} + +int argon2i_ctx(argon2_context *context) { + return argon2_ctx(context, Argon2_i); +} + +int argon2id_ctx(argon2_context *context) { + return argon2_ctx(context, Argon2_id); +} + +int argon2_verify_ctx(argon2_context *context, const char *hash, + argon2_type type) { + int ret = argon2_ctx(context, type); + if (ret != ARGON2_OK) { + return ret; + } + + if (argon2_compare((uint8_t *)hash, context->out, context->outlen)) { + return ARGON2_VERIFY_MISMATCH; + } + + return ARGON2_OK; +} + +int argon2d_verify_ctx(argon2_context *context, const char *hash) { + return argon2_verify_ctx(context, hash, Argon2_d); +} + +int argon2i_verify_ctx(argon2_context *context, const char *hash) { + return argon2_verify_ctx(context, hash, Argon2_i); +} + +int argon2id_verify_ctx(argon2_context *context, const char *hash) { + return argon2_verify_ctx(context, hash, Argon2_id); +} + +const char *argon2_error_message(int error_code) { + switch (error_code) { + case ARGON2_OK: + return "OK"; + case ARGON2_OUTPUT_PTR_NULL: + return "Output pointer is NULL"; + case ARGON2_OUTPUT_TOO_SHORT: + return "Output is too short"; + case ARGON2_OUTPUT_TOO_LONG: + return "Output is too long"; + case ARGON2_PWD_TOO_SHORT: + return "Password is too short"; + case ARGON2_PWD_TOO_LONG: + return "Password is too long"; + case ARGON2_SALT_TOO_SHORT: + return "Salt is too short"; + case ARGON2_SALT_TOO_LONG: + return "Salt is too long"; + case ARGON2_AD_TOO_SHORT: + return "Associated data is too short"; + case ARGON2_AD_TOO_LONG: + return "Associated data is too long"; + case ARGON2_SECRET_TOO_SHORT: + return "Secret is too short"; + case ARGON2_SECRET_TOO_LONG: + return "Secret is too long"; + case ARGON2_TIME_TOO_SMALL: + return "Time cost is too small"; + case ARGON2_TIME_TOO_LARGE: + return "Time cost is too large"; + case ARGON2_MEMORY_TOO_LITTLE: + return "Memory cost is too small"; + case ARGON2_MEMORY_TOO_MUCH: + return "Memory cost is too large"; + case ARGON2_LANES_TOO_FEW: + return "Too few lanes"; + case ARGON2_LANES_TOO_MANY: + return "Too many lanes"; + case ARGON2_PWD_PTR_MISMATCH: + return "Password pointer is NULL, but password length is not 0"; + case ARGON2_SALT_PTR_MISMATCH: + return "Salt pointer is NULL, but salt length is not 0"; + case ARGON2_SECRET_PTR_MISMATCH: + return "Secret pointer is NULL, but secret length is not 0"; + case ARGON2_AD_PTR_MISMATCH: + return "Associated data pointer is NULL, but ad length is not 0"; + case ARGON2_MEMORY_ALLOCATION_ERROR: + return "Memory allocation error"; + case ARGON2_FREE_MEMORY_CBK_NULL: + return "The free memory callback is NULL"; + case ARGON2_ALLOCATE_MEMORY_CBK_NULL: + return "The allocate memory callback is NULL"; + case ARGON2_INCORRECT_PARAMETER: + return "Argon2_Context context is NULL"; + case ARGON2_INCORRECT_TYPE: + return "There is no such version of Argon2"; + case ARGON2_OUT_PTR_MISMATCH: + return "Output pointer mismatch"; + case ARGON2_THREADS_TOO_FEW: + return "Not enough threads"; + case ARGON2_THREADS_TOO_MANY: + return "Too many threads"; + case ARGON2_MISSING_ARGS: + return "Missing arguments"; + case ARGON2_ENCODING_FAIL: + return "Encoding failed"; + case ARGON2_DECODING_FAIL: + return "Decoding failed"; + case ARGON2_THREAD_FAIL: + return "Threading failure"; + case ARGON2_DECODING_LENGTH_FAIL: + return "Some of encoded parameters are too long or too short"; + case ARGON2_VERIFY_MISMATCH: + return "The password does not match the supplied hash"; + default: + return "Unknown error code"; + } +} + +size_t argon2_encodedlen(uint32_t t_cost, uint32_t m_cost, uint32_t parallelism, + uint32_t saltlen, uint32_t hashlen, argon2_type type) { + return strlen("$$v=$m=,t=,p=$$") + strlen(argon2_type2string(type, 0)) + + numlen(t_cost) + numlen(m_cost) + numlen(parallelism) + + b64len(saltlen) + b64len(hashlen) + numlen(ARGON2_VERSION_NUMBER) + 1; +} diff --git a/0x0017a_ctf/third_party/argon2/src/blake2/blake2-impl.h b/0x0017a_ctf/third_party/argon2/src/blake2/blake2-impl.h new file mode 100644 index 0000000..86d0d5c --- /dev/null +++ b/0x0017a_ctf/third_party/argon2/src/blake2/blake2-impl.h @@ -0,0 +1,156 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef PORTABLE_BLAKE2_IMPL_H +#define PORTABLE_BLAKE2_IMPL_H + +#include +#include + +#ifdef _WIN32 +#define BLAKE2_INLINE __inline +#elif defined(__GNUC__) || defined(__clang__) +#define BLAKE2_INLINE __inline__ +#else +#define BLAKE2_INLINE +#endif + +/* Argon2 Team - Begin Code */ +/* + Not an exhaustive list, but should cover the majority of modern platforms + Additionally, the code will always be correct---this is only a performance + tweak. +*/ +#if (defined(__BYTE_ORDER__) && \ + (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)) || \ + defined(__LITTLE_ENDIAN__) || defined(__ARMEL__) || defined(__MIPSEL__) || \ + defined(__AARCH64EL__) || defined(__amd64__) || defined(__i386__) || \ + defined(_M_IX86) || defined(_M_X64) || defined(_M_AMD64) || \ + defined(_M_ARM) +#define NATIVE_LITTLE_ENDIAN +#endif +/* Argon2 Team - End Code */ + +static BLAKE2_INLINE uint32_t load32(const void *src) { +#if defined(NATIVE_LITTLE_ENDIAN) + uint32_t w; + memcpy(&w, src, sizeof w); + return w; +#else + const uint8_t *p = (const uint8_t *)src; + uint32_t w = *p++; + w |= (uint32_t)(*p++) << 8; + w |= (uint32_t)(*p++) << 16; + w |= (uint32_t)(*p++) << 24; + return w; +#endif +} + +static BLAKE2_INLINE uint64_t load64(const void *src) { +#if defined(NATIVE_LITTLE_ENDIAN) + uint64_t w; + memcpy(&w, src, sizeof w); + return w; +#else + const uint8_t *p = (const uint8_t *)src; + uint64_t w = *p++; + w |= (uint64_t)(*p++) << 8; + w |= (uint64_t)(*p++) << 16; + w |= (uint64_t)(*p++) << 24; + w |= (uint64_t)(*p++) << 32; + w |= (uint64_t)(*p++) << 40; + w |= (uint64_t)(*p++) << 48; + w |= (uint64_t)(*p++) << 56; + return w; +#endif +} + +static BLAKE2_INLINE void store32(void *dst, uint32_t w) { +#if defined(NATIVE_LITTLE_ENDIAN) + memcpy(dst, &w, sizeof w); +#else + uint8_t *p = (uint8_t *)dst; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; +#endif +} + +static BLAKE2_INLINE void store64(void *dst, uint64_t w) { +#if defined(NATIVE_LITTLE_ENDIAN) + memcpy(dst, &w, sizeof w); +#else + uint8_t *p = (uint8_t *)dst; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; +#endif +} + +static BLAKE2_INLINE uint64_t load48(const void *src) { + const uint8_t *p = (const uint8_t *)src; + uint64_t w = *p++; + w |= (uint64_t)(*p++) << 8; + w |= (uint64_t)(*p++) << 16; + w |= (uint64_t)(*p++) << 24; + w |= (uint64_t)(*p++) << 32; + w |= (uint64_t)(*p++) << 40; + return w; +} + +static BLAKE2_INLINE void store48(void *dst, uint64_t w) { + uint8_t *p = (uint8_t *)dst; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; +} + +static BLAKE2_INLINE uint32_t rotr32(const uint32_t w, const unsigned c) { + return (w >> c) | (w << (32 - c)); +} + +static BLAKE2_INLINE uint64_t rotr64(const uint64_t w, const unsigned c) { + return (w >> c) | (w << (64 - c)); +} + +void clear_internal_memory(void *v, size_t n); + +#endif diff --git a/0x0017a_ctf/third_party/argon2/src/blake2/blake2.h b/0x0017a_ctf/third_party/argon2/src/blake2/blake2.h new file mode 100644 index 0000000..501c6a3 --- /dev/null +++ b/0x0017a_ctf/third_party/argon2/src/blake2/blake2.h @@ -0,0 +1,89 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef PORTABLE_BLAKE2_H +#define PORTABLE_BLAKE2_H + +#include + +#if defined(__cplusplus) +extern "C" { +#endif + +enum blake2b_constant { + BLAKE2B_BLOCKBYTES = 128, + BLAKE2B_OUTBYTES = 64, + BLAKE2B_KEYBYTES = 64, + BLAKE2B_SALTBYTES = 16, + BLAKE2B_PERSONALBYTES = 16 +}; + +#pragma pack(push, 1) +typedef struct __blake2b_param { + uint8_t digest_length; /* 1 */ + uint8_t key_length; /* 2 */ + uint8_t fanout; /* 3 */ + uint8_t depth; /* 4 */ + uint32_t leaf_length; /* 8 */ + uint64_t node_offset; /* 16 */ + uint8_t node_depth; /* 17 */ + uint8_t inner_length; /* 18 */ + uint8_t reserved[14]; /* 32 */ + uint8_t salt[BLAKE2B_SALTBYTES]; /* 48 */ + uint8_t personal[BLAKE2B_PERSONALBYTES]; /* 64 */ +} blake2b_param; +#pragma pack(pop) + +typedef struct __blake2b_state { + uint64_t h[8]; + uint64_t t[2]; + uint64_t f[2]; + uint8_t buf[BLAKE2B_BLOCKBYTES]; + unsigned buflen; + unsigned outlen; + uint8_t last_node; +} blake2b_state; + +/* Ensure param structs have not been wrongly padded */ +/* Poor man's static_assert */ +enum { + blake2_size_check_0 = 1 / !!(CHAR_BIT == 8), + blake2_size_check_2 = + 1 / !!(sizeof(blake2b_param) == sizeof(uint64_t) * CHAR_BIT) +}; + +/* Streaming API */ +ARGON2_LOCAL int blake2b_init(blake2b_state *S, size_t outlen); +ARGON2_LOCAL int blake2b_init_key(blake2b_state *S, size_t outlen, const void *key, + size_t keylen); +ARGON2_LOCAL int blake2b_init_param(blake2b_state *S, const blake2b_param *P); +ARGON2_LOCAL int blake2b_update(blake2b_state *S, const void *in, size_t inlen); +ARGON2_LOCAL int blake2b_final(blake2b_state *S, void *out, size_t outlen); + +/* Simple API */ +ARGON2_LOCAL int blake2b(void *out, size_t outlen, const void *in, size_t inlen, + const void *key, size_t keylen); + +/* Argon2 Team - Begin Code */ +ARGON2_LOCAL int blake2b_long(void *out, size_t outlen, const void *in, size_t inlen); +/* Argon2 Team - End Code */ + +#if defined(__cplusplus) +} +#endif + +#endif diff --git a/0x0017a_ctf/third_party/argon2/src/blake2/blake2b.c b/0x0017a_ctf/third_party/argon2/src/blake2/blake2b.c new file mode 100644 index 0000000..3b519dd --- /dev/null +++ b/0x0017a_ctf/third_party/argon2/src/blake2/blake2b.c @@ -0,0 +1,390 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#include +#include +#include + +#include "blake2.h" +#include "blake2-impl.h" + +static const uint64_t blake2b_IV[8] = { + UINT64_C(0x6a09e667f3bcc908), UINT64_C(0xbb67ae8584caa73b), + UINT64_C(0x3c6ef372fe94f82b), UINT64_C(0xa54ff53a5f1d36f1), + UINT64_C(0x510e527fade682d1), UINT64_C(0x9b05688c2b3e6c1f), + UINT64_C(0x1f83d9abfb41bd6b), UINT64_C(0x5be0cd19137e2179)}; + +static const unsigned int blake2b_sigma[12][16] = { + {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}, + {14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3}, + {11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4}, + {7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8}, + {9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13}, + {2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9}, + {12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11}, + {13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10}, + {6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5}, + {10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0}, + {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}, + {14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3}, +}; + +static BLAKE2_INLINE void blake2b_set_lastnode(blake2b_state *S) { + S->f[1] = (uint64_t)-1; +} + +static BLAKE2_INLINE void blake2b_set_lastblock(blake2b_state *S) { + if (S->last_node) { + blake2b_set_lastnode(S); + } + S->f[0] = (uint64_t)-1; +} + +static BLAKE2_INLINE void blake2b_increment_counter(blake2b_state *S, + uint64_t inc) { + S->t[0] += inc; + S->t[1] += (S->t[0] < inc); +} + +static BLAKE2_INLINE void blake2b_invalidate_state(blake2b_state *S) { + clear_internal_memory(S, sizeof(*S)); /* wipe */ + blake2b_set_lastblock(S); /* invalidate for further use */ +} + +static BLAKE2_INLINE void blake2b_init0(blake2b_state *S) { + memset(S, 0, sizeof(*S)); + memcpy(S->h, blake2b_IV, sizeof(S->h)); +} + +int blake2b_init_param(blake2b_state *S, const blake2b_param *P) { + const unsigned char *p = (const unsigned char *)P; + unsigned int i; + + if (NULL == P || NULL == S) { + return -1; + } + + blake2b_init0(S); + /* IV XOR Parameter Block */ + for (i = 0; i < 8; ++i) { + S->h[i] ^= load64(&p[i * sizeof(S->h[i])]); + } + S->outlen = P->digest_length; + return 0; +} + +/* Sequential blake2b initialization */ +int blake2b_init(blake2b_state *S, size_t outlen) { + blake2b_param P; + + if (S == NULL) { + return -1; + } + + if ((outlen == 0) || (outlen > BLAKE2B_OUTBYTES)) { + blake2b_invalidate_state(S); + return -1; + } + + /* Setup Parameter Block for unkeyed BLAKE2 */ + P.digest_length = (uint8_t)outlen; + P.key_length = 0; + P.fanout = 1; + P.depth = 1; + P.leaf_length = 0; + P.node_offset = 0; + P.node_depth = 0; + P.inner_length = 0; + memset(P.reserved, 0, sizeof(P.reserved)); + memset(P.salt, 0, sizeof(P.salt)); + memset(P.personal, 0, sizeof(P.personal)); + + return blake2b_init_param(S, &P); +} + +int blake2b_init_key(blake2b_state *S, size_t outlen, const void *key, + size_t keylen) { + blake2b_param P; + + if (S == NULL) { + return -1; + } + + if ((outlen == 0) || (outlen > BLAKE2B_OUTBYTES)) { + blake2b_invalidate_state(S); + return -1; + } + + if ((key == 0) || (keylen == 0) || (keylen > BLAKE2B_KEYBYTES)) { + blake2b_invalidate_state(S); + return -1; + } + + /* Setup Parameter Block for keyed BLAKE2 */ + P.digest_length = (uint8_t)outlen; + P.key_length = (uint8_t)keylen; + P.fanout = 1; + P.depth = 1; + P.leaf_length = 0; + P.node_offset = 0; + P.node_depth = 0; + P.inner_length = 0; + memset(P.reserved, 0, sizeof(P.reserved)); + memset(P.salt, 0, sizeof(P.salt)); + memset(P.personal, 0, sizeof(P.personal)); + + if (blake2b_init_param(S, &P) < 0) { + blake2b_invalidate_state(S); + return -1; + } + + { + uint8_t block[BLAKE2B_BLOCKBYTES]; + memset(block, 0, BLAKE2B_BLOCKBYTES); + memcpy(block, key, keylen); + blake2b_update(S, block, BLAKE2B_BLOCKBYTES); + /* Burn the key from stack */ + clear_internal_memory(block, BLAKE2B_BLOCKBYTES); + } + return 0; +} + +static void blake2b_compress(blake2b_state *S, const uint8_t *block) { + uint64_t m[16]; + uint64_t v[16]; + unsigned int i, r; + + for (i = 0; i < 16; ++i) { + m[i] = load64(block + i * sizeof(m[i])); + } + + for (i = 0; i < 8; ++i) { + v[i] = S->h[i]; + } + + v[8] = blake2b_IV[0]; + v[9] = blake2b_IV[1]; + v[10] = blake2b_IV[2]; + v[11] = blake2b_IV[3]; + v[12] = blake2b_IV[4] ^ S->t[0]; + v[13] = blake2b_IV[5] ^ S->t[1]; + v[14] = blake2b_IV[6] ^ S->f[0]; + v[15] = blake2b_IV[7] ^ S->f[1]; + +#define G(r, i, a, b, c, d) \ + do { \ + a = a + b + m[blake2b_sigma[r][2 * i + 0]]; \ + d = rotr64(d ^ a, 32); \ + c = c + d; \ + b = rotr64(b ^ c, 24); \ + a = a + b + m[blake2b_sigma[r][2 * i + 1]]; \ + d = rotr64(d ^ a, 16); \ + c = c + d; \ + b = rotr64(b ^ c, 63); \ + } while ((void)0, 0) + +#define ROUND(r) \ + do { \ + G(r, 0, v[0], v[4], v[8], v[12]); \ + G(r, 1, v[1], v[5], v[9], v[13]); \ + G(r, 2, v[2], v[6], v[10], v[14]); \ + G(r, 3, v[3], v[7], v[11], v[15]); \ + G(r, 4, v[0], v[5], v[10], v[15]); \ + G(r, 5, v[1], v[6], v[11], v[12]); \ + G(r, 6, v[2], v[7], v[8], v[13]); \ + G(r, 7, v[3], v[4], v[9], v[14]); \ + } while ((void)0, 0) + + for (r = 0; r < 12; ++r) { + ROUND(r); + } + + for (i = 0; i < 8; ++i) { + S->h[i] = S->h[i] ^ v[i] ^ v[i + 8]; + } + +#undef G +#undef ROUND +} + +int blake2b_update(blake2b_state *S, const void *in, size_t inlen) { + const uint8_t *pin = (const uint8_t *)in; + + if (inlen == 0) { + return 0; + } + + /* Sanity check */ + if (S == NULL || in == NULL) { + return -1; + } + + /* Is this a reused state? */ + if (S->f[0] != 0) { + return -1; + } + + if (S->buflen + inlen > BLAKE2B_BLOCKBYTES) { + /* Complete current block */ + size_t left = S->buflen; + size_t fill = BLAKE2B_BLOCKBYTES - left; + memcpy(&S->buf[left], pin, fill); + blake2b_increment_counter(S, BLAKE2B_BLOCKBYTES); + blake2b_compress(S, S->buf); + S->buflen = 0; + inlen -= fill; + pin += fill; + /* Avoid buffer copies when possible */ + while (inlen > BLAKE2B_BLOCKBYTES) { + blake2b_increment_counter(S, BLAKE2B_BLOCKBYTES); + blake2b_compress(S, pin); + inlen -= BLAKE2B_BLOCKBYTES; + pin += BLAKE2B_BLOCKBYTES; + } + } + memcpy(&S->buf[S->buflen], pin, inlen); + S->buflen += (unsigned int)inlen; + return 0; +} + +int blake2b_final(blake2b_state *S, void *out, size_t outlen) { + uint8_t buffer[BLAKE2B_OUTBYTES] = {0}; + unsigned int i; + + /* Sanity checks */ + if (S == NULL || out == NULL || outlen < S->outlen) { + return -1; + } + + /* Is this a reused state? */ + if (S->f[0] != 0) { + return -1; + } + + blake2b_increment_counter(S, S->buflen); + blake2b_set_lastblock(S); + memset(&S->buf[S->buflen], 0, BLAKE2B_BLOCKBYTES - S->buflen); /* Padding */ + blake2b_compress(S, S->buf); + + for (i = 0; i < 8; ++i) { /* Output full hash to temp buffer */ + store64(buffer + sizeof(S->h[i]) * i, S->h[i]); + } + + memcpy(out, buffer, S->outlen); + clear_internal_memory(buffer, sizeof(buffer)); + clear_internal_memory(S->buf, sizeof(S->buf)); + clear_internal_memory(S->h, sizeof(S->h)); + return 0; +} + +int blake2b(void *out, size_t outlen, const void *in, size_t inlen, + const void *key, size_t keylen) { + blake2b_state S; + int ret = -1; + + /* Verify parameters */ + if (NULL == in && inlen > 0) { + goto fail; + } + + if (NULL == out || outlen == 0 || outlen > BLAKE2B_OUTBYTES) { + goto fail; + } + + if ((NULL == key && keylen > 0) || keylen > BLAKE2B_KEYBYTES) { + goto fail; + } + + if (keylen > 0) { + if (blake2b_init_key(&S, outlen, key, keylen) < 0) { + goto fail; + } + } else { + if (blake2b_init(&S, outlen) < 0) { + goto fail; + } + } + + if (blake2b_update(&S, in, inlen) < 0) { + goto fail; + } + ret = blake2b_final(&S, out, outlen); + +fail: + clear_internal_memory(&S, sizeof(S)); + return ret; +} + +/* Argon2 Team - Begin Code */ +int blake2b_long(void *pout, size_t outlen, const void *in, size_t inlen) { + uint8_t *out = (uint8_t *)pout; + blake2b_state blake_state; + uint8_t outlen_bytes[sizeof(uint32_t)] = {0}; + int ret = -1; + + if (outlen > UINT32_MAX) { + goto fail; + } + + /* Ensure little-endian byte order! */ + store32(outlen_bytes, (uint32_t)outlen); + +#define TRY(statement) \ + do { \ + ret = statement; \ + if (ret < 0) { \ + goto fail; \ + } \ + } while ((void)0, 0) + + if (outlen <= BLAKE2B_OUTBYTES) { + TRY(blake2b_init(&blake_state, outlen)); + TRY(blake2b_update(&blake_state, outlen_bytes, sizeof(outlen_bytes))); + TRY(blake2b_update(&blake_state, in, inlen)); + TRY(blake2b_final(&blake_state, out, outlen)); + } else { + uint32_t toproduce; + uint8_t out_buffer[BLAKE2B_OUTBYTES]; + uint8_t in_buffer[BLAKE2B_OUTBYTES]; + TRY(blake2b_init(&blake_state, BLAKE2B_OUTBYTES)); + TRY(blake2b_update(&blake_state, outlen_bytes, sizeof(outlen_bytes))); + TRY(blake2b_update(&blake_state, in, inlen)); + TRY(blake2b_final(&blake_state, out_buffer, BLAKE2B_OUTBYTES)); + memcpy(out, out_buffer, BLAKE2B_OUTBYTES / 2); + out += BLAKE2B_OUTBYTES / 2; + toproduce = (uint32_t)outlen - BLAKE2B_OUTBYTES / 2; + + while (toproduce > BLAKE2B_OUTBYTES) { + memcpy(in_buffer, out_buffer, BLAKE2B_OUTBYTES); + TRY(blake2b(out_buffer, BLAKE2B_OUTBYTES, in_buffer, + BLAKE2B_OUTBYTES, NULL, 0)); + memcpy(out, out_buffer, BLAKE2B_OUTBYTES / 2); + out += BLAKE2B_OUTBYTES / 2; + toproduce -= BLAKE2B_OUTBYTES / 2; + } + + memcpy(in_buffer, out_buffer, BLAKE2B_OUTBYTES); + TRY(blake2b(out_buffer, toproduce, in_buffer, BLAKE2B_OUTBYTES, NULL, + 0)); + memcpy(out, out_buffer, toproduce); + } +fail: + clear_internal_memory(&blake_state, sizeof(blake_state)); + return ret; +#undef TRY +} +/* Argon2 Team - End Code */ diff --git a/0x0017a_ctf/third_party/argon2/src/blake2/blamka-round-opt.h b/0x0017a_ctf/third_party/argon2/src/blake2/blamka-round-opt.h new file mode 100644 index 0000000..3127f2a --- /dev/null +++ b/0x0017a_ctf/third_party/argon2/src/blake2/blamka-round-opt.h @@ -0,0 +1,471 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef BLAKE_ROUND_MKA_OPT_H +#define BLAKE_ROUND_MKA_OPT_H + +#include "blake2-impl.h" + +#include +#if defined(__SSSE3__) +#include /* for _mm_shuffle_epi8 and _mm_alignr_epi8 */ +#endif + +#if defined(__XOP__) && (defined(__GNUC__) || defined(__clang__)) +#include +#endif + +#if !defined(__AVX512F__) +#if !defined(__AVX2__) +#if !defined(__XOP__) +#if defined(__SSSE3__) +#define r16 \ + (_mm_setr_epi8(2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9)) +#define r24 \ + (_mm_setr_epi8(3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10)) +#define _mm_roti_epi64(x, c) \ + (-(c) == 32) \ + ? _mm_shuffle_epi32((x), _MM_SHUFFLE(2, 3, 0, 1)) \ + : (-(c) == 24) \ + ? _mm_shuffle_epi8((x), r24) \ + : (-(c) == 16) \ + ? _mm_shuffle_epi8((x), r16) \ + : (-(c) == 63) \ + ? _mm_xor_si128(_mm_srli_epi64((x), -(c)), \ + _mm_add_epi64((x), (x))) \ + : _mm_xor_si128(_mm_srli_epi64((x), -(c)), \ + _mm_slli_epi64((x), 64 - (-(c)))) +#else /* defined(__SSE2__) */ +#define _mm_roti_epi64(r, c) \ + _mm_xor_si128(_mm_srli_epi64((r), -(c)), _mm_slli_epi64((r), 64 - (-(c)))) +#endif +#else +#endif + +static BLAKE2_INLINE __m128i fBlaMka(__m128i x, __m128i y) { + const __m128i z = _mm_mul_epu32(x, y); + return _mm_add_epi64(_mm_add_epi64(x, y), _mm_add_epi64(z, z)); +} + +#define G1(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + A0 = fBlaMka(A0, B0); \ + A1 = fBlaMka(A1, B1); \ + \ + D0 = _mm_xor_si128(D0, A0); \ + D1 = _mm_xor_si128(D1, A1); \ + \ + D0 = _mm_roti_epi64(D0, -32); \ + D1 = _mm_roti_epi64(D1, -32); \ + \ + C0 = fBlaMka(C0, D0); \ + C1 = fBlaMka(C1, D1); \ + \ + B0 = _mm_xor_si128(B0, C0); \ + B1 = _mm_xor_si128(B1, C1); \ + \ + B0 = _mm_roti_epi64(B0, -24); \ + B1 = _mm_roti_epi64(B1, -24); \ + } while ((void)0, 0) + +#define G2(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + A0 = fBlaMka(A0, B0); \ + A1 = fBlaMka(A1, B1); \ + \ + D0 = _mm_xor_si128(D0, A0); \ + D1 = _mm_xor_si128(D1, A1); \ + \ + D0 = _mm_roti_epi64(D0, -16); \ + D1 = _mm_roti_epi64(D1, -16); \ + \ + C0 = fBlaMka(C0, D0); \ + C1 = fBlaMka(C1, D1); \ + \ + B0 = _mm_xor_si128(B0, C0); \ + B1 = _mm_xor_si128(B1, C1); \ + \ + B0 = _mm_roti_epi64(B0, -63); \ + B1 = _mm_roti_epi64(B1, -63); \ + } while ((void)0, 0) + +#if defined(__SSSE3__) +#define DIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + __m128i t0 = _mm_alignr_epi8(B1, B0, 8); \ + __m128i t1 = _mm_alignr_epi8(B0, B1, 8); \ + B0 = t0; \ + B1 = t1; \ + \ + t0 = C0; \ + C0 = C1; \ + C1 = t0; \ + \ + t0 = _mm_alignr_epi8(D1, D0, 8); \ + t1 = _mm_alignr_epi8(D0, D1, 8); \ + D0 = t1; \ + D1 = t0; \ + } while ((void)0, 0) + +#define UNDIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + __m128i t0 = _mm_alignr_epi8(B0, B1, 8); \ + __m128i t1 = _mm_alignr_epi8(B1, B0, 8); \ + B0 = t0; \ + B1 = t1; \ + \ + t0 = C0; \ + C0 = C1; \ + C1 = t0; \ + \ + t0 = _mm_alignr_epi8(D0, D1, 8); \ + t1 = _mm_alignr_epi8(D1, D0, 8); \ + D0 = t1; \ + D1 = t0; \ + } while ((void)0, 0) +#else /* SSE2 */ +#define DIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + __m128i t0 = D0; \ + __m128i t1 = B0; \ + D0 = C0; \ + C0 = C1; \ + C1 = D0; \ + D0 = _mm_unpackhi_epi64(D1, _mm_unpacklo_epi64(t0, t0)); \ + D1 = _mm_unpackhi_epi64(t0, _mm_unpacklo_epi64(D1, D1)); \ + B0 = _mm_unpackhi_epi64(B0, _mm_unpacklo_epi64(B1, B1)); \ + B1 = _mm_unpackhi_epi64(B1, _mm_unpacklo_epi64(t1, t1)); \ + } while ((void)0, 0) + +#define UNDIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + __m128i t0, t1; \ + t0 = C0; \ + C0 = C1; \ + C1 = t0; \ + t0 = B0; \ + t1 = D0; \ + B0 = _mm_unpackhi_epi64(B1, _mm_unpacklo_epi64(B0, B0)); \ + B1 = _mm_unpackhi_epi64(t0, _mm_unpacklo_epi64(B1, B1)); \ + D0 = _mm_unpackhi_epi64(D0, _mm_unpacklo_epi64(D1, D1)); \ + D1 = _mm_unpackhi_epi64(D1, _mm_unpacklo_epi64(t1, t1)); \ + } while ((void)0, 0) +#endif + +#define BLAKE2_ROUND(A0, A1, B0, B1, C0, C1, D0, D1) \ + do { \ + G1(A0, B0, C0, D0, A1, B1, C1, D1); \ + G2(A0, B0, C0, D0, A1, B1, C1, D1); \ + \ + DIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1); \ + \ + G1(A0, B0, C0, D0, A1, B1, C1, D1); \ + G2(A0, B0, C0, D0, A1, B1, C1, D1); \ + \ + UNDIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1); \ + } while ((void)0, 0) +#else /* __AVX2__ */ + +#include + +#define rotr32(x) _mm256_shuffle_epi32(x, _MM_SHUFFLE(2, 3, 0, 1)) +#define rotr24(x) _mm256_shuffle_epi8(x, _mm256_setr_epi8(3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10, 3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10)) +#define rotr16(x) _mm256_shuffle_epi8(x, _mm256_setr_epi8(2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9, 2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9)) +#define rotr63(x) _mm256_xor_si256(_mm256_srli_epi64((x), 63), _mm256_add_epi64((x), (x))) + +#define G1_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + do { \ + __m256i ml = _mm256_mul_epu32(A0, B0); \ + ml = _mm256_add_epi64(ml, ml); \ + A0 = _mm256_add_epi64(A0, _mm256_add_epi64(B0, ml)); \ + D0 = _mm256_xor_si256(D0, A0); \ + D0 = rotr32(D0); \ + \ + ml = _mm256_mul_epu32(C0, D0); \ + ml = _mm256_add_epi64(ml, ml); \ + C0 = _mm256_add_epi64(C0, _mm256_add_epi64(D0, ml)); \ + \ + B0 = _mm256_xor_si256(B0, C0); \ + B0 = rotr24(B0); \ + \ + ml = _mm256_mul_epu32(A1, B1); \ + ml = _mm256_add_epi64(ml, ml); \ + A1 = _mm256_add_epi64(A1, _mm256_add_epi64(B1, ml)); \ + D1 = _mm256_xor_si256(D1, A1); \ + D1 = rotr32(D1); \ + \ + ml = _mm256_mul_epu32(C1, D1); \ + ml = _mm256_add_epi64(ml, ml); \ + C1 = _mm256_add_epi64(C1, _mm256_add_epi64(D1, ml)); \ + \ + B1 = _mm256_xor_si256(B1, C1); \ + B1 = rotr24(B1); \ + } while((void)0, 0); + +#define G2_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + do { \ + __m256i ml = _mm256_mul_epu32(A0, B0); \ + ml = _mm256_add_epi64(ml, ml); \ + A0 = _mm256_add_epi64(A0, _mm256_add_epi64(B0, ml)); \ + D0 = _mm256_xor_si256(D0, A0); \ + D0 = rotr16(D0); \ + \ + ml = _mm256_mul_epu32(C0, D0); \ + ml = _mm256_add_epi64(ml, ml); \ + C0 = _mm256_add_epi64(C0, _mm256_add_epi64(D0, ml)); \ + B0 = _mm256_xor_si256(B0, C0); \ + B0 = rotr63(B0); \ + \ + ml = _mm256_mul_epu32(A1, B1); \ + ml = _mm256_add_epi64(ml, ml); \ + A1 = _mm256_add_epi64(A1, _mm256_add_epi64(B1, ml)); \ + D1 = _mm256_xor_si256(D1, A1); \ + D1 = rotr16(D1); \ + \ + ml = _mm256_mul_epu32(C1, D1); \ + ml = _mm256_add_epi64(ml, ml); \ + C1 = _mm256_add_epi64(C1, _mm256_add_epi64(D1, ml)); \ + B1 = _mm256_xor_si256(B1, C1); \ + B1 = rotr63(B1); \ + } while((void)0, 0); + +#define DIAGONALIZE_1(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + B0 = _mm256_permute4x64_epi64(B0, _MM_SHUFFLE(0, 3, 2, 1)); \ + C0 = _mm256_permute4x64_epi64(C0, _MM_SHUFFLE(1, 0, 3, 2)); \ + D0 = _mm256_permute4x64_epi64(D0, _MM_SHUFFLE(2, 1, 0, 3)); \ + \ + B1 = _mm256_permute4x64_epi64(B1, _MM_SHUFFLE(0, 3, 2, 1)); \ + C1 = _mm256_permute4x64_epi64(C1, _MM_SHUFFLE(1, 0, 3, 2)); \ + D1 = _mm256_permute4x64_epi64(D1, _MM_SHUFFLE(2, 1, 0, 3)); \ + } while((void)0, 0); + +#define DIAGONALIZE_2(A0, A1, B0, B1, C0, C1, D0, D1) \ + do { \ + __m256i tmp1 = _mm256_blend_epi32(B0, B1, 0xCC); \ + __m256i tmp2 = _mm256_blend_epi32(B0, B1, 0x33); \ + B1 = _mm256_permute4x64_epi64(tmp1, _MM_SHUFFLE(2,3,0,1)); \ + B0 = _mm256_permute4x64_epi64(tmp2, _MM_SHUFFLE(2,3,0,1)); \ + \ + tmp1 = C0; \ + C0 = C1; \ + C1 = tmp1; \ + \ + tmp1 = _mm256_blend_epi32(D0, D1, 0xCC); \ + tmp2 = _mm256_blend_epi32(D0, D1, 0x33); \ + D0 = _mm256_permute4x64_epi64(tmp1, _MM_SHUFFLE(2,3,0,1)); \ + D1 = _mm256_permute4x64_epi64(tmp2, _MM_SHUFFLE(2,3,0,1)); \ + } while(0); + +#define UNDIAGONALIZE_1(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + B0 = _mm256_permute4x64_epi64(B0, _MM_SHUFFLE(2, 1, 0, 3)); \ + C0 = _mm256_permute4x64_epi64(C0, _MM_SHUFFLE(1, 0, 3, 2)); \ + D0 = _mm256_permute4x64_epi64(D0, _MM_SHUFFLE(0, 3, 2, 1)); \ + \ + B1 = _mm256_permute4x64_epi64(B1, _MM_SHUFFLE(2, 1, 0, 3)); \ + C1 = _mm256_permute4x64_epi64(C1, _MM_SHUFFLE(1, 0, 3, 2)); \ + D1 = _mm256_permute4x64_epi64(D1, _MM_SHUFFLE(0, 3, 2, 1)); \ + } while((void)0, 0); + +#define UNDIAGONALIZE_2(A0, A1, B0, B1, C0, C1, D0, D1) \ + do { \ + __m256i tmp1 = _mm256_blend_epi32(B0, B1, 0xCC); \ + __m256i tmp2 = _mm256_blend_epi32(B0, B1, 0x33); \ + B0 = _mm256_permute4x64_epi64(tmp1, _MM_SHUFFLE(2,3,0,1)); \ + B1 = _mm256_permute4x64_epi64(tmp2, _MM_SHUFFLE(2,3,0,1)); \ + \ + tmp1 = C0; \ + C0 = C1; \ + C1 = tmp1; \ + \ + tmp1 = _mm256_blend_epi32(D0, D1, 0x33); \ + tmp2 = _mm256_blend_epi32(D0, D1, 0xCC); \ + D0 = _mm256_permute4x64_epi64(tmp1, _MM_SHUFFLE(2,3,0,1)); \ + D1 = _mm256_permute4x64_epi64(tmp2, _MM_SHUFFLE(2,3,0,1)); \ + } while((void)0, 0); + +#define BLAKE2_ROUND_1(A0, A1, B0, B1, C0, C1, D0, D1) \ + do{ \ + G1_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + G2_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + \ + DIAGONALIZE_1(A0, B0, C0, D0, A1, B1, C1, D1) \ + \ + G1_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + G2_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + \ + UNDIAGONALIZE_1(A0, B0, C0, D0, A1, B1, C1, D1) \ + } while((void)0, 0); + +#define BLAKE2_ROUND_2(A0, A1, B0, B1, C0, C1, D0, D1) \ + do{ \ + G1_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + G2_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + \ + DIAGONALIZE_2(A0, A1, B0, B1, C0, C1, D0, D1) \ + \ + G1_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + G2_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + \ + UNDIAGONALIZE_2(A0, A1, B0, B1, C0, C1, D0, D1) \ + } while((void)0, 0); + +#endif /* __AVX2__ */ + +#else /* __AVX512F__ */ + +#include + +#define ror64(x, n) _mm512_ror_epi64((x), (n)) + +static __m512i muladd(__m512i x, __m512i y) +{ + __m512i z = _mm512_mul_epu32(x, y); + return _mm512_add_epi64(_mm512_add_epi64(x, y), _mm512_add_epi64(z, z)); +} + +#define G1(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + A0 = muladd(A0, B0); \ + A1 = muladd(A1, B1); \ +\ + D0 = _mm512_xor_si512(D0, A0); \ + D1 = _mm512_xor_si512(D1, A1); \ +\ + D0 = ror64(D0, 32); \ + D1 = ror64(D1, 32); \ +\ + C0 = muladd(C0, D0); \ + C1 = muladd(C1, D1); \ +\ + B0 = _mm512_xor_si512(B0, C0); \ + B1 = _mm512_xor_si512(B1, C1); \ +\ + B0 = ror64(B0, 24); \ + B1 = ror64(B1, 24); \ + } while ((void)0, 0) + +#define G2(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + A0 = muladd(A0, B0); \ + A1 = muladd(A1, B1); \ +\ + D0 = _mm512_xor_si512(D0, A0); \ + D1 = _mm512_xor_si512(D1, A1); \ +\ + D0 = ror64(D0, 16); \ + D1 = ror64(D1, 16); \ +\ + C0 = muladd(C0, D0); \ + C1 = muladd(C1, D1); \ +\ + B0 = _mm512_xor_si512(B0, C0); \ + B1 = _mm512_xor_si512(B1, C1); \ +\ + B0 = ror64(B0, 63); \ + B1 = ror64(B1, 63); \ + } while ((void)0, 0) + +#define DIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + B0 = _mm512_permutex_epi64(B0, _MM_SHUFFLE(0, 3, 2, 1)); \ + B1 = _mm512_permutex_epi64(B1, _MM_SHUFFLE(0, 3, 2, 1)); \ +\ + C0 = _mm512_permutex_epi64(C0, _MM_SHUFFLE(1, 0, 3, 2)); \ + C1 = _mm512_permutex_epi64(C1, _MM_SHUFFLE(1, 0, 3, 2)); \ +\ + D0 = _mm512_permutex_epi64(D0, _MM_SHUFFLE(2, 1, 0, 3)); \ + D1 = _mm512_permutex_epi64(D1, _MM_SHUFFLE(2, 1, 0, 3)); \ + } while ((void)0, 0) + +#define UNDIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + B0 = _mm512_permutex_epi64(B0, _MM_SHUFFLE(2, 1, 0, 3)); \ + B1 = _mm512_permutex_epi64(B1, _MM_SHUFFLE(2, 1, 0, 3)); \ +\ + C0 = _mm512_permutex_epi64(C0, _MM_SHUFFLE(1, 0, 3, 2)); \ + C1 = _mm512_permutex_epi64(C1, _MM_SHUFFLE(1, 0, 3, 2)); \ +\ + D0 = _mm512_permutex_epi64(D0, _MM_SHUFFLE(0, 3, 2, 1)); \ + D1 = _mm512_permutex_epi64(D1, _MM_SHUFFLE(0, 3, 2, 1)); \ + } while ((void)0, 0) + +#define BLAKE2_ROUND(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + G1(A0, B0, C0, D0, A1, B1, C1, D1); \ + G2(A0, B0, C0, D0, A1, B1, C1, D1); \ +\ + DIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1); \ +\ + G1(A0, B0, C0, D0, A1, B1, C1, D1); \ + G2(A0, B0, C0, D0, A1, B1, C1, D1); \ +\ + UNDIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1); \ + } while ((void)0, 0) + +#define SWAP_HALVES(A0, A1) \ + do { \ + __m512i t0, t1; \ + t0 = _mm512_shuffle_i64x2(A0, A1, _MM_SHUFFLE(1, 0, 1, 0)); \ + t1 = _mm512_shuffle_i64x2(A0, A1, _MM_SHUFFLE(3, 2, 3, 2)); \ + A0 = t0; \ + A1 = t1; \ + } while((void)0, 0) + +#define SWAP_QUARTERS(A0, A1) \ + do { \ + SWAP_HALVES(A0, A1); \ + A0 = _mm512_permutexvar_epi64(_mm512_setr_epi64(0, 1, 4, 5, 2, 3, 6, 7), A0); \ + A1 = _mm512_permutexvar_epi64(_mm512_setr_epi64(0, 1, 4, 5, 2, 3, 6, 7), A1); \ + } while((void)0, 0) + +#define UNSWAP_QUARTERS(A0, A1) \ + do { \ + A0 = _mm512_permutexvar_epi64(_mm512_setr_epi64(0, 1, 4, 5, 2, 3, 6, 7), A0); \ + A1 = _mm512_permutexvar_epi64(_mm512_setr_epi64(0, 1, 4, 5, 2, 3, 6, 7), A1); \ + SWAP_HALVES(A0, A1); \ + } while((void)0, 0) + +#define BLAKE2_ROUND_1(A0, C0, B0, D0, A1, C1, B1, D1) \ + do { \ + SWAP_HALVES(A0, B0); \ + SWAP_HALVES(C0, D0); \ + SWAP_HALVES(A1, B1); \ + SWAP_HALVES(C1, D1); \ + BLAKE2_ROUND(A0, B0, C0, D0, A1, B1, C1, D1); \ + SWAP_HALVES(A0, B0); \ + SWAP_HALVES(C0, D0); \ + SWAP_HALVES(A1, B1); \ + SWAP_HALVES(C1, D1); \ + } while ((void)0, 0) + +#define BLAKE2_ROUND_2(A0, A1, B0, B1, C0, C1, D0, D1) \ + do { \ + SWAP_QUARTERS(A0, A1); \ + SWAP_QUARTERS(B0, B1); \ + SWAP_QUARTERS(C0, C1); \ + SWAP_QUARTERS(D0, D1); \ + BLAKE2_ROUND(A0, B0, C0, D0, A1, B1, C1, D1); \ + UNSWAP_QUARTERS(A0, A1); \ + UNSWAP_QUARTERS(B0, B1); \ + UNSWAP_QUARTERS(C0, C1); \ + UNSWAP_QUARTERS(D0, D1); \ + } while ((void)0, 0) + +#endif /* __AVX512F__ */ +#endif /* BLAKE_ROUND_MKA_OPT_H */ diff --git a/0x0017a_ctf/third_party/argon2/src/blake2/blamka-round-ref.h b/0x0017a_ctf/third_party/argon2/src/blake2/blamka-round-ref.h new file mode 100644 index 0000000..16cfc1c --- /dev/null +++ b/0x0017a_ctf/third_party/argon2/src/blake2/blamka-round-ref.h @@ -0,0 +1,56 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef BLAKE_ROUND_MKA_H +#define BLAKE_ROUND_MKA_H + +#include "blake2.h" +#include "blake2-impl.h" + +/* designed by the Lyra PHC team */ +static BLAKE2_INLINE uint64_t fBlaMka(uint64_t x, uint64_t y) { + const uint64_t m = UINT64_C(0xFFFFFFFF); + const uint64_t xy = (x & m) * (y & m); + return x + y + 2 * xy; +} + +#define G(a, b, c, d) \ + do { \ + a = fBlaMka(a, b); \ + d = rotr64(d ^ a, 32); \ + c = fBlaMka(c, d); \ + b = rotr64(b ^ c, 24); \ + a = fBlaMka(a, b); \ + d = rotr64(d ^ a, 16); \ + c = fBlaMka(c, d); \ + b = rotr64(b ^ c, 63); \ + } while ((void)0, 0) + +#define BLAKE2_ROUND_NOMSG(v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, \ + v12, v13, v14, v15) \ + do { \ + G(v0, v4, v8, v12); \ + G(v1, v5, v9, v13); \ + G(v2, v6, v10, v14); \ + G(v3, v7, v11, v15); \ + G(v0, v5, v10, v15); \ + G(v1, v6, v11, v12); \ + G(v2, v7, v8, v13); \ + G(v3, v4, v9, v14); \ + } while ((void)0, 0) + +#endif diff --git a/0x0017a_ctf/third_party/argon2/src/core.c b/0x0017a_ctf/third_party/argon2/src/core.c new file mode 100644 index 0000000..e697882 --- /dev/null +++ b/0x0017a_ctf/third_party/argon2/src/core.c @@ -0,0 +1,648 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +/*For memory wiping*/ +#ifdef _WIN32 +#include +#include /* For SecureZeroMemory */ +#endif +#if defined __STDC_LIB_EXT1__ +#define __STDC_WANT_LIB_EXT1__ 1 +#endif +#define VC_GE_2005(version) (version >= 1400) + +/* for explicit_bzero() on glibc */ +#define _DEFAULT_SOURCE + +#include +#include +#include + +#include "core.h" +#include "thread.h" +#include "blake2/blake2.h" +#include "blake2/blake2-impl.h" + +#ifdef GENKAT +#include "genkat.h" +#endif + +#if defined(__clang__) +#if __has_attribute(optnone) +#define NOT_OPTIMIZED __attribute__((optnone)) +#endif +#elif defined(__GNUC__) +#define GCC_VERSION \ + (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__) +#if GCC_VERSION >= 40400 +#define NOT_OPTIMIZED __attribute__((optimize("O0"))) +#endif +#endif +#ifndef NOT_OPTIMIZED +#define NOT_OPTIMIZED +#endif + +/***************Instance and Position constructors**********/ +void init_block_value(block *b, uint8_t in) { memset(b->v, in, sizeof(b->v)); } + +void copy_block(block *dst, const block *src) { + memcpy(dst->v, src->v, sizeof(uint64_t) * ARGON2_QWORDS_IN_BLOCK); +} + +void xor_block(block *dst, const block *src) { + int i; + for (i = 0; i < ARGON2_QWORDS_IN_BLOCK; ++i) { + dst->v[i] ^= src->v[i]; + } +} + +static void load_block(block *dst, const void *input) { + unsigned i; + for (i = 0; i < ARGON2_QWORDS_IN_BLOCK; ++i) { + dst->v[i] = load64((const uint8_t *)input + i * sizeof(dst->v[i])); + } +} + +static void store_block(void *output, const block *src) { + unsigned i; + for (i = 0; i < ARGON2_QWORDS_IN_BLOCK; ++i) { + store64((uint8_t *)output + i * sizeof(src->v[i]), src->v[i]); + } +} + +/***************Memory functions*****************/ + +int allocate_memory(const argon2_context *context, uint8_t **memory, + size_t num, size_t size) { + size_t memory_size = num*size; + if (memory == NULL) { + return ARGON2_MEMORY_ALLOCATION_ERROR; + } + + /* 1. Check for multiplication overflow */ + if (size != 0 && memory_size / size != num) { + return ARGON2_MEMORY_ALLOCATION_ERROR; + } + + /* 2. Try to allocate with appropriate allocator */ + if (context->allocate_cbk) { + (context->allocate_cbk)(memory, memory_size); + } else { + *memory = malloc(memory_size); + } + + if (*memory == NULL) { + return ARGON2_MEMORY_ALLOCATION_ERROR; + } + + return ARGON2_OK; +} + +void free_memory(const argon2_context *context, uint8_t *memory, + size_t num, size_t size) { + size_t memory_size = num*size; + clear_internal_memory(memory, memory_size); + if (context->free_cbk) { + (context->free_cbk)(memory, memory_size); + } else { + free(memory); + } +} + +#if defined(__OpenBSD__) +#define HAVE_EXPLICIT_BZERO 1 +#elif defined(__GLIBC__) && defined(__GLIBC_PREREQ) +#if __GLIBC_PREREQ(2,25) +#define HAVE_EXPLICIT_BZERO 1 +#endif +#endif + +void NOT_OPTIMIZED secure_wipe_memory(void *v, size_t n) { +#if defined(_MSC_VER) && VC_GE_2005(_MSC_VER) || defined(__MINGW32__) + SecureZeroMemory(v, n); +#elif defined memset_s + memset_s(v, n, 0, n); +#elif defined(HAVE_EXPLICIT_BZERO) + explicit_bzero(v, n); +#else + static void *(*const volatile memset_sec)(void *, int, size_t) = &memset; + memset_sec(v, 0, n); +#endif +} + +/* Memory clear flag defaults to true. */ +int FLAG_clear_internal_memory = 1; +void clear_internal_memory(void *v, size_t n) { + if (FLAG_clear_internal_memory && v) { + secure_wipe_memory(v, n); + } +} + +void finalize(const argon2_context *context, argon2_instance_t *instance) { + if (context != NULL && instance != NULL) { + block blockhash; + uint32_t l; + + copy_block(&blockhash, instance->memory + instance->lane_length - 1); + + /* XOR the last blocks */ + for (l = 1; l < instance->lanes; ++l) { + uint32_t last_block_in_lane = + l * instance->lane_length + (instance->lane_length - 1); + xor_block(&blockhash, instance->memory + last_block_in_lane); + } + + /* Hash the result */ + { + uint8_t blockhash_bytes[ARGON2_BLOCK_SIZE]; + store_block(blockhash_bytes, &blockhash); + blake2b_long(context->out, context->outlen, blockhash_bytes, + ARGON2_BLOCK_SIZE); + /* clear blockhash and blockhash_bytes */ + clear_internal_memory(blockhash.v, ARGON2_BLOCK_SIZE); + clear_internal_memory(blockhash_bytes, ARGON2_BLOCK_SIZE); + } + +#ifdef GENKAT + print_tag(context->out, context->outlen); +#endif + + free_memory(context, (uint8_t *)instance->memory, + instance->memory_blocks, sizeof(block)); + } +} + +uint32_t index_alpha(const argon2_instance_t *instance, + const argon2_position_t *position, uint32_t pseudo_rand, + int same_lane) { + /* + * Pass 0: + * This lane : all already finished segments plus already constructed + * blocks in this segment + * Other lanes : all already finished segments + * Pass 1+: + * This lane : (SYNC_POINTS - 1) last segments plus already constructed + * blocks in this segment + * Other lanes : (SYNC_POINTS - 1) last segments + */ + uint32_t reference_area_size; + uint64_t relative_position; + uint32_t start_position, absolute_position; + + if (0 == position->pass) { + /* First pass */ + if (0 == position->slice) { + /* First slice */ + reference_area_size = + position->index - 1; /* all but the previous */ + } else { + if (same_lane) { + /* The same lane => add current segment */ + reference_area_size = + position->slice * instance->segment_length + + position->index - 1; + } else { + reference_area_size = + position->slice * instance->segment_length + + ((position->index == 0) ? (-1) : 0); + } + } + } else { + /* Second pass */ + if (same_lane) { + reference_area_size = instance->lane_length - + instance->segment_length + position->index - + 1; + } else { + reference_area_size = instance->lane_length - + instance->segment_length + + ((position->index == 0) ? (-1) : 0); + } + } + + /* 1.2.4. Mapping pseudo_rand to 0.. and produce + * relative position */ + relative_position = pseudo_rand; + relative_position = relative_position * relative_position >> 32; + relative_position = reference_area_size - 1 - + (reference_area_size * relative_position >> 32); + + /* 1.2.5 Computing starting position */ + start_position = 0; + + if (0 != position->pass) { + start_position = (position->slice == ARGON2_SYNC_POINTS - 1) + ? 0 + : (position->slice + 1) * instance->segment_length; + } + + /* 1.2.6. Computing absolute position */ + absolute_position = (start_position + relative_position) % + instance->lane_length; /* absolute position */ + return absolute_position; +} + +/* Single-threaded version for p=1 case */ +static int fill_memory_blocks_st(argon2_instance_t *instance) { + uint32_t r, s, l; + + for (r = 0; r < instance->passes; ++r) { + for (s = 0; s < ARGON2_SYNC_POINTS; ++s) { + for (l = 0; l < instance->lanes; ++l) { + argon2_position_t position = {r, l, (uint8_t)s, 0}; + fill_segment(instance, position); + } + } +#ifdef GENKAT + internal_kat(instance, r); /* Print all memory blocks */ +#endif + } + return ARGON2_OK; +} + +#if !defined(ARGON2_NO_THREADS) + +#ifdef _WIN32 +static unsigned __stdcall fill_segment_thr(void *thread_data) +#else +static void *fill_segment_thr(void *thread_data) +#endif +{ + argon2_thread_data *my_data = thread_data; + fill_segment(my_data->instance_ptr, my_data->pos); + argon2_thread_exit(); + return 0; +} + +/* Multi-threaded version for p > 1 case */ +static int fill_memory_blocks_mt(argon2_instance_t *instance) { + uint32_t r, s; + argon2_thread_handle_t *thread = NULL; + argon2_thread_data *thr_data = NULL; + int rc = ARGON2_OK; + + /* 1. Allocating space for threads */ + thread = calloc(instance->lanes, sizeof(argon2_thread_handle_t)); + if (thread == NULL) { + rc = ARGON2_MEMORY_ALLOCATION_ERROR; + goto fail; + } + + thr_data = calloc(instance->lanes, sizeof(argon2_thread_data)); + if (thr_data == NULL) { + rc = ARGON2_MEMORY_ALLOCATION_ERROR; + goto fail; + } + + for (r = 0; r < instance->passes; ++r) { + for (s = 0; s < ARGON2_SYNC_POINTS; ++s) { + uint32_t l, ll; + + /* 2. Calling threads */ + for (l = 0; l < instance->lanes; ++l) { + argon2_position_t position; + + /* 2.1 Join a thread if limit is exceeded */ + if (l >= instance->threads) { + if (argon2_thread_join(thread[l - instance->threads])) { + rc = ARGON2_THREAD_FAIL; + goto fail; + } + } + + /* 2.2 Create thread */ + position.pass = r; + position.lane = l; + position.slice = (uint8_t)s; + position.index = 0; + thr_data[l].instance_ptr = + instance; /* preparing the thread input */ + memcpy(&(thr_data[l].pos), &position, + sizeof(argon2_position_t)); + if (argon2_thread_create(&thread[l], &fill_segment_thr, + (void *)&thr_data[l])) { + /* Wait for already running threads */ + for (ll = 0; ll < l; ++ll) + argon2_thread_join(thread[ll]); + rc = ARGON2_THREAD_FAIL; + goto fail; + } + + /* fill_segment(instance, position); */ + /*Non-thread equivalent of the lines above */ + } + + /* 3. Joining remaining threads */ + for (l = instance->lanes - instance->threads; l < instance->lanes; + ++l) { + if (argon2_thread_join(thread[l])) { + rc = ARGON2_THREAD_FAIL; + goto fail; + } + } + } + +#ifdef GENKAT + internal_kat(instance, r); /* Print all memory blocks */ +#endif + } + +fail: + if (thread != NULL) { + free(thread); + } + if (thr_data != NULL) { + free(thr_data); + } + return rc; +} + +#endif /* ARGON2_NO_THREADS */ + +int fill_memory_blocks(argon2_instance_t *instance) { + if (instance == NULL || instance->lanes == 0) { + return ARGON2_INCORRECT_PARAMETER; + } +#if defined(ARGON2_NO_THREADS) + return fill_memory_blocks_st(instance); +#else + return instance->threads == 1 ? + fill_memory_blocks_st(instance) : fill_memory_blocks_mt(instance); +#endif +} + +int validate_inputs(const argon2_context *context) { + if (NULL == context) { + return ARGON2_INCORRECT_PARAMETER; + } + + if (NULL == context->out) { + return ARGON2_OUTPUT_PTR_NULL; + } + + /* Validate output length */ + if (ARGON2_MIN_OUTLEN > context->outlen) { + return ARGON2_OUTPUT_TOO_SHORT; + } + + if (ARGON2_MAX_OUTLEN < context->outlen) { + return ARGON2_OUTPUT_TOO_LONG; + } + + /* Validate password (required param) */ + if (NULL == context->pwd) { + if (0 != context->pwdlen) { + return ARGON2_PWD_PTR_MISMATCH; + } + } + + if (ARGON2_MIN_PWD_LENGTH > context->pwdlen) { + return ARGON2_PWD_TOO_SHORT; + } + + if (ARGON2_MAX_PWD_LENGTH < context->pwdlen) { + return ARGON2_PWD_TOO_LONG; + } + + /* Validate salt (required param) */ + if (NULL == context->salt) { + if (0 != context->saltlen) { + return ARGON2_SALT_PTR_MISMATCH; + } + } + + if (ARGON2_MIN_SALT_LENGTH > context->saltlen) { + return ARGON2_SALT_TOO_SHORT; + } + + if (ARGON2_MAX_SALT_LENGTH < context->saltlen) { + return ARGON2_SALT_TOO_LONG; + } + + /* Validate secret (optional param) */ + if (NULL == context->secret) { + if (0 != context->secretlen) { + return ARGON2_SECRET_PTR_MISMATCH; + } + } else { + if (ARGON2_MIN_SECRET > context->secretlen) { + return ARGON2_SECRET_TOO_SHORT; + } + if (ARGON2_MAX_SECRET < context->secretlen) { + return ARGON2_SECRET_TOO_LONG; + } + } + + /* Validate associated data (optional param) */ + if (NULL == context->ad) { + if (0 != context->adlen) { + return ARGON2_AD_PTR_MISMATCH; + } + } else { + if (ARGON2_MIN_AD_LENGTH > context->adlen) { + return ARGON2_AD_TOO_SHORT; + } + if (ARGON2_MAX_AD_LENGTH < context->adlen) { + return ARGON2_AD_TOO_LONG; + } + } + + /* Validate memory cost */ + if (ARGON2_MIN_MEMORY > context->m_cost) { + return ARGON2_MEMORY_TOO_LITTLE; + } + + if (ARGON2_MAX_MEMORY < context->m_cost) { + return ARGON2_MEMORY_TOO_MUCH; + } + + if (context->m_cost < 8 * context->lanes) { + return ARGON2_MEMORY_TOO_LITTLE; + } + + /* Validate time cost */ + if (ARGON2_MIN_TIME > context->t_cost) { + return ARGON2_TIME_TOO_SMALL; + } + + if (ARGON2_MAX_TIME < context->t_cost) { + return ARGON2_TIME_TOO_LARGE; + } + + /* Validate lanes */ + if (ARGON2_MIN_LANES > context->lanes) { + return ARGON2_LANES_TOO_FEW; + } + + if (ARGON2_MAX_LANES < context->lanes) { + return ARGON2_LANES_TOO_MANY; + } + + /* Validate threads */ + if (ARGON2_MIN_THREADS > context->threads) { + return ARGON2_THREADS_TOO_FEW; + } + + if (ARGON2_MAX_THREADS < context->threads) { + return ARGON2_THREADS_TOO_MANY; + } + + if (NULL != context->allocate_cbk && NULL == context->free_cbk) { + return ARGON2_FREE_MEMORY_CBK_NULL; + } + + if (NULL == context->allocate_cbk && NULL != context->free_cbk) { + return ARGON2_ALLOCATE_MEMORY_CBK_NULL; + } + + return ARGON2_OK; +} + +void fill_first_blocks(uint8_t *blockhash, const argon2_instance_t *instance) { + uint32_t l; + /* Make the first and second block in each lane as G(H0||0||i) or + G(H0||1||i) */ + uint8_t blockhash_bytes[ARGON2_BLOCK_SIZE]; + for (l = 0; l < instance->lanes; ++l) { + + store32(blockhash + ARGON2_PREHASH_DIGEST_LENGTH, 0); + store32(blockhash + ARGON2_PREHASH_DIGEST_LENGTH + 4, l); + blake2b_long(blockhash_bytes, ARGON2_BLOCK_SIZE, blockhash, + ARGON2_PREHASH_SEED_LENGTH); + load_block(&instance->memory[l * instance->lane_length + 0], + blockhash_bytes); + + store32(blockhash + ARGON2_PREHASH_DIGEST_LENGTH, 1); + blake2b_long(blockhash_bytes, ARGON2_BLOCK_SIZE, blockhash, + ARGON2_PREHASH_SEED_LENGTH); + load_block(&instance->memory[l * instance->lane_length + 1], + blockhash_bytes); + } + clear_internal_memory(blockhash_bytes, ARGON2_BLOCK_SIZE); +} + +void initial_hash(uint8_t *blockhash, argon2_context *context, + argon2_type type) { + blake2b_state BlakeHash; + uint8_t value[sizeof(uint32_t)]; + + if (NULL == context || NULL == blockhash) { + return; + } + + blake2b_init(&BlakeHash, ARGON2_PREHASH_DIGEST_LENGTH); + + store32(&value, context->lanes); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + store32(&value, context->outlen); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + store32(&value, context->m_cost); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + store32(&value, context->t_cost); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + store32(&value, context->version); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + store32(&value, (uint32_t)type); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + store32(&value, context->pwdlen); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + if (context->pwd != NULL) { + blake2b_update(&BlakeHash, (const uint8_t *)context->pwd, + context->pwdlen); + + if (context->flags & ARGON2_FLAG_CLEAR_PASSWORD) { + secure_wipe_memory(context->pwd, context->pwdlen); + context->pwdlen = 0; + } + } + + store32(&value, context->saltlen); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + if (context->salt != NULL) { + blake2b_update(&BlakeHash, (const uint8_t *)context->salt, + context->saltlen); + } + + store32(&value, context->secretlen); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + if (context->secret != NULL) { + blake2b_update(&BlakeHash, (const uint8_t *)context->secret, + context->secretlen); + + if (context->flags & ARGON2_FLAG_CLEAR_SECRET) { + secure_wipe_memory(context->secret, context->secretlen); + context->secretlen = 0; + } + } + + store32(&value, context->adlen); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + if (context->ad != NULL) { + blake2b_update(&BlakeHash, (const uint8_t *)context->ad, + context->adlen); + } + + blake2b_final(&BlakeHash, blockhash, ARGON2_PREHASH_DIGEST_LENGTH); +} + +int initialize(argon2_instance_t *instance, argon2_context *context) { + uint8_t blockhash[ARGON2_PREHASH_SEED_LENGTH]; + int result = ARGON2_OK; + + if (instance == NULL || context == NULL) + return ARGON2_INCORRECT_PARAMETER; + instance->context_ptr = context; + + /* 1. Memory allocation */ + result = allocate_memory(context, (uint8_t **)&(instance->memory), + instance->memory_blocks, sizeof(block)); + if (result != ARGON2_OK) { + return result; + } + + /* 2. Initial hashing */ + /* H_0 + 8 extra bytes to produce the first blocks */ + /* uint8_t blockhash[ARGON2_PREHASH_SEED_LENGTH]; */ + /* Hashing all inputs */ + initial_hash(blockhash, context, instance->type); + /* Zeroing 8 extra bytes */ + clear_internal_memory(blockhash + ARGON2_PREHASH_DIGEST_LENGTH, + ARGON2_PREHASH_SEED_LENGTH - + ARGON2_PREHASH_DIGEST_LENGTH); + +#ifdef GENKAT + initial_kat(blockhash, context, instance->type); +#endif + + /* 3. Creating first blocks, we always have at least two blocks in a slice + */ + fill_first_blocks(blockhash, instance); + /* Clearing the hash */ + clear_internal_memory(blockhash, ARGON2_PREHASH_SEED_LENGTH); + + return ARGON2_OK; +} diff --git a/0x0017a_ctf/third_party/argon2/src/core.h b/0x0017a_ctf/third_party/argon2/src/core.h new file mode 100644 index 0000000..59e2564 --- /dev/null +++ b/0x0017a_ctf/third_party/argon2/src/core.h @@ -0,0 +1,228 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef ARGON2_CORE_H +#define ARGON2_CORE_H + +#include "argon2.h" + +#define CONST_CAST(x) (x)(uintptr_t) + +/**********************Argon2 internal constants*******************************/ + +enum argon2_core_constants { + /* Memory block size in bytes */ + ARGON2_BLOCK_SIZE = 1024, + ARGON2_QWORDS_IN_BLOCK = ARGON2_BLOCK_SIZE / 8, + ARGON2_OWORDS_IN_BLOCK = ARGON2_BLOCK_SIZE / 16, + ARGON2_HWORDS_IN_BLOCK = ARGON2_BLOCK_SIZE / 32, + ARGON2_512BIT_WORDS_IN_BLOCK = ARGON2_BLOCK_SIZE / 64, + + /* Number of pseudo-random values generated by one call to Blake in Argon2i + to + generate reference block positions */ + ARGON2_ADDRESSES_IN_BLOCK = 128, + + /* Pre-hashing digest length and its extension*/ + ARGON2_PREHASH_DIGEST_LENGTH = 64, + ARGON2_PREHASH_SEED_LENGTH = 72 +}; + +/*************************Argon2 internal data types***********************/ + +/* + * Structure for the (1KB) memory block implemented as 128 64-bit words. + * Memory blocks can be copied, XORed. Internal words can be accessed by [] (no + * bounds checking). + */ +typedef struct block_ { uint64_t v[ARGON2_QWORDS_IN_BLOCK]; } block; + +/*****************Functions that work with the block******************/ + +/* Initialize each byte of the block with @in */ +void init_block_value(block *b, uint8_t in); + +/* Copy block @src to block @dst */ +void copy_block(block *dst, const block *src); + +/* XOR @src onto @dst bytewise */ +void xor_block(block *dst, const block *src); + +/* + * Argon2 instance: memory pointer, number of passes, amount of memory, type, + * and derived values. + * Used to evaluate the number and location of blocks to construct in each + * thread + */ +typedef struct Argon2_instance_t { + block *memory; /* Memory pointer */ + uint32_t version; + uint32_t passes; /* Number of passes */ + uint32_t memory_blocks; /* Number of blocks in memory */ + uint32_t segment_length; + uint32_t lane_length; + uint32_t lanes; + uint32_t threads; + argon2_type type; + int print_internals; /* whether to print the memory blocks */ + argon2_context *context_ptr; /* points back to original context */ +} argon2_instance_t; + +/* + * Argon2 position: where we construct the block right now. Used to distribute + * work between threads. + */ +typedef struct Argon2_position_t { + uint32_t pass; + uint32_t lane; + uint8_t slice; + uint32_t index; +} argon2_position_t; + +/*Struct that holds the inputs for thread handling FillSegment*/ +typedef struct Argon2_thread_data { + argon2_instance_t *instance_ptr; + argon2_position_t pos; +} argon2_thread_data; + +/*************************Argon2 core functions********************************/ + +/* Allocates memory to the given pointer, uses the appropriate allocator as + * specified in the context. Total allocated memory is num*size. + * @param context argon2_context which specifies the allocator + * @param memory pointer to the pointer to the memory + * @param size the size in bytes for each element to be allocated + * @param num the number of elements to be allocated + * @return ARGON2_OK if @memory is a valid pointer and memory is allocated + */ +int allocate_memory(const argon2_context *context, uint8_t **memory, + size_t num, size_t size); + +/* + * Frees memory at the given pointer, uses the appropriate deallocator as + * specified in the context. Also cleans the memory using clear_internal_memory. + * @param context argon2_context which specifies the deallocator + * @param memory pointer to buffer to be freed + * @param size the size in bytes for each element to be deallocated + * @param num the number of elements to be deallocated + */ +void free_memory(const argon2_context *context, uint8_t *memory, + size_t num, size_t size); + +/* Function that securely cleans the memory. This ignores any flags set + * regarding clearing memory. Usually one just calls clear_internal_memory. + * @param mem Pointer to the memory + * @param s Memory size in bytes + */ +void secure_wipe_memory(void *v, size_t n); + +/* Function that securely clears the memory if FLAG_clear_internal_memory is + * set. If the flag isn't set, this function does nothing. + * @param mem Pointer to the memory + * @param s Memory size in bytes + */ +void clear_internal_memory(void *v, size_t n); + +/* + * Computes absolute position of reference block in the lane following a skewed + * distribution and using a pseudo-random value as input + * @param instance Pointer to the current instance + * @param position Pointer to the current position + * @param pseudo_rand 32-bit pseudo-random value used to determine the position + * @param same_lane Indicates if the block will be taken from the current lane. + * If so we can reference the current segment + * @pre All pointers must be valid + */ +uint32_t index_alpha(const argon2_instance_t *instance, + const argon2_position_t *position, uint32_t pseudo_rand, + int same_lane); + +/* + * Function that validates all inputs against predefined restrictions and return + * an error code + * @param context Pointer to current Argon2 context + * @return ARGON2_OK if everything is all right, otherwise one of error codes + * (all defined in + */ +int validate_inputs(const argon2_context *context); + +/* + * Hashes all the inputs into @a blockhash[PREHASH_DIGEST_LENGTH], clears + * password and secret if needed + * @param context Pointer to the Argon2 internal structure containing memory + * pointer, and parameters for time and space requirements. + * @param blockhash Buffer for pre-hashing digest + * @param type Argon2 type + * @pre @a blockhash must have at least @a PREHASH_DIGEST_LENGTH bytes + * allocated + */ +void initial_hash(uint8_t *blockhash, argon2_context *context, + argon2_type type); + +/* + * Function creates first 2 blocks per lane + * @param instance Pointer to the current instance + * @param blockhash Pointer to the pre-hashing digest + * @pre blockhash must point to @a PREHASH_SEED_LENGTH allocated values + */ +void fill_first_blocks(uint8_t *blockhash, const argon2_instance_t *instance); + +/* + * Function allocates memory, hashes the inputs with Blake, and creates first + * two blocks. Returns the pointer to the main memory with 2 blocks per lane + * initialized + * @param context Pointer to the Argon2 internal structure containing memory + * pointer, and parameters for time and space requirements. + * @param instance Current Argon2 instance + * @return Zero if successful, -1 if memory failed to allocate. @context->state + * will be modified if successful. + */ +int initialize(argon2_instance_t *instance, argon2_context *context); + +/* + * XORing the last block of each lane, hashing it, making the tag. Deallocates + * the memory. + * @param context Pointer to current Argon2 context (use only the out parameters + * from it) + * @param instance Pointer to current instance of Argon2 + * @pre instance->state must point to necessary amount of memory + * @pre context->out must point to outlen bytes of memory + * @pre if context->free_cbk is not NULL, it should point to a function that + * deallocates memory + */ +void finalize(const argon2_context *context, argon2_instance_t *instance); + +/* + * Function that fills the segment using previous segments also from other + * threads + * @param context current context + * @param instance Pointer to the current instance + * @param position Current position + * @pre all block pointers must be valid + */ +void fill_segment(const argon2_instance_t *instance, + argon2_position_t position); + +/* + * Function that fills the entire memory t_cost times based on the first two + * blocks in each lane + * @param instance Pointer to the current instance + * @return ARGON2_OK if successful, @context->state + */ +int fill_memory_blocks(argon2_instance_t *instance); + +#endif diff --git a/0x0017a_ctf/third_party/argon2/src/encoding.c b/0x0017a_ctf/third_party/argon2/src/encoding.c new file mode 100644 index 0000000..771a440 --- /dev/null +++ b/0x0017a_ctf/third_party/argon2/src/encoding.c @@ -0,0 +1,463 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#include +#include +#include +#include +#include "encoding.h" +#include "core.h" + +/* + * Example code for a decoder and encoder of "hash strings", with Argon2 + * parameters. + * + * This code comprises three sections: + * + * -- The first section contains generic Base64 encoding and decoding + * functions. It is conceptually applicable to any hash function + * implementation that uses Base64 to encode and decode parameters, + * salts and outputs. It could be made into a library, provided that + * the relevant functions are made public (non-static) and be given + * reasonable names to avoid collisions with other functions. + * + * -- The second section is specific to Argon2. It encodes and decodes + * the parameters, salts and outputs. It does not compute the hash + * itself. + * + * The code was originally written by Thomas Pornin , + * to whom comments and remarks may be sent. It is released under what + * should amount to Public Domain or its closest equivalent; the + * following mantra is supposed to incarnate that fact with all the + * proper legal rituals: + * + * --------------------------------------------------------------------- + * This file is provided under the terms of Creative Commons CC0 1.0 + * Public Domain Dedication. To the extent possible under law, the + * author (Thomas Pornin) has waived all copyright and related or + * neighboring rights to this file. This work is published from: Canada. + * --------------------------------------------------------------------- + * + * Copyright (c) 2015 Thomas Pornin + */ + +/* ==================================================================== */ +/* + * Common code; could be shared between different hash functions. + * + * Note: the Base64 functions below assume that uppercase letters (resp. + * lowercase letters) have consecutive numerical codes, that fit on 8 + * bits. All modern systems use ASCII-compatible charsets, where these + * properties are true. If you are stuck with a dinosaur of a system + * that still defaults to EBCDIC then you already have much bigger + * interoperability issues to deal with. + */ + +/* + * Some macros for constant-time comparisons. These work over values in + * the 0..255 range. Returned value is 0x00 on "false", 0xFF on "true". + */ +#define EQ(x, y) ((((0U - ((unsigned)(x) ^ (unsigned)(y))) >> 8) & 0xFF) ^ 0xFF) +#define GT(x, y) ((((unsigned)(y) - (unsigned)(x)) >> 8) & 0xFF) +#define GE(x, y) (GT(y, x) ^ 0xFF) +#define LT(x, y) GT(y, x) +#define LE(x, y) GE(y, x) + +/* + * Convert value x (0..63) to corresponding Base64 character. + */ +static int b64_byte_to_char(unsigned x) { + return (LT(x, 26) & (x + 'A')) | + (GE(x, 26) & LT(x, 52) & (x + ('a' - 26))) | + (GE(x, 52) & LT(x, 62) & (x + ('0' - 52))) | (EQ(x, 62) & '+') | + (EQ(x, 63) & '/'); +} + +/* + * Convert character c to the corresponding 6-bit value. If character c + * is not a Base64 character, then 0xFF (255) is returned. + */ +static unsigned b64_char_to_byte(int c) { + unsigned x; + + x = (GE(c, 'A') & LE(c, 'Z') & (c - 'A')) | + (GE(c, 'a') & LE(c, 'z') & (c - ('a' - 26))) | + (GE(c, '0') & LE(c, '9') & (c - ('0' - 52))) | (EQ(c, '+') & 62) | + (EQ(c, '/') & 63); + return x | (EQ(x, 0) & (EQ(c, 'A') ^ 0xFF)); +} + +/* + * Convert some bytes to Base64. 'dst_len' is the length (in characters) + * of the output buffer 'dst'; if that buffer is not large enough to + * receive the result (including the terminating 0), then (size_t)-1 + * is returned. Otherwise, the zero-terminated Base64 string is written + * in the buffer, and the output length (counted WITHOUT the terminating + * zero) is returned. + */ +static size_t to_base64(char *dst, size_t dst_len, const void *src, + size_t src_len) { + size_t olen; + const unsigned char *buf; + unsigned acc, acc_len; + + olen = (src_len / 3) << 2; + switch (src_len % 3) { + case 2: + olen++; + /* fall through */ + case 1: + olen += 2; + break; + } + if (dst_len <= olen) { + return (size_t)-1; + } + acc = 0; + acc_len = 0; + buf = (const unsigned char *)src; + while (src_len-- > 0) { + acc = (acc << 8) + (*buf++); + acc_len += 8; + while (acc_len >= 6) { + acc_len -= 6; + *dst++ = (char)b64_byte_to_char((acc >> acc_len) & 0x3F); + } + } + if (acc_len > 0) { + *dst++ = (char)b64_byte_to_char((acc << (6 - acc_len)) & 0x3F); + } + *dst++ = 0; + return olen; +} + +/* + * Decode Base64 chars into bytes. The '*dst_len' value must initially + * contain the length of the output buffer '*dst'; when the decoding + * ends, the actual number of decoded bytes is written back in + * '*dst_len'. + * + * Decoding stops when a non-Base64 character is encountered, or when + * the output buffer capacity is exceeded. If an error occurred (output + * buffer is too small, invalid last characters leading to unprocessed + * buffered bits), then NULL is returned; otherwise, the returned value + * points to the first non-Base64 character in the source stream, which + * may be the terminating zero. + */ +static const char *from_base64(void *dst, size_t *dst_len, const char *src) { + size_t len; + unsigned char *buf; + unsigned acc, acc_len; + + buf = (unsigned char *)dst; + len = 0; + acc = 0; + acc_len = 0; + for (;;) { + unsigned d; + + d = b64_char_to_byte(*src); + if (d == 0xFF) { + break; + } + src++; + acc = (acc << 6) + d; + acc_len += 6; + if (acc_len >= 8) { + acc_len -= 8; + if ((len++) >= *dst_len) { + return NULL; + } + *buf++ = (acc >> acc_len) & 0xFF; + } + } + + /* + * If the input length is equal to 1 modulo 4 (which is + * invalid), then there will remain 6 unprocessed bits; + * otherwise, only 0, 2 or 4 bits are buffered. The buffered + * bits must also all be zero. + */ + if (acc_len > 4 || (acc & (((unsigned)1 << acc_len) - 1)) != 0) { + return NULL; + } + *dst_len = len; + return src; +} + +/* + * Decode decimal integer from 'str'; the value is written in '*v'. + * Returned value is a pointer to the next non-decimal character in the + * string. If there is no digit at all, or the value encoding is not + * minimal (extra leading zeros), or the value does not fit in an + * 'unsigned long', then NULL is returned. + */ +static const char *decode_decimal(const char *str, unsigned long *v) { + const char *orig; + unsigned long acc; + + acc = 0; + for (orig = str;; str++) { + int c; + + c = *str; + if (c < '0' || c > '9') { + break; + } + c -= '0'; + if (acc > (ULONG_MAX / 10)) { + return NULL; + } + acc *= 10; + if ((unsigned long)c > (ULONG_MAX - acc)) { + return NULL; + } + acc += (unsigned long)c; + } + if (str == orig || (*orig == '0' && str != (orig + 1))) { + return NULL; + } + *v = acc; + return str; +} + +/* ==================================================================== */ +/* + * Code specific to Argon2. + * + * The code below applies the following format: + * + * $argon2[$v=]$m=,t=,p=$$ + * + * where is either 'd', 'id', or 'i', is a decimal integer (positive, + * fits in an 'unsigned long'), and is Base64-encoded data (no '=' padding + * characters, no newline or whitespace). + * + * The last two binary chunks (encoded in Base64) are, in that order, + * the salt and the output. Both are required. The binary salt length and the + * output length must be in the allowed ranges defined in argon2.h. + * + * The ctx struct must contain buffers large enough to hold the salt and pwd + * when it is fed into decode_string. + */ + +int decode_string(argon2_context *ctx, const char *str, argon2_type type) { + +/* check for prefix */ +#define CC(prefix) \ + do { \ + size_t cc_len = strlen(prefix); \ + if (strncmp(str, prefix, cc_len) != 0) { \ + return ARGON2_DECODING_FAIL; \ + } \ + str += cc_len; \ + } while ((void)0, 0) + +/* optional prefix checking with supplied code */ +#define CC_opt(prefix, code) \ + do { \ + size_t cc_len = strlen(prefix); \ + if (strncmp(str, prefix, cc_len) == 0) { \ + str += cc_len; \ + { code; } \ + } \ + } while ((void)0, 0) + +/* Decoding prefix into decimal */ +#define DECIMAL(x) \ + do { \ + unsigned long dec_x; \ + str = decode_decimal(str, &dec_x); \ + if (str == NULL) { \ + return ARGON2_DECODING_FAIL; \ + } \ + (x) = dec_x; \ + } while ((void)0, 0) + + +/* Decoding prefix into uint32_t decimal */ +#define DECIMAL_U32(x) \ + do { \ + unsigned long dec_x; \ + str = decode_decimal(str, &dec_x); \ + if (str == NULL || dec_x > UINT32_MAX) { \ + return ARGON2_DECODING_FAIL; \ + } \ + (x) = (uint32_t)dec_x; \ + } while ((void)0, 0) + + +/* Decoding base64 into a binary buffer */ +#define BIN(buf, max_len, len) \ + do { \ + size_t bin_len = (max_len); \ + str = from_base64(buf, &bin_len, str); \ + if (str == NULL || bin_len > UINT32_MAX) { \ + return ARGON2_DECODING_FAIL; \ + } \ + (len) = (uint32_t)bin_len; \ + } while ((void)0, 0) + + size_t maxsaltlen = ctx->saltlen; + size_t maxoutlen = ctx->outlen; + int validation_result; + const char* type_string; + + /* We should start with the argon2_type we are using */ + type_string = argon2_type2string(type, 0); + if (!type_string) { + return ARGON2_INCORRECT_TYPE; + } + + CC("$"); + CC(type_string); + + /* Reading the version number if the default is suppressed */ + ctx->version = ARGON2_VERSION_10; + CC_opt("$v=", DECIMAL_U32(ctx->version)); + + CC("$m="); + DECIMAL_U32(ctx->m_cost); + CC(",t="); + DECIMAL_U32(ctx->t_cost); + CC(",p="); + DECIMAL_U32(ctx->lanes); + ctx->threads = ctx->lanes; + + CC("$"); + BIN(ctx->salt, maxsaltlen, ctx->saltlen); + CC("$"); + BIN(ctx->out, maxoutlen, ctx->outlen); + + /* The rest of the fields get the default values */ + ctx->secret = NULL; + ctx->secretlen = 0; + ctx->ad = NULL; + ctx->adlen = 0; + ctx->allocate_cbk = NULL; + ctx->free_cbk = NULL; + ctx->flags = ARGON2_DEFAULT_FLAGS; + + /* On return, must have valid context */ + validation_result = validate_inputs(ctx); + if (validation_result != ARGON2_OK) { + return validation_result; + } + + /* Can't have any additional characters */ + if (*str == 0) { + return ARGON2_OK; + } else { + return ARGON2_DECODING_FAIL; + } +#undef CC +#undef CC_opt +#undef DECIMAL +#undef BIN +} + +int encode_string(char *dst, size_t dst_len, argon2_context *ctx, + argon2_type type) { +#define SS(str) \ + do { \ + size_t pp_len = strlen(str); \ + if (pp_len >= dst_len) { \ + return ARGON2_ENCODING_FAIL; \ + } \ + memcpy(dst, str, pp_len + 1); \ + dst += pp_len; \ + dst_len -= pp_len; \ + } while ((void)0, 0) + +#define SX(x) \ + do { \ + char tmp[30]; \ + sprintf(tmp, "%lu", (unsigned long)(x)); \ + SS(tmp); \ + } while ((void)0, 0) + +#define SB(buf, len) \ + do { \ + size_t sb_len = to_base64(dst, dst_len, buf, len); \ + if (sb_len == (size_t)-1) { \ + return ARGON2_ENCODING_FAIL; \ + } \ + dst += sb_len; \ + dst_len -= sb_len; \ + } while ((void)0, 0) + + const char* type_string = argon2_type2string(type, 0); + int validation_result = validate_inputs(ctx); + + if (!type_string) { + return ARGON2_ENCODING_FAIL; + } + + if (validation_result != ARGON2_OK) { + return validation_result; + } + + + SS("$"); + SS(type_string); + + SS("$v="); + SX(ctx->version); + + SS("$m="); + SX(ctx->m_cost); + SS(",t="); + SX(ctx->t_cost); + SS(",p="); + SX(ctx->lanes); + + SS("$"); + SB(ctx->salt, ctx->saltlen); + + SS("$"); + SB(ctx->out, ctx->outlen); + return ARGON2_OK; + +#undef SS +#undef SX +#undef SB +} + +size_t b64len(uint32_t len) { + size_t olen = ((size_t)len / 3) << 2; + + switch (len % 3) { + case 2: + olen++; + /* fall through */ + case 1: + olen += 2; + break; + } + + return olen; +} + +size_t numlen(uint32_t num) { + size_t len = 1; + while (num >= 10) { + ++len; + num = num / 10; + } + return len; +} + diff --git a/0x0017a_ctf/third_party/argon2/src/encoding.h b/0x0017a_ctf/third_party/argon2/src/encoding.h new file mode 100644 index 0000000..5b8b2dd --- /dev/null +++ b/0x0017a_ctf/third_party/argon2/src/encoding.h @@ -0,0 +1,57 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef ENCODING_H +#define ENCODING_H +#include "argon2.h" + +#define ARGON2_MAX_DECODED_LANES UINT32_C(255) +#define ARGON2_MIN_DECODED_SALT_LEN UINT32_C(8) +#define ARGON2_MIN_DECODED_OUT_LEN UINT32_C(12) + +/* +* encode an Argon2 hash string into the provided buffer. 'dst_len' +* contains the size, in characters, of the 'dst' buffer; if 'dst_len' +* is less than the number of required characters (including the +* terminating 0), then this function returns ARGON2_ENCODING_ERROR. +* +* on success, ARGON2_OK is returned. +*/ +int encode_string(char *dst, size_t dst_len, argon2_context *ctx, + argon2_type type); + +/* +* Decodes an Argon2 hash string into the provided structure 'ctx'. +* The only fields that must be set prior to this call are ctx.saltlen and +* ctx.outlen (which must be the maximal salt and out length values that are +* allowed), ctx.salt and ctx.out (which must be buffers of the specified +* length), and ctx.pwd and ctx.pwdlen which must hold a valid password. +* +* Invalid input string causes an error. On success, the ctx is valid and all +* fields have been initialized. +* +* Returned value is ARGON2_OK on success, other ARGON2_ codes on error. +*/ +int decode_string(argon2_context *ctx, const char *str, argon2_type type); + +/* Returns the length of the encoded byte stream with length len */ +size_t b64len(uint32_t len); + +/* Returns the length of the encoded number num */ +size_t numlen(uint32_t num); + +#endif diff --git a/0x0017a_ctf/third_party/argon2/src/genkat.h b/0x0017a_ctf/third_party/argon2/src/genkat.h new file mode 100644 index 0000000..3a7162a --- /dev/null +++ b/0x0017a_ctf/third_party/argon2/src/genkat.h @@ -0,0 +1,51 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef ARGON2_KAT_H +#define ARGON2_KAT_H + +#include "core.h" + +/* + * Initial KAT function that prints the inputs to the file + * @param blockhash Array that contains pre-hashing digest + * @param context Holds inputs + * @param type Argon2 type + * @pre blockhash must point to INPUT_INITIAL_HASH_LENGTH bytes + * @pre context member pointers must point to allocated memory of size according + * to the length values + */ +void initial_kat(const uint8_t *blockhash, const argon2_context *context, + argon2_type type); + +/* + * Function that prints the output tag + * @param out output array pointer + * @param outlen digest length + * @pre out must point to @a outlen bytes + **/ +void print_tag(const void *out, uint32_t outlen); + +/* + * Function that prints the internal state at given moment + * @param instance pointer to the current instance + * @param pass current pass number + * @pre instance must have necessary memory allocated + **/ +void internal_kat(const argon2_instance_t *instance, uint32_t pass); + +#endif diff --git a/0x0017a_ctf/third_party/argon2/src/ref.c b/0x0017a_ctf/third_party/argon2/src/ref.c new file mode 100644 index 0000000..10e45eb --- /dev/null +++ b/0x0017a_ctf/third_party/argon2/src/ref.c @@ -0,0 +1,194 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#include +#include +#include + +#include "argon2.h" +#include "core.h" + +#include "blake2/blamka-round-ref.h" +#include "blake2/blake2-impl.h" +#include "blake2/blake2.h" + + +/* + * Function fills a new memory block and optionally XORs the old block over the new one. + * @next_block must be initialized. + * @param prev_block Pointer to the previous block + * @param ref_block Pointer to the reference block + * @param next_block Pointer to the block to be constructed + * @param with_xor Whether to XOR into the new block (1) or just overwrite (0) + * @pre all block pointers must be valid + */ +static void fill_block(const block *prev_block, const block *ref_block, + block *next_block, int with_xor) { + block blockR, block_tmp; + unsigned i; + + copy_block(&blockR, ref_block); + xor_block(&blockR, prev_block); + copy_block(&block_tmp, &blockR); + /* Now blockR = ref_block + prev_block and block_tmp = ref_block + prev_block */ + if (with_xor) { + /* Saving the next block contents for XOR over: */ + xor_block(&block_tmp, next_block); + /* Now blockR = ref_block + prev_block and + block_tmp = ref_block + prev_block + next_block */ + } + + /* Apply Blake2 on columns of 64-bit words: (0,1,...,15) , then + (16,17,..31)... finally (112,113,...127) */ + for (i = 0; i < 8; ++i) { + BLAKE2_ROUND_NOMSG( + blockR.v[16 * i], blockR.v[16 * i + 1], blockR.v[16 * i + 2], + blockR.v[16 * i + 3], blockR.v[16 * i + 4], blockR.v[16 * i + 5], + blockR.v[16 * i + 6], blockR.v[16 * i + 7], blockR.v[16 * i + 8], + blockR.v[16 * i + 9], blockR.v[16 * i + 10], blockR.v[16 * i + 11], + blockR.v[16 * i + 12], blockR.v[16 * i + 13], blockR.v[16 * i + 14], + blockR.v[16 * i + 15]); + } + + /* Apply Blake2 on rows of 64-bit words: (0,1,16,17,...112,113), then + (2,3,18,19,...,114,115).. finally (14,15,30,31,...,126,127) */ + for (i = 0; i < 8; i++) { + BLAKE2_ROUND_NOMSG( + blockR.v[2 * i], blockR.v[2 * i + 1], blockR.v[2 * i + 16], + blockR.v[2 * i + 17], blockR.v[2 * i + 32], blockR.v[2 * i + 33], + blockR.v[2 * i + 48], blockR.v[2 * i + 49], blockR.v[2 * i + 64], + blockR.v[2 * i + 65], blockR.v[2 * i + 80], blockR.v[2 * i + 81], + blockR.v[2 * i + 96], blockR.v[2 * i + 97], blockR.v[2 * i + 112], + blockR.v[2 * i + 113]); + } + + copy_block(next_block, &block_tmp); + xor_block(next_block, &blockR); +} + +static void next_addresses(block *address_block, block *input_block, + const block *zero_block) { + input_block->v[6]++; + fill_block(zero_block, input_block, address_block, 0); + fill_block(zero_block, address_block, address_block, 0); +} + +void fill_segment(const argon2_instance_t *instance, + argon2_position_t position) { + block *ref_block = NULL, *curr_block = NULL; + block address_block, input_block, zero_block; + uint64_t pseudo_rand, ref_index, ref_lane; + uint32_t prev_offset, curr_offset; + uint32_t starting_index; + uint32_t i; + int data_independent_addressing; + + if (instance == NULL) { + return; + } + + data_independent_addressing = + (instance->type == Argon2_i) || + (instance->type == Argon2_id && (position.pass == 0) && + (position.slice < ARGON2_SYNC_POINTS / 2)); + + if (data_independent_addressing) { + init_block_value(&zero_block, 0); + init_block_value(&input_block, 0); + + input_block.v[0] = position.pass; + input_block.v[1] = position.lane; + input_block.v[2] = position.slice; + input_block.v[3] = instance->memory_blocks; + input_block.v[4] = instance->passes; + input_block.v[5] = instance->type; + } + + starting_index = 0; + + if ((0 == position.pass) && (0 == position.slice)) { + starting_index = 2; /* we have already generated the first two blocks */ + + /* Don't forget to generate the first block of addresses: */ + if (data_independent_addressing) { + next_addresses(&address_block, &input_block, &zero_block); + } + } + + /* Offset of the current block */ + curr_offset = position.lane * instance->lane_length + + position.slice * instance->segment_length + starting_index; + + if (0 == curr_offset % instance->lane_length) { + /* Last block in this lane */ + prev_offset = curr_offset + instance->lane_length - 1; + } else { + /* Previous block */ + prev_offset = curr_offset - 1; + } + + for (i = starting_index; i < instance->segment_length; + ++i, ++curr_offset, ++prev_offset) { + /*1.1 Rotating prev_offset if needed */ + if (curr_offset % instance->lane_length == 1) { + prev_offset = curr_offset - 1; + } + + /* 1.2 Computing the index of the reference block */ + /* 1.2.1 Taking pseudo-random value from the previous block */ + if (data_independent_addressing) { + if (i % ARGON2_ADDRESSES_IN_BLOCK == 0) { + next_addresses(&address_block, &input_block, &zero_block); + } + pseudo_rand = address_block.v[i % ARGON2_ADDRESSES_IN_BLOCK]; + } else { + pseudo_rand = instance->memory[prev_offset].v[0]; + } + + /* 1.2.2 Computing the lane of the reference block */ + ref_lane = ((pseudo_rand >> 32)) % instance->lanes; + + if ((position.pass == 0) && (position.slice == 0)) { + /* Can not reference other lanes yet */ + ref_lane = position.lane; + } + + /* 1.2.3 Computing the number of possible reference block within the + * lane. + */ + position.index = i; + ref_index = index_alpha(instance, &position, pseudo_rand & 0xFFFFFFFF, + ref_lane == position.lane); + + /* 2 Creating a new block */ + ref_block = + instance->memory + instance->lane_length * ref_lane + ref_index; + curr_block = instance->memory + curr_offset; + if (ARGON2_VERSION_10 == instance->version) { + /* version 1.2.1 and earlier: overwrite, not XOR */ + fill_block(instance->memory + prev_offset, ref_block, curr_block, 0); + } else { + if(0 == position.pass) { + fill_block(instance->memory + prev_offset, ref_block, + curr_block, 0); + } else { + fill_block(instance->memory + prev_offset, ref_block, + curr_block, 1); + } + } + } +} diff --git a/0x0017a_ctf/third_party/argon2/src/thread.c b/0x0017a_ctf/third_party/argon2/src/thread.c new file mode 100644 index 0000000..3ae2fb2 --- /dev/null +++ b/0x0017a_ctf/third_party/argon2/src/thread.c @@ -0,0 +1,57 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#if !defined(ARGON2_NO_THREADS) + +#include "thread.h" +#if defined(_WIN32) +#include +#endif + +int argon2_thread_create(argon2_thread_handle_t *handle, + argon2_thread_func_t func, void *args) { + if (NULL == handle || func == NULL) { + return -1; + } +#if defined(_WIN32) + *handle = _beginthreadex(NULL, 0, func, args, 0, NULL); + return *handle != 0 ? 0 : -1; +#else + return pthread_create(handle, NULL, func, args); +#endif +} + +int argon2_thread_join(argon2_thread_handle_t handle) { +#if defined(_WIN32) + if (WaitForSingleObject((HANDLE)handle, INFINITE) == WAIT_OBJECT_0) { + return CloseHandle((HANDLE)handle) != 0 ? 0 : -1; + } + return -1; +#else + return pthread_join(handle, NULL); +#endif +} + +void argon2_thread_exit(void) { +#if defined(_WIN32) + _endthreadex(0); +#else + pthread_exit(NULL); +#endif +} + +#endif /* ARGON2_NO_THREADS */ diff --git a/0x0017a_ctf/third_party/argon2/src/thread.h b/0x0017a_ctf/third_party/argon2/src/thread.h new file mode 100644 index 0000000..d4ca10c --- /dev/null +++ b/0x0017a_ctf/third_party/argon2/src/thread.h @@ -0,0 +1,67 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef ARGON2_THREAD_H +#define ARGON2_THREAD_H + +#if !defined(ARGON2_NO_THREADS) + +/* + Here we implement an abstraction layer for the simpĺe requirements + of the Argon2 code. We only require 3 primitives---thread creation, + joining, and termination---so full emulation of the pthreads API + is unwarranted. Currently we wrap pthreads and Win32 threads. + + The API defines 2 types: the function pointer type, + argon2_thread_func_t, + and the type of the thread handle---argon2_thread_handle_t. +*/ +#if defined(_WIN32) +#include +typedef unsigned(__stdcall *argon2_thread_func_t)(void *); +typedef uintptr_t argon2_thread_handle_t; +#else +#include +typedef void *(*argon2_thread_func_t)(void *); +typedef pthread_t argon2_thread_handle_t; +#endif + +/* Creates a thread + * @param handle pointer to a thread handle, which is the output of this + * function. Must not be NULL. + * @param func A function pointer for the thread's entry point. Must not be + * NULL. + * @param args Pointer that is passed as an argument to @func. May be NULL. + * @return 0 if @handle and @func are valid pointers and a thread is successfully + * created. + */ +int argon2_thread_create(argon2_thread_handle_t *handle, + argon2_thread_func_t func, void *args); + +/* Waits for a thread to terminate + * @param handle Handle to a thread created with argon2_thread_create. + * @return 0 if @handle is a valid handle, and joining completed successfully. +*/ +int argon2_thread_join(argon2_thread_handle_t handle); + +/* Terminate the current thread. Must be run inside a thread created by + * argon2_thread_create. +*/ +void argon2_thread_exit(void); + +#endif /* ARGON2_NO_THREADS */ +#endif diff --git a/0x0017a_ctf/uf2conv.py b/0x0017a_ctf/uf2conv.py new file mode 100644 index 0000000..d6dd7a8 --- /dev/null +++ b/0x0017a_ctf/uf2conv.py @@ -0,0 +1,365 @@ +#!/usr/bin/env python3 +import sys +import struct +import subprocess +import re +import os +import os.path +import argparse +import json +from time import sleep + + +UF2_MAGIC_START0 = 0x0A324655 # "UF2\n" +UF2_MAGIC_START1 = 0x9E5D5157 # Randomly selected +UF2_MAGIC_END = 0x0AB16F30 # Ditto + +INFO_FILE = "/INFO_UF2.TXT" + +appstartaddr = 0x2000 +familyid = 0x0 + + +def is_uf2(buf): + w = struct.unpack(" 476: + assert False, "Invalid UF2 data size at " + ptr + newaddr = hd[3] + if (hd[2] & 0x2000) and (currfamilyid == None): + currfamilyid = hd[7] + if curraddr == None or ((hd[2] & 0x2000) and hd[7] != currfamilyid): + currfamilyid = hd[7] + curraddr = newaddr + if familyid == 0x0 or familyid == hd[7]: + appstartaddr = newaddr + padding = newaddr - curraddr + if padding < 0: + assert False, "Block out of order at " + ptr + if padding > 10*1024*1024: + assert False, "More than 10M of padding needed at " + ptr + if padding % 4 != 0: + assert False, "Non-word padding size at " + ptr + while padding > 0: + padding -= 4 + outp.append(b"\x00\x00\x00\x00") + if familyid == 0x0 or ((hd[2] & 0x2000) and familyid == hd[7]): + outp.append(block[32 : 32 + datalen]) + curraddr = newaddr + datalen + if hd[2] & 0x2000: + if hd[7] in families_found.keys(): + if families_found[hd[7]] > newaddr: + families_found[hd[7]] = newaddr + else: + families_found[hd[7]] = newaddr + if prev_flag == None: + prev_flag = hd[2] + if prev_flag != hd[2]: + all_flags_same = False + if blockno == (numblocks - 1): + print("--- UF2 File Header Info ---") + families = load_families() + for family_hex in families_found.keys(): + family_short_name = "" + for name, value in families.items(): + if value == family_hex: + family_short_name = name + print("Family ID is {:s}, hex value is 0x{:08x}".format(family_short_name,family_hex)) + print("Target Address is 0x{:08x}".format(families_found[family_hex])) + if all_flags_same: + print("All block flag values consistent, 0x{:04x}".format(hd[2])) + else: + print("Flags were not all the same") + print("----------------------------") + if len(families_found) > 1 and familyid == 0x0: + outp = [] + appstartaddr = 0x0 + return b"".join(outp) + +def convert_to_carray(file_content): + outp = "const unsigned long bindata_len = %d;\n" % len(file_content) + outp += "const unsigned char bindata[] __attribute__((aligned(16))) = {" + for i in range(len(file_content)): + if i % 16 == 0: + outp += "\n" + outp += "0x%02x, " % file_content[i] + outp += "\n};\n" + return bytes(outp, "utf-8") + +def convert_to_uf2(file_content): + global familyid + datapadding = b"" + while len(datapadding) < 512 - 256 - 32 - 4: + datapadding += b"\x00\x00\x00\x00" + numblocks = (len(file_content) + 255) // 256 + outp = [] + for blockno in range(numblocks): + ptr = 256 * blockno + chunk = file_content[ptr:ptr + 256] + flags = 0x0 + if familyid: + flags |= 0x2000 + hd = struct.pack(b" -## FREE Reverse Engineering Self-Study Course [HERE](https://github.com/mytechnotalent/Reverse-Engineering-Tutorial) +## FREE Reverse Engineering Self-Study Course [HERE](https://github.com/mytechnotalent/Reverse-Engineering)
-# Today's Tutorial [August 27, 2026] -## Lesson 278: Embedded Assembler Course (Chapter 7: ARM Thumb2 Instruction Set) -This chapter covers the ARM Thumb2 instruction set within the STM32F401CCU6 architecture. +# Today's Tutorial [September 25, 2026] +## Lesson 306: Embedded Hacking Course (Chapter 24: Debugging Constants) +This chapter covers debugging constants as well as an intro to I2C as we work a 1602 LCD as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Assembler/blob/main/Embedded-Assembler.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book.
@@ -37,7 +37,7 @@ VIDEO PROMO [HERE](https://www.youtube.com/watch?v=aD7X9sXirF8)
-# FREE Book [Download](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) +# FREE Book [Download](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf)
@@ -58,18 +58,100 @@ Students must have a working understanding of the following items:
-# Hardware [View Full Parts List](PARTS.md) -## Complete Component Kit for Raspberry Pi [BUY](https://www.pishop.us/product/custom-kit-for-pitt-edu) -### 10% PiShop DISCOUNT CODE - UPKT_HS320548_10PC -## 5mm LEDs (1 Red, 1 Green, 1 Yellow) [BUY](https://www.amazon.com/s?k=5mm+led+kit) -## 100, 220 or 330 Ohm Resistors (for LEDs) [BUY](https://www.amazon.com/s?k=resistor+assortment+kit) -## 1x SG90 Servo Motor [BUY](https://www.amazon.com/s?k=sg90+micro+servo+motor) -## 10pc 25v 1000uF Capacitor [BUY](https://www.amazon.com/Cionyce-Capacitor-Electrolytic-CapacitorsMicrowave/dp/B0B63CCQ2N?th=1) +# Hardware + +### Reference Diagrams & Schematics +- [Fritzing Project](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/hardware/EHP2.fzz) +- [Breadboard Diagram](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/hardware/EHP2_bb.png) +- [Pico 2 Pinout](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/hardware/pico-2-r4-pinout.svg) +- [Debug Probe Wiring](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/hardware/dp.png) + +### Required Components & Sensors +The following hardware parts and sensors are used throughout the course experiments, projects, and live CTFs: +- [1x Full-size Breadboard (Long)](https://www.amazon.com/s?k=full+size+breadboard) +- [1x Assorted Jumper Wires (Male-to-Male, Male-to-Female, Female-to-Female)](https://www.amazon.com/s?k=breadboard+jumper+wires+assortment) +- [1x Raspberry Pi Pico 2 w/ Header](https://www.amazon.com/s?k=raspberry+pi+pico+2+with+pre-soldered+header) +- [1x Raspberry Pi Pico Debug Probe](https://www.amazon.com/s?k=raspberry+pi+debug+probe) +- [2x USB A-Male to USB Micro-B Cables (1 for Pico 2, 1 for Debug Probe)](https://www.amazon.com/s?k=micro+usb+cable+2+pack) +- [3x 5mm LEDs (1 Red, 1 Green, 1 Yellow)](https://www.amazon.com/s?k=5mm+led+kit) +- [3x 100, 220 or 330 Ohm Resistors (for LEDs)](https://www.amazon.com/s?k=resistor+assortment+kit) +- [1x Push Button (Tactile switch)](https://www.amazon.com/s?k=tactile+push+button+assortment) +- [1x 1602 LCD (with PCF8574 I2C backpack)](https://www.amazon.com/s?k=1602+lcd+i2c+module) +- [1x DHT11 Temperature & Humidity Sensor](https://www.amazon.com/s?k=dht11+temperature+and+humidity+sensor) +- [1x SG90 Servo Motor](https://www.amazon.com/s?k=sg90+micro+servo+motor) +- [1x 1000uF 25V Capacitor (for Servo power stabilization)](https://www.amazon.com/Cionyce-Capacitor-Electrolytic-CapacitorsMicrowave/dp/B0B63CCQ2N) +- [1x Infrared (IR) Receiver (VS1838B)](https://www.amazon.com/s?k=vs1838b+ir+receiver+module) +- [1x Infrared (IR) Remote Controller (NEC-compatible)](https://www.amazon.com/s?k=arduino+ir+remote+control) +- [1x u-blox NEO-6M GPS Receiver Module (with Active Antenna)](https://www.amazon.com/Navigation-Positioning-Microcontroller-Compatible-Sensitivity/dp/B084MK8BS2) +- [2x REYAX RYLR998 868/915MHz LoRa Transceiver Modules (1x Pico 2, 1x Computer)](https://www.amazon.com/dp/B099RM1XMG) +- [1x FT232RL USB to TTL Serial Adapter Module](https://www.amazon.com/FT232RL-Serial-Adapter-Module-Arduino/dp/B0FHP71BCQ)

# Breadboard Design -![image](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/EHP2_bb.png?raw=true) +![image](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/hardware/EHP2_bb.png?raw=true) + +
+ +# Datasheets & References + +This repository includes the complete set of authoritative technical reference manuals and datasheets required for professional embedded engineering and reverse engineering on the Raspberry Pi Pico 2: + +### [RP2350 Datasheet](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/datasheets/rp2350-datasheet.pdf) +*RP2350 Datasheet: A microcontroller by Raspberry Pi (1,380 pages)* +- **Core Architecture:** Dual Arm Cortex-M33 / Hazard3 RISC-V processors running up to 150MHz, 520kB on-chip SRAM across 10 striped banks, and 8kB one-time-programmable (OTP) storage. +- **System Memory Map (Chapter 2):** Complete physical address map covering external XIP Flash (`0x10000000`), SRAM (`0x20000000`), APB/AHB peripherals (`0x40000000`), and core-local Single-Cycle I/O (`0xd0000000`). +- **Peripheral Register Definitions:** Exhaustive register layouts, reset states, and bitfield descriptions for all 52 peripherals: `IO_BANK0` (pin multiplexing & `FUNCSEL`), `PADS_BANK0` (electrical drive strength, pulls, and Schmitt triggers), `UART0`/`UART1`, `SPI0`/`SPI1`, `I2C0`/`I2C1`, `PWM`, `DMA`, `CLOCKS`, and `WATCHDOG`. +- **Programmable I/O (PIO):** Comprehensive architectural guide for the 3 on-chip PIO blocks (`PIO0`, `PIO1`, `PIO2`) with 12 state machines for deterministic, high-speed custom hardware protocols. +- **Fast GPIO Coprocessor:** Hardware specification for single-cycle atomic GPIO output and direction control via dedicated ARM coprocessor instructions (`mcrr p0`). +- **Bootrom & Hardware Security:** Covers the internal mask ROM boot flow, secure boot signature verification, SHA-256 cryptographic accelerator, and OTP key protection. + +### [Raspberry Pi Pico C/C++ SDK](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/datasheets/raspberry-pi-pico-c-sdk.pdf) +*Raspberry Pi Pico-series C/C++ SDK: Libraries and tools for development (821 pages)* +- **SDK Architecture & Build System:** CMake configuration, target library linking (`pico_stdlib`, `hardware_gpio`), compiler flags, and the UF2 binary packaging workflow. +- **Hardware Drivers (`hardware_*`):** Low-level driver API documentation: + - `hardware_gpio`: Functions like `gpio_init()`, `gpio_set_dir()`, `gpio_put()`, `gpio_get()`, and hardware pin interrupt handling. + - `hardware_uart`: Serial communication initialization (`uart_init()`, baud rate dividers, FIFO handling). + - `hardware_dma`: Channel configuration, transfer sizing, and background memory pacing. + - `hardware_clocks` & `hardware_resets`: PLL frequency configuration and peripheral unreset sequencing. +- **High-Level Runtimes (`pico_*`):** Standard I/O stream redirection (`stdio_init_all()` over UART/USB CDC), multicore core 1 launching (`pico_multicore`), sleep timers, and thread synchronization. +- **Hardware Structs (`hardware_structs`):** C struct definitions matching chip MMIO registers 1-to-1, used by reverse engineers to reconstruct decompiled peripheral accesses. + +### [Arm Cortex-M33 Technical Reference Manual](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/datasheets/arm_cortex_m33_trm_100230_0100_03_en.pdf) +*Arm® Cortex®-M33 Processor Technical Reference Manual (Doc ID: 100230_0100_03_en, 168 pages)* +- **Core Microarchitecture:** 3-stage in-order pipeline, Harvard bus architecture (instruction and data buses), integer execution core, and optional IEEE 754 single/double-precision floating-point unit (FPU). +- **Nested Vectored Interrupt Controller (NVIC):** Interrupt priorities, exception vector table mapping, low-latency interrupt entry, and hardware tail-chaining mechanics. +- **Memory Protection & TrustZone:** Memory Protection Unit (MPU) supporting up to 16 configurable regions, and Security Attribution Unit (SAU) for hardware-enforced Secure vs Non-secure domain isolation. +- **CoreSight Debug & Trace:** Debug Access Port (DAP) used by OpenOCD and the Raspberry Pi Debug Probe, Flash Patch and Breakpoint unit (FPB), Data Watchpoint and Trace (DWT), and Instrumentation Trace Macrocell (ITM). +- **Coprocessor Interface:** Bus architecture connecting hardware accelerators directly to the core (utilized by the RP2350 for single-cycle GPIO and math acceleration). + +### [Armv8-M Architecture Reference Manual (DDI0553B)](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/datasheets/DDI0553B_y_armv8m_arm.pdf) +*Armv8-M Architecture Reference Manual (Doc ID: DDI0553B, 2,149 pages)* +- **Authoritative Instruction Set Reference (Section C2.4, Pages 527–1454):** Complete alphabetical encyclopedia of every assembly instruction supported by the RP2350 Cortex-M33: + - Data processing: `MOV`, `MOVS`, `MVN`, `ADD`, `SUB`, `MUL`, `SDIV`, `UDIV`, `AND`, `ORR`, `EOR`, `BIC`. + - Memory load/store: `LDR`, `STR`, `LDRB`, `STRB`, `LDRH`, `STRH`, `LDRD`, `STRD`, `LDM`, `STM`, `PUSH`, `POP`. + - Control flow: `B`, `BL`, `BX`, `BLX`, `CBZ`, `CBNZ`, `TBB`, `TBH`. + - Coprocessor instructions: `MCR`, `MRC`, `MCRR`, `MRRC` (used by the RP2350 fast GPIO block). + - Floating-point instructions: `VMOV`, `VADD`, `VSUB`, `VMUL`, `VDIV`, `VCMP`, `VMRS`, `VMSR`. +- **Machine Opcode Encodings:** Exact 16-bit Thumb and 32-bit Thumb-2 binary bit patterns for every instruction, essential for binary patching and shellcode analysis. +- **Programmer's Model:** General-purpose registers (`r0`–`r12`), Stack Pointers (`SP`/`MSP`/`PSP`), Link Register (`LR`), Program Counter (`PC`), Status Registers (`APSR`, `IPSR`, `EPSR`, `xPSR`), and Special Registers (`CONTROL`, `PRIMASK`). +- **Exception Mechanics:** Hardware state stacking upon exception entry (`r0`-`r3`, `r12`, `lr`, `pc`, `xPSR`), EXC_RETURN values, and fault analysis (HardFault, MemManage, BusFault, UsageFault). + +### [Procedure Call Standard for the Arm Architecture (AAPCS32)](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/datasheets/aapcs32.pdf) +*Procedure Call Standard for the Arm® Architecture (AAPCS32 / ABI, 41 pages)* +- **Register Allocation Contract:** Defines caller and callee responsibilities across function calls: + - Parameter passing: `r0`–`r3` pass the first four 32-bit parameters (or 64-bit pairs like `r0`-`r1` and `r2`-`r3`). Additional parameters are pushed to the stack. + - Return values: `r0` returns 32-bit scalar values; `r0`-`r1` returns 64-bit integers and 64-bit IEEE 754 `double` floats. + - Scratch / Caller-Saved registers: `r0`–`r3`, `r12` (`IP`), and `r14` (`LR`) can be freely overwritten by called functions. + - Preserved / Callee-Saved registers: `r4`–`r11` must be preserved across function calls (saved via `push` in prologue and restored via `pop` in epilogue). +- **Floating-Point ABI:** Register allocation for hardware VFP registers (`s0`–`s15`, `d0`–`d7`) vs software floating-point library calls. +- **Data Alignment & Struct Packing:** Alignment rules (1, 2, 4, 8 bytes), structure member padding, and composite type memory layouts. + +### [ARM Application Note 132 (advnote132)](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/datasheets/advnote132.pdf) +*ABI Advisory Note – SP must be 8-byte aligned on entry to AAPCS-conforming functions (10 pages)* +- **The 8-Byte Stack Alignment Rule:** Mandates that the Stack Pointer (`SP`) must be aligned to an 8-byte (doubleword) boundary at all public function call interfaces. +- **Why Unaligned Stacks Fail:** 64-bit memory operations (`LDRD`, `STRD`) and double-precision floating-point operations require 8-byte alignment; misaligned stacks trigger hardware alignment faults or severe memory bus performance penalties. +- **Prologue Disassembly Deconstruction:** Explains why compiler-generated assembly frequently emits `push {r4, lr}` (saving two 32-bit registers) even when `r4` is completely unused—the extra register push serves as deliberate padding to keep `SP` strictly 8-byte aligned!
@@ -82,15 +164,17 @@ Introduction and Overview of Embedded Reverse Engineering: Ethics, Scoping, and ### Week 1 Notebook [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK01/WEEK01.md) +### Week 1a Notebook [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK01/WEEK01a.md) + ### Chapter 1: hello, world This chapter covers the basics of setting up a dev environment and basic template firmware for the Pico 2 MCU in addition to printing hello, world. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 2: Debugging hello, world This chapter covers the debugging of our firmware for the Pico 2 MCU hello, world program. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ## Week 2 Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Program for the Pico 2 @@ -102,7 +186,7 @@ Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Progr ### Chapter 3: Hacking hello, world This chapter covers the hacking of our firmware for the Pico 2 MCU hello, world program. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ## Week 3 Embedded System Analysis: Understanding the RP2350 Architecture w/ Comprehensive Firmware Analysis @@ -111,10 +195,22 @@ Embedded System Analysis: Understanding the RP2350 Architecture w/ Comprehensive ### Week 3 Notebook [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK03/WEEK03.md) +### Ghidra Patching Tutorial [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK03/GHIDRA_PATCHING_TUTORIAL.md) + +### CTF-01 Instructions [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/0x0001b_ctf/CTF-01-I.md) + +### CTF-01 Rubric [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/0x0001b_ctf/CTF-01-R.md) + +### CTF-01 Solution [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/0x0001b_ctf/CTF-01-S.md) + +### CTF-01 BIN [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/0x0001b_ctf/CTF-01.bin) + +### CTF-01 UF2 [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/0x0001b_ctf/CTF-01.uf2) + ### Chapter 4: Embedded System Analysis This chapter covers a comprehensive embedded system analysis reviewing parts of the RP2350 datasheet and helpful firmware analysis tools. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ## Week 4 Variables in Embedded Systems: Debugging and Hacking Variables w/ GPIO Output Basics @@ -123,35 +219,37 @@ Variables in Embedded Systems: Debugging and Hacking Variables w/ GPIO Output Ba ### Week 4 Notebook [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK04/WEEK04.md) +### Week 4a Notebook [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK04/WEEK04a.md) + ### Chapter 5: Intro To Variables This chapter covers an introduction to variables as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 6: Debugging Intro To Variables This chapter covers debugging an introduction to variables as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 7: Hacking Intro To Variables This chapter covers hacking an introduction to variables as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 8: Uninitialized Variables This chapter covers uninitialized variables as well as an intro to GPIO outputs as we blink an LED as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 9: Debugging Uninitialized Variables This chapter covers debugging uninitialized variables as well as an intro to GPIO outputs as we blink an LED as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 10: Hacking Uninitialized Variables This chapter covers hacking uninitialized variables as well as an intro to GPIO outputs as we blink an LED as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ## Week 5 Integers and Floats in Embedded Systems: Debugging and Hacking Integers and Floats w/ Intermediate GPIO Output Assembler Analysis @@ -160,50 +258,52 @@ Integers and Floats in Embedded Systems: Debugging and Hacking Integers and Floa ### Week 5 Notebook [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK05/WEEK05.md) +### Week 5a Notebook [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK05/WEEK05a.md) + ### Chapter 11: Integer Data Type This chapter covers the integer data type in addition to a deeper assembler dive into GPIO outputs as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 12: Debugging Integer Data Type This chapter covers debugging the integer data type in addition to a deeper assembler dive into GPIO outputs as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 13: Hacking Integer Data Type This chapter covers hacking the integer data type in addition to a deeper assembler dive into GPIO outputs as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 14: Floating-Point Data Type This chapter covers the floating-point data type as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 15: Debugging Floating-Point Data Type This chapter covers debugging the floating-point data type as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 16: Hacking Floating-Point Data Type This chapter covers hacking the floating-point data type as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 17: Double Floating-Point Data Type This chapter covers the double floating-point data type as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 18: Debugging Double Floating-Point Data Type This chapter covers debugging the double floating-point data type as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 19: Hacking Double Floating-Point Data Type This chapter covers hacking the double floating-point data type as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ## Week 6 Static Variables in Embedded Systems: Debugging and Hacking Static Variables w/ GPIO Input Basics @@ -212,20 +312,34 @@ Static Variables in Embedded Systems: Debugging and Hacking Static Variables w/ ### Week 6 Notebook [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK06/WEEK06.md) +### Classified Brief 0x01 [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/0x0011a_cb/CLASSIFIED-BRIEF-0x01.md) + +### GDB Hardware Debugging Tutorial [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/0x0011a_cb/GDB_DEBUG_TUTORIAL.md) + +### Ghidra Reversing Tutorial [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/0x0011a_cb/GHIDRA_REVERSING_TUTORIAL.md) + +### Classified Brief 0x01 BIN [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/0x0011a_cb/0x0011a_cb.bin) + +### Classified Brief 0x01 UF2 [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/0x0011a_cb/0x0011a_cb.uf2) + +### Float/Hex Converter Tool [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/0x0011a_cb/scripts/float_hex_converter.py) + +### Telemetry Monitor Tool [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/0x0011a_cb/scripts/telemetry_monitor.py) + ### Chapter 20: Static Variables This chapter covers static variables as well as an intro to GPIO inputs as we work with push buttons as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 21: Debugging Static Variables This chapter covers debugging static variables as well as an intro to GPIO inputs as we work with push buttons as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 22: Hacking Static Variables This chapter covers hacking static variables as well as an intro to GPIO inputs as we work with push buttons as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ## Week 7 Constants in Embedded Systems: Debugging and Hacking Constants w/ 1602 LCD I2C Basics @@ -237,21 +351,31 @@ Constants in Embedded Systems: Debugging and Hacking Constants w/ 1602 LCD I2C B ### Chapter 23: Constants This chapter covers constants as well as an intro to I2C as we work a 1602 LCD as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 24: Debugging Constants This chapter covers debugging constants as well as an intro to I2C as we work a 1602 LCD as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 25: Hacking Constants This chapter covers hacking constants as well as an intro to I2C as we work a 1602 LCD as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ## Week 8 ### Midterm Exam +### CTF-02 Instructions [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/0x0017a_ctf/CTF-02-I.md) + +### CTF-02 Rubric [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/0x0017a_ctf/CTF-02-R.md) + +### CTF-02 Solution [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/0x0017a_ctf/CTF-02-S.md) + +### CTF-02 BIN [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/0x0017a_ctf/CTF-02.bin) + +### CTF-02 UF2 [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/0x0017a_ctf/CTF-02.uf2) + ## Week 9 Operators in Embedded Systems: Debugging and Hacking Operators w/ DHT11 Temperature & Humidity Sensor Single-Wire Protocol Basics @@ -262,17 +386,17 @@ Operators in Embedded Systems: Debugging and Hacking Operators w/ DHT11 Temperat ### Chapter 26: Operators This chapter covers operators as well as an intro to single-wire protocol as we work a DHT11 temperature and humidity sensor as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 27: Debugging Operators This chapter covers debugging operators as well as an intro to single-wire protocol as we work a DHT11 temperature and humidity sensor as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 28: Hacking Operators This chapter covers hacking operators as well as an intro to single-wire protocol as we work a DHT11 temperature and humidity sensor as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ## Week 10 Conditionals in Embedded Systems: Debugging and Hacking Static & Dynamic Conditionals w/ SG90 Servo Motor PWM Basics @@ -284,32 +408,32 @@ Conditionals in Embedded Systems: Debugging and Hacking Static & Dynamic Conditi ### Chapter 29: Static Conditionals This chapter covers static conditionals as well as an intro to PWM as we work a SG90 servo motor as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 30: Debugging Static Conditionals This chapter covers debugging static conditionals as well as an intro to PWM as we work a SG90 servo motor as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 31: Hacking Static Conditionals This chapter covers hacking static conditionals as well as an intro to PWM as we work a SG90 servo motor as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 32: Dynamic Conditionals This chapter covers dynamic conditionals as well as additional PWM examples as we work a SG90 servo motor as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 33: Debugging Dynamic Conditionals This chapter covers debugging dynamic conditionals as well as additional PWM examples as we work a SG90 servo motor as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 34: Hacking Dynamic Conditionals This chapter covers hacking dynamic conditionals as well as additional PWM examples as we work a SG90 servo motor as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ## Week 11 Structures and Functions in Embedded Systems: Debugging and Hacking w/ IR Remote Control and NEC Protocol Basics @@ -321,32 +445,32 @@ Structures and Functions in Embedded Systems: Debugging and Hacking w/ IR Remote ### Chapter 35: Structures This chapter covers structures as well as an intro to infrared basics as we work a infrared receiver and infrared remote controller as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 36: Debugging Structures This chapter covers debugging structures as well as an intro to infrared basics as we work a infrared receiver and infrared remote controller as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 37: Hacking Structures This chapter covers hacking structures as well as an intro to infrared basics as we work a infrared receiver and infrared remote controller as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 38: Functions, w/ Param, w/ Return This chapter covers functions, w/ params and w/ a return value as well as additional infrared examples as we work a infrared receiver and infrared remote controller it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 39: Debugging Functions, w/ Param, w/ Return This chapter covers debugging functions, w/ params and w/ a return value as well as additional infrared examples as we work a infrared receiver and infrared remote controller as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ### Chapter 40: Hacking Functions, w/ Param, w/ Return This chapter covers hacking functions, w/ params and w/ a return value as it relates to embedded development on the Pico 2. --> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/Embedded-Hacking.pdf) to read the FREE pdf book. +-> Click [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/textbook/Embedded-Hacking.pdf) to read the FREE pdf book. ## Week 12 Unknown Firmware Debugging and Hacking @@ -355,7 +479,8 @@ Unknown Firmware Debugging and Hacking Final Review – Embedded Debugging and Hacking Techniques w/ Advanced Firmware Analysis Q&A ## Week 14 -### Final +### Final Projects + ### Final Project Option 1: The InfuSafe Pro Incident In the aftermath of a catastrophic medical device failure, you are thrust into the role of an FDA forensic investigator facing an impossible crisis: 23 patients dead, 100 million recalled insulin pumps sitting in warehouses worldwide, and 2.3 million lives hanging in the balance all while the only evidence remaining is raw binary firmware after a rogue engineer destroyed every line of source code before fleeing to Montenegro. Armed only with GDB, Ghidra, and the reverse engineering skills honed over the first seven weeks of this course, you must excavate the truth from machine code, identify the lethal bugs spawned by an AI code generator called "OopsieGPT," and determine whether these devices can be salvaged to save millions in underserved communities or if $4.7 billion in humanitarian medical technology must be incinerated. This is not a simulation; this is triage at the intersection of embedded systems security and human survival. @@ -364,23 +489,655 @@ Forty-two stories beneath frozen tundra, a shadow intelligence alliance called D
-## RP2350 ARM Assembler Drivers +# Supplemental Material (Beyond the Scope of the Course) -### An RP2350 UART driver written entirely in ARM Assembler. [HERE](https://github.com/mytechnotalent/RP2350_UART_Driver) +## Pico 2 IoT Projects & CTFs & Pi 4B/5 Embedded Linux C IoT Project & CTF -### An RP2350 blink driver written entirely in ARM Assembler. [HERE](https://github.com/mytechnotalent/RP2350_Blink_Driver) +### Act I of OPERATION COLD IRON [HERE](https://github.com/mytechnotalent/cold-chain-monitor) -### An RP2350 button driver written entirely in ARM Assembler. [HERE](https://github.com/mytechnotalent/RP2350_Button_Driver) +### Act I of OPERATION COLD IRON CTF [HERE](https://github.com/mytechnotalent/CTF_cold-chain-monitor) + +### Act II of OPERATION COLD IRON [HERE](https://github.com/mytechnotalent/access-gate) + +### Act II of OPERATION COLD IRON CTF [HERE](https://github.com/mytechnotalent/CTF_access-gate) + +### Act III of OPERATION COLD IRON [HERE](https://github.com/mytechnotalent/pipeline-valve-controller) + +### Act III of OPERATION COLD IRON CTF [HERE](https://github.com/mytechnotalent/CTF_pipeline-valve-controller) + +### Act IV of OPERATION COLD IRON [HERE](https://github.com/mytechnotalent/hvac-automation-node) + +### Act IV of OPERATION COLD IRON CTF [HERE](https://github.com/mytechnotalent/CTF_hvac-automation-node) + +### Act V of OPERATION COLD IRON [HERE](https://github.com/mytechnotalent/industrial-tamper-system) + +### Act V of OPERATION COLD IRON CTF [HERE](https://github.com/mytechnotalent/CTF_industrial-tamper-system) + +### Act VI of OPERATION COLD IRON [HERE](https://github.com/mytechnotalent/smart-logistics-dropbox) + +### Act VI of OPERATION COLD IRON CTF [HERE](https://github.com/mytechnotalent/CTF_smart-logistics-dropbox) + +### Act VII of OPERATION COLD IRON [HERE](https://github.com/mytechnotalent/factory-andon-station) + +### Act VII of OPERATION COLD IRON CTF [HERE](https://github.com/mytechnotalent/CTF_factory-andon-station) + +### Act VIII of OPERATION COLD IRON [HERE](https://github.com/mytechnotalent/datacenter-vent-controller) + +### Act VIII of OPERATION COLD IRON CTF [HERE](https://github.com/mytechnotalent/CTF_datacenter-vent-controller) + +### Act IX of OPERATION COLD IRON [HERE](https://github.com/mytechnotalent/smart-parking-barrier) + +### Act IX of OPERATION COLD IRON CTF [HERE](https://github.com/mytechnotalent/CTF_smart-parking-barrier) + +### Act X of OPERATION COLD IRON [HERE](https://github.com/mytechnotalent/chemical-warning-terminal) + +### Act X of OPERATION COLD IRON CTF [HERE](https://github.com/mytechnotalent/CTF_chemical-warning-terminal) + +### OPERATION TELESCREEN [HERE](https://github.com/mytechnotalent/telescreen) + +### OPERATION TELESCREEN CTF [HERE](https://github.com/mytechnotalent/CTF_telescreen)
-## RP2350 RISC-V Assembler Drivers +## Pico 2 W C MeshCore Project -### An RP2350 UART driver written entirely in RISC-V Assembler. [HERE](https://github.com/mytechnotalent/RP2350_UART_Driver_RISCV) +### MeshCore Bare RP2350 [HERE](https://github.com/mytechnotalent/meshcore-bare-rp2350) -### An RP2350 blink driver written entirely in RISC-V Assembler. [HERE](https://github.com/mytechnotalent/RP2350_Blink_Driver_RISCV) +
-### An RP2350 button driver written entirely in RISC-V Assembler. [HERE](https://github.com/mytechnotalent/RP2350_Button_Driver_RISCV) +## Pico 2 Rust Tutorial + +### Chapter 1: What Is Embedded Rust? +This lesson will teach what embedded Rust is within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-01.md) to read the lesson and see the code. + +### Chapter 2: Number Systems and Memory +This lesson will teach number systems and memory within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-02.md) to read the lesson and see the code. + +### Chapter 3: Rust Essentials +This lesson will teach the Rust essentials within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-03.md) to read the lesson and see the code. + +### Chapter 4: Ownership, Borrowing, and Lifetimes +This lesson will teach ownership, borrowing and lifetimes within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-04.md) to read the lesson and see the code. + +### Chapter 5: Structs, Enums, and Pattern Matching +This lesson will teach structs, enums and pattern matching within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-05.md) to read the lesson and see the code. + +### Chapter 6: Traits and Generics +This lesson will teach traits and generics within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-06.md) to read the lesson and see the code. + +### Chapter 7: no_std and no_main +This lesson will teach no_std and no_main within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-07.md) to read the lesson and see the code. + +### Chapter 8: Cargo, Targets, and the Toolchain +This lesson will teach cargo, targets and the toolchain within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-08.md) to read the lesson and see the code. + +### Chapter 9: memory.x and the Linker Script +This lesson will teach the memory.x linker script within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-09.md) to read the lesson and see the code. + +### Chapter 10: build.rs, Makefile, and Flashing +This lesson will teach the build.rs, Makefile and flashing process within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-10.md) to read the lesson and see the code. + +### Chapter 11: Memory-Mapped I/O +This lesson will teach memory-mapped I/O within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-11.md) to read the lesson and see the code. + +### Chapter 12: Real-Time and Concurrency +This lesson will teach real-time and concurrency within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-12.md) to read the lesson and see the code. + +### Chapter 13: Futures and async/await +This lesson will teach futures and async/await within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-13.md) to read the lesson and see the code. + +### Chapter 14: The Embassy Executor +This lesson will teach the Embassy executor within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-14.md) to read the lesson and see the code. + +### Chapter 15: embassy-time +This lesson will teach embassy-time within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-15.md) to read the lesson and see the code. + +### Chapter 16: The embassy-rp HAL +This lesson will teach the embassy-rp HAL within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-16.md) to read the lesson and see the code. + +### Chapter 17: GPIO with embassy-rp +This lesson will teach GPIO with embassy-rp within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-17.md) to read the lesson and see the code. + +### Chapter 18: Driver Architecture +This lesson will teach the driver architecture within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-18.md) to read the lesson and see the code. + +### Chapter 19: config.rs — Blink Configuration +This lesson will teach the config.rs blink configuration within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-19.md) to read the lesson and see the code. + +### Chapter 20: led.rs — The LED State Machine +This lesson will teach the led.rs LED state machine within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-20.md) to read the lesson and see the code. + +### Chapter 21: main.rs — The Async Blink Loop +This lesson will teach the main.rs async blink loop within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-21.md) to read the lesson and see the code. + +### Chapter 22: Button Hardware and Debouncing +This lesson will teach button hardware and debouncing within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-22.md) to read the lesson and see the code. + +### Chapter 23: button.rs — The Button Controller +This lesson will teach the button.rs button controller within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-23.md) to read the lesson and see the code. + +### Chapter 24: main.rs — The Button Polling Loop +This lesson will teach the main.rs button polling loop within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-24.md) to read the lesson and see the code. + +### Chapter 25: Host Testing with cargo test +This lesson will teach host testing with cargo test within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-25.md) to read the lesson and see the code. + +### Chapter 26: UART Fundamentals and the Echo Protocol +This lesson will teach UART fundamentals and the echo protocol within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-26.md) to read the lesson and see the code. + +### Chapter 27: uart.rs — The Echo State Machine +This lesson will teach the uart.rs echo state machine within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-27.md) to read the lesson and see the code. + +### Chapter 28: Interrupts and DMA — Interrupt-Driven UART +This lesson will teach interrupts and DMA interrupt-driven UART within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-28.md) to read the lesson and see the code. + +### Chapter 29: main.rs — The UART Echo Loop +This lesson will teach the main.rs UART echo loop within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-29.md) to read the lesson and see the code. + +### Chapter 30: The Complete Integration +This lesson will teach the complete integration within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-Rust-Tutorial/blob/main/CHAPTER-30.md) to read the lesson and see the code. + +
+ +## Pico 2 Rust Drivers + +### UART Driver [HERE](https://github.com/mytechnotalent/RP2350_Rust_UART_Driver) + +### Blink Driver [HERE](https://github.com/mytechnotalent/RP2350_Rust_Blink_Driver) + +### Button Driver [HERE](https://github.com/mytechnotalent/RP2350_Rust_Button_Driver) + +
+ +## Pico 2 ARM Assembler Tutorial + +### Chapter 1: What Is a Computer? +This lesson will teach you what is a computer with the fundamental model of computation that every computer shares with an intro to the RP2350 and ARM Cortex-M33. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-01.md) to read the lesson and see the code. + +### Chapter 2: Number Systems — Binary, Hexadecimal, and Decimal +This lesson will teach the basics of the three main number systems which are decimal, binary and hexadecimal. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-02.md) to read the lesson and see the code. + +### Chapter 3: Memory — Addresses, Bytes, Words, and Endianness +This lesson will teach the basics addresses, bytes, words and endianness within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-03.md) to read the lesson and see the code. + +### Chapter 4: What Is a Register? +This lesson will teach the general purpose registers within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-04.md) to read the lesson and see the code. + +### Chapter 5: Load-Store Architecture — How ARM Accesses Memory +This lesson will teach how ARM accesses memory with load and store architecture within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-05.md) to read the lesson and see the code. + +### Chapter 6: The Fetch-Decode-Execute Cycle in Detail +This lesson will teach the fetch and decode cycle in more detail within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-06.md) to read the lesson and see the code. + +### Chapter 7: ARM Cortex-M33 ISA Overview +This lesson will teach the ARM Cortex-M33 ISA overview within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-07.md) to read the lesson and see the code. + +### Chapter 8: ARM Immediate and Move Instructions +This lesson will teach ARM immediate and move instructions within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-08.md) to read the lesson and see the code. + +### Chapter 9: ARM Arithmetic and Logic Instructions +This lesson will teach ARM arithmetic and logic instructions within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-09.md) to read the lesson and see the code. + +### Chapter 10: ARM Memory Access Instructions +This lesson will teach ARM memory access instructions within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-10.md) to read the lesson and see the code. + +### Chapter 11: ARM Branch Instructions +This lesson will teach ARM branch instructions within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-11.md) to read the lesson and see the code. + +### Chapter 12: ARM Calls, Returns, and the Stack Frame +This lesson will teach ARM calls, returns and the stack frame within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-12.md) to read the lesson and see the code. + +### Chapter 13: Assembler Directives +This lesson will teach assembler directives within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-13.md) to read the lesson and see the code. + +### Chapter 14: Labels, Symbols, and the Symbol Table +This lesson will teach labels, symbols and the symbol table within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-14.md) to read the lesson and see the code. + +### Chapter 15: Sections, Memory Layout, and the Linker Script +This lesson will teach sections, memory layout, and the linker script within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-15.md) to read the lesson and see the code. + +### Chapter 16: System Registers and Coprocessor Interface +This lesson will teach system registers and coprocessor interface within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-16.md) to read the lesson and see the code. + +### Chapter 17: Bit Manipulation Patterns +This lesson will teach bit manipulation patterns within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-17.md) to read the lesson and see the code. + +### Chapter 18: RP2350 Hardware Architecture +This lesson will teach RP2350 hardware architecture within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-18.md) to read the lesson and see the code. + +### Chapter 19: The Linker Script +This lesson will teach the linker script within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-19.md) to read the lesson and see the code. + +### Chapter 20: The Build System +This lesson will teach the build system within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-20.md) to read the lesson and see the code. + +### Chapter 21: image_def.s — The PICOBIN Boot Block +This lesson will teach the PICOBIN boot block within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-21.md) to read the lesson and see the code. + +### Chapter 22: constants.s — Memory Addresses and Constants +This lesson will teach memory addresses and constants within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-22.md) to read the lesson and see the code. + +### Chapter 23: vector_table.s and stack.s — Boot Foundation +This lesson will teach the boot foundation within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-23.md) to read the lesson and see the code. + +### Chapter 24: reset_handler.s — The Boot Sequence +This lesson will teach the boot sequence within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-24.md) to read the lesson and see the code. + +### Chapter 25: xosc.s — Crystal Oscillator and Clock Configuration +This lesson will teach the crystal oscillator and clock configuration within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-25.md) to read the lesson and see the code. + +### Chapter 26: reset.s — Releasing Peripherals from Reset +This lesson will teach releasing peripherals from reset within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-26.md) to read the lesson and see the code. + +### Chapter 27: gpio.s Part 1 — GPIO_Config +This lesson will teach GPIO config within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-27.md) to read the lesson and see the code. + +### Chapter 28: gpio.s Part 2, delay.s, and coprocessor.s — Output Control and Timing +This lesson will teach output control and timing within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-28.md) to read the lesson and see the code. + +### Chapter 29: main.s — The Blink Loop +This lesson will teach the blink loop within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-29.md) to read the lesson and see the code. + +### Chapter 30: Full Integration — From Source to Blinking LED +This lesson will teach the full source to blinking LED within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-ARM-ASM-Tutorial/blob/main/CHAPTER-30.md) to read the lesson and see the code. + +
+ +## Pico 2 ARM Assembler Drivers + +### UART Driver [HERE](https://github.com/mytechnotalent/RP2350_UART_Driver) + +### Blink Driver [HERE](https://github.com/mytechnotalent/RP2350_Blink_Driver) + +### Button Driver [HERE](https://github.com/mytechnotalent/RP2350_Button_Driver) + +
+ +## Pico 2 RISC-V Assembler Tutorial + +### Chapter 1: What Is a Computer? +This lesson will teach you what is a computer with the fundamental model of computation that every computer shares with an intro to the RP2350 and RISC-V. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-01.md) to read the lesson and see the code. + +### Chapter 2: Number Systems — Binary, Hexadecimal, and Decimal +This lesson will teach the basics of the three main number systems which are decimal, binary and hexadecimal. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-02.md) to read the lesson and see the code. + +### Chapter 3: Memory — Addresses, Bytes, Words, and Endianness +This lesson will teach the basics of addresses, bytes, words and endianness within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-03.md) to read the lesson and see the code. + +### Chapter 4: What Is a Register? +This lesson will teach the general purpose registers within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-04.md) to read the lesson and see the code. + +### Chapter 5: Load-Store Architecture — How RISC-V Accesses Memory +This lesson will teach how RISC-V accesses memory with load and store architecture within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-05.md) to read the lesson and see the code. + +### Chapter 6: The Fetch-Decode-Execute Cycle in Detail +This lesson will teach the fetch, decode and execute cycle in detail within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-06.md) to read the lesson and see the code. + +### Chapter 7: RISC-V Hazard3 ISA Overview +This lesson will teach the RISC-V Hazard3 ISA overview within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-07.md) to read the lesson and see the code. + +### Chapter 8: RISC-V Immediate and Upper-Immediate Instructions +This lesson will teach RISC-V immediate and upper-immediate instructions within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-08.md) to read the lesson and see the code. + +### Chapter 9: RISC-V Arithmetic and Logic Instructions +This lesson will teach RISC-V arithmetic and logic instructions within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-09.md) to read the lesson and see the code. + +### Chapter 10: RISC-V Memory Access — Load and Store Deep Dive +This lesson will teach RISC-V memory access load and store instructions in deep detail within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-10.md) to read the lesson and see the code. + +### Chapter 11: RISC-V Branch Instructions +This lesson will teach RISC-V branch instructions within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-11.md) to read the lesson and see the code. + +### Chapter 12: RISC-V Jumps, Calls, and Returns +This lesson will teach RISC-V jumps, calls and returns within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-12.md) to read the lesson and see the code. + +### Chapter 13: RISC-V Pseudo-Instructions +This lesson will teach RISC-V pseudo-instructions within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-13.md) to read the lesson and see the code. + +### Chapter 14: Assembler Directives +This lesson will teach assembler directives within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-14.md) to read the lesson and see the code. + +### Chapter 15: Calling Convention and Stack Frames +This lesson will teach the calling convention and stack frames within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-15.md) to read the lesson and see the code. + +### Chapter 16: Bitwise Operations for Hardware Programming +This lesson will teach bitwise operations for hardware programming within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-16.md) to read the lesson and see the code. + +### Chapter 17: Memory-Mapped I/O +This lesson will teach memory-mapped I/O within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-17.md) to read the lesson and see the code. + +### Chapter 18: The RP2350 — Architecture and Hardware +This lesson will teach the RP2350 architecture and hardware within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-18.md) to read the lesson and see the code. + +### Chapter 19: The Linker Script — Placing Code in Memory +This lesson will teach the linker script and how code is placed in memory within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-19.md) to read the lesson and see the code. + +### Chapter 20: The Build Pipeline — From Assembly to Flashable Binary +This lesson will teach the build pipeline from assembly to flashable binary within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-20.md) to read the lesson and see the code. + +### Chapter 21: Boot Metadata — image_def.s +This lesson will teach the image_def.s boot metadata within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-21.md) to read the lesson and see the code. + +### Chapter 22: The Constants File — constants.s +This lesson will teach the constants.s file within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-22.md) to read the lesson and see the code. + +### Chapter 23: Stack and Vector Table — stack.s and vector_table.s +This lesson will teach the stack and vector table within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-23.md) to read the lesson and see the code. + +### Chapter 24: Boot Sequence — reset_handler.s +This lesson will teach the reset_handler.s boot sequence within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-24.md) to read the lesson and see the code. + +### Chapter 25: Oscillator Initialization — xosc.s +This lesson will teach the xosc.s oscillator initialization within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-25.md) to read the lesson and see the code. + +### Chapter 26: Reset Controller — reset.s +This lesson will teach the reset.s reset controller within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-26.md) to read the lesson and see the code. + +### Chapter 27: GPIO Configuration — gpio.s Part 1 +This lesson will teach the gpio.s GPIO configuration part 1 within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-27.md) to read the lesson and see the code. + +### Chapter 28: GPIO Set/Clear, Delay, and Coprocessor — gpio.s Part 2, delay.s, coprocessor.s +This lesson will teach the gpio.s GPIO set/clear, delay.s and coprocessor.s within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-28.md) to read the lesson and see the code. + +### Chapter 29: Application Entry Point — main.s +This lesson will teach the main.s application entry point within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-29.md) to read the lesson and see the code. + +### Chapter 30: Full Integration — Build, Flash, Wire, and Test +This lesson will teach the full build, flash, wire and test integration within the MCU. + +-> Click [HERE](https://github.com/mytechnotalent/RP2350-RISCV-ASM-Tutorial/blob/main/CHAPTER-30.md) to read the lesson and see the code. + +
+ +## Pico 2 RISC-V Assembler Drivers + +### UART Driver [HERE](https://github.com/mytechnotalent/RP2350_UART_Driver_RISCV) + +### Blink Driver [HERE](https://github.com/mytechnotalent/RP2350_Blink_Driver_RISCV) + +### Button Driver [HERE](https://github.com/mytechnotalent/RP2350_Button_Driver_RISCV) + +
+ +## Pico 2 Developer Projects + +### LED Chase and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-01-blink) + +### Traffic Light Phases and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-02-traffic-light) + +### Hardware PWM Breathing and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-03-led-pwm-breathing) + +### 1602 I2C LCD Text and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-04-lcd-hello) + +### Live LCD Counter and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-05-lcd-live) + +### SG90 Servo Sweep and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-06-servo-sweep) + +### SG90 Servo Position and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-07-servo-position) + +### SG90 Gauge Needle and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-08-servo-gauge) + +### Tactile Button Poll and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-09-button-poll) + +### Debounced Button Edges and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-10-button-debounce) + +### Short, Long, and Double Press Events and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-11-button-events) + +### DHT11 Temperature and Humidity Read and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-12-dht11-read) + +### DHT11 Reading on the 1602 I2C LCD and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-13-dht11-lcd) + +### DHT11 Comfort LEDs and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-14-dht11-leds) + +### VS1838B NEC Decode and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-15-ir-decode) + +### Remote Key Actions on the LEDs and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-16-ir-keys) + +### Remote Keypad Digits on the LEDs and 1602 I2C LCD and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-17-ir-keypad) + +### Remote Key Lamp Selection and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-18-ir-control-led) + +### Remote Key Preset Angles on the SG90 Servo and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-19-ir-control-servo) + +### Remote Key Status Pages on the 1602 I2C LCD and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-20-ir-lcd-status) + +### Two Way Token Echo and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-21-lora-echo) + +### DHT11 Telemetry and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-22-lora-telemetry) + +### Remote Command LEDs and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-23-lora-command) + +### ACK Timeout and Retry and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-24-lora-ack) + +### Address Filter and Sender Attribution and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-25-lora-addressing) + +### Signal Quality on the LCD and LEDs and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-26-lora-rssi) + +### Buffered Readings and Flush on Link Recovery and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-27-lora-store-forward) + +### Menu Navigation with the GP15 Button and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-28-lcd-menu-button) + +### Menu Navigation with the IR Remote and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-29-lcd-menu-remote) + +### Button and Remote Status Pages on the 1602 I2C LCD and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-30-status-pages) + +### Hysteresis Vent Control with an IR Setpoint and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-31-thermostat) + +### Latched Band Breach, Door Latch Servo, and an Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-32-cold-chain-alarm) + +### Buffered Readings, Batched Flush, and an Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-33-data-logger) + +### Gateway Command, Servo Position, and an Authenticated ACK [HERE](https://github.com/mytechnotalent/picokit-34-remote-actuator) + +### Latching Alarm LED, Local Acknowledge, and an Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-35-annunciator-ack) + +### Timed Vent and LED Actions with an Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-36-scheduler) + +### Random-Light Reaction Game, Button Time, and an Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-37-reaction-timer) + +### Timed Intersection Phases, a Pedestrian Request, and an Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-38-traffic-controller) + +### Sealed Telemetry, Loopback Verify, and a Forged-Frame Reject [HERE](https://github.com/mytechnotalent/picokit-39-authenticated-telemetry) + +### Per-Node Monotonic Sequence, Replay Window, and a Rejected Replay [HERE](https://github.com/mytechnotalent/picokit-40-anti-replay) + +### Per-Device Key from a Device ID and Salt, Two Keys Proven Different [HERE](https://github.com/mytechnotalent/picokit-41-provisioning) + +### BLAKE2b Hash-Chained Event Log and Recompute on Read [HERE](https://github.com/mytechnotalent/picokit-42-tamper-log) + +### Debug Probe Breakpoints and SWD Variable Reads [HERE](https://github.com/mytechnotalent/picokit-43-swd-breakpoints) + +### Debug Probe Data Watchpoint on a Status Variable [HERE](https://github.com/mytechnotalent/picokit-44-swd-watchpoints) + +### Controlled Fault and Cortex-M33 Fault Status Registers [HERE](https://github.com/mytechnotalent/picokit-45-fault-analysis) + +### ELF and UF2 Inspection of a Known Constant [HERE](https://github.com/mytechnotalent/picokit-46-binary-recon) + +### Two-Node Mesh Relay and Authenticated Heartbeat [HERE](https://github.com/mytechnotalent/picokit-47-two-node-mesh) + +### Sensor Node and Charted Gateway [HERE](https://github.com/mytechnotalent/picokit-48-gateway-dashboard) + +### Fleet and Config Table with Multi-Node Gateway [HERE](https://github.com/mytechnotalent/picokit-49-fleet) + +### Full Peripheral Capstone and Authenticated Telemetry [HERE](https://github.com/mytechnotalent/picokit-50-finale)
diff --git a/WEEK01/WEEK01a.md b/WEEK01/WEEK01a.md new file mode 100644 index 0000000..7a2bae8 --- /dev/null +++ b/WEEK01/WEEK01a.md @@ -0,0 +1,718 @@ +# Week 1a: Understanding the ARM Stack: Inline Assembly and Live Debugging + +*** +**LEGAL DISCLAIMER:** +The information, tools, and code provided in this repository and course are strictly for educational, research, and defensive purposes only. + +You are explicitly prohibited from using any materials contained herein to access, test, modify, or exploit any device, network, or system that you do not own 100% or for which you do not have explicit, documented, and legally binding authorization to interact with. + +By using this repository and course, you acknowledge and agree that: + +1. Any illegal, unauthorized, or malicious use of this information is solely your responsibility. +2. The author(s) and contributor(s) of this repository and course shall not be held liable for any damages, legal repercussions, criminal charges, or unauthorized actions resulting from the use, misuse, or abuse of the contents herein. +3. You will comply with all applicable local, state, national, and international laws regarding cybersecurity and computer fraud. + +**IF YOU DO NOT AGREE WITH THESE TERMS, DO NOT USE THIS REPOSITORY AND COURSE.** + +*** + +## What You'll Learn This Week + +By the end of this week, you will be able to: + +- Understand how the RP2350 Cortex-M33 stack grows in SRAM. +- Identify the ARM registers used by this stack experiment. +- Build and flash a Pico 2 ELF through a Debug Probe. +- Connect OpenOCD and GDB to live hardware. +- Step one assembly instruction at a time with `si`. +- Examine the exact stack words written by each multi-register instruction. +- Prove that an ARM register list is ordered by register number, not source-list spelling. + +--- + +## Part 1: Understanding the Basics + +### What is a Microcontroller? + +A microcontroller is a complete small computer on one chip. It contains processor cores, memory controllers, peripherals, and interfaces for hardware such as GPIO, UART, timers, and SPI. The Raspberry Pi Pico 2 uses the **RP2350** microcontroller. + +### What is the ARM Cortex-M33? + +The RP2350 can run Arm Cortex-M33 cores. The program in this folder is built for that Arm target. We will use the Debug Probe, OpenOCD, and GDB to stop a core and inspect its registers and memory while it executes the program. + +### What is Dynamic Analysis? + +Dynamic analysis means observing a program while it runs on real hardware. In this lesson we will: + +- Stop the processor at `main`. +- View the instructions produced by the compiler. +- Execute one instruction with `si`. +- Read the stack pointer and the memory it points to. + +--- + +## Part 2: Understanding Processor Registers + +### What is a Register? + +A register is very fast storage inside the CPU. Instructions use registers for values, addresses, temporary results, and control flow. + +### The ARM Cortex-M33 Registers + +| Register | Also Called | Purpose | +| --- | --- | --- | +| `r0` - `r12` | General purpose | Hold values and addresses while instructions run. | +| `r13` | SP | Points to the current top of the stack. | +| `r14` | LR | Holds the return address after a function call. | +| `r15` | PC | Points to the next instruction to execute. | + +##### General-Purpose Registers (`r0` - `r12`) + +This lesson uses `r2`, `r3`, `r4`, `r6`, `r9`, and `r10`. The assembly saves their current values to SRAM, then restores them before the loop repeats. + +##### The Stack Pointer (`r13` / SP) + +The stack is a region of SRAM used for temporary values, saved registers, return addresses, and local variables. On Cortex-M, the standard stack grows toward lower addresses. + +- A `push` lowers `sp` and writes values below the old stack pointer. +- A `pop` reads values at `sp` and raises `sp`. +- Each saved register occupies 4 bytes. + +```text +Higher addresses ++------------------+ +| Old SP location | ++------------------+ +| Saved value | ++------------------+ +| Saved value | <- SP after a multi-register push ++------------------+ +Lower addresses +``` + +##### The Link Register (`r14` / LR) + +A `bl` instruction calls a function and stores the return address in `lr`. The compiler-generated prologue for `main` saves `lr` on the stack before calling `stdio_init_all`. + +##### The Program Counter (`r15` / PC) + +The Program Counter identifies the next instruction. In GDB, the `=>` marker in `disas main` points to the instruction that will run when you type `si`. + +--- + +## Part 3: Understanding Memory Layout + +### XIP - Execute In Place + +The Pico 2 executes this firmware directly from external flash through XIP. The executable code normally begins at `0x10000000`. + +### Memory Map Overview + +```text ++-------------------------------------+ +| Flash Memory (XIP) | +| Starts at: 0x10000000 | +| Contains: program instructions | ++-------------------------------------+ +| SRAM | +| Starts at: 0x20000000 | +| Contains: stack, heap, variables | ++-------------------------------------+ +``` + +### Why the Stack Is in SRAM + +The stack changes on every function call and return, so it must be writable. When GDB displays `$sp`, it should show an address in the `0x200...` SRAM range. `x/wx $sp` reads the 32-bit value currently at the top of that stack. + +--- + +## Part 3.5: Reviewing Our Stack Code + +The file `0x0001a_stack.c` initializes standard I/O, then repeats this assembly block forever: + +```c +__asm volatile( + "push {r4, lr}\n" + "push {r3, r2, r6}\n" + "stmdb sp!, {r9, r10}\n" + "ldmia sp!, {r9, r10}\n" + "pop {r2, r3, r6}\n" + "pop {r4, lr}\n" + ::: "memory"); +``` + +### Breaking Down the Code + +##### First Push: `push {r4, lr}` + +This lowers `sp` by 8 bytes. At the new stack pointer, the saved values are: + +```text +[sp + 4] = lr (higher address, visual top) +[sp] = r4 (lower address) <- SP <- TOP OF STACK +``` + +##### Second Push: `push {r3, r2, r6}` + +This is deliberately written in a confusing order. The source says `r3` first, but an ARM register list is a set of registers, not an ordered sequence of operations. The assembler encodes the same register mask as `{r2, r3, r6}` and warns that the list is not ascending. + +After one `si`, the stack layout proves the actual rule: + +```text +[sp + 16] = lr (highest address, visual top) +[sp + 12] = r4 +[sp + 8] = r6 +[sp + 4] = r3 +[sp] = r2 (lowest address) <- SP <- TOP OF STACK +``` + +The first three words were written by this instruction; `r4` and `lr` remain from +the preceding `push {r4, lr}`. The lowest register number in this push is stored +at the lowest address. Because the stack grows down, `[sp]` is the lower address +and the older `lr` at `[sp + 16]` is the higher address at the visual top. + +##### High Registers: `stmdb sp!, {r9, r10}` + +The 16-bit Thumb `push` encoding cannot encode high registers `r8` through `r12`. +`stmdb sp!` is the general full-descending stack instruction used for `r9` and +`r10`. + +```text +[sp + 4] = r10 (higher address, visual top) +[sp] = r9 (lower address) <- SP <- TOP OF STACK +``` + +##### The Restore Instructions + +The next instructions restore the same groups in reverse stack-group order. This matters because the last group saved is at the current top of the stack: + +```text +ldmia sp!, {r9, r10} +pop {r2, r3, r6} +pop {r4, lr} +``` + +The stack pointer ends at the same value it had before the inline assembly, so the infinite loop does not consume stack space. + +### Compiling and Flashing to the Pico 2 + +##### Step 1: Compile the Code + +From the project folder, build the program: + +```powershell +& "$env:USERPROFILE\.pico-sdk\ninja\v1.13.2\ninja.exe" -C build +``` + +The expected artifact is `build\0x0001a_stack.elf`. The assembler reports `register range not in ascending order` for the deliberately unordered source list. That warning is expected for this experiment. + +##### Step 2: Flash and Verify + +Use the Debug Probe to flash the ELF and compare target flash with the built image: + +```powershell +& "$env:USERPROFILE\.pico-sdk\openocd\0.12.0+dev\openocd.exe" -s "$env:USERPROFILE\.pico-sdk\openocd\0.12.0+dev\scripts" -f interface/cmsis-dap.cfg -f target/rp2350.cfg -c 'adapter speed 5000; targets rp2350.dap.core1; cortex_m reset_config sysresetreq; targets rp2350.dap.core0; program "build/0x0001a_stack.elf" verify reset exit' +``` + +You should see: + +```text +** Programming Finished ** +** Verify Started ** +** Verified OK ** +** Resetting Target ** +shutdown command invoked +``` + +`Verified OK` proves that the programmed bytes match the ELF. `shutdown command invoked` is normal because `exit` ends OpenOCD after flashing. + +--- + +## Part 4: Dynamic Analysis with GDB + +### Prerequisites + +Before starting, you need: + +1. A Pico 2 with the Debug Probe connected. +2. OpenOCD from the installed Pico SDK. +3. `arm-none-eabi-gdb`. +4. The verified `build\0x0001a_stack.elf` on the Pico 2. + +### Connecting to Your Pico 2 with OpenOCD + +Open a terminal and start the debug server. Leave it running: + +```powershell +& "$env:USERPROFILE\.pico-sdk\openocd\0.12.0+dev\openocd.exe" -s "$env:USERPROFILE\.pico-sdk\openocd\0.12.0+dev\scripts" -f interface/cmsis-dap.cfg -f target/rp2350.cfg -c "adapter speed 5000; init" +``` + +OpenOCD listens for GDB connections on port `3333`. + +##### VM Command + +If the VM has `openocd` on its `PATH`, use the same command without the full executable path: + +```powershell +openocd -s "$env:USERPROFILE\.pico-sdk\openocd\0.12.0+dev\scripts" -f interface/cmsis-dap.cfg -f target/rp2350.cfg -c "adapter speed 5000; init" +``` + +The VM needs USB access to the Debug Probe. Nothing else about the build, ELF, or GDB sequence changes. + +### Connecting to Your Pico 2 with GDB + +Open a second terminal in the project folder: + +```powershell +arm-none-eabi-gdb build\0x0001a_stack.elf +``` + +Connect, reset, halt, and stop at `main`: + +```gdb +target extended-remote :3333 +monitor reset halt +b main +c +disas main +``` + +You should see this instruction pattern from the current `build\0x0001a_stack.elf`. +The instruction addresses are determined by the ELF. The register contents shown +later are live target state and are not determined by the ELF. + +```text +=> main: push {r3, lr} + main+2: bl stdio_init_all + main+6: push {r4, lr} + main+8: push {r2, r3, r6} + main+10: stmdb sp!, {r9, r10} + main+14: ldmia.w sp!, {r9, r10} + main+18: pop {r2, r3, r6} + main+20: ldmia.w sp!, {r4, lr} + main+24: b.n main+6 +``` + +Notice that GDB displays `{r2, r3, r6}`, not the source spelling `{r3, r2, r6}`. That is the encoded register set in canonical order. Some disassemblers display `r10` as its conventional alias, `sl`; `{r9, sl}` and `{r9, r10}` name the same register set. + +### Basic GDB Commands: Your First Steps + +| Command | Short Form | What It Does | +| --- | --- | --- | +| `break main` | `b main` | Set a breakpoint at `main`. | +| `continue` | `c` | Run until a breakpoint. | +| `disassemble` | `disas` | Show the current function's assembly. | +| `info registers` | `i r` | Display CPU registers. | +| `stepi` | `si` | Execute exactly one instruction. | +| `nexti` | `ni` | Execute one instruction without entering a call. | +| `x/wx ADDRESS` | | Examine one 32-bit hexadecimal word. | +| `monitor reset halt` | | Ask OpenOCD to reset and halt the target. | + +### Watching the Stack Change + +> **Important: the instruction addresses and stack offsets below come from the +> current ELF. The Step 4 register capture is from the live GDB session shown +> here. Register contents and old SRAM words are target state, not constants +> that can be recovered from the ELF. The deterministic rule is that `push +> {r4, lr}` decreases `sp` by 8 bytes, stores `r4` at the new `[sp]`, and +> stores `lr` at `[sp + 4]`. + +##### Step 1: Inspect the Stack Before the Compiler Prologue + +At the breakpoint, GDB is paused before `push {r3, lr}`. Inspect the current stack pointer and the two words below it: + +```gdb +(gdb) p/x $sp +$1 = 0x20082000 +(gdb) x/2wx $sp-8 +0x20081ff8: 0x88526891 0x10000187 +``` + +The stack pointer is at `0x20082000`. The two words below it contain previous values (before the prologue). + +##### Step 2: Execute One Instruction + +Execute the compiler prologue `push {r3, lr}`: + +```gdb +(gdb) si +0x100001e2 7 stdio_init_all(); +(gdb) p/x $sp +$2 = 0x20081ff8 +(gdb) p/x $r3 +$3 = 0xe000ed08 +(gdb) x/wx $sp +0x20081ff8: 0xe000ed08 +(gdb) p/x $lr +$4 = 0x1000018b +(gdb) x/wx $sp+4 +0x20081ffc: 0x1000018b +``` + +The prologue saved two values to the stack: +```text +[sp + 4] = 0x1000018b (lr, higher address, visual top) +[sp] = 0xe000ed08 (r3, lower address) <- SP <- TOP OF STACK +``` + +**Stack layout after prologue** (memory grows downward; **higher hex addresses = deeper in stack = older data**): + +```text +Address Pointer Value Label +0x20082000 ---------- ---------- (previous data — HIGHEST address, visual top) +0x20081ffc ---------- 0x1000018b (lr, higher address) +0x20081ff8 <- [sp] 0xe000ed08 (r3, lowest address) <- SP <- TOP OF STACK + +MEMORY ORDER: 0x20081ff8 < 0x20081ffc < 0x20082000 + (visual bottom) (visual top) +``` + +**Memory address explanation for newcomers:** +- Hex address `0x20081ffc` is **LARGER** than `0x20081ff8` (compare the last hex digits: `ffc` > `ff8`) +- **Larger addresses = higher in memory = deeper in the stack** +- When we PUSH, sp **DECREASES** (goes to a smaller address, moving DOWN on the page) +- When we POP, sp **INCREASES** (goes to a larger address, moving UP on the page) + +The stack pointer dropped 8 bytes: from `0x20082000` to `0x20081ff8` (it went DOWN, to a smaller/lower address). + +##### Step 3: Step Over `stdio_init_all` + +Do not step into the library initialization code. Use `ni` to execute it and return: + +```gdb +(gdb) ni +0x100001e6 15 __asm volatile( +(gdb) disas main +Dump of assembler code for function main: + 0x100001e0 <+0>: push {r3, lr} + 0x100001e2 <+2>: bl 0x10001594 +=> 0x100001e6 <+6>: push {r4, lr} + 0x100001e8 <+8>: push {r2, r3, r6} + ... +``` + +The arrow now points at `push {r4, lr}`, the first inline assembly instruction. + +##### Step 4: Prove the First Inline Push + +Read the registers and stack pointer before the first inline push: + +```gdb +(gdb) p/x $r4 +$3 = 0x100001cc +(gdb) p/x $lr +$4 = 0x1000159b +(gdb) p/x $sp +$5 = 0x20081ff8 +``` + +Now execute the first inline push: + +```gdb +(gdb) si +0x100001e8 16 "push {r4, lr}\n" +(gdb) p/x $sp +$6 = 0x20081ff0 +(gdb) x/wx $sp +0x20081ff0: 0x100001cc +(gdb) x/wx $sp+4 +0x20081ff4: 0x1000159b +``` + +**After first inline push `push {r4, lr}`:** +- SP = `0x20081ff0` (**new TOP of stack, sp decreased**) +- `r4` = `0x100001cc` (now saved on stack) +- `lr` = `0x1000159b` (now saved on stack) + +The first push saved: +```text +[sp + 4] = 0x1000159b (lr, higher address, visual top) +[sp] = 0x100001cc (r4, lower address) <- SP <- TOP OF STACK +``` + +**Stack layout after first inline push**: + +```text +Address Pointer Value Label +0x20081ffc ---------- 0x1000018b (lr from prologue — highest address, visual top) +0x20081ff8 ---------- 0xe000ed08 (r3 from prologue — higher address) +0x20081ff4 ---------- 0x1000159b (lr — higher address) +0x20081ff0 <- [sp] 0x100001cc (r4, lowest address) <- SP <- TOP OF STACK + +MEMORY ORDER: 0x20081ff0 < 0x20081ff4 < 0x20081ff8 < 0x20081ffc + (visual bottom) (visual top) + Most recent Least recent +``` + +**The stack pointer dropped from `0x20081ff8` to `0x20081ff0` — that's 8 bytes down (toward lower addresses).** +**The value at `[sp]` (the TOP) is now `0x100001cc` (r4).** +**Address `0x20081ff0` is SMALLER than `0x20081ff8`, so sp moved DOWN.** + + +##### Step 5: Prove Register-List Ordering + +Read the three registers before executing the deliberately unordered list `push {r3, r2, r6}`: + +```gdb +(gdb) p/x $r2 +$18 = 0x200005cc +(gdb) p/x $r3 +$19 = 0xe000ed08 +(gdb) p/x $r6 +$20 = 0x04f54710 +(gdb) p/x $sp +$21 = 0x20081ff0 +``` + +Now execute the second inline push: + +```gdb +(gdb) si +0x100001ea <+10>: stmdb sp!, {r9, sl} +(gdb) p/x $sp +$22 = 0x20081fe4 +(gdb) x/wx $sp +0x20081fe4: 0x200005cc +(gdb) x/wx $sp+4 +0x20081fe8: 0xe000ed08 +(gdb) x/wx $sp+8 +0x20081fec: 0x04f54710 +``` + +The second push saved three registers in **numeric order** despite the source spelling `{r3, r2, r6}`: +```text +[sp + 8] = 0x04f54710 (r6, higher address, visual top) +[sp + 4] = 0xe000ed08 (r3, higher address) +[sp] = 0x200005cc (r2, lower address) <- SP <- TOP OF STACK +``` + +**Stack layout after second inline push** (**lower hex addresses = most recent = TOP**): + +```text +Address Pointer Value Label +0x20081ffc ---------- 0x1000018b (lr — HIGHEST address, OLDEST data, visual top) +0x20081ff8 ---------- 0xe000ed08 (r3 — higher address) +0x20081ff4 ---------- 0x1000159b (lr — higher address) +0x20081ff0 ---------- 0x100001cc (r4 — higher address) +0x20081fec ---------- 0x04f54710 (r6 — higher address) +0x20081fe8 ---------- 0xe000ed08 (r3 — higher address) +0x20081fe4 <- [sp] 0x200005cc (r2, lowest address) <- SP <- TOP OF STACK + +ADDRESS ORDERING: 0x20081fe4 < 0x20081fe8 < ... < 0x20081ffc + (visual bottom) (visual top) + Hex comparison: fe4 < fe8 < fec < ff0 < ff4 < ff8 < ffc + Most recent data at the visual bottom +``` + +**The stack pointer dropped from `0x20081ff0` to `0x20081fe4` — that's 12 bytes down (three 4-byte registers).** +**When comparing hex: `0x20081fe4` is SMALLER than `0x20081ff0`, so sp moved to a LOWER address.** +**The value at `[sp]` (the TOP) is now `0x200005cc` (r2).** + +Notice: the source wrote `r3` first, but the CPU pushed `r2` first because `r2` has a lower register number. The encoded register mask is `{r2, r3, r6}`, and the stack layout proves it. + +##### Step 6: Prove the High-Register Save + +Read the high registers before the `stmdb sp!, {r9, r10}` instruction: + +```gdb +(gdb) p/x $r9 +$23 = 0x00000000 +(gdb) p/x $r10 +$24 = 0x10000000 +(gdb) p/x $sp +$25 = 0x20081fe4 +``` + +Execute the high-register save: + +```gdb +(gdb) si +0x100001ee <+14>: ldmia.w sp!, {r9, sl} +(gdb) p/x $sp +$26 = 0x20081fdc +(gdb) p/x $r9 +$27 = 0x00000000 +(gdb) p/x $r10 +$28 = 0x10000000 +(gdb) x/wx $sp +0x20081fdc: 0x00000000 +(gdb) x/wx $sp+4 +0x20081fe0: 0x10000000 +(gdb) x/wx $sp+8 +0x20081fe4: 0x200005cc +(gdb) x/wx $sp+12 +0x20081fe8: 0xe000ed08 +(gdb) x/wx $sp+16 +0x20081fec: 0x04f54710 +(gdb) x/wx $sp+20 +0x20081ff0: 0x100001cc +(gdb) x/wx $sp+24 +0x20081ff4: 0x1000159b +(gdb) x/wx $sp+28 +0x20081ff8: 0xe000ed08 +``` + +**After high-register save `stmdb sp!, {r9, r10}`:** +- SP = `0x20081fdc` (**new TOP of stack, sp decreased further**) +- `r9` = `0x00000000` (now saved on stack) +- `r10` = `0x10000000` (now saved on stack) + +The `stmdb sp!, {r9, r10}` instruction saved: +```text +[sp + 4] = 0x10000000 (r10, higher address, visual top) +[sp] = 0x00000000 (r9, lower address) <- SP <- TOP OF STACK +``` + +**The stack pointer dropped from `0x20081fe4` to `0x20081fdc` — that's 8 more bytes down.** +**The value at `[sp]` (the TOP) is now `0x00000000` (r9).** +**This is the DEEPEST point of the stack during inline assembly.** + +```text +Address Pointer Value Label +0x20081ff8 ---------- 0xe000ed08 (saved prologue r3, highest address, visual top) +0x20081ff4 ---------- 0x1000159b (lr, higher address) +0x20081ff0 ---------- 0x100001cc (r4, higher address) +0x20081fec ---------- 0x04f54710 (r6, higher address) +0x20081fe8 ---------- 0xe000ed08 (r3, higher address) +0x20081fe4 ---------- 0x200005cc (r2, higher address) +0x20081fe0 ---------- 0x10000000 (r10, higher address) +0x20081fdc <- [sp] 0x00000000 (r9, lowest address) <- SP <- TOP OF STACK +``` + +##### Step 7: Watch the Restores + +At this point, the stack is at maximum depth. Now execute the restore instructions one by one: + +**Restore 1: ldmia sp!, {r9, r10}** + +```gdb +(gdb) si +0x100001f2 <+18>: pop {r2, r3, r6} +(gdb) p/x $sp +$29 = 0x20081fe4 +(gdb) p/x $r9 +$30 = 0x00000000 +(gdb) p/x $r10 +$31 = 0x10000000 +``` + +`ldmia sp!` restored `r9` and `r10` from the stack and raised `sp` by 8 bytes (from `0x20081fdc` to `0x20081fe4`). +**SP is now `0x20081fe4`; `[sp]` contains r2, so `SP <- TOP OF STACK` at the next group.** + +**Restore 2: pop {r2, r3, r6}** + +```gdb +(gdb) si +0x100001f4 <+20>: ldmia.w sp!, {r4, lr} +(gdb) p/x $sp +$32 = 0x20081ff0 +(gdb) p/x $r2 +$33 = 0x200005cc +(gdb) p/x $r3 +$34 = 0xe000ed08 +(gdb) p/x $r6 +$35 = 0x04f54710 +``` + +`pop {r2, r3, r6}` restored the three registers from SRAM and raised `sp` by 12 bytes (from `0x20081fe4` to `0x20081ff0`). +**SP is now `0x20081ff0`; `[sp]` contains r4, so `SP <- TOP OF STACK` at the final group.** + +**Restore 3: ldmia.w sp!, {r4, lr}** + +```gdb +(gdb) si +0x100001f8 <+24>: b.n 0x100001e6 +(gdb) p/x $sp +$36 = 0x20081ff8 +(gdb) p/x $r4 +$37 = 0x100001cc +(gdb) p/x $lr +$38 = 0x1000159b +``` + +`ldmia.w sp!, {r4, lr}` restored `r4` and `lr` from SRAM and raised `sp` by 8 bytes (from `0x20081ff0` to `0x20081ff8`). +**SP is now `0x20081ff8`; `[sp]` contains the saved prologue r3, so `SP <- TOP OF STACK` for the remaining prologue stack data.** + +**Result:** After all three restore instructions, `sp` is back at `0x20081ff8`, exactly where it was before the inline assembly block started. The loop branches back to `push {r4, lr}` at address `0x100001e6` and repeats forever without consuming stack space. + +### Understanding the Stack Diagram + +At the deepest point, after `stmdb sp!, {r9, r10}`, the inline assembly has saved 28 bytes. The `old SP` below is the stack pointer after the separate compiler prologue, not the stack pointer at entry to `main`: + +```text +Before inline assembly: At maximum inline stack depth: + +old SP <- SP old SP + [old SP - 4] lr + [old SP - 8] r4 + [old SP - 12] r6 + [old SP - 16] r3 + [old SP - 20] r2 + [old SP - 24] r10 + [old SP - 28] r9 <- SP +``` + +The restoration sequence removes the top group first: `r9/r10`, then `r2/r3/r6`, then `r4/lr`. + +--- + +## Part 5: Summary and Review + +### What We Learned + +1. **Registers**: `sp`, `lr`, and `pc` control stack location, returns, and the next instruction. +2. **The stack**: It grows down in SRAM. Pushes decrease `sp`; pops increase it. +3. **Multi-register instructions**: Register-list source order is not the stack-memory order. ARM stores lower register numbers at lower addresses. +4. **OpenOCD and GDB**: OpenOCD connects to the Debug Probe; GDB connects to OpenOCD on port `3333`. +5. **Live evidence**: `si` executes one instruction, and `x/wx $sp` shows the exact 32-bit word that instruction placed at the stack pointer. + +### The Program Flow + +```text ++-----------------------------------------------------+ +| 1. push {r3, lr} | +| Compiler saves its prologue registers | ++-----------------------------------------------------+ +| 2. bl stdio_init_all | +| Initialize standard I/O | ++-----------------------------------------------------+ +| 3. push {r4, lr} | +| Save the first inline group | ++-----------------------------------------------------+ +| 4. push {r3, r2, r6} | +| Source order differs from stack-memory order | ++-----------------------------------------------------+ +| 5. stmdb / ldmia / pop / pop | +| Save and restore all groups | ++-----------------------------------------------------+ +| 6. b.n main+6 | +| Repeat with the original stack pointer | ++-----------------------------------------------------+ +``` + +--- + +## Key Takeaways + +1. **The stack grows downward**: a push decreases the numeric value in `sp`. +2. **A register list is not a sequence**: `{r3, r2, r6}` and `{r2, r3, r6}` encode the same register set. +3. **Memory is the proof**: after `si`, inspect `[sp]`, `[sp+4]`, and `[sp+8]` with GDB. +4. **The restore order matters**: always restore the most recently saved group first. +5. **Balanced stack operations are required**: the loop returns `sp` to its starting value on every iteration. + +--- + +## Glossary + +| Term | Definition | +| --- | --- | +| **Assembly** | Human-readable form of processor instructions. | +| **Breakpoint** | A debugger stop point. | +| **Debug Probe** | Hardware interface that lets OpenOCD communicate with the target over SWD. | +| **GDB** | GNU Debugger, used to inspect and control the running target. | +| **LR** | Link Register, holding a function return address. | +| **OpenOCD** | Debug server that bridges GDB and the Debug Probe. | +| **PC** | Program Counter, pointing to the next instruction. | +| **SP** | Stack Pointer, pointing to the top of the stack. | +| **SRAM** | Writable memory used for runtime data and the stack. | +| **XIP** | Execute In Place, executing program code directly from flash. | diff --git a/WEEK01/WEEK01a.pdf b/WEEK01/WEEK01a.pdf new file mode 100644 index 0000000..b0e083e Binary files /dev/null and b/WEEK01/WEEK01a.pdf differ diff --git a/WEEK03/GHIDRA_PATCHING_TUTORIAL.md b/WEEK03/GHIDRA_PATCHING_TUTORIAL.md new file mode 100644 index 0000000..5e2801d --- /dev/null +++ b/WEEK03/GHIDRA_PATCHING_TUTORIAL.md @@ -0,0 +1,252 @@ +# Ghidra Binary Patching Tutorial: ARM Cortex-M Thumb-2 Bytes Window Workflow + +``` ++-----------------------------------------------------------------+ +| GHIDRA BYTES WINDOW BINARY PATCHING GUIDE | +| | +| Target Architecture: ARM Cortex-M33 (ARMv8-M Main / Thumb-2) | +| Tool: Ghidra Software Reverse Engineering Suite | +| Core Technique: Listing Clear (C) -> Bytes Window Edit | +| -> Listing Disassemble (D) | +| Target Firmware: Raspberry Pi Pico 2 (RP2350) Raw Binaries | +| Classification: Defensive Firmware Security & Patching | ++-----------------------------------------------------------------+ +``` + +--- + +## 1. Executive Summary & Overview + +Binary patching is a fundamental capability in embedded systems reverse engineering and defensive firmware security. When analyzing compiled firmware images—such as raw binary files (`.bin`) extracted from bare-metal microcontrollers—security analysts and engineers frequently need to modify program logic directly in machine code without access to the original source code or a compilation toolchain. + +Common operational scenarios for embedded binary patching include: +- **Defensive Telemetry Correction:** Rectifying corrupted or spoofed sensor thresholds in mission-critical industrial or SCADA control nodes. +- **Vulnerability Remediation & Hot-Patching:** Neutralizing memory corruption flaws, logic bugs, or insecure dispatch routines in deployed firmware. +- **Hardware Reverse Engineering Challenges:** Solving embedded Capture The Flag (CTF) challenges where firmware logic gates must be manipulated to uncover security flags. + +While high-level desktop reverse engineering tutorials often recommend right-clicking an instruction and selecting **Patch Instruction**, this GUI action consistently fails when targeting **ARM Cortex-M Thumb-2** binaries. This comprehensive guide documents the underlying architectural reason for this failure and provides the official, step-by-step **Bytes Window Workflow** using high-resolution Ghidra screenshots from live analysis of `CTF-01.bin`. + +--- + +## 2. The Architectural Problem: Why GUI Patching Fails in ARM Thumb-2 + +### 2.1 The ARM Cortex-M Thumb-2 Instruction Set & IT Blocks + +The Raspberry Pi Pico 2 is powered by the dual-core **ARM Cortex-M33** microcontroller, which executes the **ARMv8-M Mainline (Thumb-2)** instruction set. In Thumb-2 mode: +1. Instructions are variable-length: either 16 bits (2 bytes) or 32 bits (4 bytes). +2. Conditional execution is handled via **If-Then (`IT`) blocks** (e.g., `it`, `ite`, `itt`). +3. An instruction immediately preceding an `IT` block sets the Condition Code Flags (e.g., `cmp r3, #0x5e`), and the subsequent `ite hi` instruction evaluates those flags to execute conditionally. + +### 2.2 The Context Collision in Ghidra's Disassembler + +When you right-click a compare instruction (such as `cmp r3, #0x5e` at offset `0x100001FC`) and select **Patch Instruction** (or press `Ctrl+Shift+G`): + +``` ++-----------------------------------------------------------------+ +| GUI PATCH INSTRUCTION FAILURE CHAIN | +| | +| 1. User invokes GUI Patch Instruction at compare site | +| 2. Ghidra PatchInstructionAction invokes ReDisassembleCommand | +| 3. ReDisassembleCommand hits subsequent 'ite' block | +| 4. Ghidra attempts to write internal ITBlock context register | +| 5. CodeManager throws: ContextChangeException | +| 6. Ghidra aborts Thumb decoding -> falls back to 32-bit ARM | +| 7. Downstream instructions collapsed into movwcs / ldmdavs | +| 8. Compare Site B (0x1000020A) completely swallowed & lost | ++-----------------------------------------------------------------+ +``` + +Ghidra maintains internal context registers (such as `TMode` for Thumb execution and `ITBlock` for conditional state tracking). When `ReDisassembleCommand` encounters an existing instruction downstream of the patch site, the context register write collides with existing database state, throwing a `ContextChangeException` (`Context register change conflicts with one or more instructions`). + +Because Ghidra's assembler aborts decoding Thumb instructions upon this conflict, it defaults to **32-bit ARM disassembly mode**. It misinterprets the 16-bit Thumb opcode bytes as 32-bit ARM instructions (`movwcs`, `ldmdavs`, `blcs`), which **swallows downstream code** and completely obliterates subsequent compare sites (such as Compare Site B at `0x1000020A`). + +### 2.3 Why 'Locking TMode = 1' (Ctrl+R) Does Not Solve the Issue + +Attempting to highlight the `.text` section and press `Ctrl+R` (**Set Register Values**) to set `TMode = 1` also fails once Ghidra has already performed its initial auto-analysis. Ghidra's database rules forbid setting context register values across memory ranges that already contain disassembled code. + +The clean, permanent, and battle-tested technique is the **Bytes Window Workflow**. + +--- + +## 3. The 5-Step Bytes Window Workflow + +The **Bytes Window Workflow** completely bypasses Ghidra's assembler context conflicts. By clearing the single instruction to undefined raw bytes, editing the underlying byte in the hex view, and then disassembling just that location, Ghidra's disassembler operates cleanly without attempting to rewrite `ITBlock` context registers over existing downstream code. + +### Step 1: Open the Bytes Window + +By default, Ghidra displays the **Listing** view and the **Decompiler** view. To inspect and edit raw hex bytes directly: + +1. Look at the top Ghidra menu bar. +2. Click **Window** in the menu. +3. Select **Bytes: .bin** (for example, **Bytes: CTF-01.bin**). + +![Ghidra Window Menu - Opening Bytes Window](img/fig1.png) +

Figure 1: Navigating to Window -> Bytes: CTF-01.bin in the Ghidra menu bar.

+ +4. Dock the **Bytes** window side-by-side with your **Listing** window so both panels are simultaneously visible on your screen. + +--- + +### Step 2: Locate the Target Instruction in the Listing Window + +Before making any modifications, navigate to the target function and identify the exact instruction bytes: + +1. Click inside the **Listing** window and press key **`G`** (Go To Address). +2. Enter the target address (for example, `0x100001FC`). +3. Observe the disassembled instruction and its opcode encoding: + +```assembly +100001fc 5e 2b cmp r3,#0x5e +``` + +![Target Instruction in Listing View](img/fig2.png) +

Figure 2: Listing view at offset 100001fc showing the initial instruction: cmp r3,#0x5e (bytes 5e 2b).

+ +#### Technical Breakdown of Opcode `5e 2b`: +In ARMv8-M Thumb-16 architecture, the compare-immediate instruction `cmp , #` is encoded as: +- Bit pattern: `0010 1nnn iiiiiiii` +- Opcode field (`00101`): Specifies `CMP` immediate. +- Register `r3` (`nnn = 011` binary): Specifies operand register `r3`. +- Upper byte: `0010 1011` binary = `0x2B`. +- Lower byte: `0x5E` (hex) = `94` decimal (the comparison threshold). +- Because ARM Cortex-M microcontrollers are **little-endian**, the low byte (`5E`) appears first in memory at address `0x100001FC`, followed by the high byte (`2B`) at address `0x100001FD`. +- To change the threshold from $94$ ($0\text{x}5E$) to $59$ ($0\text{x}3B$), we only need to alter byte `0x100001FC` from `5E` to `3B`! + +--- + +### Step 3: Clear the Code Bytes in the Listing Window (`C`) + +This is the critical step that prevents assembler context conflicts. Before editing a byte, the instruction must be cleared from Ghidra's active instruction database: + +1. In the **Listing** window, click directly on address **`100001fc`** (the row containing `cmp r3,#0x5e`). +2. Press the key **`C`** on your keyboard (or right-click and select **Clear Code Bytes**). +3. Notice that the instruction disassembly immediately clears into undefined raw bytes: + +```assembly +100001fc 5e ?? 5Eh ^ +100001fd 2b ?? 2Bh + +``` + +![Listing View after Clearing Code Bytes](img/fig3.png) +

Figure 3: Listing view after pressing 'C': the instruction at 100001fc is cleared to raw undefined bytes.

+ +By clearing the instruction first, Ghidra's database disarms the active context parser for this address. The subsequent `ite hi` instruction downstream is no longer linked to an active parsing state at this address. + +--- + +### Step 4: Enable Edit Mode and Modify the Byte in the Bytes Window + +Now that the address is cleared, modify the raw hex byte using the Bytes window: + +1. In the **Bytes** window toolbar, locate and click the **Pencil Icon** (**Toggle Edit Mode**). The icon highlights to indicate that byte-editing mode is now active. +2. Locate offset row **`100001f0`** in the Bytes window. +3. Move your cursor to column **`C`** (representing address `100001fc`). +4. Click on the byte **`5E`** and type the replacement value **`3B`**. +5. Notice that Ghidra immediately updates the byte to `3B` and highlights it in red to indicate an uncommitted edit. + +![Side-by-Side View of Listing and Bytes Window with Edit Mode Active](img/fig4.png) +

Figure 4: Side-by-side view showing the active pencil icon, the modified byte '3b' highlighted in red in the Bytes window, and the synchronized Listing window.

+ +6. Look at the **Listing** window. Address `100001fc` now reflects the new byte `3b` while remaining undefined: + +```assembly +100001fc 3b ?? 3Bh ; +100001fd 2b ?? 2Bh + +``` + +![Listing View showing Modified Byte before Disassembly](img/fig5.png) +

Figure 5: Listing view showing the modified byte '3b' at 100001fc ready for disassembly.

+ +--- + +### Step 5: Disassemble the Modified Instruction (`D`) + +With the desired byte safely written to memory, restore the disassembly: + +1. Click back into the **Listing** window. +2. Click directly on address **`100001fc`**. +3. Press the key **`D`** on your keyboard (or right-click and select **Disassemble**). +4. Ghidra immediately decodes the bytes `3b 2b` as Thumb-2 machine code: + +```assembly +100001fc 3b 2b cmp r3,#0x3b +``` + +5. **Verify Downstream Disassembly:** Inspect the instructions immediately following `0x100001FC`: + - `100001fe 8c bf ite hi` remains completely intact! + - `10000200 00 23 movhi r3,#0x0` remains intact! + - `10000202 01 23 movls r3,#0x1` remains intact! + - **Compare Site B at `0x1000020A` remains completely intact and visible!** + +No context conflict was triggered, no instructions were swallowed, and no 32-bit ARM decoding errors occurred. + +--- + +### Step 6: Repeat for Secondary Sites & Export Patched Firmware + +#### Repeating on Compare Site B: +In many defensive patches (such as `CTF-01`), redundant checks or dual comparison gates are enforced by the compiler: +1. In the **Listing** window, click address **`1000020a`** (`cmp r3,#0x5e`). +2. Press **`C`** to clear code bytes. +3. In the **Bytes** window at offset `1000020a`, change byte `5E` to **`3B`**. +4. In the **Listing** window, click back on **`1000020a`** and press **`D`** to disassemble. +5. Both Compare Site A and Compare Site B are now patched to `0x3B` (59 decimal)! + +#### Exporting the Patched Binary Image: +1. Click **File** in the Ghidra menu bar. +2. Select **Export Program** (or press key `O`). +3. Set **Format** to **Raw Bytes**. +4. Click the `...` button next to **Output File** and navigate to your project directory. +5. Set the filename (for example, `CTF-01_fixed.bin`). +6. Click **OK** to save the patched binary image to disk. + +#### Converting to UF2 and Flashing: +Convert the exported raw binary to the Raspberry Pi Pico 2 UF2 format using `uf2conv.py`: + +```bash +python3 uf2conv.py CTF-01_fixed.bin \ + --base 0x10000000 \ + --family 0xe48bff59 \ + --output CTF-01_fixed.uf2 +``` + +Hold the `BOOTSEL` button on your Raspberry Pi Pico 2, plug it into your workstation's USB port, and drag-and-drop `CTF-01_fixed.uf2` onto the `RP2350` drive to verify your patched firmware on physical hardware! + +--- + +## 4. Method Comparison & Reference Guide + +``` ++-----------------------------------------------------------------+ +| GHIDRA ARM THUMB-2 PATCHING METHODS MATRIX | +| | +| Method Downstream Safety IT-Block Safe Status | +| ----------------- ----------------- ------------- ------ | +| GUI Patch Inst. Fails (Swallows) No (Conflict) AVOID | +| TMode = 1 (Ctrl+R) Fails (Database) No (Exception) AVOID | +| Bytes Window (C/D) 100% Safe & Clean Yes (Disarmed) OPTIMAL | ++-----------------------------------------------------------------+ +``` + +
+ +### Keystroke Quick Reference Table + +| Step | Action | Window | Shortcut / Control | Result | +| :--- | :--- | :--- | :--- | :--- | +| **1** | Open Bytes Panel | Menu Bar | `Window` $\rightarrow$ `Bytes: ` | Displays raw hex grid | +| **2** | Locate Target | Listing | Press `G` $\rightarrow$ enter address | Cursor at target opcode | +| **3** | Clear Code Bytes | Listing | Press `C` | Instruction cleared to `??` | +| **4** | Enable Edit Mode | Bytes | Click **Pencil Icon** | Enables write mode | +| **5** | Modify Hex Byte | Bytes | Type new hex byte (`3B`) | Byte highlighted in red | +| **6** | Re-Disassemble | Listing | Click address $\rightarrow$ press `D` | Reassembles cleanly as Thumb-2 | +| **7** | Export Program | Menu Bar | `File` $\rightarrow$ `Export Program` | Saves patched `.bin` file | + +--- + +## 5. Key Takeaways & Best Practices + +1. **Thumb-2 Conditional State is Fragile in Ghidra:** The presence of `IT`/`ITE` blocks creates dynamic context register dependencies. High-level assembler dialogs fail because they attempt to re-evaluate downstream context over existing disassembly. +2. **Clear First (`C`), Edit Second, Disassemble Last (`D`):** Always clear the code bytes before modifying machine code in Ghidra. Clearing breaks the active context dependency graph and allows clean byte substitution. +3. **Always Verify Downstream Code:** After pressing `D`, scan the next 10 instructions to ensure downstream labels, branch targets, and conditional blocks were not disrupted. +4. **Export as Raw Bytes:** When flashing embedded microcontrollers like the RP2350, always export as **Raw Bytes** (`.bin`), never as ELF or PE, before converting to UF2. diff --git a/WEEK03/GHIDRA_PATCHING_TUTORIAL.pdf b/WEEK03/GHIDRA_PATCHING_TUTORIAL.pdf new file mode 100644 index 0000000..163a8ea Binary files /dev/null and b/WEEK03/GHIDRA_PATCHING_TUTORIAL.pdf differ diff --git a/WEEK03/WEEK03.md b/WEEK03/WEEK03.md index f047c74..e8167db 100644 --- a/WEEK03/WEEK03.md +++ b/WEEK03/WEEK03.md @@ -345,14 +345,20 @@ MEMORY **What this means:** -| Region | Start Address | Size | Purpose | -| --------- | ------------- | -------- | --------------------- | -| Flash | `0x10000000` | (varies) | Your code (XIP) | -| RAM | `0x20000000` | 512 KB | Main RAM | -| SCRATCH_X | `0x20080000` | 4 KB | Core 0 scratch memory | -| SCRATCH_Y | `0x20081000` | 4 KB | Core 0 stack | +| Region | Start Address | Size | Purpose | +| --------- | ------------- | -------- | -------------------------------------------- | +| Flash | `0x10000000` | (varies) | Your code (XIP) | +| RAM | `0x20000000` | 512 KB | Main striped SRAM | +| SCRATCH_X | `0x20080000` | 4 KB | SRAM8: shared, non-striped SRAM | +| SCRATCH_Y | `0x20081000` | 4 KB | SRAM9: shared, non-striped SRAM | -### Where Does the Stack Come From? +`SCRATCH_X` and `SCRATCH_Y` are linker-script names for SRAM8 and SRAM9. They +are **not hardware-assigned to Core 0 or Core 1**: both cores can access both +banks. Software may reserve either bank for per-core data to reduce bank +contention. This particular linker script selects `SCRATCH_Y` for the Core 0 +stack; that is a software allocation choice, not a property of SRAM9. + +### Where Does This Build's Core 0 Stack Come From? The linker script calculates the initial stack pointer: @@ -366,7 +372,9 @@ Let's do the math: - `LENGTH(SCRATCH_Y)` = `0x1000` (4 KB) - `__StackTop` = `0x20081000` + `0x1000` = **`0x20082000`** -This value (`0x20082000`) is what we see at offset `0x00` in the vector table! +This value (`0x20082000`) is what we see at offset `0x00` in the vector table. +It is the initial Core 0 stack pointer for this build because its linker script +chose `SCRATCH_Y`; it does not reserve `SCRATCH_Y` for Core 0 in hardware. --- @@ -791,44 +799,96 @@ Each type of exception has its own handler: ## Part 13: Finding Where Main is Called -### Step 12: Look at Platform Entry +### Step 12: Trace Reset Handler to `main` -After all the setup, the code finally calls `main()`. Let's find it: - -**Type this command:** +Start at the **application** Cortex-M vector table in XIP flash. The RP2350 +bootrom occupies `0x00000000`; it is not this firmware's vector table. Word +`0x10000000` is this image's initial stack pointer, and word `0x10000004` is +the **reset-handler pointer** loaded into `pc` when the bootrom enters the +application: ```gdb -(gdb) x/10i 0x10000186 +(gdb) x/2wx 0x10000000 +0x10000000 <__vectors>: 0x20082000 0x1000015d ``` -**You should see:** +`0x1000015d` is a Thumb function pointer: bit 0 is set to indicate Thumb +state. Clear that bit before disassembly, so the reset handler's first +instruction address is `0x1000015c`. Then continue through startup until +`platform_entry`: -``` -0x10000186 : -ldr r1, [pc, #80] @ (0x100001d8 ) -0x10000188 : blx r1 -0x1000018a : -ldr r1, [pc, #80] @ (0x100001dc ) -0x1000018c : blx r1 -0x1000018e : -ldr r1, [pc, #80] @ (0x100001e0 ) -0x10000190 : blx r1 -0x10000192 : bkpt 0x0000 -0x10000194 : -b.n 0x10000192 -0x10000196 : ldmia r1!, {r0} -0x10000198 : stmia r2!, {r0} +```gdb +(gdb) x/10i 0x1000015c +(gdb) x/x 0x10000004 +0x10000004 <__vectors+4>: 0x1000015d +(gdb) b platform_entry +(gdb) c ``` -### Understanding Platform Entry +At `platform_entry`, the three `ldr r1` / `blx r1` pairs are indirect calls: -The platform entry code makes **three function calls** using `ldr` + `blx`: +```text +0x10000186 : ldr r1, [pc, #80] +0x10000188 : blx r1 (first call) +0x1000018a : ldr r1, [pc, #80] +0x1000018c : blx r1 (second call) +0x1000018e : ldr r1, [pc, #80] +0x10000190 : blx r1 (third call) +``` -1. **First call**: `runtime_init()` - SDK initialization -2. **Second call**: `main()` - YOUR CODE! -3. **Third call**: `exit()` - Called when main returns +### Prove That the Second Call Is `main` -After `main()` returns, `exit()` is called to handle cleanup. The `bkpt` instruction after `exit()` should never be reached - it's there to catch errors if `exit()` somehow returns. +Stop at the second `blx r1`. `r1` holds the target; inspect it and then +disassemble that address: + +```gdb +(gdb) b *0x1000018c +(gdb) c + +Thread 1 "rp2350.dap.core0" hit Breakpoint 1, platform_entry () + at C:/Users/assem.KEVINTHOMAS/.pico-sdk/sdk/2.2.0/src/rp2_common/pico_crt0/crt0.S:515 +515 blx r1 +(gdb) x/x 0x1000018c +0x1000018c : 0x49144788 +(gdb) disas +Dump of assembler code for function platform_entry: + 0x10000186 <+0>: ldr r1, [pc, #80] @ (0x100001d8 ) + 0x10000188 <+2>: blx r1 + 0x1000018a <+4>: ldr r1, [pc, #80] @ (0x100001dc ) +=> 0x1000018c <+6>: blx r1 + 0x1000018e <+8>: ldr r1, [pc, #80] @ (0x100001e0 ) + 0x10000190 <+10>: blx r1 + 0x10000192 <+12>: bkpt 0x0000 + 0x10000194 <+14>: b.n 0x10000192 +End of assembler dump. +(gdb) x/x 0x1000018c +0x1000018c : 0x49144788 +(gdb) x/x $r1 +0x10000235
: 0x99f001b5 +(gdb) disas $r1 +Dump of assembler code for function main: + 0x10000234 <+0>: push {r3, lr} + 0x10000236 <+2>: bl 0x1000156c + 0x1000023a <+6>: ldr r0, [pc, #8] @ (0x10000244 ) + 0x1000023c <+8>: bl 0x100015fc <__wrap_puts> + 0x10000240 <+12>: b.n 0x1000023a + 0x10000242 <+14>: nop + 0x10000244 <+16>: adds r4, r1, r7 + 0x10000246 <+18>: asrs r0, r0, #32 +End of assembler dump. +(gdb) x/x 0x100001dc +0x100001dc : 0x10000235 +``` + +`x/x $r1` reports `0x10000235
` because Thumb function pointers have +bit 0 set. The actual instruction starts at `0x10000234`, as `disas $r1` +shows. The preceding `ldr r1, [pc, #80]` reads the literal-pool word at +`0x100001dc`; `x/x 0x100001dc` confirms that word is `0x10000235`. +This proves that the **second** indirect call enters `main()`. + +The first call performs runtime initialization. When `main()` returns, the +third call enters the SDK exit path; the following `bkpt` catches the +unexpected case where that exit path returns. ### Step 13: Set a Breakpoint at Main @@ -1031,11 +1091,14 @@ void _reset_handler(void) ### Step 18: Trace the Path to Main -Let's find how the boot code eventually calls `main()`: +Use the same evidence chain as GDB, but statically in the Listing view: -1. In the Symbol Tree, find the `main` function -2. Right-click on `main` and select **References -> Show References to main** -3. This shows everywhere `main` is called from! +1. In the Symbol Tree, find the `main` function at `0x10000234`. +2. Right-click `main` and select **References -> Show References to main**. +3. Double-click the reference at `0x1000018c` to jump to the second `blx r1`. +4. Select the instruction immediately above it: `ldr r1,[DAT_100001dc]` at + `0x1000018a`. +5. Double-click `DAT_100001dc`, or press **G** and enter `0x100001dc`. **You should see:** @@ -1043,7 +1106,16 @@ Let's find how the boot code eventually calls `main()`: | ------------------------- | ---- | ------------------ | | `1000018c` | CALL | `blx r1` (to main) | -4. Double-click on the reference to jump to `1000018c` +At `0x100001dc`, Ghidra shows the literal-pool value `0x10000235`. That is +the Thumb function pointer loaded into `r1` immediately before the call. +Clear bit 0 to obtain the actual first instruction address: + +```text +0x10000235 (Thumb function pointer; bit 0 is set) +0x10000234 (main's first instruction; bit 0 cleared) +``` + +This proves the second indirect call at `0x1000018c` reaches `main`. ### Step 19: Examine Platform Entry @@ -1071,7 +1143,14 @@ In Ghidra, look at `platform_entry`: 10000194 fd e7 b LAB_10000192 ``` -> **Key Insight:** Ghidra's decompiler makes the boot sequence crystal clear! You can see exactly what functions are called before `main()`. +The `DAT_100001dc = 10000235h` annotation is the static proof. The preceding +`ldr` loads that Thumb function pointer into `r1`; the following `blx r1` at +`0x1000018c` calls it. Ghidra clears the Thumb bit and labels the target +`main` at `0x10000234`. + +> **Key Insight:** The reset vector identifies the reset handler, the reset +> handler reaches `platform_entry`, and this literal-pool entry proves that +> `platform_entry`'s second indirect call reaches `main`. ### Step 20: Create a Boot Sequence Graph @@ -1115,8 +1194,8 @@ Ghidra can visualize the call flow: | - Finds IMAGE_DEF within first 4 kB of flash image | +-----------------------------------------------------------------+ | 3. VECTOR TABLE (0x10000000) | -| - Reads SP from offset 0x00 -> 0x20082000 | -| - Reads Reset Handler from offset 0x04 -> 0x1000015d | +| - Reads SP from offset 0x00 -> 0x20082000 | +| - Reads Reset Handler from offset 0x04 -> 0x1000015d | +-----------------------------------------------------------------+ | 4. RESET HANDLER (0x1000015c) | | - Checks CPUID (Core 0 continues, Core 1 waits) | @@ -1551,20 +1630,20 @@ well within the 4 KB scan window the bootrom uses (Datasheet 5.9.5, p. 429). | PROVEN BOOT SEQUENCE (0x0001_hello-world) | +-----------------------------------------------------------------+ | 1. Bootrom reads 0x10000000 | -| -> SP = 0x20082000 (offset +0x00 of vector table) | -| -> RST = 0x1000015d (offset +0x04, Thumb -> 0x1000015c) | +| -> SP = 0x20082000 (offset +0x00 of vector table) | +| -> RST = 0x1000015d (offset +0x04, Thumb -> 0x1000015c) | +-----------------------------------------------------------------+ | 2. Bootrom scans first 4 kB for IMAGE_DEF | -| -> Found at 0x10000138 (this build) | -| -> Start marker: d3 de ff ff | -| -> End marker: 79 35 12 ab | +| -> Found at 0x10000138 (this build) | +| -> Start marker: d3 de ff ff | +| -> End marker: 79 35 12 ab | +-----------------------------------------------------------------+ | 3. Bootrom jumps to reset handler at 0x1000015c | -| -> _reset_handler (crt0.S) runs | -| -> Checks CPUID - Core 1 sent back to bootrom | -| -> Core 0: .data copied, .bss zeroed, platform_entry called | +| -> _reset_handler (crt0.S) runs | +| -> Checks CPUID - Core 1 sent back to bootrom | +| -> Core 0: .data copied, .bss zeroed, platform_entry called | +-----------------------------------------------------------------+ -| 4. platform_entry calls runtime_init -> main -> exit | +| 4. platform_entry calls runtime_init -> main -> exit | +-----------------------------------------------------------------+ ``` diff --git a/WEEK03/WEEK03.pdf b/WEEK03/WEEK03.pdf index 32dea62..479261b 100644 Binary files a/WEEK03/WEEK03.pdf and b/WEEK03/WEEK03.pdf differ diff --git a/WEEK03/img/fig1.png b/WEEK03/img/fig1.png new file mode 100644 index 0000000..2675b54 Binary files /dev/null and b/WEEK03/img/fig1.png differ diff --git a/WEEK03/img/fig2.png b/WEEK03/img/fig2.png new file mode 100644 index 0000000..ea88c10 Binary files /dev/null and b/WEEK03/img/fig2.png differ diff --git a/WEEK03/img/fig3.png b/WEEK03/img/fig3.png new file mode 100644 index 0000000..d8508da Binary files /dev/null and b/WEEK03/img/fig3.png differ diff --git a/WEEK03/img/fig4.png b/WEEK03/img/fig4.png new file mode 100644 index 0000000..844d58f Binary files /dev/null and b/WEEK03/img/fig4.png differ diff --git a/WEEK03/img/fig5.png b/WEEK03/img/fig5.png new file mode 100644 index 0000000..842d5ee Binary files /dev/null and b/WEEK03/img/fig5.png differ diff --git a/WEEK04/WEEK04.md b/WEEK04/WEEK04.md index 1d5e045..bdc437e 100644 --- a/WEEK04/WEEK04.md +++ b/WEEK04/WEEK04.md @@ -104,7 +104,7 @@ When your program is compiled, variables go to different places depending on how ``` +-----------------------------------------------------------------+ -| .data Section (Flash -> copied to RAM at startup) | +| .data Section (Flash -> copied to RAM at startup) | | Contains: Initialized global/static variables | | Example: int counter = 42; | +-----------------------------------------------------------------+ @@ -440,10 +440,15 @@ This instruction loads the value `0x2b` (43) into register `r1` before calling ` We're going to change `0x2b` (43) to `0x46` (70)! -1. At address `1000023a`, click the instruction `movs r1,#0x2b` -2. Right-click and select **Patch Instruction** -3. Replace immediate `0x2b` with `0x46` -4. Press Enter and verify the instruction bytes change from `2b 21` to `46 21` +To patch instructions cleanly in Ghidra without assembler context conflicts, use the **Bytes Window** workflow: + +1. Ensure the Bytes window is open (**Window** -> **Bytes: 0x0005_intro-to-variables.bin**). +2. In the Bytes window toolbar, click the **pencil icon** (**Toggle Edit Mode**) to enable editing. +3. In the **Listing** window, click on address `1000023a` (`movs r1,#0x2b`) and press **`C`** (**Clear Code Bytes**). +4. In the **Bytes** window at offset `1000023a`, click on byte `2B` and change it to **`46`**. +5. In the **Listing** window, click back on address `1000023a` and press **`D`** (**Disassemble**). + +*(Alternatively, you can right-click the instruction at `1000023a` in the Listing, select **Patch Instruction**, replace immediate `0x2b` with `0x46`, and press Enter)*. The instruction now reads: ```assembly @@ -634,10 +639,11 @@ This is where `gpio_init(LED_PIN)` is called with GPIO 16. We'll change the red LED (GPIO 16) to the green LED (GPIO 17)! -1. At address `1000023a`, select `movs r0,#0x10` -2. Right-click -> **Patch Instruction** -3. Replace immediate `0x10` with `0x11` (17 decimal) -4. Click **OK** and verify bytes change from `10 20` to `11 20` +1. In the **Listing** window, click address `1000023a` (`movs r0,#0x10`) and press **`C`** (**Clear Code Bytes**). +2. In the **Bytes** window (with the pencil icon enabled), locate offset `1000023a`, click byte `10`, and change it to **`11`**. +3. In the **Listing** window, click back on address `1000023a` and press **`D`** (**Disassemble**). + +*(Alternatively, right-click `movs r0,#0x10` -> **Patch Instruction** -> change `0x10` to `0x11` and press Enter)*. ### Step 28: Find All GPIO 16 References @@ -647,14 +653,14 @@ There are more places that use GPIO 16. Look for: 10000244 10 23 movs r3,#0x10 ``` -This is used in `gpio_set_dir`. Patch this to `0x11` as well. +This is used in `gpio_set_dir`. In Listing press **`C`** at `10000244`, change byte `10` to **`11`** in the Bytes window, and press **`D`** in Listing. ```assembly 10000252 10 24 movs r4,#0x10 ``` -This is inside the loop for `gpio_put`. Patch this to `0x11` as well. -Patch each one with **Patch Instruction**, then verify: +This is inside the loop for `gpio_put`. In Listing press **`C`** at `10000252`, change byte `10` to **`11`** in the Bytes window, and press **`D`** in Listing. +Verify the patched bytes: - `10000244`: `10 23` -> `11 23` - `10000252`: `10 24` -> `11 24` @@ -667,9 +673,10 @@ Let's also change the printed value from `0` to `0x42` (66 in decimal): 1000024a 00 21 movs r1,#0x0 ``` -1. Right-click -> **Patch Instruction** -2. Replace immediate `0x0` with `0x42` -3. Click **OK** and verify bytes change from `00 21` to `42 21` +1. In Listing, click `1000024a` and press **`C`** (**Clear Code Bytes**). +2. In the Bytes window, change byte `00` to **`42`**. +3. In Listing, click back on `1000024a` and press **`D`** (**Disassemble**). +4. Verify the instruction bytes change from `00 21` to `42 21`. --- @@ -753,7 +760,7 @@ Step 2: Set function (address 0x40028084) Step 3: Enable output (via coprocessor) +-----------------------------------------------------------------+ -| - mcrr p0, #4, r4, r5, c4 (where r4=16, r5=1) | +| - mcrr p0, #4, r4, r5, c4 (where r4=16, r5=1) | +-----------------------------------------------------------------+ ``` @@ -833,10 +840,10 @@ delay2: +-----------------------------------------------------------------+ | 3. Find the values/instructions to patch | | - Look in the assembly listing | -| - Patch Instruction, then verify old bytes -> new bytes | +| - Bytes window (pencil, C, edit byte, D) or Patch Inst. | +-----------------------------------------------------------------+ | 4. Export the patched binary | -| - File -> Export Program | +| - File -> Export Program | | - Format: Raw Bytes | +-----------------------------------------------------------------+ | 5. Convert to UF2 | @@ -863,7 +870,7 @@ delay2: | Action | How To Do It | | ----------------- | ------------------------------------- | | Rename function | Right-click -> Edit Function Signature | -| Patch instruction | Right-click -> Patch Instruction, then verify old bytes -> new bytes | +| Patch instruction | Bytes window (pencil, C, edit, D) or Patch Instruction | | Export binary | File -> Export Program -> Raw Bytes | | Go to address | Press 'G' and enter address | diff --git a/WEEK04/WEEK04.pdf b/WEEK04/WEEK04.pdf index 78fbd7d..b9eb561 100644 Binary files a/WEEK04/WEEK04.pdf and b/WEEK04/WEEK04.pdf differ diff --git a/WEEK04/WEEK04a.md b/WEEK04/WEEK04a.md new file mode 100644 index 0000000..4c697fe --- /dev/null +++ b/WEEK04/WEEK04a.md @@ -0,0 +1,1063 @@ +# Week 4a: Hardware-Aware Reverse Engineering with CMSIS-SVD: Live GDB and Ghidra Analysis of Stripped Binaries + +*** +**LEGAL DISCLAIMER:** +The information, tools, and code provided in this repository and course are strictly for educational, research, and defensive purposes only. + +You are explicitly prohibited from using any materials contained herein to access, test, modify, or exploit any device, network, or system that you do not own 100% or for which you do not have explicit, documented, and legally binding authorization to interact with. + +By using this repository and course, you acknowledge and agree that: + +1. Any illegal, unauthorized, or malicious use of this information is solely your responsibility. +2. The author(s) and contributor(s) of this repository and course shall not be held liable for any damages, legal repercussions, criminal charges, or unauthorized actions resulting from the use, misuse, or abuse of the contents herein. +3. You will comply with all applicable local, state, national, and international laws regarding cybersecurity and computer fraud. + +**IF YOU DO NOT AGREE WITH THESE TERMS, DO NOT USE THIS REPOSITORY AND COURSE.** + +*** + +## What You'll Learn This Week + +By the end of this tutorial, you will be able to: + +- Understand the fundamental differences between an ELF binary and a raw `.bin` firmware dump. +- Flash and debug `CTF-01.bin` using OpenOCD and a hardware Debug Probe with explicit base addressing ($0\text{x}10000000$). +- Operate GDB without an executable or symbol table, using hardware breakpoints (`hb`) and address-based disassembly (`x/i`). +- Navigate the ARM Cortex-M Vector Table at $0\text{x}10000000$ to find the initial Stack Pointer ($0\text{x}20082000$) and Reset Vector ($0\text{x}1000015B \rightarrow 0\text{x}1000015A$). +- Follow boot execution into `main()` at $0\text{x}100001E0$ without debug symbols. +- Identify the Memory-Mapped I/O (MMIO) peripheral blind spot in stripped binaries (UART0, IO_BANK0, PADS_BANK0, RESETS, SIO). +- Install and configure CMSIS-SVD (`rp2350.svd`) and `PyCortexMDebug` inside GDB for live dynamic peripheral inspection. +- Inspect UART0 baud rate and FIFO status registers, and verify GPIO 0/1 pin multiplexing live over SWD. +- Install and run `SVD-Loader-Ghidra` on `CTF-01.bin` to map peripheral memory blocks and auto-generate C struct definitions. +- Transform raw, obscure pointer decompilation into readable, vendor-grade peripheral struct accesses. +- Understand why arithmetic immediate instructions like `add.w r0, r0, #0x40000000` appear in the assembly listing while resolving cleanly in the decompiler. +- Execute a unified hardware-aware reverse engineering workflow combining static analysis in Ghidra and dynamic analysis in GDB to solve the CTF mission. + +--- + +## Part 1: The Raw Binary Dilemma (.elf vs .bin) + +### ELF Files: The Friendly Development Container + +In previous lessons, when debugging your firmware, you launched GDB pointing to an **Executable and Linkable Format (ELF)** file: + +```cmd +arm-none-eabi-gdb build\CTF-01.elf +``` + +An ELF file is not just machine code. It is a rich, structured container that contains: +1. **ELF Header**: Specifies the target architecture, endianness, and exact entry point address. +2. **Section Headers**: Defines memory segments such as `.text`, `.data`, `.rodata`, and `.bss`. +3. **Symbol Table**: Maps human-readable names (`main`, `grid_deviation`, `evaluate_grid`) to exact virtual memory addresses. +4. **DWARF Debug Information**: Links individual assembly instructions back to original C source file line numbers, variable types, and stack frame layouts. + +When GDB loads an ELF file, it knows the name of every function, the layout of every struct, and the location of `main`. + +### Raw .bin Files: The Harsh Reality of Firmware Extraction + +In real-world hardware reverse engineering, red teaming, and firmware extraction (such as reading an external SPI flash chip or intercepting an over-the-air firmware update), you will almost never have access to an ELF file. + +Instead, you are handed a **raw binary file (`.bin`)**: + +``` ++-----------------------------------------------------------------+ +| Comparison: ELF Container vs. Raw .bin Firmware | +| | +| CTF-01.elf (Development Build) | +| +-----------------------------------------------------------+ | +| | ELF Header (Entry Point: 0x1000015b) | | +| | Symbol Table (main -> 0x100001e0, evaluate_grid -> ...) | | +| | DWARF Debug Data (C Source Line Mapping) | | +| | Section Table (.text, .rodata, .data, .bss) | | +| | Machine Code Payload (15,920 bytes) | | +| +-----------------------------------------------------------+ | +| | +| CTF-01.bin (Field Recovery Image) | +| +-----------------------------------------------------------+ | +| | [Flat Machine Code Bytes Only - No Headers, No Symbols] | | +| | 00 20 08 20 5b 01 00 10 1b 01 00 10 1d 01 00 10 ... | | +| +-----------------------------------------------------------+ | ++-----------------------------------------------------------------+ +``` + +A `.bin` file is a byte-for-byte memory dump of flash memory. It contains: +- **No ELF header** +- **No section names** +- **No symbol names** +- **No debug information** +- **No base address metadata** (the file itself does not record where in memory it belongs) + +If you attempt to launch GDB with `0x0001b_ctf/CTF-01.bin` directly: + +```powershell +arm-none-eabi-gdb 0x0001b_ctf\CTF-01.bin +``` + +GDB immediately halts with an error: + +```text +"0x0001b_ctf/CTF-01.bin": not in executable format: file format not recognized +``` + +### The Hardware MMIO Blind Spot + +Stripped binaries introduce a second, even larger obstacle: **hardware peripherals**. + +Microcontrollers interact with the outside world using **Memory-Mapped Input/Output (MMIO)**. Peripherals like UART, GPIO, Clocks, and Resets do not have special CPU instructions. Instead, they are mapped to specific, fixed physical addresses in the microcontroller's memory map: + +| Subsystem | RP2350 Physical Address Base | Function | +| :--- | :--- | :--- | +| `RESETS` | `0x40020000` | Subsystem reset controller (releases UART and GPIO from reset) | +| `IO_BANK0` | `0x40028000` | GPIO pin function select (`FUNCSEL`) and overrides | +| `PADS_BANK0` | `0x40038000` | Electrical pad controls (drive strength, pulls, Schmitt) | +| `UART0` | `0x40070000` | Serial UART interface (115200 8N1 telemetry console) | +| `SIO` | `0xd0000000` | Single-cycle I/O (fast CPU core check, GPIO controls) | + +When analyzing a raw binary, neither GDB nor Ghidra understands what `0x40070018` or `0x40028004` mean. To standard tools, they are just arbitrary hexadecimal numbers. Reverse engineers are left manually cross-referencing thousands of pages of microcontroller datasheets. + +In this tutorial, you will master the two industry-standard tools that eliminate this blind spot: +1. **PyCortexMDebug** for live, dynamic hardware awareness in **GDB**. +2. **SVD-Loader-Ghidra** for automatic struct mapping and clear decompilation in **Ghidra**. + +--- + +## Part 2: The Target Application: `0x0001b_ctf` (Operation Black Start) + +### Mission Briefing + +Our primary target is the emergency firmware build from **`0x0001b_ctf`** (**CTF-01: Operation Black Start**). + +In this scenario, a critical cyberattack severed the primary SCADA network coordinating regional power grid interconnections. An emergency firmware build was deployed to the **GRID-7** fleet of relay controllers to manage an automated black-start restoration. However, the rushed build contains two critical defects: +1. **Miscalibrated Safety Threshold**: The frozen grid frequency deviation latched at $0.87\text{ Hz}$ is evaluated against a corrupt threshold of $95$ ($0.95\text{ Hz}$) instead of the hard engineering safety limit of $60$ ($0.60\text{ Hz}$), causing the relay to report a false-safe `STABLE` status. +2. **Hardcoded False Status Line**: The operator console line falsely asserts `SIGNAL: NORMAL` regardless of actual channel health. + +The source code was overwritten during the crisis build process. The only surviving artifact is the compiled raw binary: **`CTF-01.bin`**. + +### The Source Code Behind the Binary + +Let's review the firmware architecture from `0x0001b_ctf/src/` to understand what machine code the compiler generated: + +#### `main.c` + +```c +#include "console.h" +#include "grid.h" +#include "pico/stdlib.h" + +int main(void) +{ + stdio_init_all(); + retain_dispatch_frame(); + evaluate_grid(); + print_boot_banner(); + while (true) { + print_status(); + sleep_ms(1000); + } + return 0; +} +``` + +#### `grid.c` + +```c +#include "grid.h" +#include + +// Frozen grid frequency deviation reading latched when comms were severed. +volatile uint32_t grid_deviation = 87; + +// Operator-facing classification of the frozen reading (drives GRID STATUS). +volatile uint32_t operator_state = 0; + +// Automated dispatch authorization decision (drives DISPATCH PATH). +volatile uint32_t dispatch_state = 0; + +// Quarantined black-start authorization frame, retained in flash, never sent. +static volatile const char dispatch_frame[] = + "WORLDGRID:BLACKSTART:GRID-7:WATER-3"; + +void retain_dispatch_frame(void) +{ + volatile char frame_marker = dispatch_frame[0]; + (void)frame_marker; +} + +void evaluate_grid(void) +{ + operator_state = (grid_deviation < SAFE_THRESHOLD) ? 1 : 0; + dispatch_state = (grid_deviation < SAFE_THRESHOLD) ? 1 : 0; +} +``` + +#### `console.c` + +```c +#include "console.h" +#include "grid.h" +#include + +void print_boot_banner(void) +{ + printf("GLOBAL EMBEDDED RESPONSE NETWORK\r\n"); + printf("BLACK START WINDOW: 27 MINUTES\r\n"); + printf("UART0 115200 8N1 | AUTHORIZED LAB CONSOLE\r\n"); + printf("SIGNAL: NORMAL\r\n"); + printf("RESPONSE> "); +} + +void print_status(void) +{ + printf("GRID STATUS: %s\r\n", operator_state ? "STABLE" : "CRITICAL"); + printf("DISPATCH PATH: %s\r\n", dispatch_state ? "AUTHORIZED" : "HELD"); + printf("LAST FRAME: QUARANTINED\r\n"); + printf("RESPONSE> "); +} +``` + +### Hardware Actions Performed by This Code + +1. **`stdio_init_all()`**: + - Releases the UART0, IO_BANK0, and PADS_BANK0 peripherals from reset via `RESETS` (`0x40020000`). + - Configures `GPIO0` (TX) and `GPIO1` (RX) pin multiplexing to function select `2` (UART0) in `IO_BANK0` (`0x40028000`). + - Configures pad electrical properties in `PADS_BANK0` (`0x40038000`). + - Programs baud rate divisors (`UARTIBRD`, `UARTFBRD`) and line controls (`UARTLCR_H`) in `UART0` (`0x40070000`) for 115200 baud, 8 data bits, no parity, 1 stop bit (8N1). +2. **`retain_dispatch_frame()`**: + - Anchors the secret authorization token string `"WORLDGRID:BLACKSTART:GRID-7:WATER-3"` at physical flash address $0\text{x}100037A0$. +3. **`evaluate_grid()`**: + - Compares the global `grid_deviation` variable ($87$) against `SAFE_THRESHOLD` (compiled as `cmp r3, #94`). +4. **`print_boot_banner()` & `print_status()`**: + - Streams formatted strings through the UART0 Transmit FIFO buffer (`UART0_UARTDR`). + +In your workspace, this challenge is located in `0x0001b_ctf/`: +- `0x0001b_ctf/CTF-01.bin` (Raw 15,920-byte stripped firmware) +- `0x0001b_ctf/CTF-01.uf2` (Packaged UF2 image) + +For the remainder of this lesson, we assume you **only have `0x0001b_ctf/CTF-01.bin`**. + +--- + +## Part 3: Flashing and Connecting OpenOCD with Raw Binaries + +### Flashing a Raw Binary via OpenOCD + +When flashing an `.elf` file, OpenOCD reads target memory addresses directly from the ELF program headers. However, because a `.bin` file contains no header information, you **must explicitly specify the physical base address** ($0\text{x}10000000$ for RP2350 XIP flash). + +Open a PowerShell terminal in your repository root: + +```powershell +& "$env:USERPROFILE\.pico-sdk\openocd\0.12.0+dev\openocd.exe" ` + -s "$env:USERPROFILE\.pico-sdk\openocd\0.12.0+dev\scripts" ` + -f interface/cmsis-dap.cfg ` + -f target/rp2350.cfg ` + -c "adapter speed 5000; program 0x0001b_ctf/CTF-01.bin 0x10000000 verify reset exit" +``` + +Notice the crucial parameter: `0x10000000`. This instructs OpenOCD to write the binary bytes starting at the exact beginning of external flash memory. + +```text +** Programming Started ** +[rp2350.dap.core0] target halted due to debug-request +wrote 16384 bytes from file 0x0001b_ctf/CTF-01.bin in 0.412s +** Programming Finished ** +** Verify Started ** +verified 15920 bytes in 0.082s +** Verified OK ** +** Resetting Target ** +shutdown command invoked +``` + +### Starting OpenOCD as a Live Debug Server + +To debug the running firmware interactively, launch OpenOCD without the `exit` command. Keep this terminal open: + +```powershell +& "$env:USERPROFILE\.pico-sdk\openocd\0.12.0+dev\openocd.exe" ` + -s "$env:USERPROFILE\.pico-sdk\openocd\0.12.0+dev\scripts" ` + -f interface/cmsis-dap.cfg ` + -f target/rp2350.cfg ` + -c "adapter speed 5000; init" +``` + +OpenOCD initializes the SWD hardware connection and listens for GDB connections on TCP port `3333`. + +```text +Info : Hardware thread awareness created +Info : Listening on port 3333 for gdb connections +``` + +--- + +## Part 4: Dynamic Analysis in GDB Without an ELF + +Because we are analyzing a raw binary, we do not pass a file name to GDB on startup. + +Open a second terminal window: + +```powershell +arm-none-eabi-gdb +``` + +### Step 1: Set Target Architecture and Connect + +Inside the GDB prompt, tell GDB what processor architecture to expect, connect over TCP to OpenOCD, and immediately halt the processor: + +```gdb +set architecture armv8-m.main +target extended-remote :3333 +monitor reset halt +``` + +```text +The target architecture is assumed to be armv8-m.main +Remote debugging using :3333 +target halted due to debug-request, current mode: Thread +xPSR: 0x01000000 pc: 0x1000015a msp: 0x20082000 +``` + +### Step 2: Decode the Hardware Vector Table + +How did the CPU know to halt at `0x1000015a`? + +On ARM Cortex-M processors, the first entries of flash memory ($0\text{x}10000000$) define the **Vector Table**: +- **Word 0 ($0\text{x}10000000$)**: Initial Main Stack Pointer (`msp`). +- **Word 1 ($0\text{x}10000004$)**: Reset Vector (address of the first instruction to run upon reboot). + +Let's inspect the first four 32-bit words of flash using GDB's examine command (`x/4wx`): + +```gdb +x/4wx 0x10000000 +``` + +```text +0x10000000: 0x20082000 0x1000015b 0x1000011b 0x1000011d +``` + +Let's analyze what these words reveal: + +``` ++-----------------------------------------------------------------+ +| RP2350 Cortex-M33 Vector Table Decoding | +| | +| Address Value Meaning | +| 0x10000000: 0x20082000 Initial MSP (Top of 512KB SRAM) | +| 0x10000004: 0x1000015b Reset Vector (Thumb Execution Bit 0) | +| Execution begins at: 0x1000015a | ++-----------------------------------------------------------------+ +``` + +> [!NOTE] +> The Reset Vector value is `0x1000015b`. In ARM architecture, bit 0 indicates Thumb instruction mode ($0\text{x}1000015A + 1$). The processor automatically clears bit 0 and begins executing Thumb instructions at address `0x1000015a`. + +### Step 3: Why Symbolic Commands Fail + +If you try to use symbolic commands, GDB cannot help you: + +```gdb +break main +disassemble main +``` + +```text +No symbol table is loaded. Use the "file" command. +``` + +There are no symbols! To reverse engineer this firmware dynamically, we must navigate using **instruction addresses**. + +### Step 4: Disassemble by Address Range + +Disassemble 12 instructions starting at the Reset Handler address ($0\text{x}1000015A$): + +```gdb +x/12i 0x1000015a +``` + +```text +=> 0x1000015a: mov.w r0, #3489660928 ; 0xd0000000 (SIO base) + 0x1000015e: ldr r0, [r0, #0] ; SIO_CPUID (reads core id) + 0x10000160: cbz r0, 0x10000166 ; if Core 0, branch to init + 0x10000162: movs r0, #0 + 0x10000164: b.n 0x1000014e ; Core 1 sleeps + 0x10000166: add r4, pc, #52 ; loads init table pointer + 0x10000168: ldmia r4!, {r1, r2, r3} + 0x1000016a: cmp r1, #0 + 0x1000016c: beq.n 0x10000174 + 0x1000016e: bl 0x10000196 ; copy data section to SRAM + 0x10000172: b.n 0x10000168 + 0x10000174: ldr r1, [pc, #84] ; loads BSS bounds +``` + +Notice instruction `0x1000015a`: it immediately reads SIO register `0xd0000000` (`CPUID`) to check whether execution is occurring on Core 0 or Core 1! + +Now look further down the boot sequence at address `0x10000186`: + +```gdb +x/6i 0x10000184 +``` + +```text + 0x10000184: blx r1 + 0x10000186: ldr r1, [pc, #80] ; loads address from 0x100001d8 + 0x10000188: blx r1 ; calls main()! + 0x1000018a: ldr r1, [pc, #80] + 0x1000018c: blx r1 + 0x1000018e: bkpt 0x0000 +``` + +Inspect the pointer stored at `0x100001d8`: + +```gdb +x/wx 0x100001d8 +``` + +```text +0x100001d8: 0x100001e1 +``` + +Value `0x100001e1` is Thumb address $0\text{x}100001E0 + 1$. This reveals that **`main()` is located at address `0x100001e0`**! + +### Step 5: Setting Hardware Breakpoints on Flash Memory + +In RAM, GDB can set software breakpoints by temporarily replacing instructions with a breakpoint opcode (`bkpt`). However, external XIP flash ($0\text{x}10000000 - 0\text{x}1FFFFFFF$) is **read-only**. GDB cannot write to flash memory while the processor is running. + +Therefore, you must use **hardware breakpoints** (`hb`): + +```gdb +hb *0x100001e0 +continue +``` + +```text +Hardware assisted breakpoint 1 at 0x100001e0 +Continuing. + +Breakpoint 1, 0x100001e0 in ?? () +``` + +We are now stopped at the entry point of `main()` inside a completely stripped binary! + +Disassemble the instructions in `main()` from `0x100001e0` to `0x10000216`: + +```gdb +disassemble 0x100001e0, 0x10000216 +``` + +```text +Dump of assembler code from 0x100001e0 to 0x10000216: +=> 0x100001e0: push {r7, lr} + 0x100001e2: sub sp, #8 + 0x100001e4: bl 0x1000308c ; stdio_init_all() + 0x100001e8: ldr r3, [pc, #124] ; [0x10000268] -> 0x100037a0 (dispatch_frame) + 0x100001ea: ldr r2, [pc, #128] ; [0x1000026c] -> 0x200005d8 (grid_deviation) + 0x100001ec: ldrb r3, [r3, #0] ; retain_dispatch_frame(): reads dispatch_frame[0] ('W') + 0x100001ee: ldr r6, [pc, #128] ; [0x10000270] -> 0x20000844 (operator_state) + 0x100001f0: strb.w r3, [sp, #7] ; store frame_marker + 0x100001f4: ldrb.w r3, [sp, #7] ; reload frame_marker (volatile) + 0x100001f8: ldr r3, [r2, #0] ; evaluate_grid(): read grid_deviation (87) + 0x100001fa: ldr r5, [pc, #120] ; [0x10000274] -> 0x20000834 (dispatch_state) + 0x100001fc: cmp r3, #94 ; compare site A: if grid_deviation <= 94 + 0x100001fe: ite hi + 0x10000200: movhi r3, #0 + 0x10000202: movls r3, #1 + 0x10000204: str r3, [r6, #0] ; operator_state = 1 (STABLE) + 0x10000206: ldr r3, [r2, #0] ; read grid_deviation again + 0x10000208: ldr r0, [pc, #108] ; string pointer + 0x1000020a: cmp r3, #94 ; compare site B: if grid_deviation <= 94 + 0x1000020c: ite hi + 0x1000020e: movhi r3, #0 + 0x10000210: movls r3, #1 + 0x10000212: str r3, [r5, #0] ; dispatch_state = 1 (AUTHORIZED) + 0x10000214: bl 0x1000311c ; puts("GLOBAL EMBEDDED RESPONSE NETWORK") +End of assembler dump. +``` + +Notice what reverse engineering revealed right before our eyes: +- `0x100001e4`: `bl 0x1000308c` initializes UART0 serial communications. +- `0x100001e8`: Loads pointer `0x100037a0`. Inspecting `x/s 0x100037a0` reveals the secret token `"WORLDGRID:BLACKSTART:GRID-7:WATER-3"`! +- `0x100001fc` & `0x1000020a`: Both threshold checks compare `r3` against `#94` (`0x5e`). Because `grid_deviation` is $87$, $87 \le 94$, so both `operator_state` and `dispatch_state` are incorrectly set to $1$! + +### Step 6: The MMIO Blindness in Action + +Now step past `0x100001e4` (`stdio_init_all`) using `nexti` or `stepi`. + +In standard GDB, if you want to inspect what happened to UART0, you are forced to type raw hex addresses: + +```gdb +x/wx 0x40070018 +``` + +```text +0x40070018: 0x00000090 +``` + +What does `0x90` mean? +- Is the Transmit FIFO empty? +- Is the Receive FIFO full? +- Is the UART transmitter currently busy? +- What baud rate divisor was written to `0x40070024`? + +Standard GDB has no way to tell you. Let's fix that right now. + +--- + +## Part 5: Installing and Configuring CMSIS-SVD in GDB (PyCortexMDebug) + +### What is CMSIS-SVD? + +**CMSIS-SVD (Common Microcontroller Software Interface Standard - System View Description)** is an open XML specification developed by ARM. Silicon vendors publish an `.svd` file for every chip they manufacture. + +An SVD file contains a complete, machine-readable description of: +- Every peripheral on the chip +- Its physical base address +- Every register and offset +- Every bitfield, bitmask, access permission, and human-readable description + +``` ++-----------------------------------------------------------------+ +| CMSIS-SVD Hierarchy Tree | +| | +| Device: RP2350 | +| +-- Peripheral: UART0 (Base: 0x40070000) | +| | +-- Register: UARTDR (Offset: 0x000) | +| | +-- Register: UARTFR (Offset: 0x018) | +| | +-- Register: UARTIBRD (Offset: 0x024) | +| | +-- Register: UARTLCR_H (Offset: 0x02c) | +| +-- Peripheral: IO_BANK0 (Base: 0x40028000) | +| | +-- Register: GPIO0_CTRL (Offset: 0x004) -> UART0 TX | +| | +-- Register: GPIO1_CTRL (Offset: 0x00c) -> UART0 RX | +| +-- Peripheral: PADS_BANK0 (Base: 0x40038000) | +| | +-- Register: GPIO0 (Offset: 0x004) | +| +-- Peripheral: SIO (Base: 0xd0000000) | +| +-- Register: CPUID (Offset: 0x000) | ++-----------------------------------------------------------------+ +``` + +### Step 1: Obtain `rp2350.svd` + +A pre-downloaded copy of `rp2350.svd` is included directly in your course repository under `WEEK04/rp2350.svd`. You can also download the latest version directly from the official open-source `cmsis-svd-data` repository. + +Open a PowerShell terminal and create a dedicated `svd` directory in your user profile: + +```powershell +New-Item -ItemType Directory -Force -Path "$env:USERPROFILE\.svd" + +# Option A: Copy from local course folder +Copy-Item "WEEK04\rp2350.svd" "$env:USERPROFILE\.svd\rp2350.svd" + +# Option B: Download directly from GitHub +Invoke-WebRequest ` + -Uri "https://raw.githubusercontent.com/cmsis-svd/cmsis-svd-data/main/data/RaspberryPi/rp2350.svd" ` + -OutFile "$env:USERPROFILE\.svd\rp2350.svd" +``` + +Verify that the file is in place: + +```powershell +Get-Item "$env:USERPROFILE\.svd\rp2350.svd" +``` + +### Step 2: Install `PyCortexMDebug` + +`PyCortexMDebug` is an open-source Python extension for GDB created by Bill Nahill. It parses SVD XML files and exposes high-level peripheral inspection commands inside your GDB session. + +Clone the repository into your user profile: + +```powershell +cd "$env:USERPROFILE" +git clone https://github.com/bnahill/PyCortexMDebug.git +``` + +### Step 3: Load PyCortexMDebug in GDB + +In your active GDB session, load the Python script and parse `rp2350.svd`: + +```gdb +source ~/PyCortexMDebug/scripts/gdb.py +svd_load ~/.svd/rp2350.svd +``` + +```text +Loading SVD file /Users/username/.svd/rp2350.svd... +Loaded 52 peripherals +``` + +Just like that, GDB now understands every single register, offset, and bitfield on the RP2350 microcontroller! + +> [!TIP] +> You can automate this process so SVD support is always active. Add the following lines to your `~/.gdbinit` file: +> ```gdb +> source ~/PyCortexMDebug/scripts/gdb.py +> svd_load ~/.svd/rp2350.svd +> ``` + +--- + +## Part 6: Live Dynamic Peripheral Inspection & Manipulation in GDB + +Now that GDB is hardware-aware, let's explore what we can do on our stripped `CTF-01.bin` firmware without touching source code. + +### Command 1: List All On-Chip Peripherals + +Type `svd` with no arguments to list all 52 peripherals on the RP2350: + +```gdb +svd +``` + +```text +Available Peripherals: + ACCESSCTRL ADC BUSCTRL CLOCKS + DMA GLITCH_DETECTOR I2C0 I2C1 + IO_BANK0 IO_QSPI OTP PADS_BANK0 + PADS_QSPI PIX_RP2040 PIO0 PIO1 + PIO2 PLL_SYS PLL_USB POWMAN + PWM QMI RESETS ROSC + SHA256 SIO SPI0 SPI1 + SYSINFO SYSCFG TBMAN TICKS + TIMER0 TIMER1 TRNG UART0 + UART1 USB VREG_AND_CHIP_RESET WATCHDOG + XIP_AUX XIP_CTRL XIP_QMI XOSC +``` + +### Command 2: Inspect a Peripheral Live (`svd UART0`) + +Inspect the **UART0** peripheral. GDB automatically reads the physical hardware registers across SWD and displays their live state: + +```gdb +svd UART0 +``` + +```text +UART0 @ 0x40070000: + UARTDR : 0x00000000 + UARTRSR : 0x00000000 + UARTFR : 0x00000090 + UARTILPR : 0x00000000 + UARTIBRD : 0x00000043 + UARTFBRD : 0x00000035 + UARTLCR_H : 0x00000070 + UARTCR : 0x00000301 + UARTIFLS : 0x00000012 + UARTIMSC : 0x00000000 + UARTRIS : 0x00000000 + UARTMIS : 0x00000000 + UARTICR : 0x00000000 + UARTDMACR : 0x00000003 +``` + +Look at what this dump proves: +- `UARTIBRD` ($0\text{x}43 = 67$) and `UARTFBRD` ($0\text{x}35 = 53$): These are the exact integer and fractional divisors for $115200\text{ baud}$ with a $125\text{ MHz}$ reference clock! +- `UARTLCR_H = 0x00000070`: Bits 6:5 are `11` ($8\text{ data bits}$) and bit 4 is `1` (FIFOs enabled). +- `UARTCR = 0x00000301`: Bit 0 is `UARTEN` ($1$), Bit 8 is `TXE` (Transmit Enable), Bit 9 is `RXE` (Receive Enable). + +### Command 3: Decode Bitfields (`svd /r UART0 UARTFR`) + +Remember the mysterious `0x00000090` we saw when reading `0x40070018`? Let's use the `/r` (raw/register decode) flag to decode it: + +```gdb +svd /r UART0 UARTFR +``` + +```text +UART0.UARTFR @ 0x40070018: 0x00000090 + [7] TXFE : 1 (Transmit FIFO empty) + [6] RXFF : 0 (Receive FIFO full) + [5] TXFF : 0 (Transmit FIFO full) + [4] RXFE : 1 (Receive FIFO empty) + [3] BUSY : 0 (UART busy transmitting) + [2] DCD : 0 (Data carrier detect) + [1] DSR : 0 (Data set ready) + [0] CTS : 0 (Clear to send) +``` + +In a single command, GDB completely decoded the raw hardware byte into human-readable FIFO and serial transmission states! + +Now inspect the pin multiplexer for `GPIO0`: + +```gdb +svd /r IO_BANK0 GPIO0_CTRL +``` + +```text +IO_BANK0.GPIO0_CTRL @ 0x40028004: 0x00000002 + [4:0] FUNCSEL : 2 (Function 2: UART0 TX) +``` + +This verifies that `GPIO0` has been successfully multiplexed to function as the hardware `UART0 TX` pin. + +### Command 4: Live Hardware Manipulation via SWD (`svd /w`) + +You can also **write** to registers by name using `svd /w`. + +While the processor is halted in GDB, look at your physical Pico 2 hardware board. Let's toggle the LED or write to a register directly: + +```gdb +svd /w SIO GPIO_OUT_SET 0x00010000 +``` + +You have full, symbolic, hardware-level control over a running target directly through GDB without having an ELF file or compiling a single line of code. + +--- + +## Part 7: Transitioning to Static Analysis in Ghidra + +Dynamic analysis in GDB lets us verify hardware state while stepping through execution. However, to understand the overall architecture, algorithms, and logic of a stripped firmware binary, we must perform **static analysis in Ghidra**. + +### Step 1: Import the Stripped Binary into Ghidra + +1. Launch Ghidra: `ghidraRun` +2. Create a new project named `CTF-01` +3. Drag and drop `0x0001b_ctf/CTF-01.bin` into the Active Project window. +4. In the Import dialog: + - **Language**: Click `...`, search for `Cortex`, and select **ARM:LE:32:Cortex (default)**. + - Click **Options...**: + - Change **Block Name** to `.text` + - Change **Base Address** to `10000000` (XIP Flash base) + - Click **OK**, then click **OK** to complete the import. +5. Double-click the file to open the CodeBrowser. +6. When prompted to analyze, click **Yes**, accept default analyzers, and click **Analyze**. + +### Step 2: The Decompiler Before SVD (The Pointer Maze) + +Navigate to `main` at address `0x100001E0` in the Ghidra decompiler. + +Before adding SVD support, the decompiler output looks like this: + +```c +void FUN_100001e0(void) +{ + byte extraout_DL; + + FUN_1000308c(); + FUN_1000311c(DAT_10000278); + FUN_1000311c(DAT_1000027c); + FUN_1000311c(DAT_10000280); + FUN_1000311c(DAT_10000284); + FUN_10003218(DAT_10000288); + do { + FUN_10003218(DAT_10000294,extraout_DL); + FUN_10003218(DAT_100002a0,extraout_DL); + FUN_1000311c(DAT_100002a4); + FUN_10003218(DAT_10000288); + FUN_10000cc4(1000); + } while( true ); +} +``` + +Now navigate to subroutine `FUN_100002a8` (`gpio_set_function`): + +```c +void FUN_100002a8(uint param_1, uint param_2) +{ + *(uint *)(0x40038000 + param_1 * 4 + 4) = + *(uint *)(0x40038000 + param_1 * 4 + 4) & 0xffffff7f | 0x40; + *(uint *)(0x40028000 + param_1 * 8 + 4) = param_2; + return; +} +``` + +Look at that decompilation: +- `*(uint *)(0x40038000 + param_1 * 4 + 4)` +- `*(uint *)(0x40028000 + param_1 * 8 + 4) = param_2` + +Ghidra doesn't know that `0x40038000` is `PADS_BANK0`, nor that `0x40028000` is `IO_BANK0`. In fact, if you double-click `0x40038000`, Ghidra warns that the address is **unmapped** because the `.bin` import only created a memory block for flash ($0\text{x}10000000$). + +--- + +## Part 8: Installing and Running SVD-Loader in Ghidra + +### Step 1: Install SVD-Loader-Ghidra + +`SVD-Loader-Ghidra` is an open-source Ghidra script created by Leveldown Security. It parses CMSIS-SVD files and automatically reconstructs microcontroller memory maps and data structures inside Ghidra. + +Open a PowerShell terminal and clone the repository: + +```powershell +cd "$env:USERPROFILE" +git clone https://github.com/leveldown-security/SVD-Loader-Ghidra.git +``` + +> [!IMPORTANT] +> **Ghidra 11/12+ Runtime Compatibility Fix (`#@runtime Jython`):** +> Modern Ghidra versions default to `PyGhidra` (CPython 3) for `.py` scripts. If Ghidra was not launched via `pyghidraRun`, running `SVD-Loader.py` will fail with: +> `Unable to load script: SVD-Loader.py - detail: Ghidra was not started with PyGhidra. Python is not available` +> +> `SVD-Loader` was developed for Ghidra's built-in **Jython** interpreter. To instruct Ghidra to use the built-in Jython engine, ensure `#@runtime Jython` is present at the top of `SVD-Loader.py`: +> ```python +> # Load specified SVD and generate peripheral memory maps & structures. +> #@runtime Jython +> #@author Thomas Roth , Ryan Pavlik +> ``` +> *(You can add this line using any text editor, or in Ghidra by right-clicking `SVD-Loader.py` in the Script Manager and selecting **Edit with basic editor**).* + +### Step 2: Add the Script to Ghidra Script Manager + +1. In Ghidra's CodeBrowser, open the **Script Manager**: + - Go to menu **Window** -> **Script Manager** (or click the **Script Manager** toolbar icon). + +> [!NOTE] +> **Script Manager Toolbar Icons Explained:** +> - **New Script (White Paper Icon):** To create a new script from scratch directly in Ghidra, you click the **piece of white paper** ("Create New Script") icon on the toolbar. Ghidra then prompts you to choose the script type: **`PyGhidra`** (Python 3 in Ghidra 11+), **`Java`**, or **`Jython`** (Python 2.7). +> - **Manage Script Directories (Folder with List Icon):** Because `SVD-Loader` is an existing multi-file package that relies on the bundled `cmsis_svd` parser library, we do not need to create a blank script. Instead, we register its cloned directory. + +2. In the top-right toolbar of the Script Manager window, click the **Manage Script Directories** icon (looks like a small folder with a list). +3. In the "Ghidra Script Directories / Bundle Manager" window that appears, click the **Display file chooser to add bundles to list** icon (the green `+` / folder icon on the top right). +4. Browse to and select your cloned directory: + `C:\Users\\SVD-Loader-Ghidra` +5. Click **OK** / **Select**, then close the Script Directories window. + +*(Alternatively, you can copy both `SVD-Loader.py` and the `cmsis_svd` folder directly into your default `~/ghidra_scripts` or `C:\Users\\ghidra_scripts` directory, which Ghidra discovers automatically).* + +### Step 3: Run SVD-Loader + +1. In the Script Manager search filter box, type: `SVD` +2. Locate **`SVD-Loader.py`** in the list. +3. Check the checkbox in the **In Tool** column next to `SVD-Loader.py`. This binds `SVD-Loader` directly to your CodeBrowser toolbar and menu for convenient access! +4. Select `SVD-Loader.py` and click the green **Run Script** button in the top right (or double-click the script entry). +5. A file picker dialog opens: + - Navigate to: `C:\Users\\.svd\rp2350.svd` + - Click **Open**. + +``` ++-----------------------------------------------------------------+ +| What SVD-Loader Does Automatically in Ghidra | +| | +| 1. Memory Blocks: Creates mapped, volatile memory blocks for | +| UART0, IO_BANK0, PADS_BANK0, SIO, CLOCKS, and RESETS. | +| 2. Symbol Labels: Creates global symbol labels at the exact | +| address of every register (e.g., UART0_UARTFR). | +| 3. C Structs: Generates full peripheral data structures in | +| the Data Type Manager (e.g., struct UART0_Type). | ++-----------------------------------------------------------------+ +``` + +Check the Ghidra Console window at the bottom of the screen. You will see: + +```text +Loaded SVD: rp2350.svd +Created peripheral block: SIO at 0xd0000000 (size: 0x1000) +Created peripheral block: PADS_BANK0 at 0x40038000 (size: 0x1000) +Created peripheral block: IO_BANK0 at 0x40028000 (size: 0x1000) +Created peripheral block: UART0 at 0x40070000 (size: 0x1000) +... +Successfully imported all peripherals! +``` + +### Step 4: Re-Run Auto-Analysis to Propagate References + +When you initially imported `CTF-01.bin`, Ghidra performed auto-analysis against only the initial Flash block ($0\text{x}10000000$). Now that `SVD-Loader.py` has created all 52 on-chip peripheral memory blocks, re-run analysis so Ghidra evaluates references against the newly created regions: + +1. Click menu **Analysis** -> **Auto Analyze 'CTF-01.bin'...** (or press keyboard shortcut **`A`**). +2. Ensure **Reference**, **Subroutine References**, and **Constant Reference Analyzer** are enabled. +3. Click **Analyze**. + +--- + +## Part 9: Decompiler Transformation: Before and After + +Now that the SVD structures are loaded, let's examine subroutine `FUN_100002a8` (`gpio_set_function`) again. + +### Side-by-Side Decompilation Comparison + +``` ++-----------------------------------------------------------------+ +| Decompilation of gpio_set_function() | +| | +| BEFORE SVD-Loader: | +| void FUN_100002a8(uint param_1, uint param_2) | +| { | +| *(uint *)(0x40038000 + param_1 * 4 + 4) = | +| *(uint *)(0x40038000 + param_1 * 4 + 4) & 0xffffff7f | +| | 0x40; | +| *(uint *)(0x40028000 + param_1 * 8 + 4) = param_2; | +| return; | +| } | +| | +| AFTER SVD-Loader: | +| void gpio_set_function(uint gpio, uint fn) | +| { | +| PADS_BANK0->GPIO[gpio] = | +| (PADS_BANK0->GPIO[gpio] & ~PADS_BANK0_OD) | +| | PADS_BANK0_IE; | +| IO_BANK0->GPIO[gpio].CTRL = fn; /* 2 = UART0 */ | +| return; | +| } | ++-----------------------------------------------------------------+ +``` + +Look at the difference: +1. **`*(uint *)(0x40038000 + param_1 * 4 + 4)`** is recognized as indexing into `PADS_BANK0` electrical pad controls. +2. **`& 0xffffff7f | 0x40`** is clearly revealed as clearing the `OD` (Output Disable) bit and setting the `IE` (Input Enable) bit. +3. **`*(uint *)(0x40028000 + param_1 * 8 + 4) = param_2`** immediately resolves in Ghidra's decompiler to: + ```c + (&Peripherals::IO_BANK0.GPIO0_CTRL)[param_1 * 2] = param_2; + ``` + **Why `[param_1 * 2]`?** In RP2350's `IO_BANK0`, each GPIO pin has two 32-bit registers (8 bytes total): `GPIOx_STATUS` (offset $+0$) and `GPIOx_CTRL` (offset $+4$). Because `GPIO0_CTRL` is a pointer to a 4-byte `uint32_t`, indexing by `[param_1 * 2]` steps forward by $2 \times 4\text{ bytes} = 8\text{ bytes}$ per pin, landing directly on each pin's `CTRL` register to assign `param_2` ($2$ for `UART0`)! + +> [!NOTE] +> **Understanding Assembly Listing vs. Decompiler Resolution:** +> You may notice that in the raw disassembly Listing view, line `100002be` still appears as: +> ```assembly +> 100002be 00 f1 80 40 add.w r0, r0, #0x40000000 +> ``` +> Why does `#0x40000000` not resolve to a peripheral label here? +> - **Arithmetic Immediates vs. Memory Operands:** `add.w` is an ALU integer addition, not a load or store instruction. In assembly listings, immediate scalar constants remain literal numbers. +> - **Intermediate Math vs. Target Address:** $0\text{x}40000000$ is the APB/AHB bridge base. The actual peripheral register address ($0\text{x}40028004$ for `IO_BANK0_GPIO0_CTRL`) is calculated dynamically at runtime by adding the pin index offset ($gpio \times 8$), bridge base ($0\text{x}40000000$), peripheral offset ($0\text{x}28000$), and register offset ($+4$). +> - **Where Resolution Appears:** Ghidra resolves this in the **Decompiler window** via data-flow analysis, and in the Listing window as **XREF** annotations on the subsequent `str`/`ldr` instructions that dereference the calculated pointer. If you want `#0x40000000` to show a name in the Listing, right-click the number and select **Set Equate...** (press **`E`**) to label it `PERIPHERALS_BASE`. + +### Exploring Structs in the Data Type Manager + +In Ghidra's **Data Type Manager** panel (bottom-left): +1. Expand the tree node for `CTF-01.bin`. +2. Expand the `rp2350.svd` category. +3. Locate **`UART0_Type`**: + - Double-click `UART0_Type` to open Ghidra's Structure Editor. + - You can see every field, its byte offset, and its data type: + - `0x000`: `UARTDR` (`uint32_t`) + - `0x018`: `UARTFR` (`uint32_t`) + - `0x024`: `UARTIBRD` (`uint32_t`) + - `0x028`: `UARTFBRD` (`uint32_t`) + - `0x02c`: `UARTLCR_H` (`uint32_t`) + - `0x030`: `UARTCR` (`uint32_t`) + +You can apply these struct types to any pointer in Ghidra by right-clicking a variable in the decompiler and selecting **Retype Variable** -> `UART0_Type *`. + +--- + +## Part 10: The Complete Hardware-Aware Reverse Engineering Workflow + +By combining SVD in both GDB and Ghidra, you achieve a seamless reverse engineering loop: + +``` ++-----------------------------------------------------------------+ +| The Hardware-Aware Reverse Engineering Loop | +| | +| +-----------------------------------------------------------+ | +| | 1. GHIDRA (Static Analysis + rp2350.svd) | | +| | - Identifies functions, call graph, and MMIO | | +| | - Pinpoints exact register addresses to watch | | +| +-----------------------------------------------------------+ | +| | | +| v | +| +-----------------------------------------------------------+ | +| | 2. GDB + OpenOCD (Dynamic Analysis + rp2350.svd) | | +| | - Sets hardware breakpoint (hb *0x100001e0) | | +| | - Steps through instructions with si / ni | | +| | - Inspects peripheral bitfields live (svd /r) | | +| +-----------------------------------------------------------+ | +| | | +| v | +| +-----------------------------------------------------------+ | +| | 3. LIVE HARDWARE INTERACTION | | +| | - Validates UART console telemetry (115200 8N1) | | +| | - Proves binary patches on physical silicon | | +| +-----------------------------------------------------------+ | ++-----------------------------------------------------------------+ +``` + +### Applying the Loop to Solve CTF-01 + +1. **Locate Defects via Ghidra Static Analysis**: + - In `main()` ($0\text{x}100001E0$), identify Compare Site A at $0\text{x}100001FC$ (`cmp r3, #94`) and Compare Site B at $0\text{x}1000020A$ (`cmp r3, #94`). + - Notice that while $0.87\text{ Hz}$ is dangerously high, it passes because $87 \le 94$. + - To enforce the $0.60\text{ Hz}$ safety limit, $x < 60$ is equivalent to $x \le 59$. The comparison immediate must be patched from `0x5E` ($94$) to `0x3B` ($59$). +2. **Locate the Quarantined Flag in Flash**: + - Trace the pointer loaded at address $0\text{x}100001E8$ to address $0\text{x}100037A0$. + - Inspecting that memory reveals the token: `"WORLDGRID:BLACKSTART:GRID-7:WATER-3"`. +3. **Patch and Export in Ghidra**: + - Use the **Bytes Window** workflow to prevent ARM Thumb IT-block context conflicts: + 1. Open the Bytes window (**Window** -> **Bytes: CTF-01.bin**). + 2. In the Bytes window toolbar, click the **pencil icon** (**Toggle Edit Mode**). + 3. In the Listing window, click `0x100001FC` and press **`C`** (**Clear Code Bytes**). + 4. In the Bytes window at offset `100001fc`, click on byte `5E` and change it to **`3B`**. + 5. In the Listing window, click back on `0x100001FC` and press **`D`** (**Disassemble**). + 6. Repeat at `0x1000020A`: click `0x1000020A` in the Listing, press **`C`**, change `5E` to **`3B`** in the Bytes window, click back in the Listing, and press **`D`**. + - Export the patched binary as `CTF-01_fixed.bin` via **File** -> **Export Program** -> **Format**: **Raw Bytes**. +4. **Verify on Live Hardware via OpenOCD & GDB**: + - Flash the patched binary to the Pico 2. + - Attach your USB-UART adapter to GPIO 0 (TX) and GPIO 1 (RX) at 115200 baud. + - Observe the corrected, truthful telemetry: + ```text + GRID STATUS: CRITICAL + DISPATCH PATH: HELD + LAST FRAME: QUARANTINED + RESPONSE> + ``` + +--- + +## Part 11: Summary, Cheatsheets & Review + +### GDB Raw Binary Debugging Cheatsheet + +| Task | Command | Description | +| :--- | :--- | :--- | +| Set Architecture | `set architecture armv8-m.main` | Configures GDB for ARM Cortex-M33 cores. | +| Connect to OpenOCD | `target extended-remote :3333` | Connects to OpenOCD debug server. | +| Reset & Halt | `monitor reset halt` | Sends reset signal and halts CPU at vector table. | +| Read Vector Table | `x/4wx 0x10000000` | Displays Initial Stack Pointer and Reset Vector. | +| Disassemble at PC | `x/10i $pc` | Disassembles 10 instructions at current Program Counter. | +| Disassemble Range | `disassemble 0x100001e0, 0x10000216` | Disassembles instructions between two hex addresses. | +| Hardware Breakpoint| `hb *0x100001e0` | Sets hardware breakpoint on read-only flash memory. | +| Read Memory Word | `x/wx 0x40070018` | Reads one 32-bit hexadecimal word from memory. | +| Write Memory Word | `set *0xd0000014 = 0x10000` | Writes 32-bit value directly to memory address. | + +### PyCortexMDebug SVD Cheatsheet + +| Task | Command | Description | +| :--- | :--- | :--- | +| Load Plugin | `source ~/PyCortexMDebug/scripts/gdb.py` | Imports PyCortexMDebug into GDB Python engine. | +| Load SVD File | `svd_load ~/.svd/rp2350.svd` | Parses chip peripheral XML definition. | +| List Peripherals | `svd` | Lists all on-chip hardware peripheral blocks. | +| Dump Peripheral | `svd UART0` | Reads and displays all registers in a peripheral. | +| Decode Bitfields | `svd /r UART0 UARTFR` | Decodes individual bitfields and named flags. | +| Write Register | `svd /w SIO GPIO_OUT_SET 0x10000` | Writes to peripheral register by symbolic name. | + +### RP2350 Peripheral Memory Map Quick Reference + +| Peripheral | Base Address | Size | Primary Purpose | +| :--- | :--- | :--- | :--- | +| `XIP_FLASH` | `0x10000000` | Up to 16MB | External QSPI Flash execution memory | +| `SRAM` | `0x20000000` | 512KB | On-chip data memory (stack, heap, `.data`, `.bss`) | +| `RESETS` | `0x40020000` | 4KB | Subsystem reset controller | +| `IO_BANK0` | `0x40028000` | 4KB | GPIO pin function multiplexing (`FUNCSEL`) | +| `PADS_BANK0`| `0x40038000` | 4KB | Electrical drive strength, pulls, and enables | +| `UART0` | `0x40070000` | 4KB | Serial communication interface 0 (115200 8N1) | +| `UART1` | `0x40078000` | 4KB | Serial communication interface 1 | +| `SIO` | `0xd0000000` | 4KB | Single-cycle I/O fast GPIO controls | + +--- + +## Key Takeaways + +1. **A raw `.bin` is not an ELF**: It has no headers, no symbols, and no entry point metadata. You must supply the base address ($0\text{x}10000000$) when flashing and debug using explicit addresses. +2. **Flash requires hardware breakpoints**: External flash is read-only during execution. Always use `hb *address` instead of software breakpoints (`b`). +3. **The Vector Table tells all**: Even without symbols, `x/4wx 0x10000000` gives you the initial stack pointer and the reset vector within seconds. +4. **SVD bridges the hardware gap**: CMSIS-SVD turns raw hexadecimal registers into named peripherals, registers, and bitfields across both GDB and Ghidra. +5. **GDB handles live dynamic manipulation**: `PyCortexMDebug` lets you inspect peripheral registers live, decode bitfields with `svd /r`, and toggle pins directly over SWD using `svd /w`. +6. **Ghidra handles static comprehension**: `SVD-Loader-Ghidra` creates mapped memory blocks and C structs, converting raw pointer arithmetic into readable code. +7. **Arithmetic instructions remain arithmetic**: Instructions like `add.w r0, r0, #0x40000000` calculate base addresses across multiple steps; resolution appears in the decompiler and at the load/store instructions that dereference the address. + +--- + +## Glossary + +| Term | Definition | +| :--- | :--- | +| **CMSIS-SVD** | Cortex Microcontroller Software Interface Standard - System View Description; an XML format describing microcontroller hardware peripherals. | +| **DWARF** | Standardized debugging data format embedded in ELF binaries that maps machine code to source code lines and symbols. | +| **Hardware Breakpoint (`hb`)** | A breakpoint implemented using dedicated CPU comparator registers, required for debugging code in read-only flash memory. | +| **MMIO** | Memory-Mapped Input/Output; a hardware architecture where peripheral registers are mapped into the CPU's regular memory address space. | +| **MSP** | Main Stack Pointer; the primary ARM Cortex-M stack pointer register. | +| **OpenOCD** | Open On-Chip Debugger; a software bridge that connects GDB to physical hardware via a Debug Probe. | +| **PyCortexMDebug** | A GDB Python extension that parses SVD files to provide live peripheral inspection and register manipulation. | +| **Reset Vector** | The address stored at offset $0\text{x}00000004$ in the vector table that points to the first instruction executed upon CPU reset. | +| **SIO** | Single-Cycle I/O; a dedicated RP2350 hardware block providing zero-wait-state GPIO manipulation. | +| **SVD-Loader** | A Ghidra script that imports SVD files to create memory blocks, symbol labels, and C structs for decompilation. | +| **SWD** | Serial Wire Debug; a two-wire physical debug protocol (SWCLK, SWDIO) used to debug ARM microcontrollers. | +| **UART** | Universal Asynchronous Receiver-Transmitter; a physical hardware communication protocol used for serial data transfer. | +| **XIP** | eXecute In Place; running code directly from external flash memory without copying it to RAM first. | + +*** + +Happy Hacking! diff --git a/WEEK04/WEEK04a.pdf b/WEEK04/WEEK04a.pdf new file mode 100644 index 0000000..3010e21 Binary files /dev/null and b/WEEK04/WEEK04a.pdf differ diff --git a/WEEK04/rp2350.svd b/WEEK04/rp2350.svd new file mode 100644 index 0000000..aa2c362 --- /dev/null +++ b/WEEK04/rp2350.svd @@ -0,0 +1,105849 @@ + + + + Raspberry Pi + RP2350 + RP + 0.1 + + Dual Cortex-M33 or Hazard3 processors at 150MHz + 520kB on-chip SRAM, in 10 independent banks + Extended low-power sleep states with optional SRAM retention: as low as 10uA DVDD + 8kB of one-time-programmable storage (OTP) + Up to 16MB of external QSPI flash/PSRAM via dedicated QSPI bus + Additional 16MB flash/PSRAM accessible via optional second chip-select + On-chip switched-mode power supply to generate core voltage + Low-quiescent-current LDO mode can be enabled for sleep states + 2x on-chip PLLs for internal or external clock generation + GPIOs are 5V-tolerant (powered), and 3.3V-failsafe (unpowered) + Security features: + Optional boot signing, enforced by on-chip mask ROM, with key fingerprint in OTP + Protected OTP storage for optional boot decryption key + Global bus filtering based on Arm or RISC-V security/privilege levels + Peripherals, GPIOs and DMA channels individually assignable to security domains + Hardware mitigations for fault injection attacks + Hardware SHA-256 accelerator + Peripherals: + 2x UARTs + 2x SPI controllers + 2x I2C controllers + 24x PWM channels + USB 1.1 controller and PHY, with host and device support + 12x PIO state machines + 1x HSTX peripheral + + 32 + 32 + 0xffffffff + 0x00000000 + read-write + + Copyright (c) 2024 Raspberry Pi Ltd. + + SPDX-License-Identifier: BSD-3-Clause + + + CM33 + r1p0 + little + true + true + 8 + 4 + 1 + 1 + false + 52 + + 8 + + + RESETS + 0x40020000 + + 0 + 12 + registers + + + + RESET + 0x00000000 + 0x1fffffff + + + USBCTRL + [28:28] + read-write + + + UART1 + [27:27] + read-write + + + UART0 + [26:26] + read-write + + + TRNG + [25:25] + read-write + + + TIMER1 + [24:24] + read-write + + + TIMER0 + [23:23] + read-write + + + TBMAN + [22:22] + read-write + + + SYSINFO + [21:21] + read-write + + + SYSCFG + [20:20] + read-write + + + SPI1 + [19:19] + read-write + + + SPI0 + [18:18] + read-write + + + SHA256 + [17:17] + read-write + + + PWM + [16:16] + read-write + + + PLL_USB + [15:15] + read-write + + + PLL_SYS + [14:14] + read-write + + + PIO2 + [13:13] + read-write + + + PIO1 + [12:12] + read-write + + + PIO0 + [11:11] + read-write + + + PADS_QSPI + [10:10] + read-write + + + PADS_BANK0 + [9:9] + read-write + + + JTAG + [8:8] + read-write + + + IO_QSPI + [7:7] + read-write + + + IO_BANK0 + [6:6] + read-write + + + I2C1 + [5:5] + read-write + + + I2C0 + [4:4] + read-write + + + HSTX + [3:3] + read-write + + + DMA + [2:2] + read-write + + + BUSCTRL + [1:1] + read-write + + + ADC + [0:0] + read-write + + + + + WDSEL + 0x00000004 + 0x00000000 + + + USBCTRL + [28:28] + read-write + + + UART1 + [27:27] + read-write + + + UART0 + [26:26] + read-write + + + TRNG + [25:25] + read-write + + + TIMER1 + [24:24] + read-write + + + TIMER0 + [23:23] + read-write + + + TBMAN + [22:22] + read-write + + + SYSINFO + [21:21] + read-write + + + SYSCFG + [20:20] + read-write + + + SPI1 + [19:19] + read-write + + + SPI0 + [18:18] + read-write + + + SHA256 + [17:17] + read-write + + + PWM + [16:16] + read-write + + + PLL_USB + [15:15] + read-write + + + PLL_SYS + [14:14] + read-write + + + PIO2 + [13:13] + read-write + + + PIO1 + [12:12] + read-write + + + PIO0 + [11:11] + read-write + + + PADS_QSPI + [10:10] + read-write + + + PADS_BANK0 + [9:9] + read-write + + + JTAG + [8:8] + read-write + + + IO_QSPI + [7:7] + read-write + + + IO_BANK0 + [6:6] + read-write + + + I2C1 + [5:5] + read-write + + + I2C0 + [4:4] + read-write + + + HSTX + [3:3] + read-write + + + DMA + [2:2] + read-write + + + BUSCTRL + [1:1] + read-write + + + ADC + [0:0] + read-write + + + + + RESET_DONE + 0x00000008 + 0x00000000 + + + USBCTRL + [28:28] + read-only + + + UART1 + [27:27] + read-only + + + UART0 + [26:26] + read-only + + + TRNG + [25:25] + read-only + + + TIMER1 + [24:24] + read-only + + + TIMER0 + [23:23] + read-only + + + TBMAN + [22:22] + read-only + + + SYSINFO + [21:21] + read-only + + + SYSCFG + [20:20] + read-only + + + SPI1 + [19:19] + read-only + + + SPI0 + [18:18] + read-only + + + SHA256 + [17:17] + read-only + + + PWM + [16:16] + read-only + + + PLL_USB + [15:15] + read-only + + + PLL_SYS + [14:14] + read-only + + + PIO2 + [13:13] + read-only + + + PIO1 + [12:12] + read-only + + + PIO0 + [11:11] + read-only + + + PADS_QSPI + [10:10] + read-only + + + PADS_BANK0 + [9:9] + read-only + + + JTAG + [8:8] + read-only + + + IO_QSPI + [7:7] + read-only + + + IO_BANK0 + [6:6] + read-only + + + I2C1 + [5:5] + read-only + + + I2C0 + [4:4] + read-only + + + HSTX + [3:3] + read-only + + + DMA + [2:2] + read-only + + + BUSCTRL + [1:1] + read-only + + + ADC + [0:0] + read-only + + + + + + + PSM + 0x40018000 + + 0 + 16 + registers + + + + FRCE_ON + 0x00000000 + Force block out of reset (i.e. power it on) + 0x00000000 + + + PROC1 + [24:24] + read-write + + + PROC0 + [23:23] + read-write + + + ACCESSCTRL + [22:22] + read-write + + + SIO + [21:21] + read-write + + + XIP + [20:20] + read-write + + + SRAM9 + [19:19] + read-write + + + SRAM8 + [18:18] + read-write + + + SRAM7 + [17:17] + read-write + + + SRAM6 + [16:16] + read-write + + + SRAM5 + [15:15] + read-write + + + SRAM4 + [14:14] + read-write + + + SRAM3 + [13:13] + read-write + + + SRAM2 + [12:12] + read-write + + + SRAM1 + [11:11] + read-write + + + SRAM0 + [10:10] + read-write + + + BOOTRAM + [9:9] + read-write + + + ROM + [8:8] + read-write + + + BUSFABRIC + [7:7] + read-write + + + PSM_READY + [6:6] + read-write + + + CLOCKS + [5:5] + read-write + + + RESETS + [4:4] + read-write + + + XOSC + [3:3] + read-write + + + ROSC + [2:2] + read-write + + + OTP + [1:1] + read-write + + + PROC_COLD + [0:0] + read-write + + + + + FRCE_OFF + 0x00000004 + Force into reset (i.e. power it off) + 0x00000000 + + + PROC1 + [24:24] + read-write + + + PROC0 + [23:23] + read-write + + + ACCESSCTRL + [22:22] + read-write + + + SIO + [21:21] + read-write + + + XIP + [20:20] + read-write + + + SRAM9 + [19:19] + read-write + + + SRAM8 + [18:18] + read-write + + + SRAM7 + [17:17] + read-write + + + SRAM6 + [16:16] + read-write + + + SRAM5 + [15:15] + read-write + + + SRAM4 + [14:14] + read-write + + + SRAM3 + [13:13] + read-write + + + SRAM2 + [12:12] + read-write + + + SRAM1 + [11:11] + read-write + + + SRAM0 + [10:10] + read-write + + + BOOTRAM + [9:9] + read-write + + + ROM + [8:8] + read-write + + + BUSFABRIC + [7:7] + read-write + + + PSM_READY + [6:6] + read-write + + + CLOCKS + [5:5] + read-write + + + RESETS + [4:4] + read-write + + + XOSC + [3:3] + read-write + + + ROSC + [2:2] + read-write + + + OTP + [1:1] + read-write + + + PROC_COLD + [0:0] + read-write + + + + + WDSEL + 0x00000008 + Set to 1 if the watchdog should reset this + 0x00000000 + + + PROC1 + [24:24] + read-write + + + PROC0 + [23:23] + read-write + + + ACCESSCTRL + [22:22] + read-write + + + SIO + [21:21] + read-write + + + XIP + [20:20] + read-write + + + SRAM9 + [19:19] + read-write + + + SRAM8 + [18:18] + read-write + + + SRAM7 + [17:17] + read-write + + + SRAM6 + [16:16] + read-write + + + SRAM5 + [15:15] + read-write + + + SRAM4 + [14:14] + read-write + + + SRAM3 + [13:13] + read-write + + + SRAM2 + [12:12] + read-write + + + SRAM1 + [11:11] + read-write + + + SRAM0 + [10:10] + read-write + + + BOOTRAM + [9:9] + read-write + + + ROM + [8:8] + read-write + + + BUSFABRIC + [7:7] + read-write + + + PSM_READY + [6:6] + read-write + + + CLOCKS + [5:5] + read-write + + + RESETS + [4:4] + read-write + + + XOSC + [3:3] + read-write + + + ROSC + [2:2] + read-write + + + OTP + [1:1] + read-write + + + PROC_COLD + [0:0] + read-write + + + + + DONE + 0x0000000c + Is the subsystem ready? + 0x00000000 + + + PROC1 + [24:24] + read-only + + + PROC0 + [23:23] + read-only + + + ACCESSCTRL + [22:22] + read-only + + + SIO + [21:21] + read-only + + + XIP + [20:20] + read-only + + + SRAM9 + [19:19] + read-only + + + SRAM8 + [18:18] + read-only + + + SRAM7 + [17:17] + read-only + + + SRAM6 + [16:16] + read-only + + + SRAM5 + [15:15] + read-only + + + SRAM4 + [14:14] + read-only + + + SRAM3 + [13:13] + read-only + + + SRAM2 + [12:12] + read-only + + + SRAM1 + [11:11] + read-only + + + SRAM0 + [10:10] + read-only + + + BOOTRAM + [9:9] + read-only + + + ROM + [8:8] + read-only + + + BUSFABRIC + [7:7] + read-only + + + PSM_READY + [6:6] + read-only + + + CLOCKS + [5:5] + read-only + + + RESETS + [4:4] + read-only + + + XOSC + [3:3] + read-only + + + ROSC + [2:2] + read-only + + + OTP + [1:1] + read-only + + + PROC_COLD + [0:0] + read-only + + + + + + + CLOCKS + 0x40010000 + + 0 + 212 + registers + + + CLOCKS_IRQ + 30 + + + + CLK_GPOUT0_CTRL + 0x00000000 + Clock control, can be changed on-the-fly (except for auxsrc) + 0x00000000 + + + ENABLED + clock generator is enabled + [28:28] + read-only + + + NUDGE + An edge on this signal shifts the phase of the output by 1 cycle of the input clock + This can be done at any time + [20:20] + read-write + + + PHASE + This delays the enable signal by up to 3 cycles of the input clock + This must be set before the clock is enabled to have any effect + [17:16] + read-write + + + DC50 + Enables duty cycle correction for odd divisors, can be changed on-the-fly + [12:12] + read-write + + + ENABLE + Starts and stops the clock generator cleanly + [11:11] + read-write + + + KILL + Asynchronously kills the clock generator, enable must be set low before deasserting kill + [10:10] + read-write + + + AUXSRC + Selects the auxiliary clock source, will glitch when switching + [8:5] + read-write + + + clksrc_pll_sys + 0 + + + clksrc_gpin0 + 1 + + + clksrc_gpin1 + 2 + + + clksrc_pll_usb + 3 + + + clksrc_pll_usb_primary_ref_opcg + 4 + + + rosc_clksrc + 5 + + + xosc_clksrc + 6 + + + lposc_clksrc + 7 + + + clk_sys + 8 + + + clk_usb + 9 + + + clk_adc + 10 + + + clk_ref + 11 + + + clk_peri + 12 + + + clk_hstx + 13 + + + otp_clk2fc + 14 + + + + + + + CLK_GPOUT0_DIV + 0x00000004 + 0x00010000 + + + INT + Integer part of clock divisor, 0 -> max+1, can be changed on-the-fly + [31:16] + read-write + + + FRAC + Fractional component of the divisor, can be changed on-the-fly + [15:0] + read-write + + + + + CLK_GPOUT0_SELECTED + 0x00000008 + Indicates which src is currently selected (one-hot) + 0x00000001 + + + CLK_GPOUT0_SELECTED + This slice does not have a glitchless mux (only the AUX_SRC field is present, not SRC) so this register is hardwired to 0x1. + [0:0] + read-only + + + + + CLK_GPOUT1_CTRL + 0x0000000c + Clock control, can be changed on-the-fly (except for auxsrc) + 0x00000000 + + + ENABLED + clock generator is enabled + [28:28] + read-only + + + NUDGE + An edge on this signal shifts the phase of the output by 1 cycle of the input clock + This can be done at any time + [20:20] + read-write + + + PHASE + This delays the enable signal by up to 3 cycles of the input clock + This must be set before the clock is enabled to have any effect + [17:16] + read-write + + + DC50 + Enables duty cycle correction for odd divisors, can be changed on-the-fly + [12:12] + read-write + + + ENABLE + Starts and stops the clock generator cleanly + [11:11] + read-write + + + KILL + Asynchronously kills the clock generator, enable must be set low before deasserting kill + [10:10] + read-write + + + AUXSRC + Selects the auxiliary clock source, will glitch when switching + [8:5] + read-write + + + clksrc_pll_sys + 0 + + + clksrc_gpin0 + 1 + + + clksrc_gpin1 + 2 + + + clksrc_pll_usb + 3 + + + clksrc_pll_usb_primary_ref_opcg + 4 + + + rosc_clksrc + 5 + + + xosc_clksrc + 6 + + + lposc_clksrc + 7 + + + clk_sys + 8 + + + clk_usb + 9 + + + clk_adc + 10 + + + clk_ref + 11 + + + clk_peri + 12 + + + clk_hstx + 13 + + + otp_clk2fc + 14 + + + + + + + CLK_GPOUT1_DIV + 0x00000010 + 0x00010000 + + + INT + Integer part of clock divisor, 0 -> max+1, can be changed on-the-fly + [31:16] + read-write + + + FRAC + Fractional component of the divisor, can be changed on-the-fly + [15:0] + read-write + + + + + CLK_GPOUT1_SELECTED + 0x00000014 + Indicates which src is currently selected (one-hot) + 0x00000001 + + + CLK_GPOUT1_SELECTED + This slice does not have a glitchless mux (only the AUX_SRC field is present, not SRC) so this register is hardwired to 0x1. + [0:0] + read-only + + + + + CLK_GPOUT2_CTRL + 0x00000018 + Clock control, can be changed on-the-fly (except for auxsrc) + 0x00000000 + + + ENABLED + clock generator is enabled + [28:28] + read-only + + + NUDGE + An edge on this signal shifts the phase of the output by 1 cycle of the input clock + This can be done at any time + [20:20] + read-write + + + PHASE + This delays the enable signal by up to 3 cycles of the input clock + This must be set before the clock is enabled to have any effect + [17:16] + read-write + + + DC50 + Enables duty cycle correction for odd divisors, can be changed on-the-fly + [12:12] + read-write + + + ENABLE + Starts and stops the clock generator cleanly + [11:11] + read-write + + + KILL + Asynchronously kills the clock generator, enable must be set low before deasserting kill + [10:10] + read-write + + + AUXSRC + Selects the auxiliary clock source, will glitch when switching + [8:5] + read-write + + + clksrc_pll_sys + 0 + + + clksrc_gpin0 + 1 + + + clksrc_gpin1 + 2 + + + clksrc_pll_usb + 3 + + + clksrc_pll_usb_primary_ref_opcg + 4 + + + rosc_clksrc_ph + 5 + + + xosc_clksrc + 6 + + + lposc_clksrc + 7 + + + clk_sys + 8 + + + clk_usb + 9 + + + clk_adc + 10 + + + clk_ref + 11 + + + clk_peri + 12 + + + clk_hstx + 13 + + + otp_clk2fc + 14 + + + + + + + CLK_GPOUT2_DIV + 0x0000001c + 0x00010000 + + + INT + Integer part of clock divisor, 0 -> max+1, can be changed on-the-fly + [31:16] + read-write + + + FRAC + Fractional component of the divisor, can be changed on-the-fly + [15:0] + read-write + + + + + CLK_GPOUT2_SELECTED + 0x00000020 + Indicates which src is currently selected (one-hot) + 0x00000001 + + + CLK_GPOUT2_SELECTED + This slice does not have a glitchless mux (only the AUX_SRC field is present, not SRC) so this register is hardwired to 0x1. + [0:0] + read-only + + + + + CLK_GPOUT3_CTRL + 0x00000024 + Clock control, can be changed on-the-fly (except for auxsrc) + 0x00000000 + + + ENABLED + clock generator is enabled + [28:28] + read-only + + + NUDGE + An edge on this signal shifts the phase of the output by 1 cycle of the input clock + This can be done at any time + [20:20] + read-write + + + PHASE + This delays the enable signal by up to 3 cycles of the input clock + This must be set before the clock is enabled to have any effect + [17:16] + read-write + + + DC50 + Enables duty cycle correction for odd divisors, can be changed on-the-fly + [12:12] + read-write + + + ENABLE + Starts and stops the clock generator cleanly + [11:11] + read-write + + + KILL + Asynchronously kills the clock generator, enable must be set low before deasserting kill + [10:10] + read-write + + + AUXSRC + Selects the auxiliary clock source, will glitch when switching + [8:5] + read-write + + + clksrc_pll_sys + 0 + + + clksrc_gpin0 + 1 + + + clksrc_gpin1 + 2 + + + clksrc_pll_usb + 3 + + + clksrc_pll_usb_primary_ref_opcg + 4 + + + rosc_clksrc_ph + 5 + + + xosc_clksrc + 6 + + + lposc_clksrc + 7 + + + clk_sys + 8 + + + clk_usb + 9 + + + clk_adc + 10 + + + clk_ref + 11 + + + clk_peri + 12 + + + clk_hstx + 13 + + + otp_clk2fc + 14 + + + + + + + CLK_GPOUT3_DIV + 0x00000028 + 0x00010000 + + + INT + Integer part of clock divisor, 0 -> max+1, can be changed on-the-fly + [31:16] + read-write + + + FRAC + Fractional component of the divisor, can be changed on-the-fly + [15:0] + read-write + + + + + CLK_GPOUT3_SELECTED + 0x0000002c + Indicates which src is currently selected (one-hot) + 0x00000001 + + + CLK_GPOUT3_SELECTED + This slice does not have a glitchless mux (only the AUX_SRC field is present, not SRC) so this register is hardwired to 0x1. + [0:0] + read-only + + + + + CLK_REF_CTRL + 0x00000030 + Clock control, can be changed on-the-fly (except for auxsrc) + 0x00000000 + + + AUXSRC + Selects the auxiliary clock source, will glitch when switching + [6:5] + read-write + + + clksrc_pll_usb + 0 + + + clksrc_gpin0 + 1 + + + clksrc_gpin1 + 2 + + + clksrc_pll_usb_primary_ref_opcg + 3 + + + + + SRC + Selects the clock source glitchlessly, can be changed on-the-fly + [1:0] + read-write + + + rosc_clksrc_ph + 0 + + + clksrc_clk_ref_aux + 1 + + + xosc_clksrc + 2 + + + lposc_clksrc + 3 + + + + + + + CLK_REF_DIV + 0x00000034 + 0x00010000 + + + INT + Integer part of clock divisor, 0 -> max+1, can be changed on-the-fly + [23:16] + read-write + + + + + CLK_REF_SELECTED + 0x00000038 + Indicates which src is currently selected (one-hot) + 0x00000001 + + + CLK_REF_SELECTED + The glitchless multiplexer does not switch instantaneously (to avoid glitches), so software should poll this register to wait for the switch to complete. This register contains one decoded bit for each of the clock sources enumerated in the CTRL SRC field. At most one of these bits will be set at any time, indicating that clock is currently present at the output of the glitchless mux. Whilst switching is in progress, this register may briefly show all-0s. + [3:0] + read-only + + + + + CLK_SYS_CTRL + 0x0000003c + Clock control, can be changed on-the-fly (except for auxsrc) + 0x00000000 + + + AUXSRC + Selects the auxiliary clock source, will glitch when switching + [7:5] + read-write + + + clksrc_pll_sys + 0 + + + clksrc_pll_usb + 1 + + + rosc_clksrc + 2 + + + xosc_clksrc + 3 + + + clksrc_gpin0 + 4 + + + clksrc_gpin1 + 5 + + + + + SRC + Selects the clock source glitchlessly, can be changed on-the-fly + [0:0] + read-write + + + clk_ref + 0 + + + clksrc_clk_sys_aux + 1 + + + + + + + CLK_SYS_DIV + 0x00000040 + 0x00010000 + + + INT + Integer part of clock divisor, 0 -> max+1, can be changed on-the-fly + [31:16] + read-write + + + FRAC + Fractional component of the divisor, can be changed on-the-fly + [15:0] + read-write + + + + + CLK_SYS_SELECTED + 0x00000044 + Indicates which src is currently selected (one-hot) + 0x00000001 + + + CLK_SYS_SELECTED + The glitchless multiplexer does not switch instantaneously (to avoid glitches), so software should poll this register to wait for the switch to complete. This register contains one decoded bit for each of the clock sources enumerated in the CTRL SRC field. At most one of these bits will be set at any time, indicating that clock is currently present at the output of the glitchless mux. Whilst switching is in progress, this register may briefly show all-0s. + [1:0] + read-only + + + + + CLK_PERI_CTRL + 0x00000048 + Clock control, can be changed on-the-fly (except for auxsrc) + 0x00000000 + + + ENABLED + clock generator is enabled + [28:28] + read-only + + + ENABLE + Starts and stops the clock generator cleanly + [11:11] + read-write + + + KILL + Asynchronously kills the clock generator, enable must be set low before deasserting kill + [10:10] + read-write + + + AUXSRC + Selects the auxiliary clock source, will glitch when switching + [7:5] + read-write + + + clk_sys + 0 + + + clksrc_pll_sys + 1 + + + clksrc_pll_usb + 2 + + + rosc_clksrc_ph + 3 + + + xosc_clksrc + 4 + + + clksrc_gpin0 + 5 + + + clksrc_gpin1 + 6 + + + + + + + CLK_PERI_DIV + 0x0000004c + 0x00010000 + + + INT + Integer part of clock divisor, 0 -> max+1, can be changed on-the-fly + [17:16] + read-write + + + + + CLK_PERI_SELECTED + 0x00000050 + Indicates which src is currently selected (one-hot) + 0x00000001 + + + CLK_PERI_SELECTED + This slice does not have a glitchless mux (only the AUX_SRC field is present, not SRC) so this register is hardwired to 0x1. + [0:0] + read-only + + + + + CLK_HSTX_CTRL + 0x00000054 + Clock control, can be changed on-the-fly (except for auxsrc) + 0x00000000 + + + ENABLED + clock generator is enabled + [28:28] + read-only + + + NUDGE + An edge on this signal shifts the phase of the output by 1 cycle of the input clock + This can be done at any time + [20:20] + read-write + + + PHASE + This delays the enable signal by up to 3 cycles of the input clock + This must be set before the clock is enabled to have any effect + [17:16] + read-write + + + ENABLE + Starts and stops the clock generator cleanly + [11:11] + read-write + + + KILL + Asynchronously kills the clock generator, enable must be set low before deasserting kill + [10:10] + read-write + + + AUXSRC + Selects the auxiliary clock source, will glitch when switching + [7:5] + read-write + + + clk_sys + 0 + + + clksrc_pll_sys + 1 + + + clksrc_pll_usb + 2 + + + clksrc_gpin0 + 3 + + + clksrc_gpin1 + 4 + + + + + + + CLK_HSTX_DIV + 0x00000058 + 0x00010000 + + + INT + Integer part of clock divisor, 0 -> max+1, can be changed on-the-fly + [17:16] + read-write + + + + + CLK_HSTX_SELECTED + 0x0000005c + Indicates which src is currently selected (one-hot) + 0x00000001 + + + CLK_HSTX_SELECTED + This slice does not have a glitchless mux (only the AUX_SRC field is present, not SRC) so this register is hardwired to 0x1. + [0:0] + read-only + + + + + CLK_USB_CTRL + 0x00000060 + Clock control, can be changed on-the-fly (except for auxsrc) + 0x00000000 + + + ENABLED + clock generator is enabled + [28:28] + read-only + + + NUDGE + An edge on this signal shifts the phase of the output by 1 cycle of the input clock + This can be done at any time + [20:20] + read-write + + + PHASE + This delays the enable signal by up to 3 cycles of the input clock + This must be set before the clock is enabled to have any effect + [17:16] + read-write + + + ENABLE + Starts and stops the clock generator cleanly + [11:11] + read-write + + + KILL + Asynchronously kills the clock generator, enable must be set low before deasserting kill + [10:10] + read-write + + + AUXSRC + Selects the auxiliary clock source, will glitch when switching + [7:5] + read-write + + + clksrc_pll_usb + 0 + + + clksrc_pll_sys + 1 + + + rosc_clksrc_ph + 2 + + + xosc_clksrc + 3 + + + clksrc_gpin0 + 4 + + + clksrc_gpin1 + 5 + + + + + + + CLK_USB_DIV + 0x00000064 + 0x00010000 + + + INT + Integer part of clock divisor, 0 -> max+1, can be changed on-the-fly + [19:16] + read-write + + + + + CLK_USB_SELECTED + 0x00000068 + Indicates which src is currently selected (one-hot) + 0x00000001 + + + CLK_USB_SELECTED + This slice does not have a glitchless mux (only the AUX_SRC field is present, not SRC) so this register is hardwired to 0x1. + [0:0] + read-only + + + + + CLK_ADC_CTRL + 0x0000006c + Clock control, can be changed on-the-fly (except for auxsrc) + 0x00000000 + + + ENABLED + clock generator is enabled + [28:28] + read-only + + + NUDGE + An edge on this signal shifts the phase of the output by 1 cycle of the input clock + This can be done at any time + [20:20] + read-write + + + PHASE + This delays the enable signal by up to 3 cycles of the input clock + This must be set before the clock is enabled to have any effect + [17:16] + read-write + + + ENABLE + Starts and stops the clock generator cleanly + [11:11] + read-write + + + KILL + Asynchronously kills the clock generator, enable must be set low before deasserting kill + [10:10] + read-write + + + AUXSRC + Selects the auxiliary clock source, will glitch when switching + [7:5] + read-write + + + clksrc_pll_usb + 0 + + + clksrc_pll_sys + 1 + + + rosc_clksrc_ph + 2 + + + xosc_clksrc + 3 + + + clksrc_gpin0 + 4 + + + clksrc_gpin1 + 5 + + + + + + + CLK_ADC_DIV + 0x00000070 + 0x00010000 + + + INT + Integer part of clock divisor, 0 -> max+1, can be changed on-the-fly + [19:16] + read-write + + + + + CLK_ADC_SELECTED + 0x00000074 + Indicates which src is currently selected (one-hot) + 0x00000001 + + + CLK_ADC_SELECTED + This slice does not have a glitchless mux (only the AUX_SRC field is present, not SRC) so this register is hardwired to 0x1. + [0:0] + read-only + + + + + DFTCLK_XOSC_CTRL + 0x00000078 + 0x00000000 + + + SRC + [1:0] + read-write + + + NULL + 0 + + + clksrc_pll_usb_primary + 1 + + + clksrc_gpin0 + 2 + + + + + + + DFTCLK_ROSC_CTRL + 0x0000007c + 0x00000000 + + + SRC + [1:0] + read-write + + + NULL + 0 + + + clksrc_pll_sys_primary_rosc + 1 + + + clksrc_gpin1 + 2 + + + + + + + DFTCLK_LPOSC_CTRL + 0x00000080 + 0x00000000 + + + SRC + [1:0] + read-write + + + NULL + 0 + + + clksrc_pll_usb_primary_lposc + 1 + + + clksrc_gpin1 + 2 + + + + + + + CLK_SYS_RESUS_CTRL + 0x00000084 + 0x000000ff + + + CLEAR + For clearing the resus after the fault that triggered it has been corrected + [16:16] + read-write + + + FRCE + Force a resus, for test purposes only + [12:12] + read-write + + + ENABLE + Enable resus + [8:8] + read-write + + + TIMEOUT + This is expressed as a number of clk_ref cycles + and must be >= 2x clk_ref_freq/min_clk_tst_freq + [7:0] + read-write + + + + + CLK_SYS_RESUS_STATUS + 0x00000088 + 0x00000000 + + + RESUSSED + Clock has been resuscitated, correct the error then send ctrl_clear=1 + [0:0] + read-only + + + + + FC0_REF_KHZ + 0x0000008c + Reference clock frequency in kHz + 0x00000000 + + + FC0_REF_KHZ + [19:0] + read-write + + + + + FC0_MIN_KHZ + 0x00000090 + Minimum pass frequency in kHz. This is optional. Set to 0 if you are not using the pass/fail flags + 0x00000000 + + + FC0_MIN_KHZ + [24:0] + read-write + + + + + FC0_MAX_KHZ + 0x00000094 + Maximum pass frequency in kHz. This is optional. Set to 0x1ffffff if you are not using the pass/fail flags + 0x01ffffff + + + FC0_MAX_KHZ + [24:0] + read-write + + + + + FC0_DELAY + 0x00000098 + Delays the start of frequency counting to allow the mux to settle + Delay is measured in multiples of the reference clock period + 0x00000001 + + + FC0_DELAY + [2:0] + read-write + + + + + FC0_INTERVAL + 0x0000009c + The test interval is 0.98us * 2**interval, but let's call it 1us * 2**interval + The default gives a test interval of 250us + 0x00000008 + + + FC0_INTERVAL + [3:0] + read-write + + + + + FC0_SRC + 0x000000a0 + Clock sent to frequency counter, set to 0 when not required + Writing to this register initiates the frequency count + 0x00000000 + + + FC0_SRC + [7:0] + read-write + + + NULL + 0 + + + pll_sys_clksrc_primary + 1 + + + pll_usb_clksrc_primary + 2 + + + rosc_clksrc + 3 + + + rosc_clksrc_ph + 4 + + + xosc_clksrc + 5 + + + clksrc_gpin0 + 6 + + + clksrc_gpin1 + 7 + + + clk_ref + 8 + + + clk_sys + 9 + + + clk_peri + 10 + + + clk_usb + 11 + + + clk_adc + 12 + + + clk_hstx + 13 + + + lposc_clksrc + 14 + + + otp_clk2fc + 15 + + + pll_usb_clksrc_primary_dft + 16 + + + + + + + FC0_STATUS + 0x000000a4 + Frequency counter status + 0x00000000 + + + DIED + Test clock stopped during test + [28:28] + read-only + + + FAST + Test clock faster than expected, only valid when status_done=1 + [24:24] + read-only + + + SLOW + Test clock slower than expected, only valid when status_done=1 + [20:20] + read-only + + + FAIL + Test failed + [16:16] + read-only + + + WAITING + Waiting for test clock to start + [12:12] + read-only + + + RUNNING + Test running + [8:8] + read-only + + + DONE + Test complete + [4:4] + read-only + + + PASS + Test passed + [0:0] + read-only + + + + + FC0_RESULT + 0x000000a8 + Result of frequency measurement, only valid when status_done=1 + 0x00000000 + + + KHZ + [29:5] + read-only + + + FRAC + [4:0] + read-only + + + + + WAKE_EN0 + 0x000000ac + enable clock in wake mode + 0xffffffff + + + CLK_SYS_SIO + [31:31] + read-write + + + CLK_SYS_SHA256 + [30:30] + read-write + + + CLK_SYS_PSM + [29:29] + read-write + + + CLK_SYS_ROSC + [28:28] + read-write + + + CLK_SYS_ROM + [27:27] + read-write + + + CLK_SYS_RESETS + [26:26] + read-write + + + CLK_SYS_PWM + [25:25] + read-write + + + CLK_SYS_POWMAN + [24:24] + read-write + + + CLK_REF_POWMAN + [23:23] + read-write + + + CLK_SYS_PLL_USB + [22:22] + read-write + + + CLK_SYS_PLL_SYS + [21:21] + read-write + + + CLK_SYS_PIO2 + [20:20] + read-write + + + CLK_SYS_PIO1 + [19:19] + read-write + + + CLK_SYS_PIO0 + [18:18] + read-write + + + CLK_SYS_PADS + [17:17] + read-write + + + CLK_SYS_OTP + [16:16] + read-write + + + CLK_REF_OTP + [15:15] + read-write + + + CLK_SYS_JTAG + [14:14] + read-write + + + CLK_SYS_IO + [13:13] + read-write + + + CLK_SYS_I2C1 + [12:12] + read-write + + + CLK_SYS_I2C0 + [11:11] + read-write + + + CLK_SYS_HSTX + [10:10] + read-write + + + CLK_HSTX + [9:9] + read-write + + + CLK_SYS_GLITCH_DETECTOR + [8:8] + read-write + + + CLK_SYS_DMA + [7:7] + read-write + + + CLK_SYS_BUSFABRIC + [6:6] + read-write + + + CLK_SYS_BUSCTRL + [5:5] + read-write + + + CLK_SYS_BOOTRAM + [4:4] + read-write + + + CLK_SYS_ADC + [3:3] + read-write + + + CLK_ADC + [2:2] + read-write + + + CLK_SYS_ACCESSCTRL + [1:1] + read-write + + + CLK_SYS_CLOCKS + [0:0] + read-write + + + + + WAKE_EN1 + 0x000000b0 + enable clock in wake mode + 0x7fffffff + + + CLK_SYS_XOSC + [30:30] + read-write + + + CLK_SYS_XIP + [29:29] + read-write + + + CLK_SYS_WATCHDOG + [28:28] + read-write + + + CLK_USB + [27:27] + read-write + + + CLK_SYS_USBCTRL + [26:26] + read-write + + + CLK_SYS_UART1 + [25:25] + read-write + + + CLK_PERI_UART1 + [24:24] + read-write + + + CLK_SYS_UART0 + [23:23] + read-write + + + CLK_PERI_UART0 + [22:22] + read-write + + + CLK_SYS_TRNG + [21:21] + read-write + + + CLK_SYS_TIMER1 + [20:20] + read-write + + + CLK_SYS_TIMER0 + [19:19] + read-write + + + CLK_SYS_TICKS + [18:18] + read-write + + + CLK_REF_TICKS + [17:17] + read-write + + + CLK_SYS_TBMAN + [16:16] + read-write + + + CLK_SYS_SYSINFO + [15:15] + read-write + + + CLK_SYS_SYSCFG + [14:14] + read-write + + + CLK_SYS_SRAM9 + [13:13] + read-write + + + CLK_SYS_SRAM8 + [12:12] + read-write + + + CLK_SYS_SRAM7 + [11:11] + read-write + + + CLK_SYS_SRAM6 + [10:10] + read-write + + + CLK_SYS_SRAM5 + [9:9] + read-write + + + CLK_SYS_SRAM4 + [8:8] + read-write + + + CLK_SYS_SRAM3 + [7:7] + read-write + + + CLK_SYS_SRAM2 + [6:6] + read-write + + + CLK_SYS_SRAM1 + [5:5] + read-write + + + CLK_SYS_SRAM0 + [4:4] + read-write + + + CLK_SYS_SPI1 + [3:3] + read-write + + + CLK_PERI_SPI1 + [2:2] + read-write + + + CLK_SYS_SPI0 + [1:1] + read-write + + + CLK_PERI_SPI0 + [0:0] + read-write + + + + + SLEEP_EN0 + 0x000000b4 + enable clock in sleep mode + 0xffffffff + + + CLK_SYS_SIO + [31:31] + read-write + + + CLK_SYS_SHA256 + [30:30] + read-write + + + CLK_SYS_PSM + [29:29] + read-write + + + CLK_SYS_ROSC + [28:28] + read-write + + + CLK_SYS_ROM + [27:27] + read-write + + + CLK_SYS_RESETS + [26:26] + read-write + + + CLK_SYS_PWM + [25:25] + read-write + + + CLK_SYS_POWMAN + [24:24] + read-write + + + CLK_REF_POWMAN + [23:23] + read-write + + + CLK_SYS_PLL_USB + [22:22] + read-write + + + CLK_SYS_PLL_SYS + [21:21] + read-write + + + CLK_SYS_PIO2 + [20:20] + read-write + + + CLK_SYS_PIO1 + [19:19] + read-write + + + CLK_SYS_PIO0 + [18:18] + read-write + + + CLK_SYS_PADS + [17:17] + read-write + + + CLK_SYS_OTP + [16:16] + read-write + + + CLK_REF_OTP + [15:15] + read-write + + + CLK_SYS_JTAG + [14:14] + read-write + + + CLK_SYS_IO + [13:13] + read-write + + + CLK_SYS_I2C1 + [12:12] + read-write + + + CLK_SYS_I2C0 + [11:11] + read-write + + + CLK_SYS_HSTX + [10:10] + read-write + + + CLK_HSTX + [9:9] + read-write + + + CLK_SYS_GLITCH_DETECTOR + [8:8] + read-write + + + CLK_SYS_DMA + [7:7] + read-write + + + CLK_SYS_BUSFABRIC + [6:6] + read-write + + + CLK_SYS_BUSCTRL + [5:5] + read-write + + + CLK_SYS_BOOTRAM + [4:4] + read-write + + + CLK_SYS_ADC + [3:3] + read-write + + + CLK_ADC + [2:2] + read-write + + + CLK_SYS_ACCESSCTRL + [1:1] + read-write + + + CLK_SYS_CLOCKS + [0:0] + read-write + + + + + SLEEP_EN1 + 0x000000b8 + enable clock in sleep mode + 0x7fffffff + + + CLK_SYS_XOSC + [30:30] + read-write + + + CLK_SYS_XIP + [29:29] + read-write + + + CLK_SYS_WATCHDOG + [28:28] + read-write + + + CLK_USB + [27:27] + read-write + + + CLK_SYS_USBCTRL + [26:26] + read-write + + + CLK_SYS_UART1 + [25:25] + read-write + + + CLK_PERI_UART1 + [24:24] + read-write + + + CLK_SYS_UART0 + [23:23] + read-write + + + CLK_PERI_UART0 + [22:22] + read-write + + + CLK_SYS_TRNG + [21:21] + read-write + + + CLK_SYS_TIMER1 + [20:20] + read-write + + + CLK_SYS_TIMER0 + [19:19] + read-write + + + CLK_SYS_TICKS + [18:18] + read-write + + + CLK_REF_TICKS + [17:17] + read-write + + + CLK_SYS_TBMAN + [16:16] + read-write + + + CLK_SYS_SYSINFO + [15:15] + read-write + + + CLK_SYS_SYSCFG + [14:14] + read-write + + + CLK_SYS_SRAM9 + [13:13] + read-write + + + CLK_SYS_SRAM8 + [12:12] + read-write + + + CLK_SYS_SRAM7 + [11:11] + read-write + + + CLK_SYS_SRAM6 + [10:10] + read-write + + + CLK_SYS_SRAM5 + [9:9] + read-write + + + CLK_SYS_SRAM4 + [8:8] + read-write + + + CLK_SYS_SRAM3 + [7:7] + read-write + + + CLK_SYS_SRAM2 + [6:6] + read-write + + + CLK_SYS_SRAM1 + [5:5] + read-write + + + CLK_SYS_SRAM0 + [4:4] + read-write + + + CLK_SYS_SPI1 + [3:3] + read-write + + + CLK_PERI_SPI1 + [2:2] + read-write + + + CLK_SYS_SPI0 + [1:1] + read-write + + + CLK_PERI_SPI0 + [0:0] + read-write + + + + + ENABLED0 + 0x000000bc + indicates the state of the clock enable + 0x00000000 + + + CLK_SYS_SIO + [31:31] + read-only + + + CLK_SYS_SHA256 + [30:30] + read-only + + + CLK_SYS_PSM + [29:29] + read-only + + + CLK_SYS_ROSC + [28:28] + read-only + + + CLK_SYS_ROM + [27:27] + read-only + + + CLK_SYS_RESETS + [26:26] + read-only + + + CLK_SYS_PWM + [25:25] + read-only + + + CLK_SYS_POWMAN + [24:24] + read-only + + + CLK_REF_POWMAN + [23:23] + read-only + + + CLK_SYS_PLL_USB + [22:22] + read-only + + + CLK_SYS_PLL_SYS + [21:21] + read-only + + + CLK_SYS_PIO2 + [20:20] + read-only + + + CLK_SYS_PIO1 + [19:19] + read-only + + + CLK_SYS_PIO0 + [18:18] + read-only + + + CLK_SYS_PADS + [17:17] + read-only + + + CLK_SYS_OTP + [16:16] + read-only + + + CLK_REF_OTP + [15:15] + read-only + + + CLK_SYS_JTAG + [14:14] + read-only + + + CLK_SYS_IO + [13:13] + read-only + + + CLK_SYS_I2C1 + [12:12] + read-only + + + CLK_SYS_I2C0 + [11:11] + read-only + + + CLK_SYS_HSTX + [10:10] + read-only + + + CLK_HSTX + [9:9] + read-only + + + CLK_SYS_GLITCH_DETECTOR + [8:8] + read-only + + + CLK_SYS_DMA + [7:7] + read-only + + + CLK_SYS_BUSFABRIC + [6:6] + read-only + + + CLK_SYS_BUSCTRL + [5:5] + read-only + + + CLK_SYS_BOOTRAM + [4:4] + read-only + + + CLK_SYS_ADC + [3:3] + read-only + + + CLK_ADC + [2:2] + read-only + + + CLK_SYS_ACCESSCTRL + [1:1] + read-only + + + CLK_SYS_CLOCKS + [0:0] + read-only + + + + + ENABLED1 + 0x000000c0 + indicates the state of the clock enable + 0x00000000 + + + CLK_SYS_XOSC + [30:30] + read-only + + + CLK_SYS_XIP + [29:29] + read-only + + + CLK_SYS_WATCHDOG + [28:28] + read-only + + + CLK_USB + [27:27] + read-only + + + CLK_SYS_USBCTRL + [26:26] + read-only + + + CLK_SYS_UART1 + [25:25] + read-only + + + CLK_PERI_UART1 + [24:24] + read-only + + + CLK_SYS_UART0 + [23:23] + read-only + + + CLK_PERI_UART0 + [22:22] + read-only + + + CLK_SYS_TRNG + [21:21] + read-only + + + CLK_SYS_TIMER1 + [20:20] + read-only + + + CLK_SYS_TIMER0 + [19:19] + read-only + + + CLK_SYS_TICKS + [18:18] + read-only + + + CLK_REF_TICKS + [17:17] + read-only + + + CLK_SYS_TBMAN + [16:16] + read-only + + + CLK_SYS_SYSINFO + [15:15] + read-only + + + CLK_SYS_SYSCFG + [14:14] + read-only + + + CLK_SYS_SRAM9 + [13:13] + read-only + + + CLK_SYS_SRAM8 + [12:12] + read-only + + + CLK_SYS_SRAM7 + [11:11] + read-only + + + CLK_SYS_SRAM6 + [10:10] + read-only + + + CLK_SYS_SRAM5 + [9:9] + read-only + + + CLK_SYS_SRAM4 + [8:8] + read-only + + + CLK_SYS_SRAM3 + [7:7] + read-only + + + CLK_SYS_SRAM2 + [6:6] + read-only + + + CLK_SYS_SRAM1 + [5:5] + read-only + + + CLK_SYS_SRAM0 + [4:4] + read-only + + + CLK_SYS_SPI1 + [3:3] + read-only + + + CLK_PERI_SPI1 + [2:2] + read-only + + + CLK_SYS_SPI0 + [1:1] + read-only + + + CLK_PERI_SPI0 + [0:0] + read-only + + + + + INTR + 0x000000c4 + Raw Interrupts + 0x00000000 + + + CLK_SYS_RESUS + [0:0] + read-only + + + + + INTE + 0x000000c8 + Interrupt Enable + 0x00000000 + + + CLK_SYS_RESUS + [0:0] + read-write + + + + + INTF + 0x000000cc + Interrupt Force + 0x00000000 + + + CLK_SYS_RESUS + [0:0] + read-write + + + + + INTS + 0x000000d0 + Interrupt status after masking & forcing + 0x00000000 + + + CLK_SYS_RESUS + [0:0] + read-only + + + + + + + TICKS + 0x40108000 + + 0 + 72 + registers + + + + PROC0_CTRL + 0x00000000 + Controls the tick generator + 0x00000000 + + + RUNNING + Is the tick generator running? + [1:1] + read-only + + + ENABLE + start / stop tick generation + [0:0] + read-write + + + + + PROC0_CYCLES + 0x00000004 + 0x00000000 + + + PROC0_CYCLES + Total number of clk_tick cycles before the next tick. + [8:0] + read-write + + + + + PROC0_COUNT + 0x00000008 + 0x00000000 + + + PROC0_COUNT + Count down timer: the remaining number clk_tick cycles before the next tick is generated. + [8:0] + read-only + + + + + PROC1_CTRL + 0x0000000c + Controls the tick generator + 0x00000000 + + + RUNNING + Is the tick generator running? + [1:1] + read-only + + + ENABLE + start / stop tick generation + [0:0] + read-write + + + + + PROC1_CYCLES + 0x00000010 + 0x00000000 + + + PROC1_CYCLES + Total number of clk_tick cycles before the next tick. + [8:0] + read-write + + + + + PROC1_COUNT + 0x00000014 + 0x00000000 + + + PROC1_COUNT + Count down timer: the remaining number clk_tick cycles before the next tick is generated. + [8:0] + read-only + + + + + TIMER0_CTRL + 0x00000018 + Controls the tick generator + 0x00000000 + + + RUNNING + Is the tick generator running? + [1:1] + read-only + + + ENABLE + start / stop tick generation + [0:0] + read-write + + + + + TIMER0_CYCLES + 0x0000001c + 0x00000000 + + + TIMER0_CYCLES + Total number of clk_tick cycles before the next tick. + [8:0] + read-write + + + + + TIMER0_COUNT + 0x00000020 + 0x00000000 + + + TIMER0_COUNT + Count down timer: the remaining number clk_tick cycles before the next tick is generated. + [8:0] + read-only + + + + + TIMER1_CTRL + 0x00000024 + Controls the tick generator + 0x00000000 + + + RUNNING + Is the tick generator running? + [1:1] + read-only + + + ENABLE + start / stop tick generation + [0:0] + read-write + + + + + TIMER1_CYCLES + 0x00000028 + 0x00000000 + + + TIMER1_CYCLES + Total number of clk_tick cycles before the next tick. + [8:0] + read-write + + + + + TIMER1_COUNT + 0x0000002c + 0x00000000 + + + TIMER1_COUNT + Count down timer: the remaining number clk_tick cycles before the next tick is generated. + [8:0] + read-only + + + + + WATCHDOG_CTRL + 0x00000030 + Controls the tick generator + 0x00000000 + + + RUNNING + Is the tick generator running? + [1:1] + read-only + + + ENABLE + start / stop tick generation + [0:0] + read-write + + + + + WATCHDOG_CYCLES + 0x00000034 + 0x00000000 + + + WATCHDOG_CYCLES + Total number of clk_tick cycles before the next tick. + [8:0] + read-write + + + + + WATCHDOG_COUNT + 0x00000038 + 0x00000000 + + + WATCHDOG_COUNT + Count down timer: the remaining number clk_tick cycles before the next tick is generated. + [8:0] + read-only + + + + + RISCV_CTRL + 0x0000003c + Controls the tick generator + 0x00000000 + + + RUNNING + Is the tick generator running? + [1:1] + read-only + + + ENABLE + start / stop tick generation + [0:0] + read-write + + + + + RISCV_CYCLES + 0x00000040 + 0x00000000 + + + RISCV_CYCLES + Total number of clk_tick cycles before the next tick. + [8:0] + read-write + + + + + RISCV_COUNT + 0x00000044 + 0x00000000 + + + RISCV_COUNT + Count down timer: the remaining number clk_tick cycles before the next tick is generated. + [8:0] + read-only + + + + + + + PADS_BANK0 + 0x40038000 + + 0 + 204 + registers + + + + VOLTAGE_SELECT + 0x00000000 + Voltage select. Per bank control + 0x00000000 + + + VOLTAGE_SELECT + [0:0] + read-write + + + 3v3 + 0 + Set voltage to 3.3V (DVDD >= 2V5) + + + 1v8 + 1 + Set voltage to 1.8V (DVDD <= 1V8) + + + + + + + GPIO0 + 0x00000004 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO1 + 0x00000008 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO2 + 0x0000000c + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO3 + 0x00000010 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO4 + 0x00000014 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO5 + 0x00000018 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO6 + 0x0000001c + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO7 + 0x00000020 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO8 + 0x00000024 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO9 + 0x00000028 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO10 + 0x0000002c + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO11 + 0x00000030 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO12 + 0x00000034 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO13 + 0x00000038 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO14 + 0x0000003c + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO15 + 0x00000040 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO16 + 0x00000044 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO17 + 0x00000048 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO18 + 0x0000004c + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO19 + 0x00000050 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO20 + 0x00000054 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO21 + 0x00000058 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO22 + 0x0000005c + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO23 + 0x00000060 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO24 + 0x00000064 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO25 + 0x00000068 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO26 + 0x0000006c + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO27 + 0x00000070 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO28 + 0x00000074 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO29 + 0x00000078 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO30 + 0x0000007c + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO31 + 0x00000080 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO32 + 0x00000084 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO33 + 0x00000088 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO34 + 0x0000008c + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO35 + 0x00000090 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO36 + 0x00000094 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO37 + 0x00000098 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO38 + 0x0000009c + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO39 + 0x000000a0 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO40 + 0x000000a4 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO41 + 0x000000a8 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO42 + 0x000000ac + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO43 + 0x000000b0 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO44 + 0x000000b4 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO45 + 0x000000b8 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO46 + 0x000000bc + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO47 + 0x000000c0 + 0x00000116 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + SWCLK + 0x000000c4 + 0x0000005a + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + SWD + 0x000000c8 + 0x0000005a + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + + + PADS_QSPI + 0x40040000 + + 0 + 28 + registers + + + + VOLTAGE_SELECT + 0x00000000 + Voltage select. Per bank control + 0x00000000 + + + VOLTAGE_SELECT + [0:0] + read-write + + + 3v3 + 0 + Set voltage to 3.3V (DVDD >= 2V5) + + + 1v8 + 1 + Set voltage to 1.8V (DVDD <= 1V8) + + + + + + + GPIO_QSPI_SCLK + 0x00000004 + 0x00000156 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO_QSPI_SD0 + 0x00000008 + 0x00000156 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO_QSPI_SD1 + 0x0000000c + 0x00000156 + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO_QSPI_SD2 + 0x00000010 + 0x0000015a + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO_QSPI_SD3 + 0x00000014 + 0x0000015a + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + GPIO_QSPI_SS + 0x00000018 + 0x0000015a + + + ISO + Pad isolation control. Remove this once the pad is configured by software. + [8:8] + read-write + + + OD + Output disable. Has priority over output enable from peripherals + [7:7] + read-write + + + IE + Input enable + [6:6] + read-write + + + DRIVE + Drive strength. + [5:4] + read-write + + + 2mA + 0 + + + 4mA + 1 + + + 8mA + 2 + + + 12mA + 3 + + + + + PUE + Pull up enable + [3:3] + read-write + + + PDE + Pull down enable + [2:2] + read-write + + + SCHMITT + Enable schmitt trigger + [1:1] + read-write + + + SLEWFAST + Slew rate control. 1 = Fast, 0 = Slow + [0:0] + read-write + + + + + + + IO_QSPI + 0x40030000 + + 0 + 576 + registers + + + IO_IRQ_QSPI + 23 + + + IO_IRQ_QSPI_NS + 24 + + + + USBPHY_DP_STATUS + 0x00000000 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + USBPHY_DP_CTRL + 0x00000004 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + uart1_tx + 2 + + + i2c0_sda + 3 + + + siob_proc_56 + 5 + + + null + 31 + + + + + + + USBPHY_DM_STATUS + 0x00000008 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + USBPHY_DM_CTRL + 0x0000000c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + uart1_rx + 2 + + + i2c0_scl + 3 + + + siob_proc_57 + 5 + + + null + 31 + + + + + + + GPIO_QSPI_SCLK_STATUS + 0x00000010 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO_QSPI_SCLK_CTRL + 0x00000014 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + xip_sclk + 0 + + + uart1_cts + 2 + + + i2c1_sda + 3 + + + siob_proc_58 + 5 + + + uart1_tx + 11 + + + null + 31 + + + + + + + GPIO_QSPI_SS_STATUS + 0x00000018 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO_QSPI_SS_CTRL + 0x0000001c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + xip_ss_n_0 + 0 + + + uart1_rts + 2 + + + i2c1_scl + 3 + + + siob_proc_59 + 5 + + + uart1_rx + 11 + + + null + 31 + + + + + + + GPIO_QSPI_SD0_STATUS + 0x00000020 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO_QSPI_SD0_CTRL + 0x00000024 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + xip_sd0 + 0 + + + uart0_tx + 2 + + + i2c0_sda + 3 + + + siob_proc_60 + 5 + + + null + 31 + + + + + + + GPIO_QSPI_SD1_STATUS + 0x00000028 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO_QSPI_SD1_CTRL + 0x0000002c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + xip_sd1 + 0 + + + uart0_rx + 2 + + + i2c0_scl + 3 + + + siob_proc_61 + 5 + + + null + 31 + + + + + + + GPIO_QSPI_SD2_STATUS + 0x00000030 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO_QSPI_SD2_CTRL + 0x00000034 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + xip_sd2 + 0 + + + uart0_cts + 2 + + + i2c1_sda + 3 + + + siob_proc_62 + 5 + + + uart0_tx + 11 + + + null + 31 + + + + + + + GPIO_QSPI_SD3_STATUS + 0x00000038 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO_QSPI_SD3_CTRL + 0x0000003c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + xip_sd3 + 0 + + + uart0_rts + 2 + + + i2c1_scl + 3 + + + siob_proc_63 + 5 + + + uart0_rx + 11 + + + null + 31 + + + + + + + IRQSUMMARY_PROC0_SECURE + 0x00000200 + 0x00000000 + + + GPIO_QSPI_SD3 + [7:7] + read-only + + + GPIO_QSPI_SD2 + [6:6] + read-only + + + GPIO_QSPI_SD1 + [5:5] + read-only + + + GPIO_QSPI_SD0 + [4:4] + read-only + + + GPIO_QSPI_SS + [3:3] + read-only + + + GPIO_QSPI_SCLK + [2:2] + read-only + + + USBPHY_DM + [1:1] + read-only + + + USBPHY_DP + [0:0] + read-only + + + + + IRQSUMMARY_PROC0_NONSECURE + 0x00000204 + 0x00000000 + + + GPIO_QSPI_SD3 + [7:7] + read-only + + + GPIO_QSPI_SD2 + [6:6] + read-only + + + GPIO_QSPI_SD1 + [5:5] + read-only + + + GPIO_QSPI_SD0 + [4:4] + read-only + + + GPIO_QSPI_SS + [3:3] + read-only + + + GPIO_QSPI_SCLK + [2:2] + read-only + + + USBPHY_DM + [1:1] + read-only + + + USBPHY_DP + [0:0] + read-only + + + + + IRQSUMMARY_PROC1_SECURE + 0x00000208 + 0x00000000 + + + GPIO_QSPI_SD3 + [7:7] + read-only + + + GPIO_QSPI_SD2 + [6:6] + read-only + + + GPIO_QSPI_SD1 + [5:5] + read-only + + + GPIO_QSPI_SD0 + [4:4] + read-only + + + GPIO_QSPI_SS + [3:3] + read-only + + + GPIO_QSPI_SCLK + [2:2] + read-only + + + USBPHY_DM + [1:1] + read-only + + + USBPHY_DP + [0:0] + read-only + + + + + IRQSUMMARY_PROC1_NONSECURE + 0x0000020c + 0x00000000 + + + GPIO_QSPI_SD3 + [7:7] + read-only + + + GPIO_QSPI_SD2 + [6:6] + read-only + + + GPIO_QSPI_SD1 + [5:5] + read-only + + + GPIO_QSPI_SD0 + [4:4] + read-only + + + GPIO_QSPI_SS + [3:3] + read-only + + + GPIO_QSPI_SCLK + [2:2] + read-only + + + USBPHY_DM + [1:1] + read-only + + + USBPHY_DP + [0:0] + read-only + + + + + IRQSUMMARY_DORMANT_WAKE_SECURE + 0x00000210 + 0x00000000 + + + GPIO_QSPI_SD3 + [7:7] + read-only + + + GPIO_QSPI_SD2 + [6:6] + read-only + + + GPIO_QSPI_SD1 + [5:5] + read-only + + + GPIO_QSPI_SD0 + [4:4] + read-only + + + GPIO_QSPI_SS + [3:3] + read-only + + + GPIO_QSPI_SCLK + [2:2] + read-only + + + USBPHY_DM + [1:1] + read-only + + + USBPHY_DP + [0:0] + read-only + + + + + IRQSUMMARY_DORMANT_WAKE_NONSECURE + 0x00000214 + 0x00000000 + + + GPIO_QSPI_SD3 + [7:7] + read-only + + + GPIO_QSPI_SD2 + [6:6] + read-only + + + GPIO_QSPI_SD1 + [5:5] + read-only + + + GPIO_QSPI_SD0 + [4:4] + read-only + + + GPIO_QSPI_SS + [3:3] + read-only + + + GPIO_QSPI_SCLK + [2:2] + read-only + + + USBPHY_DM + [1:1] + read-only + + + USBPHY_DP + [0:0] + read-only + + + + + INTR + 0x00000218 + Raw Interrupts + 0x00000000 + + + GPIO_QSPI_SD3_EDGE_HIGH + [31:31] + read-write + oneToClear + + + GPIO_QSPI_SD3_EDGE_LOW + [30:30] + read-write + oneToClear + + + GPIO_QSPI_SD3_LEVEL_HIGH + [29:29] + read-only + + + GPIO_QSPI_SD3_LEVEL_LOW + [28:28] + read-only + + + GPIO_QSPI_SD2_EDGE_HIGH + [27:27] + read-write + oneToClear + + + GPIO_QSPI_SD2_EDGE_LOW + [26:26] + read-write + oneToClear + + + GPIO_QSPI_SD2_LEVEL_HIGH + [25:25] + read-only + + + GPIO_QSPI_SD2_LEVEL_LOW + [24:24] + read-only + + + GPIO_QSPI_SD1_EDGE_HIGH + [23:23] + read-write + oneToClear + + + GPIO_QSPI_SD1_EDGE_LOW + [22:22] + read-write + oneToClear + + + GPIO_QSPI_SD1_LEVEL_HIGH + [21:21] + read-only + + + GPIO_QSPI_SD1_LEVEL_LOW + [20:20] + read-only + + + GPIO_QSPI_SD0_EDGE_HIGH + [19:19] + read-write + oneToClear + + + GPIO_QSPI_SD0_EDGE_LOW + [18:18] + read-write + oneToClear + + + GPIO_QSPI_SD0_LEVEL_HIGH + [17:17] + read-only + + + GPIO_QSPI_SD0_LEVEL_LOW + [16:16] + read-only + + + GPIO_QSPI_SS_EDGE_HIGH + [15:15] + read-write + oneToClear + + + GPIO_QSPI_SS_EDGE_LOW + [14:14] + read-write + oneToClear + + + GPIO_QSPI_SS_LEVEL_HIGH + [13:13] + read-only + + + GPIO_QSPI_SS_LEVEL_LOW + [12:12] + read-only + + + GPIO_QSPI_SCLK_EDGE_HIGH + [11:11] + read-write + oneToClear + + + GPIO_QSPI_SCLK_EDGE_LOW + [10:10] + read-write + oneToClear + + + GPIO_QSPI_SCLK_LEVEL_HIGH + [9:9] + read-only + + + GPIO_QSPI_SCLK_LEVEL_LOW + [8:8] + read-only + + + USBPHY_DM_EDGE_HIGH + [7:7] + read-write + oneToClear + + + USBPHY_DM_EDGE_LOW + [6:6] + read-write + oneToClear + + + USBPHY_DM_LEVEL_HIGH + [5:5] + read-only + + + USBPHY_DM_LEVEL_LOW + [4:4] + read-only + + + USBPHY_DP_EDGE_HIGH + [3:3] + read-write + oneToClear + + + USBPHY_DP_EDGE_LOW + [2:2] + read-write + oneToClear + + + USBPHY_DP_LEVEL_HIGH + [1:1] + read-only + + + USBPHY_DP_LEVEL_LOW + [0:0] + read-only + + + + + PROC0_INTE + 0x0000021c + Interrupt Enable for proc0 + 0x00000000 + + + GPIO_QSPI_SD3_EDGE_HIGH + [31:31] + read-write + + + GPIO_QSPI_SD3_EDGE_LOW + [30:30] + read-write + + + GPIO_QSPI_SD3_LEVEL_HIGH + [29:29] + read-write + + + GPIO_QSPI_SD3_LEVEL_LOW + [28:28] + read-write + + + GPIO_QSPI_SD2_EDGE_HIGH + [27:27] + read-write + + + GPIO_QSPI_SD2_EDGE_LOW + [26:26] + read-write + + + GPIO_QSPI_SD2_LEVEL_HIGH + [25:25] + read-write + + + GPIO_QSPI_SD2_LEVEL_LOW + [24:24] + read-write + + + GPIO_QSPI_SD1_EDGE_HIGH + [23:23] + read-write + + + GPIO_QSPI_SD1_EDGE_LOW + [22:22] + read-write + + + GPIO_QSPI_SD1_LEVEL_HIGH + [21:21] + read-write + + + GPIO_QSPI_SD1_LEVEL_LOW + [20:20] + read-write + + + GPIO_QSPI_SD0_EDGE_HIGH + [19:19] + read-write + + + GPIO_QSPI_SD0_EDGE_LOW + [18:18] + read-write + + + GPIO_QSPI_SD0_LEVEL_HIGH + [17:17] + read-write + + + GPIO_QSPI_SD0_LEVEL_LOW + [16:16] + read-write + + + GPIO_QSPI_SS_EDGE_HIGH + [15:15] + read-write + + + GPIO_QSPI_SS_EDGE_LOW + [14:14] + read-write + + + GPIO_QSPI_SS_LEVEL_HIGH + [13:13] + read-write + + + GPIO_QSPI_SS_LEVEL_LOW + [12:12] + read-write + + + GPIO_QSPI_SCLK_EDGE_HIGH + [11:11] + read-write + + + GPIO_QSPI_SCLK_EDGE_LOW + [10:10] + read-write + + + GPIO_QSPI_SCLK_LEVEL_HIGH + [9:9] + read-write + + + GPIO_QSPI_SCLK_LEVEL_LOW + [8:8] + read-write + + + USBPHY_DM_EDGE_HIGH + [7:7] + read-write + + + USBPHY_DM_EDGE_LOW + [6:6] + read-write + + + USBPHY_DM_LEVEL_HIGH + [5:5] + read-write + + + USBPHY_DM_LEVEL_LOW + [4:4] + read-write + + + USBPHY_DP_EDGE_HIGH + [3:3] + read-write + + + USBPHY_DP_EDGE_LOW + [2:2] + read-write + + + USBPHY_DP_LEVEL_HIGH + [1:1] + read-write + + + USBPHY_DP_LEVEL_LOW + [0:0] + read-write + + + + + PROC0_INTF + 0x00000220 + Interrupt Force for proc0 + 0x00000000 + + + GPIO_QSPI_SD3_EDGE_HIGH + [31:31] + read-write + + + GPIO_QSPI_SD3_EDGE_LOW + [30:30] + read-write + + + GPIO_QSPI_SD3_LEVEL_HIGH + [29:29] + read-write + + + GPIO_QSPI_SD3_LEVEL_LOW + [28:28] + read-write + + + GPIO_QSPI_SD2_EDGE_HIGH + [27:27] + read-write + + + GPIO_QSPI_SD2_EDGE_LOW + [26:26] + read-write + + + GPIO_QSPI_SD2_LEVEL_HIGH + [25:25] + read-write + + + GPIO_QSPI_SD2_LEVEL_LOW + [24:24] + read-write + + + GPIO_QSPI_SD1_EDGE_HIGH + [23:23] + read-write + + + GPIO_QSPI_SD1_EDGE_LOW + [22:22] + read-write + + + GPIO_QSPI_SD1_LEVEL_HIGH + [21:21] + read-write + + + GPIO_QSPI_SD1_LEVEL_LOW + [20:20] + read-write + + + GPIO_QSPI_SD0_EDGE_HIGH + [19:19] + read-write + + + GPIO_QSPI_SD0_EDGE_LOW + [18:18] + read-write + + + GPIO_QSPI_SD0_LEVEL_HIGH + [17:17] + read-write + + + GPIO_QSPI_SD0_LEVEL_LOW + [16:16] + read-write + + + GPIO_QSPI_SS_EDGE_HIGH + [15:15] + read-write + + + GPIO_QSPI_SS_EDGE_LOW + [14:14] + read-write + + + GPIO_QSPI_SS_LEVEL_HIGH + [13:13] + read-write + + + GPIO_QSPI_SS_LEVEL_LOW + [12:12] + read-write + + + GPIO_QSPI_SCLK_EDGE_HIGH + [11:11] + read-write + + + GPIO_QSPI_SCLK_EDGE_LOW + [10:10] + read-write + + + GPIO_QSPI_SCLK_LEVEL_HIGH + [9:9] + read-write + + + GPIO_QSPI_SCLK_LEVEL_LOW + [8:8] + read-write + + + USBPHY_DM_EDGE_HIGH + [7:7] + read-write + + + USBPHY_DM_EDGE_LOW + [6:6] + read-write + + + USBPHY_DM_LEVEL_HIGH + [5:5] + read-write + + + USBPHY_DM_LEVEL_LOW + [4:4] + read-write + + + USBPHY_DP_EDGE_HIGH + [3:3] + read-write + + + USBPHY_DP_EDGE_LOW + [2:2] + read-write + + + USBPHY_DP_LEVEL_HIGH + [1:1] + read-write + + + USBPHY_DP_LEVEL_LOW + [0:0] + read-write + + + + + PROC0_INTS + 0x00000224 + Interrupt status after masking & forcing for proc0 + 0x00000000 + + + GPIO_QSPI_SD3_EDGE_HIGH + [31:31] + read-only + + + GPIO_QSPI_SD3_EDGE_LOW + [30:30] + read-only + + + GPIO_QSPI_SD3_LEVEL_HIGH + [29:29] + read-only + + + GPIO_QSPI_SD3_LEVEL_LOW + [28:28] + read-only + + + GPIO_QSPI_SD2_EDGE_HIGH + [27:27] + read-only + + + GPIO_QSPI_SD2_EDGE_LOW + [26:26] + read-only + + + GPIO_QSPI_SD2_LEVEL_HIGH + [25:25] + read-only + + + GPIO_QSPI_SD2_LEVEL_LOW + [24:24] + read-only + + + GPIO_QSPI_SD1_EDGE_HIGH + [23:23] + read-only + + + GPIO_QSPI_SD1_EDGE_LOW + [22:22] + read-only + + + GPIO_QSPI_SD1_LEVEL_HIGH + [21:21] + read-only + + + GPIO_QSPI_SD1_LEVEL_LOW + [20:20] + read-only + + + GPIO_QSPI_SD0_EDGE_HIGH + [19:19] + read-only + + + GPIO_QSPI_SD0_EDGE_LOW + [18:18] + read-only + + + GPIO_QSPI_SD0_LEVEL_HIGH + [17:17] + read-only + + + GPIO_QSPI_SD0_LEVEL_LOW + [16:16] + read-only + + + GPIO_QSPI_SS_EDGE_HIGH + [15:15] + read-only + + + GPIO_QSPI_SS_EDGE_LOW + [14:14] + read-only + + + GPIO_QSPI_SS_LEVEL_HIGH + [13:13] + read-only + + + GPIO_QSPI_SS_LEVEL_LOW + [12:12] + read-only + + + GPIO_QSPI_SCLK_EDGE_HIGH + [11:11] + read-only + + + GPIO_QSPI_SCLK_EDGE_LOW + [10:10] + read-only + + + GPIO_QSPI_SCLK_LEVEL_HIGH + [9:9] + read-only + + + GPIO_QSPI_SCLK_LEVEL_LOW + [8:8] + read-only + + + USBPHY_DM_EDGE_HIGH + [7:7] + read-only + + + USBPHY_DM_EDGE_LOW + [6:6] + read-only + + + USBPHY_DM_LEVEL_HIGH + [5:5] + read-only + + + USBPHY_DM_LEVEL_LOW + [4:4] + read-only + + + USBPHY_DP_EDGE_HIGH + [3:3] + read-only + + + USBPHY_DP_EDGE_LOW + [2:2] + read-only + + + USBPHY_DP_LEVEL_HIGH + [1:1] + read-only + + + USBPHY_DP_LEVEL_LOW + [0:0] + read-only + + + + + PROC1_INTE + 0x00000228 + Interrupt Enable for proc1 + 0x00000000 + + + GPIO_QSPI_SD3_EDGE_HIGH + [31:31] + read-write + + + GPIO_QSPI_SD3_EDGE_LOW + [30:30] + read-write + + + GPIO_QSPI_SD3_LEVEL_HIGH + [29:29] + read-write + + + GPIO_QSPI_SD3_LEVEL_LOW + [28:28] + read-write + + + GPIO_QSPI_SD2_EDGE_HIGH + [27:27] + read-write + + + GPIO_QSPI_SD2_EDGE_LOW + [26:26] + read-write + + + GPIO_QSPI_SD2_LEVEL_HIGH + [25:25] + read-write + + + GPIO_QSPI_SD2_LEVEL_LOW + [24:24] + read-write + + + GPIO_QSPI_SD1_EDGE_HIGH + [23:23] + read-write + + + GPIO_QSPI_SD1_EDGE_LOW + [22:22] + read-write + + + GPIO_QSPI_SD1_LEVEL_HIGH + [21:21] + read-write + + + GPIO_QSPI_SD1_LEVEL_LOW + [20:20] + read-write + + + GPIO_QSPI_SD0_EDGE_HIGH + [19:19] + read-write + + + GPIO_QSPI_SD0_EDGE_LOW + [18:18] + read-write + + + GPIO_QSPI_SD0_LEVEL_HIGH + [17:17] + read-write + + + GPIO_QSPI_SD0_LEVEL_LOW + [16:16] + read-write + + + GPIO_QSPI_SS_EDGE_HIGH + [15:15] + read-write + + + GPIO_QSPI_SS_EDGE_LOW + [14:14] + read-write + + + GPIO_QSPI_SS_LEVEL_HIGH + [13:13] + read-write + + + GPIO_QSPI_SS_LEVEL_LOW + [12:12] + read-write + + + GPIO_QSPI_SCLK_EDGE_HIGH + [11:11] + read-write + + + GPIO_QSPI_SCLK_EDGE_LOW + [10:10] + read-write + + + GPIO_QSPI_SCLK_LEVEL_HIGH + [9:9] + read-write + + + GPIO_QSPI_SCLK_LEVEL_LOW + [8:8] + read-write + + + USBPHY_DM_EDGE_HIGH + [7:7] + read-write + + + USBPHY_DM_EDGE_LOW + [6:6] + read-write + + + USBPHY_DM_LEVEL_HIGH + [5:5] + read-write + + + USBPHY_DM_LEVEL_LOW + [4:4] + read-write + + + USBPHY_DP_EDGE_HIGH + [3:3] + read-write + + + USBPHY_DP_EDGE_LOW + [2:2] + read-write + + + USBPHY_DP_LEVEL_HIGH + [1:1] + read-write + + + USBPHY_DP_LEVEL_LOW + [0:0] + read-write + + + + + PROC1_INTF + 0x0000022c + Interrupt Force for proc1 + 0x00000000 + + + GPIO_QSPI_SD3_EDGE_HIGH + [31:31] + read-write + + + GPIO_QSPI_SD3_EDGE_LOW + [30:30] + read-write + + + GPIO_QSPI_SD3_LEVEL_HIGH + [29:29] + read-write + + + GPIO_QSPI_SD3_LEVEL_LOW + [28:28] + read-write + + + GPIO_QSPI_SD2_EDGE_HIGH + [27:27] + read-write + + + GPIO_QSPI_SD2_EDGE_LOW + [26:26] + read-write + + + GPIO_QSPI_SD2_LEVEL_HIGH + [25:25] + read-write + + + GPIO_QSPI_SD2_LEVEL_LOW + [24:24] + read-write + + + GPIO_QSPI_SD1_EDGE_HIGH + [23:23] + read-write + + + GPIO_QSPI_SD1_EDGE_LOW + [22:22] + read-write + + + GPIO_QSPI_SD1_LEVEL_HIGH + [21:21] + read-write + + + GPIO_QSPI_SD1_LEVEL_LOW + [20:20] + read-write + + + GPIO_QSPI_SD0_EDGE_HIGH + [19:19] + read-write + + + GPIO_QSPI_SD0_EDGE_LOW + [18:18] + read-write + + + GPIO_QSPI_SD0_LEVEL_HIGH + [17:17] + read-write + + + GPIO_QSPI_SD0_LEVEL_LOW + [16:16] + read-write + + + GPIO_QSPI_SS_EDGE_HIGH + [15:15] + read-write + + + GPIO_QSPI_SS_EDGE_LOW + [14:14] + read-write + + + GPIO_QSPI_SS_LEVEL_HIGH + [13:13] + read-write + + + GPIO_QSPI_SS_LEVEL_LOW + [12:12] + read-write + + + GPIO_QSPI_SCLK_EDGE_HIGH + [11:11] + read-write + + + GPIO_QSPI_SCLK_EDGE_LOW + [10:10] + read-write + + + GPIO_QSPI_SCLK_LEVEL_HIGH + [9:9] + read-write + + + GPIO_QSPI_SCLK_LEVEL_LOW + [8:8] + read-write + + + USBPHY_DM_EDGE_HIGH + [7:7] + read-write + + + USBPHY_DM_EDGE_LOW + [6:6] + read-write + + + USBPHY_DM_LEVEL_HIGH + [5:5] + read-write + + + USBPHY_DM_LEVEL_LOW + [4:4] + read-write + + + USBPHY_DP_EDGE_HIGH + [3:3] + read-write + + + USBPHY_DP_EDGE_LOW + [2:2] + read-write + + + USBPHY_DP_LEVEL_HIGH + [1:1] + read-write + + + USBPHY_DP_LEVEL_LOW + [0:0] + read-write + + + + + PROC1_INTS + 0x00000230 + Interrupt status after masking & forcing for proc1 + 0x00000000 + + + GPIO_QSPI_SD3_EDGE_HIGH + [31:31] + read-only + + + GPIO_QSPI_SD3_EDGE_LOW + [30:30] + read-only + + + GPIO_QSPI_SD3_LEVEL_HIGH + [29:29] + read-only + + + GPIO_QSPI_SD3_LEVEL_LOW + [28:28] + read-only + + + GPIO_QSPI_SD2_EDGE_HIGH + [27:27] + read-only + + + GPIO_QSPI_SD2_EDGE_LOW + [26:26] + read-only + + + GPIO_QSPI_SD2_LEVEL_HIGH + [25:25] + read-only + + + GPIO_QSPI_SD2_LEVEL_LOW + [24:24] + read-only + + + GPIO_QSPI_SD1_EDGE_HIGH + [23:23] + read-only + + + GPIO_QSPI_SD1_EDGE_LOW + [22:22] + read-only + + + GPIO_QSPI_SD1_LEVEL_HIGH + [21:21] + read-only + + + GPIO_QSPI_SD1_LEVEL_LOW + [20:20] + read-only + + + GPIO_QSPI_SD0_EDGE_HIGH + [19:19] + read-only + + + GPIO_QSPI_SD0_EDGE_LOW + [18:18] + read-only + + + GPIO_QSPI_SD0_LEVEL_HIGH + [17:17] + read-only + + + GPIO_QSPI_SD0_LEVEL_LOW + [16:16] + read-only + + + GPIO_QSPI_SS_EDGE_HIGH + [15:15] + read-only + + + GPIO_QSPI_SS_EDGE_LOW + [14:14] + read-only + + + GPIO_QSPI_SS_LEVEL_HIGH + [13:13] + read-only + + + GPIO_QSPI_SS_LEVEL_LOW + [12:12] + read-only + + + GPIO_QSPI_SCLK_EDGE_HIGH + [11:11] + read-only + + + GPIO_QSPI_SCLK_EDGE_LOW + [10:10] + read-only + + + GPIO_QSPI_SCLK_LEVEL_HIGH + [9:9] + read-only + + + GPIO_QSPI_SCLK_LEVEL_LOW + [8:8] + read-only + + + USBPHY_DM_EDGE_HIGH + [7:7] + read-only + + + USBPHY_DM_EDGE_LOW + [6:6] + read-only + + + USBPHY_DM_LEVEL_HIGH + [5:5] + read-only + + + USBPHY_DM_LEVEL_LOW + [4:4] + read-only + + + USBPHY_DP_EDGE_HIGH + [3:3] + read-only + + + USBPHY_DP_EDGE_LOW + [2:2] + read-only + + + USBPHY_DP_LEVEL_HIGH + [1:1] + read-only + + + USBPHY_DP_LEVEL_LOW + [0:0] + read-only + + + + + DORMANT_WAKE_INTE + 0x00000234 + Interrupt Enable for dormant_wake + 0x00000000 + + + GPIO_QSPI_SD3_EDGE_HIGH + [31:31] + read-write + + + GPIO_QSPI_SD3_EDGE_LOW + [30:30] + read-write + + + GPIO_QSPI_SD3_LEVEL_HIGH + [29:29] + read-write + + + GPIO_QSPI_SD3_LEVEL_LOW + [28:28] + read-write + + + GPIO_QSPI_SD2_EDGE_HIGH + [27:27] + read-write + + + GPIO_QSPI_SD2_EDGE_LOW + [26:26] + read-write + + + GPIO_QSPI_SD2_LEVEL_HIGH + [25:25] + read-write + + + GPIO_QSPI_SD2_LEVEL_LOW + [24:24] + read-write + + + GPIO_QSPI_SD1_EDGE_HIGH + [23:23] + read-write + + + GPIO_QSPI_SD1_EDGE_LOW + [22:22] + read-write + + + GPIO_QSPI_SD1_LEVEL_HIGH + [21:21] + read-write + + + GPIO_QSPI_SD1_LEVEL_LOW + [20:20] + read-write + + + GPIO_QSPI_SD0_EDGE_HIGH + [19:19] + read-write + + + GPIO_QSPI_SD0_EDGE_LOW + [18:18] + read-write + + + GPIO_QSPI_SD0_LEVEL_HIGH + [17:17] + read-write + + + GPIO_QSPI_SD0_LEVEL_LOW + [16:16] + read-write + + + GPIO_QSPI_SS_EDGE_HIGH + [15:15] + read-write + + + GPIO_QSPI_SS_EDGE_LOW + [14:14] + read-write + + + GPIO_QSPI_SS_LEVEL_HIGH + [13:13] + read-write + + + GPIO_QSPI_SS_LEVEL_LOW + [12:12] + read-write + + + GPIO_QSPI_SCLK_EDGE_HIGH + [11:11] + read-write + + + GPIO_QSPI_SCLK_EDGE_LOW + [10:10] + read-write + + + GPIO_QSPI_SCLK_LEVEL_HIGH + [9:9] + read-write + + + GPIO_QSPI_SCLK_LEVEL_LOW + [8:8] + read-write + + + USBPHY_DM_EDGE_HIGH + [7:7] + read-write + + + USBPHY_DM_EDGE_LOW + [6:6] + read-write + + + USBPHY_DM_LEVEL_HIGH + [5:5] + read-write + + + USBPHY_DM_LEVEL_LOW + [4:4] + read-write + + + USBPHY_DP_EDGE_HIGH + [3:3] + read-write + + + USBPHY_DP_EDGE_LOW + [2:2] + read-write + + + USBPHY_DP_LEVEL_HIGH + [1:1] + read-write + + + USBPHY_DP_LEVEL_LOW + [0:0] + read-write + + + + + DORMANT_WAKE_INTF + 0x00000238 + Interrupt Force for dormant_wake + 0x00000000 + + + GPIO_QSPI_SD3_EDGE_HIGH + [31:31] + read-write + + + GPIO_QSPI_SD3_EDGE_LOW + [30:30] + read-write + + + GPIO_QSPI_SD3_LEVEL_HIGH + [29:29] + read-write + + + GPIO_QSPI_SD3_LEVEL_LOW + [28:28] + read-write + + + GPIO_QSPI_SD2_EDGE_HIGH + [27:27] + read-write + + + GPIO_QSPI_SD2_EDGE_LOW + [26:26] + read-write + + + GPIO_QSPI_SD2_LEVEL_HIGH + [25:25] + read-write + + + GPIO_QSPI_SD2_LEVEL_LOW + [24:24] + read-write + + + GPIO_QSPI_SD1_EDGE_HIGH + [23:23] + read-write + + + GPIO_QSPI_SD1_EDGE_LOW + [22:22] + read-write + + + GPIO_QSPI_SD1_LEVEL_HIGH + [21:21] + read-write + + + GPIO_QSPI_SD1_LEVEL_LOW + [20:20] + read-write + + + GPIO_QSPI_SD0_EDGE_HIGH + [19:19] + read-write + + + GPIO_QSPI_SD0_EDGE_LOW + [18:18] + read-write + + + GPIO_QSPI_SD0_LEVEL_HIGH + [17:17] + read-write + + + GPIO_QSPI_SD0_LEVEL_LOW + [16:16] + read-write + + + GPIO_QSPI_SS_EDGE_HIGH + [15:15] + read-write + + + GPIO_QSPI_SS_EDGE_LOW + [14:14] + read-write + + + GPIO_QSPI_SS_LEVEL_HIGH + [13:13] + read-write + + + GPIO_QSPI_SS_LEVEL_LOW + [12:12] + read-write + + + GPIO_QSPI_SCLK_EDGE_HIGH + [11:11] + read-write + + + GPIO_QSPI_SCLK_EDGE_LOW + [10:10] + read-write + + + GPIO_QSPI_SCLK_LEVEL_HIGH + [9:9] + read-write + + + GPIO_QSPI_SCLK_LEVEL_LOW + [8:8] + read-write + + + USBPHY_DM_EDGE_HIGH + [7:7] + read-write + + + USBPHY_DM_EDGE_LOW + [6:6] + read-write + + + USBPHY_DM_LEVEL_HIGH + [5:5] + read-write + + + USBPHY_DM_LEVEL_LOW + [4:4] + read-write + + + USBPHY_DP_EDGE_HIGH + [3:3] + read-write + + + USBPHY_DP_EDGE_LOW + [2:2] + read-write + + + USBPHY_DP_LEVEL_HIGH + [1:1] + read-write + + + USBPHY_DP_LEVEL_LOW + [0:0] + read-write + + + + + DORMANT_WAKE_INTS + 0x0000023c + Interrupt status after masking & forcing for dormant_wake + 0x00000000 + + + GPIO_QSPI_SD3_EDGE_HIGH + [31:31] + read-only + + + GPIO_QSPI_SD3_EDGE_LOW + [30:30] + read-only + + + GPIO_QSPI_SD3_LEVEL_HIGH + [29:29] + read-only + + + GPIO_QSPI_SD3_LEVEL_LOW + [28:28] + read-only + + + GPIO_QSPI_SD2_EDGE_HIGH + [27:27] + read-only + + + GPIO_QSPI_SD2_EDGE_LOW + [26:26] + read-only + + + GPIO_QSPI_SD2_LEVEL_HIGH + [25:25] + read-only + + + GPIO_QSPI_SD2_LEVEL_LOW + [24:24] + read-only + + + GPIO_QSPI_SD1_EDGE_HIGH + [23:23] + read-only + + + GPIO_QSPI_SD1_EDGE_LOW + [22:22] + read-only + + + GPIO_QSPI_SD1_LEVEL_HIGH + [21:21] + read-only + + + GPIO_QSPI_SD1_LEVEL_LOW + [20:20] + read-only + + + GPIO_QSPI_SD0_EDGE_HIGH + [19:19] + read-only + + + GPIO_QSPI_SD0_EDGE_LOW + [18:18] + read-only + + + GPIO_QSPI_SD0_LEVEL_HIGH + [17:17] + read-only + + + GPIO_QSPI_SD0_LEVEL_LOW + [16:16] + read-only + + + GPIO_QSPI_SS_EDGE_HIGH + [15:15] + read-only + + + GPIO_QSPI_SS_EDGE_LOW + [14:14] + read-only + + + GPIO_QSPI_SS_LEVEL_HIGH + [13:13] + read-only + + + GPIO_QSPI_SS_LEVEL_LOW + [12:12] + read-only + + + GPIO_QSPI_SCLK_EDGE_HIGH + [11:11] + read-only + + + GPIO_QSPI_SCLK_EDGE_LOW + [10:10] + read-only + + + GPIO_QSPI_SCLK_LEVEL_HIGH + [9:9] + read-only + + + GPIO_QSPI_SCLK_LEVEL_LOW + [8:8] + read-only + + + USBPHY_DM_EDGE_HIGH + [7:7] + read-only + + + USBPHY_DM_EDGE_LOW + [6:6] + read-only + + + USBPHY_DM_LEVEL_HIGH + [5:5] + read-only + + + USBPHY_DM_LEVEL_LOW + [4:4] + read-only + + + USBPHY_DP_EDGE_HIGH + [3:3] + read-only + + + USBPHY_DP_EDGE_LOW + [2:2] + read-only + + + USBPHY_DP_LEVEL_HIGH + [1:1] + read-only + + + USBPHY_DP_LEVEL_LOW + [0:0] + read-only + + + + + + + IO_BANK0 + 0x40028000 + + 0 + 800 + registers + + + IO_IRQ_BANK0 + 21 + + + IO_IRQ_BANK0_NS + 22 + + + + GPIO0_STATUS + 0x00000000 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO0_CTRL + 0x00000004 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + jtag_tck + 0 + + + spi0_rx + 1 + + + uart0_tx + 2 + + + i2c0_sda + 3 + + + pwm_a_0 + 4 + + + siob_proc_0 + 5 + + + pio0_0 + 6 + + + pio1_0 + 7 + + + pio2_0 + 8 + + + xip_ss_n_1 + 9 + + + usb_muxing_overcurr_detect + 10 + + + null + 31 + + + + + + + GPIO1_STATUS + 0x00000008 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO1_CTRL + 0x0000000c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + jtag_tms + 0 + + + spi0_ss_n + 1 + + + uart0_rx + 2 + + + i2c0_scl + 3 + + + pwm_b_0 + 4 + + + siob_proc_1 + 5 + + + pio0_1 + 6 + + + pio1_1 + 7 + + + pio2_1 + 8 + + + coresight_traceclk + 9 + + + usb_muxing_vbus_detect + 10 + + + null + 31 + + + + + + + GPIO2_STATUS + 0x00000010 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO2_CTRL + 0x00000014 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + jtag_tdi + 0 + + + spi0_sclk + 1 + + + uart0_cts + 2 + + + i2c1_sda + 3 + + + pwm_a_1 + 4 + + + siob_proc_2 + 5 + + + pio0_2 + 6 + + + pio1_2 + 7 + + + pio2_2 + 8 + + + coresight_tracedata_0 + 9 + + + usb_muxing_vbus_en + 10 + + + uart0_tx + 11 + + + null + 31 + + + + + + + GPIO3_STATUS + 0x00000018 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO3_CTRL + 0x0000001c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + jtag_tdo + 0 + + + spi0_tx + 1 + + + uart0_rts + 2 + + + i2c1_scl + 3 + + + pwm_b_1 + 4 + + + siob_proc_3 + 5 + + + pio0_3 + 6 + + + pio1_3 + 7 + + + pio2_3 + 8 + + + coresight_tracedata_1 + 9 + + + usb_muxing_overcurr_detect + 10 + + + uart0_rx + 11 + + + null + 31 + + + + + + + GPIO4_STATUS + 0x00000020 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO4_CTRL + 0x00000024 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi0_rx + 1 + + + uart1_tx + 2 + + + i2c0_sda + 3 + + + pwm_a_2 + 4 + + + siob_proc_4 + 5 + + + pio0_4 + 6 + + + pio1_4 + 7 + + + pio2_4 + 8 + + + coresight_tracedata_2 + 9 + + + usb_muxing_vbus_detect + 10 + + + null + 31 + + + + + + + GPIO5_STATUS + 0x00000028 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO5_CTRL + 0x0000002c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi0_ss_n + 1 + + + uart1_rx + 2 + + + i2c0_scl + 3 + + + pwm_b_2 + 4 + + + siob_proc_5 + 5 + + + pio0_5 + 6 + + + pio1_5 + 7 + + + pio2_5 + 8 + + + coresight_tracedata_3 + 9 + + + usb_muxing_vbus_en + 10 + + + null + 31 + + + + + + + GPIO6_STATUS + 0x00000030 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO6_CTRL + 0x00000034 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi0_sclk + 1 + + + uart1_cts + 2 + + + i2c1_sda + 3 + + + pwm_a_3 + 4 + + + siob_proc_6 + 5 + + + pio0_6 + 6 + + + pio1_6 + 7 + + + pio2_6 + 8 + + + usb_muxing_overcurr_detect + 10 + + + uart1_tx + 11 + + + null + 31 + + + + + + + GPIO7_STATUS + 0x00000038 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO7_CTRL + 0x0000003c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi0_tx + 1 + + + uart1_rts + 2 + + + i2c1_scl + 3 + + + pwm_b_3 + 4 + + + siob_proc_7 + 5 + + + pio0_7 + 6 + + + pio1_7 + 7 + + + pio2_7 + 8 + + + usb_muxing_vbus_detect + 10 + + + uart1_rx + 11 + + + null + 31 + + + + + + + GPIO8_STATUS + 0x00000040 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO8_CTRL + 0x00000044 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_rx + 1 + + + uart1_tx + 2 + + + i2c0_sda + 3 + + + pwm_a_4 + 4 + + + siob_proc_8 + 5 + + + pio0_8 + 6 + + + pio1_8 + 7 + + + pio2_8 + 8 + + + xip_ss_n_1 + 9 + + + usb_muxing_vbus_en + 10 + + + null + 31 + + + + + + + GPIO9_STATUS + 0x00000048 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO9_CTRL + 0x0000004c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_ss_n + 1 + + + uart1_rx + 2 + + + i2c0_scl + 3 + + + pwm_b_4 + 4 + + + siob_proc_9 + 5 + + + pio0_9 + 6 + + + pio1_9 + 7 + + + pio2_9 + 8 + + + usb_muxing_overcurr_detect + 10 + + + null + 31 + + + + + + + GPIO10_STATUS + 0x00000050 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO10_CTRL + 0x00000054 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_sclk + 1 + + + uart1_cts + 2 + + + i2c1_sda + 3 + + + pwm_a_5 + 4 + + + siob_proc_10 + 5 + + + pio0_10 + 6 + + + pio1_10 + 7 + + + pio2_10 + 8 + + + usb_muxing_vbus_detect + 10 + + + uart1_tx + 11 + + + null + 31 + + + + + + + GPIO11_STATUS + 0x00000058 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO11_CTRL + 0x0000005c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_tx + 1 + + + uart1_rts + 2 + + + i2c1_scl + 3 + + + pwm_b_5 + 4 + + + siob_proc_11 + 5 + + + pio0_11 + 6 + + + pio1_11 + 7 + + + pio2_11 + 8 + + + usb_muxing_vbus_en + 10 + + + uart1_rx + 11 + + + null + 31 + + + + + + + GPIO12_STATUS + 0x00000060 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO12_CTRL + 0x00000064 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + hstx_0 + 0 + + + spi1_rx + 1 + + + uart0_tx + 2 + + + i2c0_sda + 3 + + + pwm_a_6 + 4 + + + siob_proc_12 + 5 + + + pio0_12 + 6 + + + pio1_12 + 7 + + + pio2_12 + 8 + + + clocks_gpin_0 + 9 + + + usb_muxing_overcurr_detect + 10 + + + null + 31 + + + + + + + GPIO13_STATUS + 0x00000068 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO13_CTRL + 0x0000006c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + hstx_1 + 0 + + + spi1_ss_n + 1 + + + uart0_rx + 2 + + + i2c0_scl + 3 + + + pwm_b_6 + 4 + + + siob_proc_13 + 5 + + + pio0_13 + 6 + + + pio1_13 + 7 + + + pio2_13 + 8 + + + clocks_gpout_0 + 9 + + + usb_muxing_vbus_detect + 10 + + + null + 31 + + + + + + + GPIO14_STATUS + 0x00000070 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO14_CTRL + 0x00000074 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + hstx_2 + 0 + + + spi1_sclk + 1 + + + uart0_cts + 2 + + + i2c1_sda + 3 + + + pwm_a_7 + 4 + + + siob_proc_14 + 5 + + + pio0_14 + 6 + + + pio1_14 + 7 + + + pio2_14 + 8 + + + clocks_gpin_1 + 9 + + + usb_muxing_vbus_en + 10 + + + uart0_tx + 11 + + + null + 31 + + + + + + + GPIO15_STATUS + 0x00000078 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO15_CTRL + 0x0000007c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + hstx_3 + 0 + + + spi1_tx + 1 + + + uart0_rts + 2 + + + i2c1_scl + 3 + + + pwm_b_7 + 4 + + + siob_proc_15 + 5 + + + pio0_15 + 6 + + + pio1_15 + 7 + + + pio2_15 + 8 + + + clocks_gpout_1 + 9 + + + usb_muxing_overcurr_detect + 10 + + + uart0_rx + 11 + + + null + 31 + + + + + + + GPIO16_STATUS + 0x00000080 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO16_CTRL + 0x00000084 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + hstx_4 + 0 + + + spi0_rx + 1 + + + uart0_tx + 2 + + + i2c0_sda + 3 + + + pwm_a_0 + 4 + + + siob_proc_16 + 5 + + + pio0_16 + 6 + + + pio1_16 + 7 + + + pio2_16 + 8 + + + usb_muxing_vbus_detect + 10 + + + null + 31 + + + + + + + GPIO17_STATUS + 0x00000088 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO17_CTRL + 0x0000008c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + hstx_5 + 0 + + + spi0_ss_n + 1 + + + uart0_rx + 2 + + + i2c0_scl + 3 + + + pwm_b_0 + 4 + + + siob_proc_17 + 5 + + + pio0_17 + 6 + + + pio1_17 + 7 + + + pio2_17 + 8 + + + usb_muxing_vbus_en + 10 + + + null + 31 + + + + + + + GPIO18_STATUS + 0x00000090 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO18_CTRL + 0x00000094 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + hstx_6 + 0 + + + spi0_sclk + 1 + + + uart0_cts + 2 + + + i2c1_sda + 3 + + + pwm_a_1 + 4 + + + siob_proc_18 + 5 + + + pio0_18 + 6 + + + pio1_18 + 7 + + + pio2_18 + 8 + + + usb_muxing_overcurr_detect + 10 + + + uart0_tx + 11 + + + null + 31 + + + + + + + GPIO19_STATUS + 0x00000098 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO19_CTRL + 0x0000009c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + hstx_7 + 0 + + + spi0_tx + 1 + + + uart0_rts + 2 + + + i2c1_scl + 3 + + + pwm_b_1 + 4 + + + siob_proc_19 + 5 + + + pio0_19 + 6 + + + pio1_19 + 7 + + + pio2_19 + 8 + + + xip_ss_n_1 + 9 + + + usb_muxing_vbus_detect + 10 + + + uart0_rx + 11 + + + null + 31 + + + + + + + GPIO20_STATUS + 0x000000a0 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO20_CTRL + 0x000000a4 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi0_rx + 1 + + + uart1_tx + 2 + + + i2c0_sda + 3 + + + pwm_a_2 + 4 + + + siob_proc_20 + 5 + + + pio0_20 + 6 + + + pio1_20 + 7 + + + pio2_20 + 8 + + + clocks_gpin_0 + 9 + + + usb_muxing_vbus_en + 10 + + + null + 31 + + + + + + + GPIO21_STATUS + 0x000000a8 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO21_CTRL + 0x000000ac + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi0_ss_n + 1 + + + uart1_rx + 2 + + + i2c0_scl + 3 + + + pwm_b_2 + 4 + + + siob_proc_21 + 5 + + + pio0_21 + 6 + + + pio1_21 + 7 + + + pio2_21 + 8 + + + clocks_gpout_0 + 9 + + + usb_muxing_overcurr_detect + 10 + + + null + 31 + + + + + + + GPIO22_STATUS + 0x000000b0 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO22_CTRL + 0x000000b4 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi0_sclk + 1 + + + uart1_cts + 2 + + + i2c1_sda + 3 + + + pwm_a_3 + 4 + + + siob_proc_22 + 5 + + + pio0_22 + 6 + + + pio1_22 + 7 + + + pio2_22 + 8 + + + clocks_gpin_1 + 9 + + + usb_muxing_vbus_detect + 10 + + + uart1_tx + 11 + + + null + 31 + + + + + + + GPIO23_STATUS + 0x000000b8 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO23_CTRL + 0x000000bc + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi0_tx + 1 + + + uart1_rts + 2 + + + i2c1_scl + 3 + + + pwm_b_3 + 4 + + + siob_proc_23 + 5 + + + pio0_23 + 6 + + + pio1_23 + 7 + + + pio2_23 + 8 + + + clocks_gpout_1 + 9 + + + usb_muxing_vbus_en + 10 + + + uart1_rx + 11 + + + null + 31 + + + + + + + GPIO24_STATUS + 0x000000c0 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO24_CTRL + 0x000000c4 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_rx + 1 + + + uart1_tx + 2 + + + i2c0_sda + 3 + + + pwm_a_4 + 4 + + + siob_proc_24 + 5 + + + pio0_24 + 6 + + + pio1_24 + 7 + + + pio2_24 + 8 + + + clocks_gpout_2 + 9 + + + usb_muxing_overcurr_detect + 10 + + + null + 31 + + + + + + + GPIO25_STATUS + 0x000000c8 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO25_CTRL + 0x000000cc + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_ss_n + 1 + + + uart1_rx + 2 + + + i2c0_scl + 3 + + + pwm_b_4 + 4 + + + siob_proc_25 + 5 + + + pio0_25 + 6 + + + pio1_25 + 7 + + + pio2_25 + 8 + + + clocks_gpout_3 + 9 + + + usb_muxing_vbus_detect + 10 + + + null + 31 + + + + + + + GPIO26_STATUS + 0x000000d0 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO26_CTRL + 0x000000d4 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_sclk + 1 + + + uart1_cts + 2 + + + i2c1_sda + 3 + + + pwm_a_5 + 4 + + + siob_proc_26 + 5 + + + pio0_26 + 6 + + + pio1_26 + 7 + + + pio2_26 + 8 + + + usb_muxing_vbus_en + 10 + + + uart1_tx + 11 + + + null + 31 + + + + + + + GPIO27_STATUS + 0x000000d8 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO27_CTRL + 0x000000dc + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_tx + 1 + + + uart1_rts + 2 + + + i2c1_scl + 3 + + + pwm_b_5 + 4 + + + siob_proc_27 + 5 + + + pio0_27 + 6 + + + pio1_27 + 7 + + + pio2_27 + 8 + + + usb_muxing_overcurr_detect + 10 + + + uart1_rx + 11 + + + null + 31 + + + + + + + GPIO28_STATUS + 0x000000e0 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO28_CTRL + 0x000000e4 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_rx + 1 + + + uart0_tx + 2 + + + i2c0_sda + 3 + + + pwm_a_6 + 4 + + + siob_proc_28 + 5 + + + pio0_28 + 6 + + + pio1_28 + 7 + + + pio2_28 + 8 + + + usb_muxing_vbus_detect + 10 + + + null + 31 + + + + + + + GPIO29_STATUS + 0x000000e8 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO29_CTRL + 0x000000ec + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_ss_n + 1 + + + uart0_rx + 2 + + + i2c0_scl + 3 + + + pwm_b_6 + 4 + + + siob_proc_29 + 5 + + + pio0_29 + 6 + + + pio1_29 + 7 + + + pio2_29 + 8 + + + usb_muxing_vbus_en + 10 + + + null + 31 + + + + + + + GPIO30_STATUS + 0x000000f0 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO30_CTRL + 0x000000f4 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_sclk + 1 + + + uart0_cts + 2 + + + i2c1_sda + 3 + + + pwm_a_7 + 4 + + + siob_proc_30 + 5 + + + pio0_30 + 6 + + + pio1_30 + 7 + + + pio2_30 + 8 + + + usb_muxing_overcurr_detect + 10 + + + uart0_tx + 11 + + + null + 31 + + + + + + + GPIO31_STATUS + 0x000000f8 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO31_CTRL + 0x000000fc + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_tx + 1 + + + uart0_rts + 2 + + + i2c1_scl + 3 + + + pwm_b_7 + 4 + + + siob_proc_31 + 5 + + + pio0_31 + 6 + + + pio1_31 + 7 + + + pio2_31 + 8 + + + usb_muxing_vbus_detect + 10 + + + uart0_rx + 11 + + + null + 31 + + + + + + + GPIO32_STATUS + 0x00000100 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO32_CTRL + 0x00000104 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi0_rx + 1 + + + uart0_tx + 2 + + + i2c0_sda + 3 + + + pwm_a_8 + 4 + + + siob_proc_32 + 5 + + + pio0_32 + 6 + + + pio1_32 + 7 + + + pio2_32 + 8 + + + usb_muxing_vbus_en + 10 + + + null + 31 + + + + + + + GPIO33_STATUS + 0x00000108 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO33_CTRL + 0x0000010c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi0_ss_n + 1 + + + uart0_rx + 2 + + + i2c0_scl + 3 + + + pwm_b_8 + 4 + + + siob_proc_33 + 5 + + + pio0_33 + 6 + + + pio1_33 + 7 + + + pio2_33 + 8 + + + usb_muxing_overcurr_detect + 10 + + + null + 31 + + + + + + + GPIO34_STATUS + 0x00000110 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO34_CTRL + 0x00000114 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi0_sclk + 1 + + + uart0_cts + 2 + + + i2c1_sda + 3 + + + pwm_a_9 + 4 + + + siob_proc_34 + 5 + + + pio0_34 + 6 + + + pio1_34 + 7 + + + pio2_34 + 8 + + + usb_muxing_vbus_detect + 10 + + + uart0_tx + 11 + + + null + 31 + + + + + + + GPIO35_STATUS + 0x00000118 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO35_CTRL + 0x0000011c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi0_tx + 1 + + + uart0_rts + 2 + + + i2c1_scl + 3 + + + pwm_b_9 + 4 + + + siob_proc_35 + 5 + + + pio0_35 + 6 + + + pio1_35 + 7 + + + pio2_35 + 8 + + + usb_muxing_vbus_en + 10 + + + uart0_rx + 11 + + + null + 31 + + + + + + + GPIO36_STATUS + 0x00000120 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO36_CTRL + 0x00000124 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi0_rx + 1 + + + uart1_tx + 2 + + + i2c0_sda + 3 + + + pwm_a_10 + 4 + + + siob_proc_36 + 5 + + + pio0_36 + 6 + + + pio1_36 + 7 + + + pio2_36 + 8 + + + usb_muxing_overcurr_detect + 10 + + + null + 31 + + + + + + + GPIO37_STATUS + 0x00000128 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO37_CTRL + 0x0000012c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi0_ss_n + 1 + + + uart1_rx + 2 + + + i2c0_scl + 3 + + + pwm_b_10 + 4 + + + siob_proc_37 + 5 + + + pio0_37 + 6 + + + pio1_37 + 7 + + + pio2_37 + 8 + + + usb_muxing_vbus_detect + 10 + + + null + 31 + + + + + + + GPIO38_STATUS + 0x00000130 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO38_CTRL + 0x00000134 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi0_sclk + 1 + + + uart1_cts + 2 + + + i2c1_sda + 3 + + + pwm_a_11 + 4 + + + siob_proc_38 + 5 + + + pio0_38 + 6 + + + pio1_38 + 7 + + + pio2_38 + 8 + + + usb_muxing_vbus_en + 10 + + + uart1_tx + 11 + + + null + 31 + + + + + + + GPIO39_STATUS + 0x00000138 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO39_CTRL + 0x0000013c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi0_tx + 1 + + + uart1_rts + 2 + + + i2c1_scl + 3 + + + pwm_b_11 + 4 + + + siob_proc_39 + 5 + + + pio0_39 + 6 + + + pio1_39 + 7 + + + pio2_39 + 8 + + + usb_muxing_overcurr_detect + 10 + + + uart1_rx + 11 + + + null + 31 + + + + + + + GPIO40_STATUS + 0x00000140 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO40_CTRL + 0x00000144 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_rx + 1 + + + uart1_tx + 2 + + + i2c0_sda + 3 + + + pwm_a_8 + 4 + + + siob_proc_40 + 5 + + + pio0_40 + 6 + + + pio1_40 + 7 + + + pio2_40 + 8 + + + usb_muxing_vbus_detect + 10 + + + null + 31 + + + + + + + GPIO41_STATUS + 0x00000148 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO41_CTRL + 0x0000014c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_ss_n + 1 + + + uart1_rx + 2 + + + i2c0_scl + 3 + + + pwm_b_8 + 4 + + + siob_proc_41 + 5 + + + pio0_41 + 6 + + + pio1_41 + 7 + + + pio2_41 + 8 + + + usb_muxing_vbus_en + 10 + + + null + 31 + + + + + + + GPIO42_STATUS + 0x00000150 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO42_CTRL + 0x00000154 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_sclk + 1 + + + uart1_cts + 2 + + + i2c1_sda + 3 + + + pwm_a_9 + 4 + + + siob_proc_42 + 5 + + + pio0_42 + 6 + + + pio1_42 + 7 + + + pio2_42 + 8 + + + usb_muxing_overcurr_detect + 10 + + + uart1_tx + 11 + + + null + 31 + + + + + + + GPIO43_STATUS + 0x00000158 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO43_CTRL + 0x0000015c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_tx + 1 + + + uart1_rts + 2 + + + i2c1_scl + 3 + + + pwm_b_9 + 4 + + + siob_proc_43 + 5 + + + pio0_43 + 6 + + + pio1_43 + 7 + + + pio2_43 + 8 + + + usb_muxing_vbus_detect + 10 + + + uart1_rx + 11 + + + null + 31 + + + + + + + GPIO44_STATUS + 0x00000160 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO44_CTRL + 0x00000164 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_rx + 1 + + + uart0_tx + 2 + + + i2c0_sda + 3 + + + pwm_a_10 + 4 + + + siob_proc_44 + 5 + + + pio0_44 + 6 + + + pio1_44 + 7 + + + pio2_44 + 8 + + + usb_muxing_vbus_en + 10 + + + null + 31 + + + + + + + GPIO45_STATUS + 0x00000168 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO45_CTRL + 0x0000016c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_ss_n + 1 + + + uart0_rx + 2 + + + i2c0_scl + 3 + + + pwm_b_10 + 4 + + + siob_proc_45 + 5 + + + pio0_45 + 6 + + + pio1_45 + 7 + + + pio2_45 + 8 + + + usb_muxing_overcurr_detect + 10 + + + null + 31 + + + + + + + GPIO46_STATUS + 0x00000170 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO46_CTRL + 0x00000174 + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_sclk + 1 + + + uart0_cts + 2 + + + i2c1_sda + 3 + + + pwm_a_11 + 4 + + + siob_proc_46 + 5 + + + pio0_46 + 6 + + + pio1_46 + 7 + + + pio2_46 + 8 + + + usb_muxing_vbus_detect + 10 + + + uart0_tx + 11 + + + null + 31 + + + + + + + GPIO47_STATUS + 0x00000178 + 0x00000000 + + + IRQTOPROC + interrupt to processors, after override is applied + [26:26] + read-only + + + INFROMPAD + input signal from pad, before filtering and override are applied + [17:17] + read-only + + + OETOPAD + output enable to pad after register override is applied + [13:13] + read-only + + + OUTTOPAD + output signal to pad after register override is applied + [9:9] + read-only + + + + + GPIO47_CTRL + 0x0000017c + 0x0000001f + + + IRQOVER + [29:28] + read-write + + + NORMAL + 0 + don't invert the interrupt + + + INVERT + 1 + invert the interrupt + + + LOW + 2 + drive interrupt low + + + HIGH + 3 + drive interrupt high + + + + + INOVER + [17:16] + read-write + + + NORMAL + 0 + don't invert the peri input + + + INVERT + 1 + invert the peri input + + + LOW + 2 + drive peri input low + + + HIGH + 3 + drive peri input high + + + + + OEOVER + [15:14] + read-write + + + NORMAL + 0 + drive output enable from peripheral signal selected by funcsel + + + INVERT + 1 + drive output enable from inverse of peripheral signal selected by funcsel + + + DISABLE + 2 + disable output + + + ENABLE + 3 + enable output + + + + + OUTOVER + [13:12] + read-write + + + NORMAL + 0 + drive output from peripheral signal selected by funcsel + + + INVERT + 1 + drive output from inverse of peripheral signal selected by funcsel + + + LOW + 2 + drive output low + + + HIGH + 3 + drive output high + + + + + FUNCSEL + 0-31 -> selects pin function according to the gpio table + 31 == NULL + [4:0] + read-write + + + spi1_tx + 1 + + + uart0_rts + 2 + + + i2c1_scl + 3 + + + pwm_b_11 + 4 + + + siob_proc_47 + 5 + + + pio0_47 + 6 + + + pio1_47 + 7 + + + pio2_47 + 8 + + + xip_ss_n_1 + 9 + + + usb_muxing_vbus_en + 10 + + + uart0_rx + 11 + + + null + 31 + + + + + + + IRQSUMMARY_PROC0_SECURE0 + 0x00000200 + 0x00000000 + + + GPIO31 + [31:31] + read-only + + + GPIO30 + [30:30] + read-only + + + GPIO29 + [29:29] + read-only + + + GPIO28 + [28:28] + read-only + + + GPIO27 + [27:27] + read-only + + + GPIO26 + [26:26] + read-only + + + GPIO25 + [25:25] + read-only + + + GPIO24 + [24:24] + read-only + + + GPIO23 + [23:23] + read-only + + + GPIO22 + [22:22] + read-only + + + GPIO21 + [21:21] + read-only + + + GPIO20 + [20:20] + read-only + + + GPIO19 + [19:19] + read-only + + + GPIO18 + [18:18] + read-only + + + GPIO17 + [17:17] + read-only + + + GPIO16 + [16:16] + read-only + + + GPIO15 + [15:15] + read-only + + + GPIO14 + [14:14] + read-only + + + GPIO13 + [13:13] + read-only + + + GPIO12 + [12:12] + read-only + + + GPIO11 + [11:11] + read-only + + + GPIO10 + [10:10] + read-only + + + GPIO9 + [9:9] + read-only + + + GPIO8 + [8:8] + read-only + + + GPIO7 + [7:7] + read-only + + + GPIO6 + [6:6] + read-only + + + GPIO5 + [5:5] + read-only + + + GPIO4 + [4:4] + read-only + + + GPIO3 + [3:3] + read-only + + + GPIO2 + [2:2] + read-only + + + GPIO1 + [1:1] + read-only + + + GPIO0 + [0:0] + read-only + + + + + IRQSUMMARY_PROC0_SECURE1 + 0x00000204 + 0x00000000 + + + GPIO47 + [15:15] + read-only + + + GPIO46 + [14:14] + read-only + + + GPIO45 + [13:13] + read-only + + + GPIO44 + [12:12] + read-only + + + GPIO43 + [11:11] + read-only + + + GPIO42 + [10:10] + read-only + + + GPIO41 + [9:9] + read-only + + + GPIO40 + [8:8] + read-only + + + GPIO39 + [7:7] + read-only + + + GPIO38 + [6:6] + read-only + + + GPIO37 + [5:5] + read-only + + + GPIO36 + [4:4] + read-only + + + GPIO35 + [3:3] + read-only + + + GPIO34 + [2:2] + read-only + + + GPIO33 + [1:1] + read-only + + + GPIO32 + [0:0] + read-only + + + + + IRQSUMMARY_PROC0_NONSECURE0 + 0x00000208 + 0x00000000 + + + GPIO31 + [31:31] + read-only + + + GPIO30 + [30:30] + read-only + + + GPIO29 + [29:29] + read-only + + + GPIO28 + [28:28] + read-only + + + GPIO27 + [27:27] + read-only + + + GPIO26 + [26:26] + read-only + + + GPIO25 + [25:25] + read-only + + + GPIO24 + [24:24] + read-only + + + GPIO23 + [23:23] + read-only + + + GPIO22 + [22:22] + read-only + + + GPIO21 + [21:21] + read-only + + + GPIO20 + [20:20] + read-only + + + GPIO19 + [19:19] + read-only + + + GPIO18 + [18:18] + read-only + + + GPIO17 + [17:17] + read-only + + + GPIO16 + [16:16] + read-only + + + GPIO15 + [15:15] + read-only + + + GPIO14 + [14:14] + read-only + + + GPIO13 + [13:13] + read-only + + + GPIO12 + [12:12] + read-only + + + GPIO11 + [11:11] + read-only + + + GPIO10 + [10:10] + read-only + + + GPIO9 + [9:9] + read-only + + + GPIO8 + [8:8] + read-only + + + GPIO7 + [7:7] + read-only + + + GPIO6 + [6:6] + read-only + + + GPIO5 + [5:5] + read-only + + + GPIO4 + [4:4] + read-only + + + GPIO3 + [3:3] + read-only + + + GPIO2 + [2:2] + read-only + + + GPIO1 + [1:1] + read-only + + + GPIO0 + [0:0] + read-only + + + + + IRQSUMMARY_PROC0_NONSECURE1 + 0x0000020c + 0x00000000 + + + GPIO47 + [15:15] + read-only + + + GPIO46 + [14:14] + read-only + + + GPIO45 + [13:13] + read-only + + + GPIO44 + [12:12] + read-only + + + GPIO43 + [11:11] + read-only + + + GPIO42 + [10:10] + read-only + + + GPIO41 + [9:9] + read-only + + + GPIO40 + [8:8] + read-only + + + GPIO39 + [7:7] + read-only + + + GPIO38 + [6:6] + read-only + + + GPIO37 + [5:5] + read-only + + + GPIO36 + [4:4] + read-only + + + GPIO35 + [3:3] + read-only + + + GPIO34 + [2:2] + read-only + + + GPIO33 + [1:1] + read-only + + + GPIO32 + [0:0] + read-only + + + + + IRQSUMMARY_PROC1_SECURE0 + 0x00000210 + 0x00000000 + + + GPIO31 + [31:31] + read-only + + + GPIO30 + [30:30] + read-only + + + GPIO29 + [29:29] + read-only + + + GPIO28 + [28:28] + read-only + + + GPIO27 + [27:27] + read-only + + + GPIO26 + [26:26] + read-only + + + GPIO25 + [25:25] + read-only + + + GPIO24 + [24:24] + read-only + + + GPIO23 + [23:23] + read-only + + + GPIO22 + [22:22] + read-only + + + GPIO21 + [21:21] + read-only + + + GPIO20 + [20:20] + read-only + + + GPIO19 + [19:19] + read-only + + + GPIO18 + [18:18] + read-only + + + GPIO17 + [17:17] + read-only + + + GPIO16 + [16:16] + read-only + + + GPIO15 + [15:15] + read-only + + + GPIO14 + [14:14] + read-only + + + GPIO13 + [13:13] + read-only + + + GPIO12 + [12:12] + read-only + + + GPIO11 + [11:11] + read-only + + + GPIO10 + [10:10] + read-only + + + GPIO9 + [9:9] + read-only + + + GPIO8 + [8:8] + read-only + + + GPIO7 + [7:7] + read-only + + + GPIO6 + [6:6] + read-only + + + GPIO5 + [5:5] + read-only + + + GPIO4 + [4:4] + read-only + + + GPIO3 + [3:3] + read-only + + + GPIO2 + [2:2] + read-only + + + GPIO1 + [1:1] + read-only + + + GPIO0 + [0:0] + read-only + + + + + IRQSUMMARY_PROC1_SECURE1 + 0x00000214 + 0x00000000 + + + GPIO47 + [15:15] + read-only + + + GPIO46 + [14:14] + read-only + + + GPIO45 + [13:13] + read-only + + + GPIO44 + [12:12] + read-only + + + GPIO43 + [11:11] + read-only + + + GPIO42 + [10:10] + read-only + + + GPIO41 + [9:9] + read-only + + + GPIO40 + [8:8] + read-only + + + GPIO39 + [7:7] + read-only + + + GPIO38 + [6:6] + read-only + + + GPIO37 + [5:5] + read-only + + + GPIO36 + [4:4] + read-only + + + GPIO35 + [3:3] + read-only + + + GPIO34 + [2:2] + read-only + + + GPIO33 + [1:1] + read-only + + + GPIO32 + [0:0] + read-only + + + + + IRQSUMMARY_PROC1_NONSECURE0 + 0x00000218 + 0x00000000 + + + GPIO31 + [31:31] + read-only + + + GPIO30 + [30:30] + read-only + + + GPIO29 + [29:29] + read-only + + + GPIO28 + [28:28] + read-only + + + GPIO27 + [27:27] + read-only + + + GPIO26 + [26:26] + read-only + + + GPIO25 + [25:25] + read-only + + + GPIO24 + [24:24] + read-only + + + GPIO23 + [23:23] + read-only + + + GPIO22 + [22:22] + read-only + + + GPIO21 + [21:21] + read-only + + + GPIO20 + [20:20] + read-only + + + GPIO19 + [19:19] + read-only + + + GPIO18 + [18:18] + read-only + + + GPIO17 + [17:17] + read-only + + + GPIO16 + [16:16] + read-only + + + GPIO15 + [15:15] + read-only + + + GPIO14 + [14:14] + read-only + + + GPIO13 + [13:13] + read-only + + + GPIO12 + [12:12] + read-only + + + GPIO11 + [11:11] + read-only + + + GPIO10 + [10:10] + read-only + + + GPIO9 + [9:9] + read-only + + + GPIO8 + [8:8] + read-only + + + GPIO7 + [7:7] + read-only + + + GPIO6 + [6:6] + read-only + + + GPIO5 + [5:5] + read-only + + + GPIO4 + [4:4] + read-only + + + GPIO3 + [3:3] + read-only + + + GPIO2 + [2:2] + read-only + + + GPIO1 + [1:1] + read-only + + + GPIO0 + [0:0] + read-only + + + + + IRQSUMMARY_PROC1_NONSECURE1 + 0x0000021c + 0x00000000 + + + GPIO47 + [15:15] + read-only + + + GPIO46 + [14:14] + read-only + + + GPIO45 + [13:13] + read-only + + + GPIO44 + [12:12] + read-only + + + GPIO43 + [11:11] + read-only + + + GPIO42 + [10:10] + read-only + + + GPIO41 + [9:9] + read-only + + + GPIO40 + [8:8] + read-only + + + GPIO39 + [7:7] + read-only + + + GPIO38 + [6:6] + read-only + + + GPIO37 + [5:5] + read-only + + + GPIO36 + [4:4] + read-only + + + GPIO35 + [3:3] + read-only + + + GPIO34 + [2:2] + read-only + + + GPIO33 + [1:1] + read-only + + + GPIO32 + [0:0] + read-only + + + + + IRQSUMMARY_DORMANT_WAKE_SECURE0 + 0x00000220 + 0x00000000 + + + GPIO31 + [31:31] + read-only + + + GPIO30 + [30:30] + read-only + + + GPIO29 + [29:29] + read-only + + + GPIO28 + [28:28] + read-only + + + GPIO27 + [27:27] + read-only + + + GPIO26 + [26:26] + read-only + + + GPIO25 + [25:25] + read-only + + + GPIO24 + [24:24] + read-only + + + GPIO23 + [23:23] + read-only + + + GPIO22 + [22:22] + read-only + + + GPIO21 + [21:21] + read-only + + + GPIO20 + [20:20] + read-only + + + GPIO19 + [19:19] + read-only + + + GPIO18 + [18:18] + read-only + + + GPIO17 + [17:17] + read-only + + + GPIO16 + [16:16] + read-only + + + GPIO15 + [15:15] + read-only + + + GPIO14 + [14:14] + read-only + + + GPIO13 + [13:13] + read-only + + + GPIO12 + [12:12] + read-only + + + GPIO11 + [11:11] + read-only + + + GPIO10 + [10:10] + read-only + + + GPIO9 + [9:9] + read-only + + + GPIO8 + [8:8] + read-only + + + GPIO7 + [7:7] + read-only + + + GPIO6 + [6:6] + read-only + + + GPIO5 + [5:5] + read-only + + + GPIO4 + [4:4] + read-only + + + GPIO3 + [3:3] + read-only + + + GPIO2 + [2:2] + read-only + + + GPIO1 + [1:1] + read-only + + + GPIO0 + [0:0] + read-only + + + + + IRQSUMMARY_DORMANT_WAKE_SECURE1 + 0x00000224 + 0x00000000 + + + GPIO47 + [15:15] + read-only + + + GPIO46 + [14:14] + read-only + + + GPIO45 + [13:13] + read-only + + + GPIO44 + [12:12] + read-only + + + GPIO43 + [11:11] + read-only + + + GPIO42 + [10:10] + read-only + + + GPIO41 + [9:9] + read-only + + + GPIO40 + [8:8] + read-only + + + GPIO39 + [7:7] + read-only + + + GPIO38 + [6:6] + read-only + + + GPIO37 + [5:5] + read-only + + + GPIO36 + [4:4] + read-only + + + GPIO35 + [3:3] + read-only + + + GPIO34 + [2:2] + read-only + + + GPIO33 + [1:1] + read-only + + + GPIO32 + [0:0] + read-only + + + + + IRQSUMMARY_DORMANT_WAKE_NONSECURE0 + 0x00000228 + 0x00000000 + + + GPIO31 + [31:31] + read-only + + + GPIO30 + [30:30] + read-only + + + GPIO29 + [29:29] + read-only + + + GPIO28 + [28:28] + read-only + + + GPIO27 + [27:27] + read-only + + + GPIO26 + [26:26] + read-only + + + GPIO25 + [25:25] + read-only + + + GPIO24 + [24:24] + read-only + + + GPIO23 + [23:23] + read-only + + + GPIO22 + [22:22] + read-only + + + GPIO21 + [21:21] + read-only + + + GPIO20 + [20:20] + read-only + + + GPIO19 + [19:19] + read-only + + + GPIO18 + [18:18] + read-only + + + GPIO17 + [17:17] + read-only + + + GPIO16 + [16:16] + read-only + + + GPIO15 + [15:15] + read-only + + + GPIO14 + [14:14] + read-only + + + GPIO13 + [13:13] + read-only + + + GPIO12 + [12:12] + read-only + + + GPIO11 + [11:11] + read-only + + + GPIO10 + [10:10] + read-only + + + GPIO9 + [9:9] + read-only + + + GPIO8 + [8:8] + read-only + + + GPIO7 + [7:7] + read-only + + + GPIO6 + [6:6] + read-only + + + GPIO5 + [5:5] + read-only + + + GPIO4 + [4:4] + read-only + + + GPIO3 + [3:3] + read-only + + + GPIO2 + [2:2] + read-only + + + GPIO1 + [1:1] + read-only + + + GPIO0 + [0:0] + read-only + + + + + IRQSUMMARY_DORMANT_WAKE_NONSECURE1 + 0x0000022c + 0x00000000 + + + GPIO47 + [15:15] + read-only + + + GPIO46 + [14:14] + read-only + + + GPIO45 + [13:13] + read-only + + + GPIO44 + [12:12] + read-only + + + GPIO43 + [11:11] + read-only + + + GPIO42 + [10:10] + read-only + + + GPIO41 + [9:9] + read-only + + + GPIO40 + [8:8] + read-only + + + GPIO39 + [7:7] + read-only + + + GPIO38 + [6:6] + read-only + + + GPIO37 + [5:5] + read-only + + + GPIO36 + [4:4] + read-only + + + GPIO35 + [3:3] + read-only + + + GPIO34 + [2:2] + read-only + + + GPIO33 + [1:1] + read-only + + + GPIO32 + [0:0] + read-only + + + + + INTR0 + 0x00000230 + Raw Interrupts + 0x00000000 + + + GPIO7_EDGE_HIGH + [31:31] + read-write + oneToClear + + + GPIO7_EDGE_LOW + [30:30] + read-write + oneToClear + + + GPIO7_LEVEL_HIGH + [29:29] + read-only + + + GPIO7_LEVEL_LOW + [28:28] + read-only + + + GPIO6_EDGE_HIGH + [27:27] + read-write + oneToClear + + + GPIO6_EDGE_LOW + [26:26] + read-write + oneToClear + + + GPIO6_LEVEL_HIGH + [25:25] + read-only + + + GPIO6_LEVEL_LOW + [24:24] + read-only + + + GPIO5_EDGE_HIGH + [23:23] + read-write + oneToClear + + + GPIO5_EDGE_LOW + [22:22] + read-write + oneToClear + + + GPIO5_LEVEL_HIGH + [21:21] + read-only + + + GPIO5_LEVEL_LOW + [20:20] + read-only + + + GPIO4_EDGE_HIGH + [19:19] + read-write + oneToClear + + + GPIO4_EDGE_LOW + [18:18] + read-write + oneToClear + + + GPIO4_LEVEL_HIGH + [17:17] + read-only + + + GPIO4_LEVEL_LOW + [16:16] + read-only + + + GPIO3_EDGE_HIGH + [15:15] + read-write + oneToClear + + + GPIO3_EDGE_LOW + [14:14] + read-write + oneToClear + + + GPIO3_LEVEL_HIGH + [13:13] + read-only + + + GPIO3_LEVEL_LOW + [12:12] + read-only + + + GPIO2_EDGE_HIGH + [11:11] + read-write + oneToClear + + + GPIO2_EDGE_LOW + [10:10] + read-write + oneToClear + + + GPIO2_LEVEL_HIGH + [9:9] + read-only + + + GPIO2_LEVEL_LOW + [8:8] + read-only + + + GPIO1_EDGE_HIGH + [7:7] + read-write + oneToClear + + + GPIO1_EDGE_LOW + [6:6] + read-write + oneToClear + + + GPIO1_LEVEL_HIGH + [5:5] + read-only + + + GPIO1_LEVEL_LOW + [4:4] + read-only + + + GPIO0_EDGE_HIGH + [3:3] + read-write + oneToClear + + + GPIO0_EDGE_LOW + [2:2] + read-write + oneToClear + + + GPIO0_LEVEL_HIGH + [1:1] + read-only + + + GPIO0_LEVEL_LOW + [0:0] + read-only + + + + + INTR1 + 0x00000234 + Raw Interrupts + 0x00000000 + + + GPIO15_EDGE_HIGH + [31:31] + read-write + oneToClear + + + GPIO15_EDGE_LOW + [30:30] + read-write + oneToClear + + + GPIO15_LEVEL_HIGH + [29:29] + read-only + + + GPIO15_LEVEL_LOW + [28:28] + read-only + + + GPIO14_EDGE_HIGH + [27:27] + read-write + oneToClear + + + GPIO14_EDGE_LOW + [26:26] + read-write + oneToClear + + + GPIO14_LEVEL_HIGH + [25:25] + read-only + + + GPIO14_LEVEL_LOW + [24:24] + read-only + + + GPIO13_EDGE_HIGH + [23:23] + read-write + oneToClear + + + GPIO13_EDGE_LOW + [22:22] + read-write + oneToClear + + + GPIO13_LEVEL_HIGH + [21:21] + read-only + + + GPIO13_LEVEL_LOW + [20:20] + read-only + + + GPIO12_EDGE_HIGH + [19:19] + read-write + oneToClear + + + GPIO12_EDGE_LOW + [18:18] + read-write + oneToClear + + + GPIO12_LEVEL_HIGH + [17:17] + read-only + + + GPIO12_LEVEL_LOW + [16:16] + read-only + + + GPIO11_EDGE_HIGH + [15:15] + read-write + oneToClear + + + GPIO11_EDGE_LOW + [14:14] + read-write + oneToClear + + + GPIO11_LEVEL_HIGH + [13:13] + read-only + + + GPIO11_LEVEL_LOW + [12:12] + read-only + + + GPIO10_EDGE_HIGH + [11:11] + read-write + oneToClear + + + GPIO10_EDGE_LOW + [10:10] + read-write + oneToClear + + + GPIO10_LEVEL_HIGH + [9:9] + read-only + + + GPIO10_LEVEL_LOW + [8:8] + read-only + + + GPIO9_EDGE_HIGH + [7:7] + read-write + oneToClear + + + GPIO9_EDGE_LOW + [6:6] + read-write + oneToClear + + + GPIO9_LEVEL_HIGH + [5:5] + read-only + + + GPIO9_LEVEL_LOW + [4:4] + read-only + + + GPIO8_EDGE_HIGH + [3:3] + read-write + oneToClear + + + GPIO8_EDGE_LOW + [2:2] + read-write + oneToClear + + + GPIO8_LEVEL_HIGH + [1:1] + read-only + + + GPIO8_LEVEL_LOW + [0:0] + read-only + + + + + INTR2 + 0x00000238 + Raw Interrupts + 0x00000000 + + + GPIO23_EDGE_HIGH + [31:31] + read-write + oneToClear + + + GPIO23_EDGE_LOW + [30:30] + read-write + oneToClear + + + GPIO23_LEVEL_HIGH + [29:29] + read-only + + + GPIO23_LEVEL_LOW + [28:28] + read-only + + + GPIO22_EDGE_HIGH + [27:27] + read-write + oneToClear + + + GPIO22_EDGE_LOW + [26:26] + read-write + oneToClear + + + GPIO22_LEVEL_HIGH + [25:25] + read-only + + + GPIO22_LEVEL_LOW + [24:24] + read-only + + + GPIO21_EDGE_HIGH + [23:23] + read-write + oneToClear + + + GPIO21_EDGE_LOW + [22:22] + read-write + oneToClear + + + GPIO21_LEVEL_HIGH + [21:21] + read-only + + + GPIO21_LEVEL_LOW + [20:20] + read-only + + + GPIO20_EDGE_HIGH + [19:19] + read-write + oneToClear + + + GPIO20_EDGE_LOW + [18:18] + read-write + oneToClear + + + GPIO20_LEVEL_HIGH + [17:17] + read-only + + + GPIO20_LEVEL_LOW + [16:16] + read-only + + + GPIO19_EDGE_HIGH + [15:15] + read-write + oneToClear + + + GPIO19_EDGE_LOW + [14:14] + read-write + oneToClear + + + GPIO19_LEVEL_HIGH + [13:13] + read-only + + + GPIO19_LEVEL_LOW + [12:12] + read-only + + + GPIO18_EDGE_HIGH + [11:11] + read-write + oneToClear + + + GPIO18_EDGE_LOW + [10:10] + read-write + oneToClear + + + GPIO18_LEVEL_HIGH + [9:9] + read-only + + + GPIO18_LEVEL_LOW + [8:8] + read-only + + + GPIO17_EDGE_HIGH + [7:7] + read-write + oneToClear + + + GPIO17_EDGE_LOW + [6:6] + read-write + oneToClear + + + GPIO17_LEVEL_HIGH + [5:5] + read-only + + + GPIO17_LEVEL_LOW + [4:4] + read-only + + + GPIO16_EDGE_HIGH + [3:3] + read-write + oneToClear + + + GPIO16_EDGE_LOW + [2:2] + read-write + oneToClear + + + GPIO16_LEVEL_HIGH + [1:1] + read-only + + + GPIO16_LEVEL_LOW + [0:0] + read-only + + + + + INTR3 + 0x0000023c + Raw Interrupts + 0x00000000 + + + GPIO31_EDGE_HIGH + [31:31] + read-write + oneToClear + + + GPIO31_EDGE_LOW + [30:30] + read-write + oneToClear + + + GPIO31_LEVEL_HIGH + [29:29] + read-only + + + GPIO31_LEVEL_LOW + [28:28] + read-only + + + GPIO30_EDGE_HIGH + [27:27] + read-write + oneToClear + + + GPIO30_EDGE_LOW + [26:26] + read-write + oneToClear + + + GPIO30_LEVEL_HIGH + [25:25] + read-only + + + GPIO30_LEVEL_LOW + [24:24] + read-only + + + GPIO29_EDGE_HIGH + [23:23] + read-write + oneToClear + + + GPIO29_EDGE_LOW + [22:22] + read-write + oneToClear + + + GPIO29_LEVEL_HIGH + [21:21] + read-only + + + GPIO29_LEVEL_LOW + [20:20] + read-only + + + GPIO28_EDGE_HIGH + [19:19] + read-write + oneToClear + + + GPIO28_EDGE_LOW + [18:18] + read-write + oneToClear + + + GPIO28_LEVEL_HIGH + [17:17] + read-only + + + GPIO28_LEVEL_LOW + [16:16] + read-only + + + GPIO27_EDGE_HIGH + [15:15] + read-write + oneToClear + + + GPIO27_EDGE_LOW + [14:14] + read-write + oneToClear + + + GPIO27_LEVEL_HIGH + [13:13] + read-only + + + GPIO27_LEVEL_LOW + [12:12] + read-only + + + GPIO26_EDGE_HIGH + [11:11] + read-write + oneToClear + + + GPIO26_EDGE_LOW + [10:10] + read-write + oneToClear + + + GPIO26_LEVEL_HIGH + [9:9] + read-only + + + GPIO26_LEVEL_LOW + [8:8] + read-only + + + GPIO25_EDGE_HIGH + [7:7] + read-write + oneToClear + + + GPIO25_EDGE_LOW + [6:6] + read-write + oneToClear + + + GPIO25_LEVEL_HIGH + [5:5] + read-only + + + GPIO25_LEVEL_LOW + [4:4] + read-only + + + GPIO24_EDGE_HIGH + [3:3] + read-write + oneToClear + + + GPIO24_EDGE_LOW + [2:2] + read-write + oneToClear + + + GPIO24_LEVEL_HIGH + [1:1] + read-only + + + GPIO24_LEVEL_LOW + [0:0] + read-only + + + + + INTR4 + 0x00000240 + Raw Interrupts + 0x00000000 + + + GPIO39_EDGE_HIGH + [31:31] + read-write + oneToClear + + + GPIO39_EDGE_LOW + [30:30] + read-write + oneToClear + + + GPIO39_LEVEL_HIGH + [29:29] + read-only + + + GPIO39_LEVEL_LOW + [28:28] + read-only + + + GPIO38_EDGE_HIGH + [27:27] + read-write + oneToClear + + + GPIO38_EDGE_LOW + [26:26] + read-write + oneToClear + + + GPIO38_LEVEL_HIGH + [25:25] + read-only + + + GPIO38_LEVEL_LOW + [24:24] + read-only + + + GPIO37_EDGE_HIGH + [23:23] + read-write + oneToClear + + + GPIO37_EDGE_LOW + [22:22] + read-write + oneToClear + + + GPIO37_LEVEL_HIGH + [21:21] + read-only + + + GPIO37_LEVEL_LOW + [20:20] + read-only + + + GPIO36_EDGE_HIGH + [19:19] + read-write + oneToClear + + + GPIO36_EDGE_LOW + [18:18] + read-write + oneToClear + + + GPIO36_LEVEL_HIGH + [17:17] + read-only + + + GPIO36_LEVEL_LOW + [16:16] + read-only + + + GPIO35_EDGE_HIGH + [15:15] + read-write + oneToClear + + + GPIO35_EDGE_LOW + [14:14] + read-write + oneToClear + + + GPIO35_LEVEL_HIGH + [13:13] + read-only + + + GPIO35_LEVEL_LOW + [12:12] + read-only + + + GPIO34_EDGE_HIGH + [11:11] + read-write + oneToClear + + + GPIO34_EDGE_LOW + [10:10] + read-write + oneToClear + + + GPIO34_LEVEL_HIGH + [9:9] + read-only + + + GPIO34_LEVEL_LOW + [8:8] + read-only + + + GPIO33_EDGE_HIGH + [7:7] + read-write + oneToClear + + + GPIO33_EDGE_LOW + [6:6] + read-write + oneToClear + + + GPIO33_LEVEL_HIGH + [5:5] + read-only + + + GPIO33_LEVEL_LOW + [4:4] + read-only + + + GPIO32_EDGE_HIGH + [3:3] + read-write + oneToClear + + + GPIO32_EDGE_LOW + [2:2] + read-write + oneToClear + + + GPIO32_LEVEL_HIGH + [1:1] + read-only + + + GPIO32_LEVEL_LOW + [0:0] + read-only + + + + + INTR5 + 0x00000244 + Raw Interrupts + 0x00000000 + + + GPIO47_EDGE_HIGH + [31:31] + read-write + oneToClear + + + GPIO47_EDGE_LOW + [30:30] + read-write + oneToClear + + + GPIO47_LEVEL_HIGH + [29:29] + read-only + + + GPIO47_LEVEL_LOW + [28:28] + read-only + + + GPIO46_EDGE_HIGH + [27:27] + read-write + oneToClear + + + GPIO46_EDGE_LOW + [26:26] + read-write + oneToClear + + + GPIO46_LEVEL_HIGH + [25:25] + read-only + + + GPIO46_LEVEL_LOW + [24:24] + read-only + + + GPIO45_EDGE_HIGH + [23:23] + read-write + oneToClear + + + GPIO45_EDGE_LOW + [22:22] + read-write + oneToClear + + + GPIO45_LEVEL_HIGH + [21:21] + read-only + + + GPIO45_LEVEL_LOW + [20:20] + read-only + + + GPIO44_EDGE_HIGH + [19:19] + read-write + oneToClear + + + GPIO44_EDGE_LOW + [18:18] + read-write + oneToClear + + + GPIO44_LEVEL_HIGH + [17:17] + read-only + + + GPIO44_LEVEL_LOW + [16:16] + read-only + + + GPIO43_EDGE_HIGH + [15:15] + read-write + oneToClear + + + GPIO43_EDGE_LOW + [14:14] + read-write + oneToClear + + + GPIO43_LEVEL_HIGH + [13:13] + read-only + + + GPIO43_LEVEL_LOW + [12:12] + read-only + + + GPIO42_EDGE_HIGH + [11:11] + read-write + oneToClear + + + GPIO42_EDGE_LOW + [10:10] + read-write + oneToClear + + + GPIO42_LEVEL_HIGH + [9:9] + read-only + + + GPIO42_LEVEL_LOW + [8:8] + read-only + + + GPIO41_EDGE_HIGH + [7:7] + read-write + oneToClear + + + GPIO41_EDGE_LOW + [6:6] + read-write + oneToClear + + + GPIO41_LEVEL_HIGH + [5:5] + read-only + + + GPIO41_LEVEL_LOW + [4:4] + read-only + + + GPIO40_EDGE_HIGH + [3:3] + read-write + oneToClear + + + GPIO40_EDGE_LOW + [2:2] + read-write + oneToClear + + + GPIO40_LEVEL_HIGH + [1:1] + read-only + + + GPIO40_LEVEL_LOW + [0:0] + read-only + + + + + PROC0_INTE0 + 0x00000248 + Interrupt Enable for proc0 + 0x00000000 + + + GPIO7_EDGE_HIGH + [31:31] + read-write + + + GPIO7_EDGE_LOW + [30:30] + read-write + + + GPIO7_LEVEL_HIGH + [29:29] + read-write + + + GPIO7_LEVEL_LOW + [28:28] + read-write + + + GPIO6_EDGE_HIGH + [27:27] + read-write + + + GPIO6_EDGE_LOW + [26:26] + read-write + + + GPIO6_LEVEL_HIGH + [25:25] + read-write + + + GPIO6_LEVEL_LOW + [24:24] + read-write + + + GPIO5_EDGE_HIGH + [23:23] + read-write + + + GPIO5_EDGE_LOW + [22:22] + read-write + + + GPIO5_LEVEL_HIGH + [21:21] + read-write + + + GPIO5_LEVEL_LOW + [20:20] + read-write + + + GPIO4_EDGE_HIGH + [19:19] + read-write + + + GPIO4_EDGE_LOW + [18:18] + read-write + + + GPIO4_LEVEL_HIGH + [17:17] + read-write + + + GPIO4_LEVEL_LOW + [16:16] + read-write + + + GPIO3_EDGE_HIGH + [15:15] + read-write + + + GPIO3_EDGE_LOW + [14:14] + read-write + + + GPIO3_LEVEL_HIGH + [13:13] + read-write + + + GPIO3_LEVEL_LOW + [12:12] + read-write + + + GPIO2_EDGE_HIGH + [11:11] + read-write + + + GPIO2_EDGE_LOW + [10:10] + read-write + + + GPIO2_LEVEL_HIGH + [9:9] + read-write + + + GPIO2_LEVEL_LOW + [8:8] + read-write + + + GPIO1_EDGE_HIGH + [7:7] + read-write + + + GPIO1_EDGE_LOW + [6:6] + read-write + + + GPIO1_LEVEL_HIGH + [5:5] + read-write + + + GPIO1_LEVEL_LOW + [4:4] + read-write + + + GPIO0_EDGE_HIGH + [3:3] + read-write + + + GPIO0_EDGE_LOW + [2:2] + read-write + + + GPIO0_LEVEL_HIGH + [1:1] + read-write + + + GPIO0_LEVEL_LOW + [0:0] + read-write + + + + + PROC0_INTE1 + 0x0000024c + Interrupt Enable for proc0 + 0x00000000 + + + GPIO15_EDGE_HIGH + [31:31] + read-write + + + GPIO15_EDGE_LOW + [30:30] + read-write + + + GPIO15_LEVEL_HIGH + [29:29] + read-write + + + GPIO15_LEVEL_LOW + [28:28] + read-write + + + GPIO14_EDGE_HIGH + [27:27] + read-write + + + GPIO14_EDGE_LOW + [26:26] + read-write + + + GPIO14_LEVEL_HIGH + [25:25] + read-write + + + GPIO14_LEVEL_LOW + [24:24] + read-write + + + GPIO13_EDGE_HIGH + [23:23] + read-write + + + GPIO13_EDGE_LOW + [22:22] + read-write + + + GPIO13_LEVEL_HIGH + [21:21] + read-write + + + GPIO13_LEVEL_LOW + [20:20] + read-write + + + GPIO12_EDGE_HIGH + [19:19] + read-write + + + GPIO12_EDGE_LOW + [18:18] + read-write + + + GPIO12_LEVEL_HIGH + [17:17] + read-write + + + GPIO12_LEVEL_LOW + [16:16] + read-write + + + GPIO11_EDGE_HIGH + [15:15] + read-write + + + GPIO11_EDGE_LOW + [14:14] + read-write + + + GPIO11_LEVEL_HIGH + [13:13] + read-write + + + GPIO11_LEVEL_LOW + [12:12] + read-write + + + GPIO10_EDGE_HIGH + [11:11] + read-write + + + GPIO10_EDGE_LOW + [10:10] + read-write + + + GPIO10_LEVEL_HIGH + [9:9] + read-write + + + GPIO10_LEVEL_LOW + [8:8] + read-write + + + GPIO9_EDGE_HIGH + [7:7] + read-write + + + GPIO9_EDGE_LOW + [6:6] + read-write + + + GPIO9_LEVEL_HIGH + [5:5] + read-write + + + GPIO9_LEVEL_LOW + [4:4] + read-write + + + GPIO8_EDGE_HIGH + [3:3] + read-write + + + GPIO8_EDGE_LOW + [2:2] + read-write + + + GPIO8_LEVEL_HIGH + [1:1] + read-write + + + GPIO8_LEVEL_LOW + [0:0] + read-write + + + + + PROC0_INTE2 + 0x00000250 + Interrupt Enable for proc0 + 0x00000000 + + + GPIO23_EDGE_HIGH + [31:31] + read-write + + + GPIO23_EDGE_LOW + [30:30] + read-write + + + GPIO23_LEVEL_HIGH + [29:29] + read-write + + + GPIO23_LEVEL_LOW + [28:28] + read-write + + + GPIO22_EDGE_HIGH + [27:27] + read-write + + + GPIO22_EDGE_LOW + [26:26] + read-write + + + GPIO22_LEVEL_HIGH + [25:25] + read-write + + + GPIO22_LEVEL_LOW + [24:24] + read-write + + + GPIO21_EDGE_HIGH + [23:23] + read-write + + + GPIO21_EDGE_LOW + [22:22] + read-write + + + GPIO21_LEVEL_HIGH + [21:21] + read-write + + + GPIO21_LEVEL_LOW + [20:20] + read-write + + + GPIO20_EDGE_HIGH + [19:19] + read-write + + + GPIO20_EDGE_LOW + [18:18] + read-write + + + GPIO20_LEVEL_HIGH + [17:17] + read-write + + + GPIO20_LEVEL_LOW + [16:16] + read-write + + + GPIO19_EDGE_HIGH + [15:15] + read-write + + + GPIO19_EDGE_LOW + [14:14] + read-write + + + GPIO19_LEVEL_HIGH + [13:13] + read-write + + + GPIO19_LEVEL_LOW + [12:12] + read-write + + + GPIO18_EDGE_HIGH + [11:11] + read-write + + + GPIO18_EDGE_LOW + [10:10] + read-write + + + GPIO18_LEVEL_HIGH + [9:9] + read-write + + + GPIO18_LEVEL_LOW + [8:8] + read-write + + + GPIO17_EDGE_HIGH + [7:7] + read-write + + + GPIO17_EDGE_LOW + [6:6] + read-write + + + GPIO17_LEVEL_HIGH + [5:5] + read-write + + + GPIO17_LEVEL_LOW + [4:4] + read-write + + + GPIO16_EDGE_HIGH + [3:3] + read-write + + + GPIO16_EDGE_LOW + [2:2] + read-write + + + GPIO16_LEVEL_HIGH + [1:1] + read-write + + + GPIO16_LEVEL_LOW + [0:0] + read-write + + + + + PROC0_INTE3 + 0x00000254 + Interrupt Enable for proc0 + 0x00000000 + + + GPIO31_EDGE_HIGH + [31:31] + read-write + + + GPIO31_EDGE_LOW + [30:30] + read-write + + + GPIO31_LEVEL_HIGH + [29:29] + read-write + + + GPIO31_LEVEL_LOW + [28:28] + read-write + + + GPIO30_EDGE_HIGH + [27:27] + read-write + + + GPIO30_EDGE_LOW + [26:26] + read-write + + + GPIO30_LEVEL_HIGH + [25:25] + read-write + + + GPIO30_LEVEL_LOW + [24:24] + read-write + + + GPIO29_EDGE_HIGH + [23:23] + read-write + + + GPIO29_EDGE_LOW + [22:22] + read-write + + + GPIO29_LEVEL_HIGH + [21:21] + read-write + + + GPIO29_LEVEL_LOW + [20:20] + read-write + + + GPIO28_EDGE_HIGH + [19:19] + read-write + + + GPIO28_EDGE_LOW + [18:18] + read-write + + + GPIO28_LEVEL_HIGH + [17:17] + read-write + + + GPIO28_LEVEL_LOW + [16:16] + read-write + + + GPIO27_EDGE_HIGH + [15:15] + read-write + + + GPIO27_EDGE_LOW + [14:14] + read-write + + + GPIO27_LEVEL_HIGH + [13:13] + read-write + + + GPIO27_LEVEL_LOW + [12:12] + read-write + + + GPIO26_EDGE_HIGH + [11:11] + read-write + + + GPIO26_EDGE_LOW + [10:10] + read-write + + + GPIO26_LEVEL_HIGH + [9:9] + read-write + + + GPIO26_LEVEL_LOW + [8:8] + read-write + + + GPIO25_EDGE_HIGH + [7:7] + read-write + + + GPIO25_EDGE_LOW + [6:6] + read-write + + + GPIO25_LEVEL_HIGH + [5:5] + read-write + + + GPIO25_LEVEL_LOW + [4:4] + read-write + + + GPIO24_EDGE_HIGH + [3:3] + read-write + + + GPIO24_EDGE_LOW + [2:2] + read-write + + + GPIO24_LEVEL_HIGH + [1:1] + read-write + + + GPIO24_LEVEL_LOW + [0:0] + read-write + + + + + PROC0_INTE4 + 0x00000258 + Interrupt Enable for proc0 + 0x00000000 + + + GPIO39_EDGE_HIGH + [31:31] + read-write + + + GPIO39_EDGE_LOW + [30:30] + read-write + + + GPIO39_LEVEL_HIGH + [29:29] + read-write + + + GPIO39_LEVEL_LOW + [28:28] + read-write + + + GPIO38_EDGE_HIGH + [27:27] + read-write + + + GPIO38_EDGE_LOW + [26:26] + read-write + + + GPIO38_LEVEL_HIGH + [25:25] + read-write + + + GPIO38_LEVEL_LOW + [24:24] + read-write + + + GPIO37_EDGE_HIGH + [23:23] + read-write + + + GPIO37_EDGE_LOW + [22:22] + read-write + + + GPIO37_LEVEL_HIGH + [21:21] + read-write + + + GPIO37_LEVEL_LOW + [20:20] + read-write + + + GPIO36_EDGE_HIGH + [19:19] + read-write + + + GPIO36_EDGE_LOW + [18:18] + read-write + + + GPIO36_LEVEL_HIGH + [17:17] + read-write + + + GPIO36_LEVEL_LOW + [16:16] + read-write + + + GPIO35_EDGE_HIGH + [15:15] + read-write + + + GPIO35_EDGE_LOW + [14:14] + read-write + + + GPIO35_LEVEL_HIGH + [13:13] + read-write + + + GPIO35_LEVEL_LOW + [12:12] + read-write + + + GPIO34_EDGE_HIGH + [11:11] + read-write + + + GPIO34_EDGE_LOW + [10:10] + read-write + + + GPIO34_LEVEL_HIGH + [9:9] + read-write + + + GPIO34_LEVEL_LOW + [8:8] + read-write + + + GPIO33_EDGE_HIGH + [7:7] + read-write + + + GPIO33_EDGE_LOW + [6:6] + read-write + + + GPIO33_LEVEL_HIGH + [5:5] + read-write + + + GPIO33_LEVEL_LOW + [4:4] + read-write + + + GPIO32_EDGE_HIGH + [3:3] + read-write + + + GPIO32_EDGE_LOW + [2:2] + read-write + + + GPIO32_LEVEL_HIGH + [1:1] + read-write + + + GPIO32_LEVEL_LOW + [0:0] + read-write + + + + + PROC0_INTE5 + 0x0000025c + Interrupt Enable for proc0 + 0x00000000 + + + GPIO47_EDGE_HIGH + [31:31] + read-write + + + GPIO47_EDGE_LOW + [30:30] + read-write + + + GPIO47_LEVEL_HIGH + [29:29] + read-write + + + GPIO47_LEVEL_LOW + [28:28] + read-write + + + GPIO46_EDGE_HIGH + [27:27] + read-write + + + GPIO46_EDGE_LOW + [26:26] + read-write + + + GPIO46_LEVEL_HIGH + [25:25] + read-write + + + GPIO46_LEVEL_LOW + [24:24] + read-write + + + GPIO45_EDGE_HIGH + [23:23] + read-write + + + GPIO45_EDGE_LOW + [22:22] + read-write + + + GPIO45_LEVEL_HIGH + [21:21] + read-write + + + GPIO45_LEVEL_LOW + [20:20] + read-write + + + GPIO44_EDGE_HIGH + [19:19] + read-write + + + GPIO44_EDGE_LOW + [18:18] + read-write + + + GPIO44_LEVEL_HIGH + [17:17] + read-write + + + GPIO44_LEVEL_LOW + [16:16] + read-write + + + GPIO43_EDGE_HIGH + [15:15] + read-write + + + GPIO43_EDGE_LOW + [14:14] + read-write + + + GPIO43_LEVEL_HIGH + [13:13] + read-write + + + GPIO43_LEVEL_LOW + [12:12] + read-write + + + GPIO42_EDGE_HIGH + [11:11] + read-write + + + GPIO42_EDGE_LOW + [10:10] + read-write + + + GPIO42_LEVEL_HIGH + [9:9] + read-write + + + GPIO42_LEVEL_LOW + [8:8] + read-write + + + GPIO41_EDGE_HIGH + [7:7] + read-write + + + GPIO41_EDGE_LOW + [6:6] + read-write + + + GPIO41_LEVEL_HIGH + [5:5] + read-write + + + GPIO41_LEVEL_LOW + [4:4] + read-write + + + GPIO40_EDGE_HIGH + [3:3] + read-write + + + GPIO40_EDGE_LOW + [2:2] + read-write + + + GPIO40_LEVEL_HIGH + [1:1] + read-write + + + GPIO40_LEVEL_LOW + [0:0] + read-write + + + + + PROC0_INTF0 + 0x00000260 + Interrupt Force for proc0 + 0x00000000 + + + GPIO7_EDGE_HIGH + [31:31] + read-write + + + GPIO7_EDGE_LOW + [30:30] + read-write + + + GPIO7_LEVEL_HIGH + [29:29] + read-write + + + GPIO7_LEVEL_LOW + [28:28] + read-write + + + GPIO6_EDGE_HIGH + [27:27] + read-write + + + GPIO6_EDGE_LOW + [26:26] + read-write + + + GPIO6_LEVEL_HIGH + [25:25] + read-write + + + GPIO6_LEVEL_LOW + [24:24] + read-write + + + GPIO5_EDGE_HIGH + [23:23] + read-write + + + GPIO5_EDGE_LOW + [22:22] + read-write + + + GPIO5_LEVEL_HIGH + [21:21] + read-write + + + GPIO5_LEVEL_LOW + [20:20] + read-write + + + GPIO4_EDGE_HIGH + [19:19] + read-write + + + GPIO4_EDGE_LOW + [18:18] + read-write + + + GPIO4_LEVEL_HIGH + [17:17] + read-write + + + GPIO4_LEVEL_LOW + [16:16] + read-write + + + GPIO3_EDGE_HIGH + [15:15] + read-write + + + GPIO3_EDGE_LOW + [14:14] + read-write + + + GPIO3_LEVEL_HIGH + [13:13] + read-write + + + GPIO3_LEVEL_LOW + [12:12] + read-write + + + GPIO2_EDGE_HIGH + [11:11] + read-write + + + GPIO2_EDGE_LOW + [10:10] + read-write + + + GPIO2_LEVEL_HIGH + [9:9] + read-write + + + GPIO2_LEVEL_LOW + [8:8] + read-write + + + GPIO1_EDGE_HIGH + [7:7] + read-write + + + GPIO1_EDGE_LOW + [6:6] + read-write + + + GPIO1_LEVEL_HIGH + [5:5] + read-write + + + GPIO1_LEVEL_LOW + [4:4] + read-write + + + GPIO0_EDGE_HIGH + [3:3] + read-write + + + GPIO0_EDGE_LOW + [2:2] + read-write + + + GPIO0_LEVEL_HIGH + [1:1] + read-write + + + GPIO0_LEVEL_LOW + [0:0] + read-write + + + + + PROC0_INTF1 + 0x00000264 + Interrupt Force for proc0 + 0x00000000 + + + GPIO15_EDGE_HIGH + [31:31] + read-write + + + GPIO15_EDGE_LOW + [30:30] + read-write + + + GPIO15_LEVEL_HIGH + [29:29] + read-write + + + GPIO15_LEVEL_LOW + [28:28] + read-write + + + GPIO14_EDGE_HIGH + [27:27] + read-write + + + GPIO14_EDGE_LOW + [26:26] + read-write + + + GPIO14_LEVEL_HIGH + [25:25] + read-write + + + GPIO14_LEVEL_LOW + [24:24] + read-write + + + GPIO13_EDGE_HIGH + [23:23] + read-write + + + GPIO13_EDGE_LOW + [22:22] + read-write + + + GPIO13_LEVEL_HIGH + [21:21] + read-write + + + GPIO13_LEVEL_LOW + [20:20] + read-write + + + GPIO12_EDGE_HIGH + [19:19] + read-write + + + GPIO12_EDGE_LOW + [18:18] + read-write + + + GPIO12_LEVEL_HIGH + [17:17] + read-write + + + GPIO12_LEVEL_LOW + [16:16] + read-write + + + GPIO11_EDGE_HIGH + [15:15] + read-write + + + GPIO11_EDGE_LOW + [14:14] + read-write + + + GPIO11_LEVEL_HIGH + [13:13] + read-write + + + GPIO11_LEVEL_LOW + [12:12] + read-write + + + GPIO10_EDGE_HIGH + [11:11] + read-write + + + GPIO10_EDGE_LOW + [10:10] + read-write + + + GPIO10_LEVEL_HIGH + [9:9] + read-write + + + GPIO10_LEVEL_LOW + [8:8] + read-write + + + GPIO9_EDGE_HIGH + [7:7] + read-write + + + GPIO9_EDGE_LOW + [6:6] + read-write + + + GPIO9_LEVEL_HIGH + [5:5] + read-write + + + GPIO9_LEVEL_LOW + [4:4] + read-write + + + GPIO8_EDGE_HIGH + [3:3] + read-write + + + GPIO8_EDGE_LOW + [2:2] + read-write + + + GPIO8_LEVEL_HIGH + [1:1] + read-write + + + GPIO8_LEVEL_LOW + [0:0] + read-write + + + + + PROC0_INTF2 + 0x00000268 + Interrupt Force for proc0 + 0x00000000 + + + GPIO23_EDGE_HIGH + [31:31] + read-write + + + GPIO23_EDGE_LOW + [30:30] + read-write + + + GPIO23_LEVEL_HIGH + [29:29] + read-write + + + GPIO23_LEVEL_LOW + [28:28] + read-write + + + GPIO22_EDGE_HIGH + [27:27] + read-write + + + GPIO22_EDGE_LOW + [26:26] + read-write + + + GPIO22_LEVEL_HIGH + [25:25] + read-write + + + GPIO22_LEVEL_LOW + [24:24] + read-write + + + GPIO21_EDGE_HIGH + [23:23] + read-write + + + GPIO21_EDGE_LOW + [22:22] + read-write + + + GPIO21_LEVEL_HIGH + [21:21] + read-write + + + GPIO21_LEVEL_LOW + [20:20] + read-write + + + GPIO20_EDGE_HIGH + [19:19] + read-write + + + GPIO20_EDGE_LOW + [18:18] + read-write + + + GPIO20_LEVEL_HIGH + [17:17] + read-write + + + GPIO20_LEVEL_LOW + [16:16] + read-write + + + GPIO19_EDGE_HIGH + [15:15] + read-write + + + GPIO19_EDGE_LOW + [14:14] + read-write + + + GPIO19_LEVEL_HIGH + [13:13] + read-write + + + GPIO19_LEVEL_LOW + [12:12] + read-write + + + GPIO18_EDGE_HIGH + [11:11] + read-write + + + GPIO18_EDGE_LOW + [10:10] + read-write + + + GPIO18_LEVEL_HIGH + [9:9] + read-write + + + GPIO18_LEVEL_LOW + [8:8] + read-write + + + GPIO17_EDGE_HIGH + [7:7] + read-write + + + GPIO17_EDGE_LOW + [6:6] + read-write + + + GPIO17_LEVEL_HIGH + [5:5] + read-write + + + GPIO17_LEVEL_LOW + [4:4] + read-write + + + GPIO16_EDGE_HIGH + [3:3] + read-write + + + GPIO16_EDGE_LOW + [2:2] + read-write + + + GPIO16_LEVEL_HIGH + [1:1] + read-write + + + GPIO16_LEVEL_LOW + [0:0] + read-write + + + + + PROC0_INTF3 + 0x0000026c + Interrupt Force for proc0 + 0x00000000 + + + GPIO31_EDGE_HIGH + [31:31] + read-write + + + GPIO31_EDGE_LOW + [30:30] + read-write + + + GPIO31_LEVEL_HIGH + [29:29] + read-write + + + GPIO31_LEVEL_LOW + [28:28] + read-write + + + GPIO30_EDGE_HIGH + [27:27] + read-write + + + GPIO30_EDGE_LOW + [26:26] + read-write + + + GPIO30_LEVEL_HIGH + [25:25] + read-write + + + GPIO30_LEVEL_LOW + [24:24] + read-write + + + GPIO29_EDGE_HIGH + [23:23] + read-write + + + GPIO29_EDGE_LOW + [22:22] + read-write + + + GPIO29_LEVEL_HIGH + [21:21] + read-write + + + GPIO29_LEVEL_LOW + [20:20] + read-write + + + GPIO28_EDGE_HIGH + [19:19] + read-write + + + GPIO28_EDGE_LOW + [18:18] + read-write + + + GPIO28_LEVEL_HIGH + [17:17] + read-write + + + GPIO28_LEVEL_LOW + [16:16] + read-write + + + GPIO27_EDGE_HIGH + [15:15] + read-write + + + GPIO27_EDGE_LOW + [14:14] + read-write + + + GPIO27_LEVEL_HIGH + [13:13] + read-write + + + GPIO27_LEVEL_LOW + [12:12] + read-write + + + GPIO26_EDGE_HIGH + [11:11] + read-write + + + GPIO26_EDGE_LOW + [10:10] + read-write + + + GPIO26_LEVEL_HIGH + [9:9] + read-write + + + GPIO26_LEVEL_LOW + [8:8] + read-write + + + GPIO25_EDGE_HIGH + [7:7] + read-write + + + GPIO25_EDGE_LOW + [6:6] + read-write + + + GPIO25_LEVEL_HIGH + [5:5] + read-write + + + GPIO25_LEVEL_LOW + [4:4] + read-write + + + GPIO24_EDGE_HIGH + [3:3] + read-write + + + GPIO24_EDGE_LOW + [2:2] + read-write + + + GPIO24_LEVEL_HIGH + [1:1] + read-write + + + GPIO24_LEVEL_LOW + [0:0] + read-write + + + + + PROC0_INTF4 + 0x00000270 + Interrupt Force for proc0 + 0x00000000 + + + GPIO39_EDGE_HIGH + [31:31] + read-write + + + GPIO39_EDGE_LOW + [30:30] + read-write + + + GPIO39_LEVEL_HIGH + [29:29] + read-write + + + GPIO39_LEVEL_LOW + [28:28] + read-write + + + GPIO38_EDGE_HIGH + [27:27] + read-write + + + GPIO38_EDGE_LOW + [26:26] + read-write + + + GPIO38_LEVEL_HIGH + [25:25] + read-write + + + GPIO38_LEVEL_LOW + [24:24] + read-write + + + GPIO37_EDGE_HIGH + [23:23] + read-write + + + GPIO37_EDGE_LOW + [22:22] + read-write + + + GPIO37_LEVEL_HIGH + [21:21] + read-write + + + GPIO37_LEVEL_LOW + [20:20] + read-write + + + GPIO36_EDGE_HIGH + [19:19] + read-write + + + GPIO36_EDGE_LOW + [18:18] + read-write + + + GPIO36_LEVEL_HIGH + [17:17] + read-write + + + GPIO36_LEVEL_LOW + [16:16] + read-write + + + GPIO35_EDGE_HIGH + [15:15] + read-write + + + GPIO35_EDGE_LOW + [14:14] + read-write + + + GPIO35_LEVEL_HIGH + [13:13] + read-write + + + GPIO35_LEVEL_LOW + [12:12] + read-write + + + GPIO34_EDGE_HIGH + [11:11] + read-write + + + GPIO34_EDGE_LOW + [10:10] + read-write + + + GPIO34_LEVEL_HIGH + [9:9] + read-write + + + GPIO34_LEVEL_LOW + [8:8] + read-write + + + GPIO33_EDGE_HIGH + [7:7] + read-write + + + GPIO33_EDGE_LOW + [6:6] + read-write + + + GPIO33_LEVEL_HIGH + [5:5] + read-write + + + GPIO33_LEVEL_LOW + [4:4] + read-write + + + GPIO32_EDGE_HIGH + [3:3] + read-write + + + GPIO32_EDGE_LOW + [2:2] + read-write + + + GPIO32_LEVEL_HIGH + [1:1] + read-write + + + GPIO32_LEVEL_LOW + [0:0] + read-write + + + + + PROC0_INTF5 + 0x00000274 + Interrupt Force for proc0 + 0x00000000 + + + GPIO47_EDGE_HIGH + [31:31] + read-write + + + GPIO47_EDGE_LOW + [30:30] + read-write + + + GPIO47_LEVEL_HIGH + [29:29] + read-write + + + GPIO47_LEVEL_LOW + [28:28] + read-write + + + GPIO46_EDGE_HIGH + [27:27] + read-write + + + GPIO46_EDGE_LOW + [26:26] + read-write + + + GPIO46_LEVEL_HIGH + [25:25] + read-write + + + GPIO46_LEVEL_LOW + [24:24] + read-write + + + GPIO45_EDGE_HIGH + [23:23] + read-write + + + GPIO45_EDGE_LOW + [22:22] + read-write + + + GPIO45_LEVEL_HIGH + [21:21] + read-write + + + GPIO45_LEVEL_LOW + [20:20] + read-write + + + GPIO44_EDGE_HIGH + [19:19] + read-write + + + GPIO44_EDGE_LOW + [18:18] + read-write + + + GPIO44_LEVEL_HIGH + [17:17] + read-write + + + GPIO44_LEVEL_LOW + [16:16] + read-write + + + GPIO43_EDGE_HIGH + [15:15] + read-write + + + GPIO43_EDGE_LOW + [14:14] + read-write + + + GPIO43_LEVEL_HIGH + [13:13] + read-write + + + GPIO43_LEVEL_LOW + [12:12] + read-write + + + GPIO42_EDGE_HIGH + [11:11] + read-write + + + GPIO42_EDGE_LOW + [10:10] + read-write + + + GPIO42_LEVEL_HIGH + [9:9] + read-write + + + GPIO42_LEVEL_LOW + [8:8] + read-write + + + GPIO41_EDGE_HIGH + [7:7] + read-write + + + GPIO41_EDGE_LOW + [6:6] + read-write + + + GPIO41_LEVEL_HIGH + [5:5] + read-write + + + GPIO41_LEVEL_LOW + [4:4] + read-write + + + GPIO40_EDGE_HIGH + [3:3] + read-write + + + GPIO40_EDGE_LOW + [2:2] + read-write + + + GPIO40_LEVEL_HIGH + [1:1] + read-write + + + GPIO40_LEVEL_LOW + [0:0] + read-write + + + + + PROC0_INTS0 + 0x00000278 + Interrupt status after masking & forcing for proc0 + 0x00000000 + + + GPIO7_EDGE_HIGH + [31:31] + read-only + + + GPIO7_EDGE_LOW + [30:30] + read-only + + + GPIO7_LEVEL_HIGH + [29:29] + read-only + + + GPIO7_LEVEL_LOW + [28:28] + read-only + + + GPIO6_EDGE_HIGH + [27:27] + read-only + + + GPIO6_EDGE_LOW + [26:26] + read-only + + + GPIO6_LEVEL_HIGH + [25:25] + read-only + + + GPIO6_LEVEL_LOW + [24:24] + read-only + + + GPIO5_EDGE_HIGH + [23:23] + read-only + + + GPIO5_EDGE_LOW + [22:22] + read-only + + + GPIO5_LEVEL_HIGH + [21:21] + read-only + + + GPIO5_LEVEL_LOW + [20:20] + read-only + + + GPIO4_EDGE_HIGH + [19:19] + read-only + + + GPIO4_EDGE_LOW + [18:18] + read-only + + + GPIO4_LEVEL_HIGH + [17:17] + read-only + + + GPIO4_LEVEL_LOW + [16:16] + read-only + + + GPIO3_EDGE_HIGH + [15:15] + read-only + + + GPIO3_EDGE_LOW + [14:14] + read-only + + + GPIO3_LEVEL_HIGH + [13:13] + read-only + + + GPIO3_LEVEL_LOW + [12:12] + read-only + + + GPIO2_EDGE_HIGH + [11:11] + read-only + + + GPIO2_EDGE_LOW + [10:10] + read-only + + + GPIO2_LEVEL_HIGH + [9:9] + read-only + + + GPIO2_LEVEL_LOW + [8:8] + read-only + + + GPIO1_EDGE_HIGH + [7:7] + read-only + + + GPIO1_EDGE_LOW + [6:6] + read-only + + + GPIO1_LEVEL_HIGH + [5:5] + read-only + + + GPIO1_LEVEL_LOW + [4:4] + read-only + + + GPIO0_EDGE_HIGH + [3:3] + read-only + + + GPIO0_EDGE_LOW + [2:2] + read-only + + + GPIO0_LEVEL_HIGH + [1:1] + read-only + + + GPIO0_LEVEL_LOW + [0:0] + read-only + + + + + PROC0_INTS1 + 0x0000027c + Interrupt status after masking & forcing for proc0 + 0x00000000 + + + GPIO15_EDGE_HIGH + [31:31] + read-only + + + GPIO15_EDGE_LOW + [30:30] + read-only + + + GPIO15_LEVEL_HIGH + [29:29] + read-only + + + GPIO15_LEVEL_LOW + [28:28] + read-only + + + GPIO14_EDGE_HIGH + [27:27] + read-only + + + GPIO14_EDGE_LOW + [26:26] + read-only + + + GPIO14_LEVEL_HIGH + [25:25] + read-only + + + GPIO14_LEVEL_LOW + [24:24] + read-only + + + GPIO13_EDGE_HIGH + [23:23] + read-only + + + GPIO13_EDGE_LOW + [22:22] + read-only + + + GPIO13_LEVEL_HIGH + [21:21] + read-only + + + GPIO13_LEVEL_LOW + [20:20] + read-only + + + GPIO12_EDGE_HIGH + [19:19] + read-only + + + GPIO12_EDGE_LOW + [18:18] + read-only + + + GPIO12_LEVEL_HIGH + [17:17] + read-only + + + GPIO12_LEVEL_LOW + [16:16] + read-only + + + GPIO11_EDGE_HIGH + [15:15] + read-only + + + GPIO11_EDGE_LOW + [14:14] + read-only + + + GPIO11_LEVEL_HIGH + [13:13] + read-only + + + GPIO11_LEVEL_LOW + [12:12] + read-only + + + GPIO10_EDGE_HIGH + [11:11] + read-only + + + GPIO10_EDGE_LOW + [10:10] + read-only + + + GPIO10_LEVEL_HIGH + [9:9] + read-only + + + GPIO10_LEVEL_LOW + [8:8] + read-only + + + GPIO9_EDGE_HIGH + [7:7] + read-only + + + GPIO9_EDGE_LOW + [6:6] + read-only + + + GPIO9_LEVEL_HIGH + [5:5] + read-only + + + GPIO9_LEVEL_LOW + [4:4] + read-only + + + GPIO8_EDGE_HIGH + [3:3] + read-only + + + GPIO8_EDGE_LOW + [2:2] + read-only + + + GPIO8_LEVEL_HIGH + [1:1] + read-only + + + GPIO8_LEVEL_LOW + [0:0] + read-only + + + + + PROC0_INTS2 + 0x00000280 + Interrupt status after masking & forcing for proc0 + 0x00000000 + + + GPIO23_EDGE_HIGH + [31:31] + read-only + + + GPIO23_EDGE_LOW + [30:30] + read-only + + + GPIO23_LEVEL_HIGH + [29:29] + read-only + + + GPIO23_LEVEL_LOW + [28:28] + read-only + + + GPIO22_EDGE_HIGH + [27:27] + read-only + + + GPIO22_EDGE_LOW + [26:26] + read-only + + + GPIO22_LEVEL_HIGH + [25:25] + read-only + + + GPIO22_LEVEL_LOW + [24:24] + read-only + + + GPIO21_EDGE_HIGH + [23:23] + read-only + + + GPIO21_EDGE_LOW + [22:22] + read-only + + + GPIO21_LEVEL_HIGH + [21:21] + read-only + + + GPIO21_LEVEL_LOW + [20:20] + read-only + + + GPIO20_EDGE_HIGH + [19:19] + read-only + + + GPIO20_EDGE_LOW + [18:18] + read-only + + + GPIO20_LEVEL_HIGH + [17:17] + read-only + + + GPIO20_LEVEL_LOW + [16:16] + read-only + + + GPIO19_EDGE_HIGH + [15:15] + read-only + + + GPIO19_EDGE_LOW + [14:14] + read-only + + + GPIO19_LEVEL_HIGH + [13:13] + read-only + + + GPIO19_LEVEL_LOW + [12:12] + read-only + + + GPIO18_EDGE_HIGH + [11:11] + read-only + + + GPIO18_EDGE_LOW + [10:10] + read-only + + + GPIO18_LEVEL_HIGH + [9:9] + read-only + + + GPIO18_LEVEL_LOW + [8:8] + read-only + + + GPIO17_EDGE_HIGH + [7:7] + read-only + + + GPIO17_EDGE_LOW + [6:6] + read-only + + + GPIO17_LEVEL_HIGH + [5:5] + read-only + + + GPIO17_LEVEL_LOW + [4:4] + read-only + + + GPIO16_EDGE_HIGH + [3:3] + read-only + + + GPIO16_EDGE_LOW + [2:2] + read-only + + + GPIO16_LEVEL_HIGH + [1:1] + read-only + + + GPIO16_LEVEL_LOW + [0:0] + read-only + + + + + PROC0_INTS3 + 0x00000284 + Interrupt status after masking & forcing for proc0 + 0x00000000 + + + GPIO31_EDGE_HIGH + [31:31] + read-only + + + GPIO31_EDGE_LOW + [30:30] + read-only + + + GPIO31_LEVEL_HIGH + [29:29] + read-only + + + GPIO31_LEVEL_LOW + [28:28] + read-only + + + GPIO30_EDGE_HIGH + [27:27] + read-only + + + GPIO30_EDGE_LOW + [26:26] + read-only + + + GPIO30_LEVEL_HIGH + [25:25] + read-only + + + GPIO30_LEVEL_LOW + [24:24] + read-only + + + GPIO29_EDGE_HIGH + [23:23] + read-only + + + GPIO29_EDGE_LOW + [22:22] + read-only + + + GPIO29_LEVEL_HIGH + [21:21] + read-only + + + GPIO29_LEVEL_LOW + [20:20] + read-only + + + GPIO28_EDGE_HIGH + [19:19] + read-only + + + GPIO28_EDGE_LOW + [18:18] + read-only + + + GPIO28_LEVEL_HIGH + [17:17] + read-only + + + GPIO28_LEVEL_LOW + [16:16] + read-only + + + GPIO27_EDGE_HIGH + [15:15] + read-only + + + GPIO27_EDGE_LOW + [14:14] + read-only + + + GPIO27_LEVEL_HIGH + [13:13] + read-only + + + GPIO27_LEVEL_LOW + [12:12] + read-only + + + GPIO26_EDGE_HIGH + [11:11] + read-only + + + GPIO26_EDGE_LOW + [10:10] + read-only + + + GPIO26_LEVEL_HIGH + [9:9] + read-only + + + GPIO26_LEVEL_LOW + [8:8] + read-only + + + GPIO25_EDGE_HIGH + [7:7] + read-only + + + GPIO25_EDGE_LOW + [6:6] + read-only + + + GPIO25_LEVEL_HIGH + [5:5] + read-only + + + GPIO25_LEVEL_LOW + [4:4] + read-only + + + GPIO24_EDGE_HIGH + [3:3] + read-only + + + GPIO24_EDGE_LOW + [2:2] + read-only + + + GPIO24_LEVEL_HIGH + [1:1] + read-only + + + GPIO24_LEVEL_LOW + [0:0] + read-only + + + + + PROC0_INTS4 + 0x00000288 + Interrupt status after masking & forcing for proc0 + 0x00000000 + + + GPIO39_EDGE_HIGH + [31:31] + read-only + + + GPIO39_EDGE_LOW + [30:30] + read-only + + + GPIO39_LEVEL_HIGH + [29:29] + read-only + + + GPIO39_LEVEL_LOW + [28:28] + read-only + + + GPIO38_EDGE_HIGH + [27:27] + read-only + + + GPIO38_EDGE_LOW + [26:26] + read-only + + + GPIO38_LEVEL_HIGH + [25:25] + read-only + + + GPIO38_LEVEL_LOW + [24:24] + read-only + + + GPIO37_EDGE_HIGH + [23:23] + read-only + + + GPIO37_EDGE_LOW + [22:22] + read-only + + + GPIO37_LEVEL_HIGH + [21:21] + read-only + + + GPIO37_LEVEL_LOW + [20:20] + read-only + + + GPIO36_EDGE_HIGH + [19:19] + read-only + + + GPIO36_EDGE_LOW + [18:18] + read-only + + + GPIO36_LEVEL_HIGH + [17:17] + read-only + + + GPIO36_LEVEL_LOW + [16:16] + read-only + + + GPIO35_EDGE_HIGH + [15:15] + read-only + + + GPIO35_EDGE_LOW + [14:14] + read-only + + + GPIO35_LEVEL_HIGH + [13:13] + read-only + + + GPIO35_LEVEL_LOW + [12:12] + read-only + + + GPIO34_EDGE_HIGH + [11:11] + read-only + + + GPIO34_EDGE_LOW + [10:10] + read-only + + + GPIO34_LEVEL_HIGH + [9:9] + read-only + + + GPIO34_LEVEL_LOW + [8:8] + read-only + + + GPIO33_EDGE_HIGH + [7:7] + read-only + + + GPIO33_EDGE_LOW + [6:6] + read-only + + + GPIO33_LEVEL_HIGH + [5:5] + read-only + + + GPIO33_LEVEL_LOW + [4:4] + read-only + + + GPIO32_EDGE_HIGH + [3:3] + read-only + + + GPIO32_EDGE_LOW + [2:2] + read-only + + + GPIO32_LEVEL_HIGH + [1:1] + read-only + + + GPIO32_LEVEL_LOW + [0:0] + read-only + + + + + PROC0_INTS5 + 0x0000028c + Interrupt status after masking & forcing for proc0 + 0x00000000 + + + GPIO47_EDGE_HIGH + [31:31] + read-only + + + GPIO47_EDGE_LOW + [30:30] + read-only + + + GPIO47_LEVEL_HIGH + [29:29] + read-only + + + GPIO47_LEVEL_LOW + [28:28] + read-only + + + GPIO46_EDGE_HIGH + [27:27] + read-only + + + GPIO46_EDGE_LOW + [26:26] + read-only + + + GPIO46_LEVEL_HIGH + [25:25] + read-only + + + GPIO46_LEVEL_LOW + [24:24] + read-only + + + GPIO45_EDGE_HIGH + [23:23] + read-only + + + GPIO45_EDGE_LOW + [22:22] + read-only + + + GPIO45_LEVEL_HIGH + [21:21] + read-only + + + GPIO45_LEVEL_LOW + [20:20] + read-only + + + GPIO44_EDGE_HIGH + [19:19] + read-only + + + GPIO44_EDGE_LOW + [18:18] + read-only + + + GPIO44_LEVEL_HIGH + [17:17] + read-only + + + GPIO44_LEVEL_LOW + [16:16] + read-only + + + GPIO43_EDGE_HIGH + [15:15] + read-only + + + GPIO43_EDGE_LOW + [14:14] + read-only + + + GPIO43_LEVEL_HIGH + [13:13] + read-only + + + GPIO43_LEVEL_LOW + [12:12] + read-only + + + GPIO42_EDGE_HIGH + [11:11] + read-only + + + GPIO42_EDGE_LOW + [10:10] + read-only + + + GPIO42_LEVEL_HIGH + [9:9] + read-only + + + GPIO42_LEVEL_LOW + [8:8] + read-only + + + GPIO41_EDGE_HIGH + [7:7] + read-only + + + GPIO41_EDGE_LOW + [6:6] + read-only + + + GPIO41_LEVEL_HIGH + [5:5] + read-only + + + GPIO41_LEVEL_LOW + [4:4] + read-only + + + GPIO40_EDGE_HIGH + [3:3] + read-only + + + GPIO40_EDGE_LOW + [2:2] + read-only + + + GPIO40_LEVEL_HIGH + [1:1] + read-only + + + GPIO40_LEVEL_LOW + [0:0] + read-only + + + + + PROC1_INTE0 + 0x00000290 + Interrupt Enable for proc1 + 0x00000000 + + + GPIO7_EDGE_HIGH + [31:31] + read-write + + + GPIO7_EDGE_LOW + [30:30] + read-write + + + GPIO7_LEVEL_HIGH + [29:29] + read-write + + + GPIO7_LEVEL_LOW + [28:28] + read-write + + + GPIO6_EDGE_HIGH + [27:27] + read-write + + + GPIO6_EDGE_LOW + [26:26] + read-write + + + GPIO6_LEVEL_HIGH + [25:25] + read-write + + + GPIO6_LEVEL_LOW + [24:24] + read-write + + + GPIO5_EDGE_HIGH + [23:23] + read-write + + + GPIO5_EDGE_LOW + [22:22] + read-write + + + GPIO5_LEVEL_HIGH + [21:21] + read-write + + + GPIO5_LEVEL_LOW + [20:20] + read-write + + + GPIO4_EDGE_HIGH + [19:19] + read-write + + + GPIO4_EDGE_LOW + [18:18] + read-write + + + GPIO4_LEVEL_HIGH + [17:17] + read-write + + + GPIO4_LEVEL_LOW + [16:16] + read-write + + + GPIO3_EDGE_HIGH + [15:15] + read-write + + + GPIO3_EDGE_LOW + [14:14] + read-write + + + GPIO3_LEVEL_HIGH + [13:13] + read-write + + + GPIO3_LEVEL_LOW + [12:12] + read-write + + + GPIO2_EDGE_HIGH + [11:11] + read-write + + + GPIO2_EDGE_LOW + [10:10] + read-write + + + GPIO2_LEVEL_HIGH + [9:9] + read-write + + + GPIO2_LEVEL_LOW + [8:8] + read-write + + + GPIO1_EDGE_HIGH + [7:7] + read-write + + + GPIO1_EDGE_LOW + [6:6] + read-write + + + GPIO1_LEVEL_HIGH + [5:5] + read-write + + + GPIO1_LEVEL_LOW + [4:4] + read-write + + + GPIO0_EDGE_HIGH + [3:3] + read-write + + + GPIO0_EDGE_LOW + [2:2] + read-write + + + GPIO0_LEVEL_HIGH + [1:1] + read-write + + + GPIO0_LEVEL_LOW + [0:0] + read-write + + + + + PROC1_INTE1 + 0x00000294 + Interrupt Enable for proc1 + 0x00000000 + + + GPIO15_EDGE_HIGH + [31:31] + read-write + + + GPIO15_EDGE_LOW + [30:30] + read-write + + + GPIO15_LEVEL_HIGH + [29:29] + read-write + + + GPIO15_LEVEL_LOW + [28:28] + read-write + + + GPIO14_EDGE_HIGH + [27:27] + read-write + + + GPIO14_EDGE_LOW + [26:26] + read-write + + + GPIO14_LEVEL_HIGH + [25:25] + read-write + + + GPIO14_LEVEL_LOW + [24:24] + read-write + + + GPIO13_EDGE_HIGH + [23:23] + read-write + + + GPIO13_EDGE_LOW + [22:22] + read-write + + + GPIO13_LEVEL_HIGH + [21:21] + read-write + + + GPIO13_LEVEL_LOW + [20:20] + read-write + + + GPIO12_EDGE_HIGH + [19:19] + read-write + + + GPIO12_EDGE_LOW + [18:18] + read-write + + + GPIO12_LEVEL_HIGH + [17:17] + read-write + + + GPIO12_LEVEL_LOW + [16:16] + read-write + + + GPIO11_EDGE_HIGH + [15:15] + read-write + + + GPIO11_EDGE_LOW + [14:14] + read-write + + + GPIO11_LEVEL_HIGH + [13:13] + read-write + + + GPIO11_LEVEL_LOW + [12:12] + read-write + + + GPIO10_EDGE_HIGH + [11:11] + read-write + + + GPIO10_EDGE_LOW + [10:10] + read-write + + + GPIO10_LEVEL_HIGH + [9:9] + read-write + + + GPIO10_LEVEL_LOW + [8:8] + read-write + + + GPIO9_EDGE_HIGH + [7:7] + read-write + + + GPIO9_EDGE_LOW + [6:6] + read-write + + + GPIO9_LEVEL_HIGH + [5:5] + read-write + + + GPIO9_LEVEL_LOW + [4:4] + read-write + + + GPIO8_EDGE_HIGH + [3:3] + read-write + + + GPIO8_EDGE_LOW + [2:2] + read-write + + + GPIO8_LEVEL_HIGH + [1:1] + read-write + + + GPIO8_LEVEL_LOW + [0:0] + read-write + + + + + PROC1_INTE2 + 0x00000298 + Interrupt Enable for proc1 + 0x00000000 + + + GPIO23_EDGE_HIGH + [31:31] + read-write + + + GPIO23_EDGE_LOW + [30:30] + read-write + + + GPIO23_LEVEL_HIGH + [29:29] + read-write + + + GPIO23_LEVEL_LOW + [28:28] + read-write + + + GPIO22_EDGE_HIGH + [27:27] + read-write + + + GPIO22_EDGE_LOW + [26:26] + read-write + + + GPIO22_LEVEL_HIGH + [25:25] + read-write + + + GPIO22_LEVEL_LOW + [24:24] + read-write + + + GPIO21_EDGE_HIGH + [23:23] + read-write + + + GPIO21_EDGE_LOW + [22:22] + read-write + + + GPIO21_LEVEL_HIGH + [21:21] + read-write + + + GPIO21_LEVEL_LOW + [20:20] + read-write + + + GPIO20_EDGE_HIGH + [19:19] + read-write + + + GPIO20_EDGE_LOW + [18:18] + read-write + + + GPIO20_LEVEL_HIGH + [17:17] + read-write + + + GPIO20_LEVEL_LOW + [16:16] + read-write + + + GPIO19_EDGE_HIGH + [15:15] + read-write + + + GPIO19_EDGE_LOW + [14:14] + read-write + + + GPIO19_LEVEL_HIGH + [13:13] + read-write + + + GPIO19_LEVEL_LOW + [12:12] + read-write + + + GPIO18_EDGE_HIGH + [11:11] + read-write + + + GPIO18_EDGE_LOW + [10:10] + read-write + + + GPIO18_LEVEL_HIGH + [9:9] + read-write + + + GPIO18_LEVEL_LOW + [8:8] + read-write + + + GPIO17_EDGE_HIGH + [7:7] + read-write + + + GPIO17_EDGE_LOW + [6:6] + read-write + + + GPIO17_LEVEL_HIGH + [5:5] + read-write + + + GPIO17_LEVEL_LOW + [4:4] + read-write + + + GPIO16_EDGE_HIGH + [3:3] + read-write + + + GPIO16_EDGE_LOW + [2:2] + read-write + + + GPIO16_LEVEL_HIGH + [1:1] + read-write + + + GPIO16_LEVEL_LOW + [0:0] + read-write + + + + + PROC1_INTE3 + 0x0000029c + Interrupt Enable for proc1 + 0x00000000 + + + GPIO31_EDGE_HIGH + [31:31] + read-write + + + GPIO31_EDGE_LOW + [30:30] + read-write + + + GPIO31_LEVEL_HIGH + [29:29] + read-write + + + GPIO31_LEVEL_LOW + [28:28] + read-write + + + GPIO30_EDGE_HIGH + [27:27] + read-write + + + GPIO30_EDGE_LOW + [26:26] + read-write + + + GPIO30_LEVEL_HIGH + [25:25] + read-write + + + GPIO30_LEVEL_LOW + [24:24] + read-write + + + GPIO29_EDGE_HIGH + [23:23] + read-write + + + GPIO29_EDGE_LOW + [22:22] + read-write + + + GPIO29_LEVEL_HIGH + [21:21] + read-write + + + GPIO29_LEVEL_LOW + [20:20] + read-write + + + GPIO28_EDGE_HIGH + [19:19] + read-write + + + GPIO28_EDGE_LOW + [18:18] + read-write + + + GPIO28_LEVEL_HIGH + [17:17] + read-write + + + GPIO28_LEVEL_LOW + [16:16] + read-write + + + GPIO27_EDGE_HIGH + [15:15] + read-write + + + GPIO27_EDGE_LOW + [14:14] + read-write + + + GPIO27_LEVEL_HIGH + [13:13] + read-write + + + GPIO27_LEVEL_LOW + [12:12] + read-write + + + GPIO26_EDGE_HIGH + [11:11] + read-write + + + GPIO26_EDGE_LOW + [10:10] + read-write + + + GPIO26_LEVEL_HIGH + [9:9] + read-write + + + GPIO26_LEVEL_LOW + [8:8] + read-write + + + GPIO25_EDGE_HIGH + [7:7] + read-write + + + GPIO25_EDGE_LOW + [6:6] + read-write + + + GPIO25_LEVEL_HIGH + [5:5] + read-write + + + GPIO25_LEVEL_LOW + [4:4] + read-write + + + GPIO24_EDGE_HIGH + [3:3] + read-write + + + GPIO24_EDGE_LOW + [2:2] + read-write + + + GPIO24_LEVEL_HIGH + [1:1] + read-write + + + GPIO24_LEVEL_LOW + [0:0] + read-write + + + + + PROC1_INTE4 + 0x000002a0 + Interrupt Enable for proc1 + 0x00000000 + + + GPIO39_EDGE_HIGH + [31:31] + read-write + + + GPIO39_EDGE_LOW + [30:30] + read-write + + + GPIO39_LEVEL_HIGH + [29:29] + read-write + + + GPIO39_LEVEL_LOW + [28:28] + read-write + + + GPIO38_EDGE_HIGH + [27:27] + read-write + + + GPIO38_EDGE_LOW + [26:26] + read-write + + + GPIO38_LEVEL_HIGH + [25:25] + read-write + + + GPIO38_LEVEL_LOW + [24:24] + read-write + + + GPIO37_EDGE_HIGH + [23:23] + read-write + + + GPIO37_EDGE_LOW + [22:22] + read-write + + + GPIO37_LEVEL_HIGH + [21:21] + read-write + + + GPIO37_LEVEL_LOW + [20:20] + read-write + + + GPIO36_EDGE_HIGH + [19:19] + read-write + + + GPIO36_EDGE_LOW + [18:18] + read-write + + + GPIO36_LEVEL_HIGH + [17:17] + read-write + + + GPIO36_LEVEL_LOW + [16:16] + read-write + + + GPIO35_EDGE_HIGH + [15:15] + read-write + + + GPIO35_EDGE_LOW + [14:14] + read-write + + + GPIO35_LEVEL_HIGH + [13:13] + read-write + + + GPIO35_LEVEL_LOW + [12:12] + read-write + + + GPIO34_EDGE_HIGH + [11:11] + read-write + + + GPIO34_EDGE_LOW + [10:10] + read-write + + + GPIO34_LEVEL_HIGH + [9:9] + read-write + + + GPIO34_LEVEL_LOW + [8:8] + read-write + + + GPIO33_EDGE_HIGH + [7:7] + read-write + + + GPIO33_EDGE_LOW + [6:6] + read-write + + + GPIO33_LEVEL_HIGH + [5:5] + read-write + + + GPIO33_LEVEL_LOW + [4:4] + read-write + + + GPIO32_EDGE_HIGH + [3:3] + read-write + + + GPIO32_EDGE_LOW + [2:2] + read-write + + + GPIO32_LEVEL_HIGH + [1:1] + read-write + + + GPIO32_LEVEL_LOW + [0:0] + read-write + + + + + PROC1_INTE5 + 0x000002a4 + Interrupt Enable for proc1 + 0x00000000 + + + GPIO47_EDGE_HIGH + [31:31] + read-write + + + GPIO47_EDGE_LOW + [30:30] + read-write + + + GPIO47_LEVEL_HIGH + [29:29] + read-write + + + GPIO47_LEVEL_LOW + [28:28] + read-write + + + GPIO46_EDGE_HIGH + [27:27] + read-write + + + GPIO46_EDGE_LOW + [26:26] + read-write + + + GPIO46_LEVEL_HIGH + [25:25] + read-write + + + GPIO46_LEVEL_LOW + [24:24] + read-write + + + GPIO45_EDGE_HIGH + [23:23] + read-write + + + GPIO45_EDGE_LOW + [22:22] + read-write + + + GPIO45_LEVEL_HIGH + [21:21] + read-write + + + GPIO45_LEVEL_LOW + [20:20] + read-write + + + GPIO44_EDGE_HIGH + [19:19] + read-write + + + GPIO44_EDGE_LOW + [18:18] + read-write + + + GPIO44_LEVEL_HIGH + [17:17] + read-write + + + GPIO44_LEVEL_LOW + [16:16] + read-write + + + GPIO43_EDGE_HIGH + [15:15] + read-write + + + GPIO43_EDGE_LOW + [14:14] + read-write + + + GPIO43_LEVEL_HIGH + [13:13] + read-write + + + GPIO43_LEVEL_LOW + [12:12] + read-write + + + GPIO42_EDGE_HIGH + [11:11] + read-write + + + GPIO42_EDGE_LOW + [10:10] + read-write + + + GPIO42_LEVEL_HIGH + [9:9] + read-write + + + GPIO42_LEVEL_LOW + [8:8] + read-write + + + GPIO41_EDGE_HIGH + [7:7] + read-write + + + GPIO41_EDGE_LOW + [6:6] + read-write + + + GPIO41_LEVEL_HIGH + [5:5] + read-write + + + GPIO41_LEVEL_LOW + [4:4] + read-write + + + GPIO40_EDGE_HIGH + [3:3] + read-write + + + GPIO40_EDGE_LOW + [2:2] + read-write + + + GPIO40_LEVEL_HIGH + [1:1] + read-write + + + GPIO40_LEVEL_LOW + [0:0] + read-write + + + + + PROC1_INTF0 + 0x000002a8 + Interrupt Force for proc1 + 0x00000000 + + + GPIO7_EDGE_HIGH + [31:31] + read-write + + + GPIO7_EDGE_LOW + [30:30] + read-write + + + GPIO7_LEVEL_HIGH + [29:29] + read-write + + + GPIO7_LEVEL_LOW + [28:28] + read-write + + + GPIO6_EDGE_HIGH + [27:27] + read-write + + + GPIO6_EDGE_LOW + [26:26] + read-write + + + GPIO6_LEVEL_HIGH + [25:25] + read-write + + + GPIO6_LEVEL_LOW + [24:24] + read-write + + + GPIO5_EDGE_HIGH + [23:23] + read-write + + + GPIO5_EDGE_LOW + [22:22] + read-write + + + GPIO5_LEVEL_HIGH + [21:21] + read-write + + + GPIO5_LEVEL_LOW + [20:20] + read-write + + + GPIO4_EDGE_HIGH + [19:19] + read-write + + + GPIO4_EDGE_LOW + [18:18] + read-write + + + GPIO4_LEVEL_HIGH + [17:17] + read-write + + + GPIO4_LEVEL_LOW + [16:16] + read-write + + + GPIO3_EDGE_HIGH + [15:15] + read-write + + + GPIO3_EDGE_LOW + [14:14] + read-write + + + GPIO3_LEVEL_HIGH + [13:13] + read-write + + + GPIO3_LEVEL_LOW + [12:12] + read-write + + + GPIO2_EDGE_HIGH + [11:11] + read-write + + + GPIO2_EDGE_LOW + [10:10] + read-write + + + GPIO2_LEVEL_HIGH + [9:9] + read-write + + + GPIO2_LEVEL_LOW + [8:8] + read-write + + + GPIO1_EDGE_HIGH + [7:7] + read-write + + + GPIO1_EDGE_LOW + [6:6] + read-write + + + GPIO1_LEVEL_HIGH + [5:5] + read-write + + + GPIO1_LEVEL_LOW + [4:4] + read-write + + + GPIO0_EDGE_HIGH + [3:3] + read-write + + + GPIO0_EDGE_LOW + [2:2] + read-write + + + GPIO0_LEVEL_HIGH + [1:1] + read-write + + + GPIO0_LEVEL_LOW + [0:0] + read-write + + + + + PROC1_INTF1 + 0x000002ac + Interrupt Force for proc1 + 0x00000000 + + + GPIO15_EDGE_HIGH + [31:31] + read-write + + + GPIO15_EDGE_LOW + [30:30] + read-write + + + GPIO15_LEVEL_HIGH + [29:29] + read-write + + + GPIO15_LEVEL_LOW + [28:28] + read-write + + + GPIO14_EDGE_HIGH + [27:27] + read-write + + + GPIO14_EDGE_LOW + [26:26] + read-write + + + GPIO14_LEVEL_HIGH + [25:25] + read-write + + + GPIO14_LEVEL_LOW + [24:24] + read-write + + + GPIO13_EDGE_HIGH + [23:23] + read-write + + + GPIO13_EDGE_LOW + [22:22] + read-write + + + GPIO13_LEVEL_HIGH + [21:21] + read-write + + + GPIO13_LEVEL_LOW + [20:20] + read-write + + + GPIO12_EDGE_HIGH + [19:19] + read-write + + + GPIO12_EDGE_LOW + [18:18] + read-write + + + GPIO12_LEVEL_HIGH + [17:17] + read-write + + + GPIO12_LEVEL_LOW + [16:16] + read-write + + + GPIO11_EDGE_HIGH + [15:15] + read-write + + + GPIO11_EDGE_LOW + [14:14] + read-write + + + GPIO11_LEVEL_HIGH + [13:13] + read-write + + + GPIO11_LEVEL_LOW + [12:12] + read-write + + + GPIO10_EDGE_HIGH + [11:11] + read-write + + + GPIO10_EDGE_LOW + [10:10] + read-write + + + GPIO10_LEVEL_HIGH + [9:9] + read-write + + + GPIO10_LEVEL_LOW + [8:8] + read-write + + + GPIO9_EDGE_HIGH + [7:7] + read-write + + + GPIO9_EDGE_LOW + [6:6] + read-write + + + GPIO9_LEVEL_HIGH + [5:5] + read-write + + + GPIO9_LEVEL_LOW + [4:4] + read-write + + + GPIO8_EDGE_HIGH + [3:3] + read-write + + + GPIO8_EDGE_LOW + [2:2] + read-write + + + GPIO8_LEVEL_HIGH + [1:1] + read-write + + + GPIO8_LEVEL_LOW + [0:0] + read-write + + + + + PROC1_INTF2 + 0x000002b0 + Interrupt Force for proc1 + 0x00000000 + + + GPIO23_EDGE_HIGH + [31:31] + read-write + + + GPIO23_EDGE_LOW + [30:30] + read-write + + + GPIO23_LEVEL_HIGH + [29:29] + read-write + + + GPIO23_LEVEL_LOW + [28:28] + read-write + + + GPIO22_EDGE_HIGH + [27:27] + read-write + + + GPIO22_EDGE_LOW + [26:26] + read-write + + + GPIO22_LEVEL_HIGH + [25:25] + read-write + + + GPIO22_LEVEL_LOW + [24:24] + read-write + + + GPIO21_EDGE_HIGH + [23:23] + read-write + + + GPIO21_EDGE_LOW + [22:22] + read-write + + + GPIO21_LEVEL_HIGH + [21:21] + read-write + + + GPIO21_LEVEL_LOW + [20:20] + read-write + + + GPIO20_EDGE_HIGH + [19:19] + read-write + + + GPIO20_EDGE_LOW + [18:18] + read-write + + + GPIO20_LEVEL_HIGH + [17:17] + read-write + + + GPIO20_LEVEL_LOW + [16:16] + read-write + + + GPIO19_EDGE_HIGH + [15:15] + read-write + + + GPIO19_EDGE_LOW + [14:14] + read-write + + + GPIO19_LEVEL_HIGH + [13:13] + read-write + + + GPIO19_LEVEL_LOW + [12:12] + read-write + + + GPIO18_EDGE_HIGH + [11:11] + read-write + + + GPIO18_EDGE_LOW + [10:10] + read-write + + + GPIO18_LEVEL_HIGH + [9:9] + read-write + + + GPIO18_LEVEL_LOW + [8:8] + read-write + + + GPIO17_EDGE_HIGH + [7:7] + read-write + + + GPIO17_EDGE_LOW + [6:6] + read-write + + + GPIO17_LEVEL_HIGH + [5:5] + read-write + + + GPIO17_LEVEL_LOW + [4:4] + read-write + + + GPIO16_EDGE_HIGH + [3:3] + read-write + + + GPIO16_EDGE_LOW + [2:2] + read-write + + + GPIO16_LEVEL_HIGH + [1:1] + read-write + + + GPIO16_LEVEL_LOW + [0:0] + read-write + + + + + PROC1_INTF3 + 0x000002b4 + Interrupt Force for proc1 + 0x00000000 + + + GPIO31_EDGE_HIGH + [31:31] + read-write + + + GPIO31_EDGE_LOW + [30:30] + read-write + + + GPIO31_LEVEL_HIGH + [29:29] + read-write + + + GPIO31_LEVEL_LOW + [28:28] + read-write + + + GPIO30_EDGE_HIGH + [27:27] + read-write + + + GPIO30_EDGE_LOW + [26:26] + read-write + + + GPIO30_LEVEL_HIGH + [25:25] + read-write + + + GPIO30_LEVEL_LOW + [24:24] + read-write + + + GPIO29_EDGE_HIGH + [23:23] + read-write + + + GPIO29_EDGE_LOW + [22:22] + read-write + + + GPIO29_LEVEL_HIGH + [21:21] + read-write + + + GPIO29_LEVEL_LOW + [20:20] + read-write + + + GPIO28_EDGE_HIGH + [19:19] + read-write + + + GPIO28_EDGE_LOW + [18:18] + read-write + + + GPIO28_LEVEL_HIGH + [17:17] + read-write + + + GPIO28_LEVEL_LOW + [16:16] + read-write + + + GPIO27_EDGE_HIGH + [15:15] + read-write + + + GPIO27_EDGE_LOW + [14:14] + read-write + + + GPIO27_LEVEL_HIGH + [13:13] + read-write + + + GPIO27_LEVEL_LOW + [12:12] + read-write + + + GPIO26_EDGE_HIGH + [11:11] + read-write + + + GPIO26_EDGE_LOW + [10:10] + read-write + + + GPIO26_LEVEL_HIGH + [9:9] + read-write + + + GPIO26_LEVEL_LOW + [8:8] + read-write + + + GPIO25_EDGE_HIGH + [7:7] + read-write + + + GPIO25_EDGE_LOW + [6:6] + read-write + + + GPIO25_LEVEL_HIGH + [5:5] + read-write + + + GPIO25_LEVEL_LOW + [4:4] + read-write + + + GPIO24_EDGE_HIGH + [3:3] + read-write + + + GPIO24_EDGE_LOW + [2:2] + read-write + + + GPIO24_LEVEL_HIGH + [1:1] + read-write + + + GPIO24_LEVEL_LOW + [0:0] + read-write + + + + + PROC1_INTF4 + 0x000002b8 + Interrupt Force for proc1 + 0x00000000 + + + GPIO39_EDGE_HIGH + [31:31] + read-write + + + GPIO39_EDGE_LOW + [30:30] + read-write + + + GPIO39_LEVEL_HIGH + [29:29] + read-write + + + GPIO39_LEVEL_LOW + [28:28] + read-write + + + GPIO38_EDGE_HIGH + [27:27] + read-write + + + GPIO38_EDGE_LOW + [26:26] + read-write + + + GPIO38_LEVEL_HIGH + [25:25] + read-write + + + GPIO38_LEVEL_LOW + [24:24] + read-write + + + GPIO37_EDGE_HIGH + [23:23] + read-write + + + GPIO37_EDGE_LOW + [22:22] + read-write + + + GPIO37_LEVEL_HIGH + [21:21] + read-write + + + GPIO37_LEVEL_LOW + [20:20] + read-write + + + GPIO36_EDGE_HIGH + [19:19] + read-write + + + GPIO36_EDGE_LOW + [18:18] + read-write + + + GPIO36_LEVEL_HIGH + [17:17] + read-write + + + GPIO36_LEVEL_LOW + [16:16] + read-write + + + GPIO35_EDGE_HIGH + [15:15] + read-write + + + GPIO35_EDGE_LOW + [14:14] + read-write + + + GPIO35_LEVEL_HIGH + [13:13] + read-write + + + GPIO35_LEVEL_LOW + [12:12] + read-write + + + GPIO34_EDGE_HIGH + [11:11] + read-write + + + GPIO34_EDGE_LOW + [10:10] + read-write + + + GPIO34_LEVEL_HIGH + [9:9] + read-write + + + GPIO34_LEVEL_LOW + [8:8] + read-write + + + GPIO33_EDGE_HIGH + [7:7] + read-write + + + GPIO33_EDGE_LOW + [6:6] + read-write + + + GPIO33_LEVEL_HIGH + [5:5] + read-write + + + GPIO33_LEVEL_LOW + [4:4] + read-write + + + GPIO32_EDGE_HIGH + [3:3] + read-write + + + GPIO32_EDGE_LOW + [2:2] + read-write + + + GPIO32_LEVEL_HIGH + [1:1] + read-write + + + GPIO32_LEVEL_LOW + [0:0] + read-write + + + + + PROC1_INTF5 + 0x000002bc + Interrupt Force for proc1 + 0x00000000 + + + GPIO47_EDGE_HIGH + [31:31] + read-write + + + GPIO47_EDGE_LOW + [30:30] + read-write + + + GPIO47_LEVEL_HIGH + [29:29] + read-write + + + GPIO47_LEVEL_LOW + [28:28] + read-write + + + GPIO46_EDGE_HIGH + [27:27] + read-write + + + GPIO46_EDGE_LOW + [26:26] + read-write + + + GPIO46_LEVEL_HIGH + [25:25] + read-write + + + GPIO46_LEVEL_LOW + [24:24] + read-write + + + GPIO45_EDGE_HIGH + [23:23] + read-write + + + GPIO45_EDGE_LOW + [22:22] + read-write + + + GPIO45_LEVEL_HIGH + [21:21] + read-write + + + GPIO45_LEVEL_LOW + [20:20] + read-write + + + GPIO44_EDGE_HIGH + [19:19] + read-write + + + GPIO44_EDGE_LOW + [18:18] + read-write + + + GPIO44_LEVEL_HIGH + [17:17] + read-write + + + GPIO44_LEVEL_LOW + [16:16] + read-write + + + GPIO43_EDGE_HIGH + [15:15] + read-write + + + GPIO43_EDGE_LOW + [14:14] + read-write + + + GPIO43_LEVEL_HIGH + [13:13] + read-write + + + GPIO43_LEVEL_LOW + [12:12] + read-write + + + GPIO42_EDGE_HIGH + [11:11] + read-write + + + GPIO42_EDGE_LOW + [10:10] + read-write + + + GPIO42_LEVEL_HIGH + [9:9] + read-write + + + GPIO42_LEVEL_LOW + [8:8] + read-write + + + GPIO41_EDGE_HIGH + [7:7] + read-write + + + GPIO41_EDGE_LOW + [6:6] + read-write + + + GPIO41_LEVEL_HIGH + [5:5] + read-write + + + GPIO41_LEVEL_LOW + [4:4] + read-write + + + GPIO40_EDGE_HIGH + [3:3] + read-write + + + GPIO40_EDGE_LOW + [2:2] + read-write + + + GPIO40_LEVEL_HIGH + [1:1] + read-write + + + GPIO40_LEVEL_LOW + [0:0] + read-write + + + + + PROC1_INTS0 + 0x000002c0 + Interrupt status after masking & forcing for proc1 + 0x00000000 + + + GPIO7_EDGE_HIGH + [31:31] + read-only + + + GPIO7_EDGE_LOW + [30:30] + read-only + + + GPIO7_LEVEL_HIGH + [29:29] + read-only + + + GPIO7_LEVEL_LOW + [28:28] + read-only + + + GPIO6_EDGE_HIGH + [27:27] + read-only + + + GPIO6_EDGE_LOW + [26:26] + read-only + + + GPIO6_LEVEL_HIGH + [25:25] + read-only + + + GPIO6_LEVEL_LOW + [24:24] + read-only + + + GPIO5_EDGE_HIGH + [23:23] + read-only + + + GPIO5_EDGE_LOW + [22:22] + read-only + + + GPIO5_LEVEL_HIGH + [21:21] + read-only + + + GPIO5_LEVEL_LOW + [20:20] + read-only + + + GPIO4_EDGE_HIGH + [19:19] + read-only + + + GPIO4_EDGE_LOW + [18:18] + read-only + + + GPIO4_LEVEL_HIGH + [17:17] + read-only + + + GPIO4_LEVEL_LOW + [16:16] + read-only + + + GPIO3_EDGE_HIGH + [15:15] + read-only + + + GPIO3_EDGE_LOW + [14:14] + read-only + + + GPIO3_LEVEL_HIGH + [13:13] + read-only + + + GPIO3_LEVEL_LOW + [12:12] + read-only + + + GPIO2_EDGE_HIGH + [11:11] + read-only + + + GPIO2_EDGE_LOW + [10:10] + read-only + + + GPIO2_LEVEL_HIGH + [9:9] + read-only + + + GPIO2_LEVEL_LOW + [8:8] + read-only + + + GPIO1_EDGE_HIGH + [7:7] + read-only + + + GPIO1_EDGE_LOW + [6:6] + read-only + + + GPIO1_LEVEL_HIGH + [5:5] + read-only + + + GPIO1_LEVEL_LOW + [4:4] + read-only + + + GPIO0_EDGE_HIGH + [3:3] + read-only + + + GPIO0_EDGE_LOW + [2:2] + read-only + + + GPIO0_LEVEL_HIGH + [1:1] + read-only + + + GPIO0_LEVEL_LOW + [0:0] + read-only + + + + + PROC1_INTS1 + 0x000002c4 + Interrupt status after masking & forcing for proc1 + 0x00000000 + + + GPIO15_EDGE_HIGH + [31:31] + read-only + + + GPIO15_EDGE_LOW + [30:30] + read-only + + + GPIO15_LEVEL_HIGH + [29:29] + read-only + + + GPIO15_LEVEL_LOW + [28:28] + read-only + + + GPIO14_EDGE_HIGH + [27:27] + read-only + + + GPIO14_EDGE_LOW + [26:26] + read-only + + + GPIO14_LEVEL_HIGH + [25:25] + read-only + + + GPIO14_LEVEL_LOW + [24:24] + read-only + + + GPIO13_EDGE_HIGH + [23:23] + read-only + + + GPIO13_EDGE_LOW + [22:22] + read-only + + + GPIO13_LEVEL_HIGH + [21:21] + read-only + + + GPIO13_LEVEL_LOW + [20:20] + read-only + + + GPIO12_EDGE_HIGH + [19:19] + read-only + + + GPIO12_EDGE_LOW + [18:18] + read-only + + + GPIO12_LEVEL_HIGH + [17:17] + read-only + + + GPIO12_LEVEL_LOW + [16:16] + read-only + + + GPIO11_EDGE_HIGH + [15:15] + read-only + + + GPIO11_EDGE_LOW + [14:14] + read-only + + + GPIO11_LEVEL_HIGH + [13:13] + read-only + + + GPIO11_LEVEL_LOW + [12:12] + read-only + + + GPIO10_EDGE_HIGH + [11:11] + read-only + + + GPIO10_EDGE_LOW + [10:10] + read-only + + + GPIO10_LEVEL_HIGH + [9:9] + read-only + + + GPIO10_LEVEL_LOW + [8:8] + read-only + + + GPIO9_EDGE_HIGH + [7:7] + read-only + + + GPIO9_EDGE_LOW + [6:6] + read-only + + + GPIO9_LEVEL_HIGH + [5:5] + read-only + + + GPIO9_LEVEL_LOW + [4:4] + read-only + + + GPIO8_EDGE_HIGH + [3:3] + read-only + + + GPIO8_EDGE_LOW + [2:2] + read-only + + + GPIO8_LEVEL_HIGH + [1:1] + read-only + + + GPIO8_LEVEL_LOW + [0:0] + read-only + + + + + PROC1_INTS2 + 0x000002c8 + Interrupt status after masking & forcing for proc1 + 0x00000000 + + + GPIO23_EDGE_HIGH + [31:31] + read-only + + + GPIO23_EDGE_LOW + [30:30] + read-only + + + GPIO23_LEVEL_HIGH + [29:29] + read-only + + + GPIO23_LEVEL_LOW + [28:28] + read-only + + + GPIO22_EDGE_HIGH + [27:27] + read-only + + + GPIO22_EDGE_LOW + [26:26] + read-only + + + GPIO22_LEVEL_HIGH + [25:25] + read-only + + + GPIO22_LEVEL_LOW + [24:24] + read-only + + + GPIO21_EDGE_HIGH + [23:23] + read-only + + + GPIO21_EDGE_LOW + [22:22] + read-only + + + GPIO21_LEVEL_HIGH + [21:21] + read-only + + + GPIO21_LEVEL_LOW + [20:20] + read-only + + + GPIO20_EDGE_HIGH + [19:19] + read-only + + + GPIO20_EDGE_LOW + [18:18] + read-only + + + GPIO20_LEVEL_HIGH + [17:17] + read-only + + + GPIO20_LEVEL_LOW + [16:16] + read-only + + + GPIO19_EDGE_HIGH + [15:15] + read-only + + + GPIO19_EDGE_LOW + [14:14] + read-only + + + GPIO19_LEVEL_HIGH + [13:13] + read-only + + + GPIO19_LEVEL_LOW + [12:12] + read-only + + + GPIO18_EDGE_HIGH + [11:11] + read-only + + + GPIO18_EDGE_LOW + [10:10] + read-only + + + GPIO18_LEVEL_HIGH + [9:9] + read-only + + + GPIO18_LEVEL_LOW + [8:8] + read-only + + + GPIO17_EDGE_HIGH + [7:7] + read-only + + + GPIO17_EDGE_LOW + [6:6] + read-only + + + GPIO17_LEVEL_HIGH + [5:5] + read-only + + + GPIO17_LEVEL_LOW + [4:4] + read-only + + + GPIO16_EDGE_HIGH + [3:3] + read-only + + + GPIO16_EDGE_LOW + [2:2] + read-only + + + GPIO16_LEVEL_HIGH + [1:1] + read-only + + + GPIO16_LEVEL_LOW + [0:0] + read-only + + + + + PROC1_INTS3 + 0x000002cc + Interrupt status after masking & forcing for proc1 + 0x00000000 + + + GPIO31_EDGE_HIGH + [31:31] + read-only + + + GPIO31_EDGE_LOW + [30:30] + read-only + + + GPIO31_LEVEL_HIGH + [29:29] + read-only + + + GPIO31_LEVEL_LOW + [28:28] + read-only + + + GPIO30_EDGE_HIGH + [27:27] + read-only + + + GPIO30_EDGE_LOW + [26:26] + read-only + + + GPIO30_LEVEL_HIGH + [25:25] + read-only + + + GPIO30_LEVEL_LOW + [24:24] + read-only + + + GPIO29_EDGE_HIGH + [23:23] + read-only + + + GPIO29_EDGE_LOW + [22:22] + read-only + + + GPIO29_LEVEL_HIGH + [21:21] + read-only + + + GPIO29_LEVEL_LOW + [20:20] + read-only + + + GPIO28_EDGE_HIGH + [19:19] + read-only + + + GPIO28_EDGE_LOW + [18:18] + read-only + + + GPIO28_LEVEL_HIGH + [17:17] + read-only + + + GPIO28_LEVEL_LOW + [16:16] + read-only + + + GPIO27_EDGE_HIGH + [15:15] + read-only + + + GPIO27_EDGE_LOW + [14:14] + read-only + + + GPIO27_LEVEL_HIGH + [13:13] + read-only + + + GPIO27_LEVEL_LOW + [12:12] + read-only + + + GPIO26_EDGE_HIGH + [11:11] + read-only + + + GPIO26_EDGE_LOW + [10:10] + read-only + + + GPIO26_LEVEL_HIGH + [9:9] + read-only + + + GPIO26_LEVEL_LOW + [8:8] + read-only + + + GPIO25_EDGE_HIGH + [7:7] + read-only + + + GPIO25_EDGE_LOW + [6:6] + read-only + + + GPIO25_LEVEL_HIGH + [5:5] + read-only + + + GPIO25_LEVEL_LOW + [4:4] + read-only + + + GPIO24_EDGE_HIGH + [3:3] + read-only + + + GPIO24_EDGE_LOW + [2:2] + read-only + + + GPIO24_LEVEL_HIGH + [1:1] + read-only + + + GPIO24_LEVEL_LOW + [0:0] + read-only + + + + + PROC1_INTS4 + 0x000002d0 + Interrupt status after masking & forcing for proc1 + 0x00000000 + + + GPIO39_EDGE_HIGH + [31:31] + read-only + + + GPIO39_EDGE_LOW + [30:30] + read-only + + + GPIO39_LEVEL_HIGH + [29:29] + read-only + + + GPIO39_LEVEL_LOW + [28:28] + read-only + + + GPIO38_EDGE_HIGH + [27:27] + read-only + + + GPIO38_EDGE_LOW + [26:26] + read-only + + + GPIO38_LEVEL_HIGH + [25:25] + read-only + + + GPIO38_LEVEL_LOW + [24:24] + read-only + + + GPIO37_EDGE_HIGH + [23:23] + read-only + + + GPIO37_EDGE_LOW + [22:22] + read-only + + + GPIO37_LEVEL_HIGH + [21:21] + read-only + + + GPIO37_LEVEL_LOW + [20:20] + read-only + + + GPIO36_EDGE_HIGH + [19:19] + read-only + + + GPIO36_EDGE_LOW + [18:18] + read-only + + + GPIO36_LEVEL_HIGH + [17:17] + read-only + + + GPIO36_LEVEL_LOW + [16:16] + read-only + + + GPIO35_EDGE_HIGH + [15:15] + read-only + + + GPIO35_EDGE_LOW + [14:14] + read-only + + + GPIO35_LEVEL_HIGH + [13:13] + read-only + + + GPIO35_LEVEL_LOW + [12:12] + read-only + + + GPIO34_EDGE_HIGH + [11:11] + read-only + + + GPIO34_EDGE_LOW + [10:10] + read-only + + + GPIO34_LEVEL_HIGH + [9:9] + read-only + + + GPIO34_LEVEL_LOW + [8:8] + read-only + + + GPIO33_EDGE_HIGH + [7:7] + read-only + + + GPIO33_EDGE_LOW + [6:6] + read-only + + + GPIO33_LEVEL_HIGH + [5:5] + read-only + + + GPIO33_LEVEL_LOW + [4:4] + read-only + + + GPIO32_EDGE_HIGH + [3:3] + read-only + + + GPIO32_EDGE_LOW + [2:2] + read-only + + + GPIO32_LEVEL_HIGH + [1:1] + read-only + + + GPIO32_LEVEL_LOW + [0:0] + read-only + + + + + PROC1_INTS5 + 0x000002d4 + Interrupt status after masking & forcing for proc1 + 0x00000000 + + + GPIO47_EDGE_HIGH + [31:31] + read-only + + + GPIO47_EDGE_LOW + [30:30] + read-only + + + GPIO47_LEVEL_HIGH + [29:29] + read-only + + + GPIO47_LEVEL_LOW + [28:28] + read-only + + + GPIO46_EDGE_HIGH + [27:27] + read-only + + + GPIO46_EDGE_LOW + [26:26] + read-only + + + GPIO46_LEVEL_HIGH + [25:25] + read-only + + + GPIO46_LEVEL_LOW + [24:24] + read-only + + + GPIO45_EDGE_HIGH + [23:23] + read-only + + + GPIO45_EDGE_LOW + [22:22] + read-only + + + GPIO45_LEVEL_HIGH + [21:21] + read-only + + + GPIO45_LEVEL_LOW + [20:20] + read-only + + + GPIO44_EDGE_HIGH + [19:19] + read-only + + + GPIO44_EDGE_LOW + [18:18] + read-only + + + GPIO44_LEVEL_HIGH + [17:17] + read-only + + + GPIO44_LEVEL_LOW + [16:16] + read-only + + + GPIO43_EDGE_HIGH + [15:15] + read-only + + + GPIO43_EDGE_LOW + [14:14] + read-only + + + GPIO43_LEVEL_HIGH + [13:13] + read-only + + + GPIO43_LEVEL_LOW + [12:12] + read-only + + + GPIO42_EDGE_HIGH + [11:11] + read-only + + + GPIO42_EDGE_LOW + [10:10] + read-only + + + GPIO42_LEVEL_HIGH + [9:9] + read-only + + + GPIO42_LEVEL_LOW + [8:8] + read-only + + + GPIO41_EDGE_HIGH + [7:7] + read-only + + + GPIO41_EDGE_LOW + [6:6] + read-only + + + GPIO41_LEVEL_HIGH + [5:5] + read-only + + + GPIO41_LEVEL_LOW + [4:4] + read-only + + + GPIO40_EDGE_HIGH + [3:3] + read-only + + + GPIO40_EDGE_LOW + [2:2] + read-only + + + GPIO40_LEVEL_HIGH + [1:1] + read-only + + + GPIO40_LEVEL_LOW + [0:0] + read-only + + + + + DORMANT_WAKE_INTE0 + 0x000002d8 + Interrupt Enable for dormant_wake + 0x00000000 + + + GPIO7_EDGE_HIGH + [31:31] + read-write + + + GPIO7_EDGE_LOW + [30:30] + read-write + + + GPIO7_LEVEL_HIGH + [29:29] + read-write + + + GPIO7_LEVEL_LOW + [28:28] + read-write + + + GPIO6_EDGE_HIGH + [27:27] + read-write + + + GPIO6_EDGE_LOW + [26:26] + read-write + + + GPIO6_LEVEL_HIGH + [25:25] + read-write + + + GPIO6_LEVEL_LOW + [24:24] + read-write + + + GPIO5_EDGE_HIGH + [23:23] + read-write + + + GPIO5_EDGE_LOW + [22:22] + read-write + + + GPIO5_LEVEL_HIGH + [21:21] + read-write + + + GPIO5_LEVEL_LOW + [20:20] + read-write + + + GPIO4_EDGE_HIGH + [19:19] + read-write + + + GPIO4_EDGE_LOW + [18:18] + read-write + + + GPIO4_LEVEL_HIGH + [17:17] + read-write + + + GPIO4_LEVEL_LOW + [16:16] + read-write + + + GPIO3_EDGE_HIGH + [15:15] + read-write + + + GPIO3_EDGE_LOW + [14:14] + read-write + + + GPIO3_LEVEL_HIGH + [13:13] + read-write + + + GPIO3_LEVEL_LOW + [12:12] + read-write + + + GPIO2_EDGE_HIGH + [11:11] + read-write + + + GPIO2_EDGE_LOW + [10:10] + read-write + + + GPIO2_LEVEL_HIGH + [9:9] + read-write + + + GPIO2_LEVEL_LOW + [8:8] + read-write + + + GPIO1_EDGE_HIGH + [7:7] + read-write + + + GPIO1_EDGE_LOW + [6:6] + read-write + + + GPIO1_LEVEL_HIGH + [5:5] + read-write + + + GPIO1_LEVEL_LOW + [4:4] + read-write + + + GPIO0_EDGE_HIGH + [3:3] + read-write + + + GPIO0_EDGE_LOW + [2:2] + read-write + + + GPIO0_LEVEL_HIGH + [1:1] + read-write + + + GPIO0_LEVEL_LOW + [0:0] + read-write + + + + + DORMANT_WAKE_INTE1 + 0x000002dc + Interrupt Enable for dormant_wake + 0x00000000 + + + GPIO15_EDGE_HIGH + [31:31] + read-write + + + GPIO15_EDGE_LOW + [30:30] + read-write + + + GPIO15_LEVEL_HIGH + [29:29] + read-write + + + GPIO15_LEVEL_LOW + [28:28] + read-write + + + GPIO14_EDGE_HIGH + [27:27] + read-write + + + GPIO14_EDGE_LOW + [26:26] + read-write + + + GPIO14_LEVEL_HIGH + [25:25] + read-write + + + GPIO14_LEVEL_LOW + [24:24] + read-write + + + GPIO13_EDGE_HIGH + [23:23] + read-write + + + GPIO13_EDGE_LOW + [22:22] + read-write + + + GPIO13_LEVEL_HIGH + [21:21] + read-write + + + GPIO13_LEVEL_LOW + [20:20] + read-write + + + GPIO12_EDGE_HIGH + [19:19] + read-write + + + GPIO12_EDGE_LOW + [18:18] + read-write + + + GPIO12_LEVEL_HIGH + [17:17] + read-write + + + GPIO12_LEVEL_LOW + [16:16] + read-write + + + GPIO11_EDGE_HIGH + [15:15] + read-write + + + GPIO11_EDGE_LOW + [14:14] + read-write + + + GPIO11_LEVEL_HIGH + [13:13] + read-write + + + GPIO11_LEVEL_LOW + [12:12] + read-write + + + GPIO10_EDGE_HIGH + [11:11] + read-write + + + GPIO10_EDGE_LOW + [10:10] + read-write + + + GPIO10_LEVEL_HIGH + [9:9] + read-write + + + GPIO10_LEVEL_LOW + [8:8] + read-write + + + GPIO9_EDGE_HIGH + [7:7] + read-write + + + GPIO9_EDGE_LOW + [6:6] + read-write + + + GPIO9_LEVEL_HIGH + [5:5] + read-write + + + GPIO9_LEVEL_LOW + [4:4] + read-write + + + GPIO8_EDGE_HIGH + [3:3] + read-write + + + GPIO8_EDGE_LOW + [2:2] + read-write + + + GPIO8_LEVEL_HIGH + [1:1] + read-write + + + GPIO8_LEVEL_LOW + [0:0] + read-write + + + + + DORMANT_WAKE_INTE2 + 0x000002e0 + Interrupt Enable for dormant_wake + 0x00000000 + + + GPIO23_EDGE_HIGH + [31:31] + read-write + + + GPIO23_EDGE_LOW + [30:30] + read-write + + + GPIO23_LEVEL_HIGH + [29:29] + read-write + + + GPIO23_LEVEL_LOW + [28:28] + read-write + + + GPIO22_EDGE_HIGH + [27:27] + read-write + + + GPIO22_EDGE_LOW + [26:26] + read-write + + + GPIO22_LEVEL_HIGH + [25:25] + read-write + + + GPIO22_LEVEL_LOW + [24:24] + read-write + + + GPIO21_EDGE_HIGH + [23:23] + read-write + + + GPIO21_EDGE_LOW + [22:22] + read-write + + + GPIO21_LEVEL_HIGH + [21:21] + read-write + + + GPIO21_LEVEL_LOW + [20:20] + read-write + + + GPIO20_EDGE_HIGH + [19:19] + read-write + + + GPIO20_EDGE_LOW + [18:18] + read-write + + + GPIO20_LEVEL_HIGH + [17:17] + read-write + + + GPIO20_LEVEL_LOW + [16:16] + read-write + + + GPIO19_EDGE_HIGH + [15:15] + read-write + + + GPIO19_EDGE_LOW + [14:14] + read-write + + + GPIO19_LEVEL_HIGH + [13:13] + read-write + + + GPIO19_LEVEL_LOW + [12:12] + read-write + + + GPIO18_EDGE_HIGH + [11:11] + read-write + + + GPIO18_EDGE_LOW + [10:10] + read-write + + + GPIO18_LEVEL_HIGH + [9:9] + read-write + + + GPIO18_LEVEL_LOW + [8:8] + read-write + + + GPIO17_EDGE_HIGH + [7:7] + read-write + + + GPIO17_EDGE_LOW + [6:6] + read-write + + + GPIO17_LEVEL_HIGH + [5:5] + read-write + + + GPIO17_LEVEL_LOW + [4:4] + read-write + + + GPIO16_EDGE_HIGH + [3:3] + read-write + + + GPIO16_EDGE_LOW + [2:2] + read-write + + + GPIO16_LEVEL_HIGH + [1:1] + read-write + + + GPIO16_LEVEL_LOW + [0:0] + read-write + + + + + DORMANT_WAKE_INTE3 + 0x000002e4 + Interrupt Enable for dormant_wake + 0x00000000 + + + GPIO31_EDGE_HIGH + [31:31] + read-write + + + GPIO31_EDGE_LOW + [30:30] + read-write + + + GPIO31_LEVEL_HIGH + [29:29] + read-write + + + GPIO31_LEVEL_LOW + [28:28] + read-write + + + GPIO30_EDGE_HIGH + [27:27] + read-write + + + GPIO30_EDGE_LOW + [26:26] + read-write + + + GPIO30_LEVEL_HIGH + [25:25] + read-write + + + GPIO30_LEVEL_LOW + [24:24] + read-write + + + GPIO29_EDGE_HIGH + [23:23] + read-write + + + GPIO29_EDGE_LOW + [22:22] + read-write + + + GPIO29_LEVEL_HIGH + [21:21] + read-write + + + GPIO29_LEVEL_LOW + [20:20] + read-write + + + GPIO28_EDGE_HIGH + [19:19] + read-write + + + GPIO28_EDGE_LOW + [18:18] + read-write + + + GPIO28_LEVEL_HIGH + [17:17] + read-write + + + GPIO28_LEVEL_LOW + [16:16] + read-write + + + GPIO27_EDGE_HIGH + [15:15] + read-write + + + GPIO27_EDGE_LOW + [14:14] + read-write + + + GPIO27_LEVEL_HIGH + [13:13] + read-write + + + GPIO27_LEVEL_LOW + [12:12] + read-write + + + GPIO26_EDGE_HIGH + [11:11] + read-write + + + GPIO26_EDGE_LOW + [10:10] + read-write + + + GPIO26_LEVEL_HIGH + [9:9] + read-write + + + GPIO26_LEVEL_LOW + [8:8] + read-write + + + GPIO25_EDGE_HIGH + [7:7] + read-write + + + GPIO25_EDGE_LOW + [6:6] + read-write + + + GPIO25_LEVEL_HIGH + [5:5] + read-write + + + GPIO25_LEVEL_LOW + [4:4] + read-write + + + GPIO24_EDGE_HIGH + [3:3] + read-write + + + GPIO24_EDGE_LOW + [2:2] + read-write + + + GPIO24_LEVEL_HIGH + [1:1] + read-write + + + GPIO24_LEVEL_LOW + [0:0] + read-write + + + + + DORMANT_WAKE_INTE4 + 0x000002e8 + Interrupt Enable for dormant_wake + 0x00000000 + + + GPIO39_EDGE_HIGH + [31:31] + read-write + + + GPIO39_EDGE_LOW + [30:30] + read-write + + + GPIO39_LEVEL_HIGH + [29:29] + read-write + + + GPIO39_LEVEL_LOW + [28:28] + read-write + + + GPIO38_EDGE_HIGH + [27:27] + read-write + + + GPIO38_EDGE_LOW + [26:26] + read-write + + + GPIO38_LEVEL_HIGH + [25:25] + read-write + + + GPIO38_LEVEL_LOW + [24:24] + read-write + + + GPIO37_EDGE_HIGH + [23:23] + read-write + + + GPIO37_EDGE_LOW + [22:22] + read-write + + + GPIO37_LEVEL_HIGH + [21:21] + read-write + + + GPIO37_LEVEL_LOW + [20:20] + read-write + + + GPIO36_EDGE_HIGH + [19:19] + read-write + + + GPIO36_EDGE_LOW + [18:18] + read-write + + + GPIO36_LEVEL_HIGH + [17:17] + read-write + + + GPIO36_LEVEL_LOW + [16:16] + read-write + + + GPIO35_EDGE_HIGH + [15:15] + read-write + + + GPIO35_EDGE_LOW + [14:14] + read-write + + + GPIO35_LEVEL_HIGH + [13:13] + read-write + + + GPIO35_LEVEL_LOW + [12:12] + read-write + + + GPIO34_EDGE_HIGH + [11:11] + read-write + + + GPIO34_EDGE_LOW + [10:10] + read-write + + + GPIO34_LEVEL_HIGH + [9:9] + read-write + + + GPIO34_LEVEL_LOW + [8:8] + read-write + + + GPIO33_EDGE_HIGH + [7:7] + read-write + + + GPIO33_EDGE_LOW + [6:6] + read-write + + + GPIO33_LEVEL_HIGH + [5:5] + read-write + + + GPIO33_LEVEL_LOW + [4:4] + read-write + + + GPIO32_EDGE_HIGH + [3:3] + read-write + + + GPIO32_EDGE_LOW + [2:2] + read-write + + + GPIO32_LEVEL_HIGH + [1:1] + read-write + + + GPIO32_LEVEL_LOW + [0:0] + read-write + + + + + DORMANT_WAKE_INTE5 + 0x000002ec + Interrupt Enable for dormant_wake + 0x00000000 + + + GPIO47_EDGE_HIGH + [31:31] + read-write + + + GPIO47_EDGE_LOW + [30:30] + read-write + + + GPIO47_LEVEL_HIGH + [29:29] + read-write + + + GPIO47_LEVEL_LOW + [28:28] + read-write + + + GPIO46_EDGE_HIGH + [27:27] + read-write + + + GPIO46_EDGE_LOW + [26:26] + read-write + + + GPIO46_LEVEL_HIGH + [25:25] + read-write + + + GPIO46_LEVEL_LOW + [24:24] + read-write + + + GPIO45_EDGE_HIGH + [23:23] + read-write + + + GPIO45_EDGE_LOW + [22:22] + read-write + + + GPIO45_LEVEL_HIGH + [21:21] + read-write + + + GPIO45_LEVEL_LOW + [20:20] + read-write + + + GPIO44_EDGE_HIGH + [19:19] + read-write + + + GPIO44_EDGE_LOW + [18:18] + read-write + + + GPIO44_LEVEL_HIGH + [17:17] + read-write + + + GPIO44_LEVEL_LOW + [16:16] + read-write + + + GPIO43_EDGE_HIGH + [15:15] + read-write + + + GPIO43_EDGE_LOW + [14:14] + read-write + + + GPIO43_LEVEL_HIGH + [13:13] + read-write + + + GPIO43_LEVEL_LOW + [12:12] + read-write + + + GPIO42_EDGE_HIGH + [11:11] + read-write + + + GPIO42_EDGE_LOW + [10:10] + read-write + + + GPIO42_LEVEL_HIGH + [9:9] + read-write + + + GPIO42_LEVEL_LOW + [8:8] + read-write + + + GPIO41_EDGE_HIGH + [7:7] + read-write + + + GPIO41_EDGE_LOW + [6:6] + read-write + + + GPIO41_LEVEL_HIGH + [5:5] + read-write + + + GPIO41_LEVEL_LOW + [4:4] + read-write + + + GPIO40_EDGE_HIGH + [3:3] + read-write + + + GPIO40_EDGE_LOW + [2:2] + read-write + + + GPIO40_LEVEL_HIGH + [1:1] + read-write + + + GPIO40_LEVEL_LOW + [0:0] + read-write + + + + + DORMANT_WAKE_INTF0 + 0x000002f0 + Interrupt Force for dormant_wake + 0x00000000 + + + GPIO7_EDGE_HIGH + [31:31] + read-write + + + GPIO7_EDGE_LOW + [30:30] + read-write + + + GPIO7_LEVEL_HIGH + [29:29] + read-write + + + GPIO7_LEVEL_LOW + [28:28] + read-write + + + GPIO6_EDGE_HIGH + [27:27] + read-write + + + GPIO6_EDGE_LOW + [26:26] + read-write + + + GPIO6_LEVEL_HIGH + [25:25] + read-write + + + GPIO6_LEVEL_LOW + [24:24] + read-write + + + GPIO5_EDGE_HIGH + [23:23] + read-write + + + GPIO5_EDGE_LOW + [22:22] + read-write + + + GPIO5_LEVEL_HIGH + [21:21] + read-write + + + GPIO5_LEVEL_LOW + [20:20] + read-write + + + GPIO4_EDGE_HIGH + [19:19] + read-write + + + GPIO4_EDGE_LOW + [18:18] + read-write + + + GPIO4_LEVEL_HIGH + [17:17] + read-write + + + GPIO4_LEVEL_LOW + [16:16] + read-write + + + GPIO3_EDGE_HIGH + [15:15] + read-write + + + GPIO3_EDGE_LOW + [14:14] + read-write + + + GPIO3_LEVEL_HIGH + [13:13] + read-write + + + GPIO3_LEVEL_LOW + [12:12] + read-write + + + GPIO2_EDGE_HIGH + [11:11] + read-write + + + GPIO2_EDGE_LOW + [10:10] + read-write + + + GPIO2_LEVEL_HIGH + [9:9] + read-write + + + GPIO2_LEVEL_LOW + [8:8] + read-write + + + GPIO1_EDGE_HIGH + [7:7] + read-write + + + GPIO1_EDGE_LOW + [6:6] + read-write + + + GPIO1_LEVEL_HIGH + [5:5] + read-write + + + GPIO1_LEVEL_LOW + [4:4] + read-write + + + GPIO0_EDGE_HIGH + [3:3] + read-write + + + GPIO0_EDGE_LOW + [2:2] + read-write + + + GPIO0_LEVEL_HIGH + [1:1] + read-write + + + GPIO0_LEVEL_LOW + [0:0] + read-write + + + + + DORMANT_WAKE_INTF1 + 0x000002f4 + Interrupt Force for dormant_wake + 0x00000000 + + + GPIO15_EDGE_HIGH + [31:31] + read-write + + + GPIO15_EDGE_LOW + [30:30] + read-write + + + GPIO15_LEVEL_HIGH + [29:29] + read-write + + + GPIO15_LEVEL_LOW + [28:28] + read-write + + + GPIO14_EDGE_HIGH + [27:27] + read-write + + + GPIO14_EDGE_LOW + [26:26] + read-write + + + GPIO14_LEVEL_HIGH + [25:25] + read-write + + + GPIO14_LEVEL_LOW + [24:24] + read-write + + + GPIO13_EDGE_HIGH + [23:23] + read-write + + + GPIO13_EDGE_LOW + [22:22] + read-write + + + GPIO13_LEVEL_HIGH + [21:21] + read-write + + + GPIO13_LEVEL_LOW + [20:20] + read-write + + + GPIO12_EDGE_HIGH + [19:19] + read-write + + + GPIO12_EDGE_LOW + [18:18] + read-write + + + GPIO12_LEVEL_HIGH + [17:17] + read-write + + + GPIO12_LEVEL_LOW + [16:16] + read-write + + + GPIO11_EDGE_HIGH + [15:15] + read-write + + + GPIO11_EDGE_LOW + [14:14] + read-write + + + GPIO11_LEVEL_HIGH + [13:13] + read-write + + + GPIO11_LEVEL_LOW + [12:12] + read-write + + + GPIO10_EDGE_HIGH + [11:11] + read-write + + + GPIO10_EDGE_LOW + [10:10] + read-write + + + GPIO10_LEVEL_HIGH + [9:9] + read-write + + + GPIO10_LEVEL_LOW + [8:8] + read-write + + + GPIO9_EDGE_HIGH + [7:7] + read-write + + + GPIO9_EDGE_LOW + [6:6] + read-write + + + GPIO9_LEVEL_HIGH + [5:5] + read-write + + + GPIO9_LEVEL_LOW + [4:4] + read-write + + + GPIO8_EDGE_HIGH + [3:3] + read-write + + + GPIO8_EDGE_LOW + [2:2] + read-write + + + GPIO8_LEVEL_HIGH + [1:1] + read-write + + + GPIO8_LEVEL_LOW + [0:0] + read-write + + + + + DORMANT_WAKE_INTF2 + 0x000002f8 + Interrupt Force for dormant_wake + 0x00000000 + + + GPIO23_EDGE_HIGH + [31:31] + read-write + + + GPIO23_EDGE_LOW + [30:30] + read-write + + + GPIO23_LEVEL_HIGH + [29:29] + read-write + + + GPIO23_LEVEL_LOW + [28:28] + read-write + + + GPIO22_EDGE_HIGH + [27:27] + read-write + + + GPIO22_EDGE_LOW + [26:26] + read-write + + + GPIO22_LEVEL_HIGH + [25:25] + read-write + + + GPIO22_LEVEL_LOW + [24:24] + read-write + + + GPIO21_EDGE_HIGH + [23:23] + read-write + + + GPIO21_EDGE_LOW + [22:22] + read-write + + + GPIO21_LEVEL_HIGH + [21:21] + read-write + + + GPIO21_LEVEL_LOW + [20:20] + read-write + + + GPIO20_EDGE_HIGH + [19:19] + read-write + + + GPIO20_EDGE_LOW + [18:18] + read-write + + + GPIO20_LEVEL_HIGH + [17:17] + read-write + + + GPIO20_LEVEL_LOW + [16:16] + read-write + + + GPIO19_EDGE_HIGH + [15:15] + read-write + + + GPIO19_EDGE_LOW + [14:14] + read-write + + + GPIO19_LEVEL_HIGH + [13:13] + read-write + + + GPIO19_LEVEL_LOW + [12:12] + read-write + + + GPIO18_EDGE_HIGH + [11:11] + read-write + + + GPIO18_EDGE_LOW + [10:10] + read-write + + + GPIO18_LEVEL_HIGH + [9:9] + read-write + + + GPIO18_LEVEL_LOW + [8:8] + read-write + + + GPIO17_EDGE_HIGH + [7:7] + read-write + + + GPIO17_EDGE_LOW + [6:6] + read-write + + + GPIO17_LEVEL_HIGH + [5:5] + read-write + + + GPIO17_LEVEL_LOW + [4:4] + read-write + + + GPIO16_EDGE_HIGH + [3:3] + read-write + + + GPIO16_EDGE_LOW + [2:2] + read-write + + + GPIO16_LEVEL_HIGH + [1:1] + read-write + + + GPIO16_LEVEL_LOW + [0:0] + read-write + + + + + DORMANT_WAKE_INTF3 + 0x000002fc + Interrupt Force for dormant_wake + 0x00000000 + + + GPIO31_EDGE_HIGH + [31:31] + read-write + + + GPIO31_EDGE_LOW + [30:30] + read-write + + + GPIO31_LEVEL_HIGH + [29:29] + read-write + + + GPIO31_LEVEL_LOW + [28:28] + read-write + + + GPIO30_EDGE_HIGH + [27:27] + read-write + + + GPIO30_EDGE_LOW + [26:26] + read-write + + + GPIO30_LEVEL_HIGH + [25:25] + read-write + + + GPIO30_LEVEL_LOW + [24:24] + read-write + + + GPIO29_EDGE_HIGH + [23:23] + read-write + + + GPIO29_EDGE_LOW + [22:22] + read-write + + + GPIO29_LEVEL_HIGH + [21:21] + read-write + + + GPIO29_LEVEL_LOW + [20:20] + read-write + + + GPIO28_EDGE_HIGH + [19:19] + read-write + + + GPIO28_EDGE_LOW + [18:18] + read-write + + + GPIO28_LEVEL_HIGH + [17:17] + read-write + + + GPIO28_LEVEL_LOW + [16:16] + read-write + + + GPIO27_EDGE_HIGH + [15:15] + read-write + + + GPIO27_EDGE_LOW + [14:14] + read-write + + + GPIO27_LEVEL_HIGH + [13:13] + read-write + + + GPIO27_LEVEL_LOW + [12:12] + read-write + + + GPIO26_EDGE_HIGH + [11:11] + read-write + + + GPIO26_EDGE_LOW + [10:10] + read-write + + + GPIO26_LEVEL_HIGH + [9:9] + read-write + + + GPIO26_LEVEL_LOW + [8:8] + read-write + + + GPIO25_EDGE_HIGH + [7:7] + read-write + + + GPIO25_EDGE_LOW + [6:6] + read-write + + + GPIO25_LEVEL_HIGH + [5:5] + read-write + + + GPIO25_LEVEL_LOW + [4:4] + read-write + + + GPIO24_EDGE_HIGH + [3:3] + read-write + + + GPIO24_EDGE_LOW + [2:2] + read-write + + + GPIO24_LEVEL_HIGH + [1:1] + read-write + + + GPIO24_LEVEL_LOW + [0:0] + read-write + + + + + DORMANT_WAKE_INTF4 + 0x00000300 + Interrupt Force for dormant_wake + 0x00000000 + + + GPIO39_EDGE_HIGH + [31:31] + read-write + + + GPIO39_EDGE_LOW + [30:30] + read-write + + + GPIO39_LEVEL_HIGH + [29:29] + read-write + + + GPIO39_LEVEL_LOW + [28:28] + read-write + + + GPIO38_EDGE_HIGH + [27:27] + read-write + + + GPIO38_EDGE_LOW + [26:26] + read-write + + + GPIO38_LEVEL_HIGH + [25:25] + read-write + + + GPIO38_LEVEL_LOW + [24:24] + read-write + + + GPIO37_EDGE_HIGH + [23:23] + read-write + + + GPIO37_EDGE_LOW + [22:22] + read-write + + + GPIO37_LEVEL_HIGH + [21:21] + read-write + + + GPIO37_LEVEL_LOW + [20:20] + read-write + + + GPIO36_EDGE_HIGH + [19:19] + read-write + + + GPIO36_EDGE_LOW + [18:18] + read-write + + + GPIO36_LEVEL_HIGH + [17:17] + read-write + + + GPIO36_LEVEL_LOW + [16:16] + read-write + + + GPIO35_EDGE_HIGH + [15:15] + read-write + + + GPIO35_EDGE_LOW + [14:14] + read-write + + + GPIO35_LEVEL_HIGH + [13:13] + read-write + + + GPIO35_LEVEL_LOW + [12:12] + read-write + + + GPIO34_EDGE_HIGH + [11:11] + read-write + + + GPIO34_EDGE_LOW + [10:10] + read-write + + + GPIO34_LEVEL_HIGH + [9:9] + read-write + + + GPIO34_LEVEL_LOW + [8:8] + read-write + + + GPIO33_EDGE_HIGH + [7:7] + read-write + + + GPIO33_EDGE_LOW + [6:6] + read-write + + + GPIO33_LEVEL_HIGH + [5:5] + read-write + + + GPIO33_LEVEL_LOW + [4:4] + read-write + + + GPIO32_EDGE_HIGH + [3:3] + read-write + + + GPIO32_EDGE_LOW + [2:2] + read-write + + + GPIO32_LEVEL_HIGH + [1:1] + read-write + + + GPIO32_LEVEL_LOW + [0:0] + read-write + + + + + DORMANT_WAKE_INTF5 + 0x00000304 + Interrupt Force for dormant_wake + 0x00000000 + + + GPIO47_EDGE_HIGH + [31:31] + read-write + + + GPIO47_EDGE_LOW + [30:30] + read-write + + + GPIO47_LEVEL_HIGH + [29:29] + read-write + + + GPIO47_LEVEL_LOW + [28:28] + read-write + + + GPIO46_EDGE_HIGH + [27:27] + read-write + + + GPIO46_EDGE_LOW + [26:26] + read-write + + + GPIO46_LEVEL_HIGH + [25:25] + read-write + + + GPIO46_LEVEL_LOW + [24:24] + read-write + + + GPIO45_EDGE_HIGH + [23:23] + read-write + + + GPIO45_EDGE_LOW + [22:22] + read-write + + + GPIO45_LEVEL_HIGH + [21:21] + read-write + + + GPIO45_LEVEL_LOW + [20:20] + read-write + + + GPIO44_EDGE_HIGH + [19:19] + read-write + + + GPIO44_EDGE_LOW + [18:18] + read-write + + + GPIO44_LEVEL_HIGH + [17:17] + read-write + + + GPIO44_LEVEL_LOW + [16:16] + read-write + + + GPIO43_EDGE_HIGH + [15:15] + read-write + + + GPIO43_EDGE_LOW + [14:14] + read-write + + + GPIO43_LEVEL_HIGH + [13:13] + read-write + + + GPIO43_LEVEL_LOW + [12:12] + read-write + + + GPIO42_EDGE_HIGH + [11:11] + read-write + + + GPIO42_EDGE_LOW + [10:10] + read-write + + + GPIO42_LEVEL_HIGH + [9:9] + read-write + + + GPIO42_LEVEL_LOW + [8:8] + read-write + + + GPIO41_EDGE_HIGH + [7:7] + read-write + + + GPIO41_EDGE_LOW + [6:6] + read-write + + + GPIO41_LEVEL_HIGH + [5:5] + read-write + + + GPIO41_LEVEL_LOW + [4:4] + read-write + + + GPIO40_EDGE_HIGH + [3:3] + read-write + + + GPIO40_EDGE_LOW + [2:2] + read-write + + + GPIO40_LEVEL_HIGH + [1:1] + read-write + + + GPIO40_LEVEL_LOW + [0:0] + read-write + + + + + DORMANT_WAKE_INTS0 + 0x00000308 + Interrupt status after masking & forcing for dormant_wake + 0x00000000 + + + GPIO7_EDGE_HIGH + [31:31] + read-only + + + GPIO7_EDGE_LOW + [30:30] + read-only + + + GPIO7_LEVEL_HIGH + [29:29] + read-only + + + GPIO7_LEVEL_LOW + [28:28] + read-only + + + GPIO6_EDGE_HIGH + [27:27] + read-only + + + GPIO6_EDGE_LOW + [26:26] + read-only + + + GPIO6_LEVEL_HIGH + [25:25] + read-only + + + GPIO6_LEVEL_LOW + [24:24] + read-only + + + GPIO5_EDGE_HIGH + [23:23] + read-only + + + GPIO5_EDGE_LOW + [22:22] + read-only + + + GPIO5_LEVEL_HIGH + [21:21] + read-only + + + GPIO5_LEVEL_LOW + [20:20] + read-only + + + GPIO4_EDGE_HIGH + [19:19] + read-only + + + GPIO4_EDGE_LOW + [18:18] + read-only + + + GPIO4_LEVEL_HIGH + [17:17] + read-only + + + GPIO4_LEVEL_LOW + [16:16] + read-only + + + GPIO3_EDGE_HIGH + [15:15] + read-only + + + GPIO3_EDGE_LOW + [14:14] + read-only + + + GPIO3_LEVEL_HIGH + [13:13] + read-only + + + GPIO3_LEVEL_LOW + [12:12] + read-only + + + GPIO2_EDGE_HIGH + [11:11] + read-only + + + GPIO2_EDGE_LOW + [10:10] + read-only + + + GPIO2_LEVEL_HIGH + [9:9] + read-only + + + GPIO2_LEVEL_LOW + [8:8] + read-only + + + GPIO1_EDGE_HIGH + [7:7] + read-only + + + GPIO1_EDGE_LOW + [6:6] + read-only + + + GPIO1_LEVEL_HIGH + [5:5] + read-only + + + GPIO1_LEVEL_LOW + [4:4] + read-only + + + GPIO0_EDGE_HIGH + [3:3] + read-only + + + GPIO0_EDGE_LOW + [2:2] + read-only + + + GPIO0_LEVEL_HIGH + [1:1] + read-only + + + GPIO0_LEVEL_LOW + [0:0] + read-only + + + + + DORMANT_WAKE_INTS1 + 0x0000030c + Interrupt status after masking & forcing for dormant_wake + 0x00000000 + + + GPIO15_EDGE_HIGH + [31:31] + read-only + + + GPIO15_EDGE_LOW + [30:30] + read-only + + + GPIO15_LEVEL_HIGH + [29:29] + read-only + + + GPIO15_LEVEL_LOW + [28:28] + read-only + + + GPIO14_EDGE_HIGH + [27:27] + read-only + + + GPIO14_EDGE_LOW + [26:26] + read-only + + + GPIO14_LEVEL_HIGH + [25:25] + read-only + + + GPIO14_LEVEL_LOW + [24:24] + read-only + + + GPIO13_EDGE_HIGH + [23:23] + read-only + + + GPIO13_EDGE_LOW + [22:22] + read-only + + + GPIO13_LEVEL_HIGH + [21:21] + read-only + + + GPIO13_LEVEL_LOW + [20:20] + read-only + + + GPIO12_EDGE_HIGH + [19:19] + read-only + + + GPIO12_EDGE_LOW + [18:18] + read-only + + + GPIO12_LEVEL_HIGH + [17:17] + read-only + + + GPIO12_LEVEL_LOW + [16:16] + read-only + + + GPIO11_EDGE_HIGH + [15:15] + read-only + + + GPIO11_EDGE_LOW + [14:14] + read-only + + + GPIO11_LEVEL_HIGH + [13:13] + read-only + + + GPIO11_LEVEL_LOW + [12:12] + read-only + + + GPIO10_EDGE_HIGH + [11:11] + read-only + + + GPIO10_EDGE_LOW + [10:10] + read-only + + + GPIO10_LEVEL_HIGH + [9:9] + read-only + + + GPIO10_LEVEL_LOW + [8:8] + read-only + + + GPIO9_EDGE_HIGH + [7:7] + read-only + + + GPIO9_EDGE_LOW + [6:6] + read-only + + + GPIO9_LEVEL_HIGH + [5:5] + read-only + + + GPIO9_LEVEL_LOW + [4:4] + read-only + + + GPIO8_EDGE_HIGH + [3:3] + read-only + + + GPIO8_EDGE_LOW + [2:2] + read-only + + + GPIO8_LEVEL_HIGH + [1:1] + read-only + + + GPIO8_LEVEL_LOW + [0:0] + read-only + + + + + DORMANT_WAKE_INTS2 + 0x00000310 + Interrupt status after masking & forcing for dormant_wake + 0x00000000 + + + GPIO23_EDGE_HIGH + [31:31] + read-only + + + GPIO23_EDGE_LOW + [30:30] + read-only + + + GPIO23_LEVEL_HIGH + [29:29] + read-only + + + GPIO23_LEVEL_LOW + [28:28] + read-only + + + GPIO22_EDGE_HIGH + [27:27] + read-only + + + GPIO22_EDGE_LOW + [26:26] + read-only + + + GPIO22_LEVEL_HIGH + [25:25] + read-only + + + GPIO22_LEVEL_LOW + [24:24] + read-only + + + GPIO21_EDGE_HIGH + [23:23] + read-only + + + GPIO21_EDGE_LOW + [22:22] + read-only + + + GPIO21_LEVEL_HIGH + [21:21] + read-only + + + GPIO21_LEVEL_LOW + [20:20] + read-only + + + GPIO20_EDGE_HIGH + [19:19] + read-only + + + GPIO20_EDGE_LOW + [18:18] + read-only + + + GPIO20_LEVEL_HIGH + [17:17] + read-only + + + GPIO20_LEVEL_LOW + [16:16] + read-only + + + GPIO19_EDGE_HIGH + [15:15] + read-only + + + GPIO19_EDGE_LOW + [14:14] + read-only + + + GPIO19_LEVEL_HIGH + [13:13] + read-only + + + GPIO19_LEVEL_LOW + [12:12] + read-only + + + GPIO18_EDGE_HIGH + [11:11] + read-only + + + GPIO18_EDGE_LOW + [10:10] + read-only + + + GPIO18_LEVEL_HIGH + [9:9] + read-only + + + GPIO18_LEVEL_LOW + [8:8] + read-only + + + GPIO17_EDGE_HIGH + [7:7] + read-only + + + GPIO17_EDGE_LOW + [6:6] + read-only + + + GPIO17_LEVEL_HIGH + [5:5] + read-only + + + GPIO17_LEVEL_LOW + [4:4] + read-only + + + GPIO16_EDGE_HIGH + [3:3] + read-only + + + GPIO16_EDGE_LOW + [2:2] + read-only + + + GPIO16_LEVEL_HIGH + [1:1] + read-only + + + GPIO16_LEVEL_LOW + [0:0] + read-only + + + + + DORMANT_WAKE_INTS3 + 0x00000314 + Interrupt status after masking & forcing for dormant_wake + 0x00000000 + + + GPIO31_EDGE_HIGH + [31:31] + read-only + + + GPIO31_EDGE_LOW + [30:30] + read-only + + + GPIO31_LEVEL_HIGH + [29:29] + read-only + + + GPIO31_LEVEL_LOW + [28:28] + read-only + + + GPIO30_EDGE_HIGH + [27:27] + read-only + + + GPIO30_EDGE_LOW + [26:26] + read-only + + + GPIO30_LEVEL_HIGH + [25:25] + read-only + + + GPIO30_LEVEL_LOW + [24:24] + read-only + + + GPIO29_EDGE_HIGH + [23:23] + read-only + + + GPIO29_EDGE_LOW + [22:22] + read-only + + + GPIO29_LEVEL_HIGH + [21:21] + read-only + + + GPIO29_LEVEL_LOW + [20:20] + read-only + + + GPIO28_EDGE_HIGH + [19:19] + read-only + + + GPIO28_EDGE_LOW + [18:18] + read-only + + + GPIO28_LEVEL_HIGH + [17:17] + read-only + + + GPIO28_LEVEL_LOW + [16:16] + read-only + + + GPIO27_EDGE_HIGH + [15:15] + read-only + + + GPIO27_EDGE_LOW + [14:14] + read-only + + + GPIO27_LEVEL_HIGH + [13:13] + read-only + + + GPIO27_LEVEL_LOW + [12:12] + read-only + + + GPIO26_EDGE_HIGH + [11:11] + read-only + + + GPIO26_EDGE_LOW + [10:10] + read-only + + + GPIO26_LEVEL_HIGH + [9:9] + read-only + + + GPIO26_LEVEL_LOW + [8:8] + read-only + + + GPIO25_EDGE_HIGH + [7:7] + read-only + + + GPIO25_EDGE_LOW + [6:6] + read-only + + + GPIO25_LEVEL_HIGH + [5:5] + read-only + + + GPIO25_LEVEL_LOW + [4:4] + read-only + + + GPIO24_EDGE_HIGH + [3:3] + read-only + + + GPIO24_EDGE_LOW + [2:2] + read-only + + + GPIO24_LEVEL_HIGH + [1:1] + read-only + + + GPIO24_LEVEL_LOW + [0:0] + read-only + + + + + DORMANT_WAKE_INTS4 + 0x00000318 + Interrupt status after masking & forcing for dormant_wake + 0x00000000 + + + GPIO39_EDGE_HIGH + [31:31] + read-only + + + GPIO39_EDGE_LOW + [30:30] + read-only + + + GPIO39_LEVEL_HIGH + [29:29] + read-only + + + GPIO39_LEVEL_LOW + [28:28] + read-only + + + GPIO38_EDGE_HIGH + [27:27] + read-only + + + GPIO38_EDGE_LOW + [26:26] + read-only + + + GPIO38_LEVEL_HIGH + [25:25] + read-only + + + GPIO38_LEVEL_LOW + [24:24] + read-only + + + GPIO37_EDGE_HIGH + [23:23] + read-only + + + GPIO37_EDGE_LOW + [22:22] + read-only + + + GPIO37_LEVEL_HIGH + [21:21] + read-only + + + GPIO37_LEVEL_LOW + [20:20] + read-only + + + GPIO36_EDGE_HIGH + [19:19] + read-only + + + GPIO36_EDGE_LOW + [18:18] + read-only + + + GPIO36_LEVEL_HIGH + [17:17] + read-only + + + GPIO36_LEVEL_LOW + [16:16] + read-only + + + GPIO35_EDGE_HIGH + [15:15] + read-only + + + GPIO35_EDGE_LOW + [14:14] + read-only + + + GPIO35_LEVEL_HIGH + [13:13] + read-only + + + GPIO35_LEVEL_LOW + [12:12] + read-only + + + GPIO34_EDGE_HIGH + [11:11] + read-only + + + GPIO34_EDGE_LOW + [10:10] + read-only + + + GPIO34_LEVEL_HIGH + [9:9] + read-only + + + GPIO34_LEVEL_LOW + [8:8] + read-only + + + GPIO33_EDGE_HIGH + [7:7] + read-only + + + GPIO33_EDGE_LOW + [6:6] + read-only + + + GPIO33_LEVEL_HIGH + [5:5] + read-only + + + GPIO33_LEVEL_LOW + [4:4] + read-only + + + GPIO32_EDGE_HIGH + [3:3] + read-only + + + GPIO32_EDGE_LOW + [2:2] + read-only + + + GPIO32_LEVEL_HIGH + [1:1] + read-only + + + GPIO32_LEVEL_LOW + [0:0] + read-only + + + + + DORMANT_WAKE_INTS5 + 0x0000031c + Interrupt status after masking & forcing for dormant_wake + 0x00000000 + + + GPIO47_EDGE_HIGH + [31:31] + read-only + + + GPIO47_EDGE_LOW + [30:30] + read-only + + + GPIO47_LEVEL_HIGH + [29:29] + read-only + + + GPIO47_LEVEL_LOW + [28:28] + read-only + + + GPIO46_EDGE_HIGH + [27:27] + read-only + + + GPIO46_EDGE_LOW + [26:26] + read-only + + + GPIO46_LEVEL_HIGH + [25:25] + read-only + + + GPIO46_LEVEL_LOW + [24:24] + read-only + + + GPIO45_EDGE_HIGH + [23:23] + read-only + + + GPIO45_EDGE_LOW + [22:22] + read-only + + + GPIO45_LEVEL_HIGH + [21:21] + read-only + + + GPIO45_LEVEL_LOW + [20:20] + read-only + + + GPIO44_EDGE_HIGH + [19:19] + read-only + + + GPIO44_EDGE_LOW + [18:18] + read-only + + + GPIO44_LEVEL_HIGH + [17:17] + read-only + + + GPIO44_LEVEL_LOW + [16:16] + read-only + + + GPIO43_EDGE_HIGH + [15:15] + read-only + + + GPIO43_EDGE_LOW + [14:14] + read-only + + + GPIO43_LEVEL_HIGH + [13:13] + read-only + + + GPIO43_LEVEL_LOW + [12:12] + read-only + + + GPIO42_EDGE_HIGH + [11:11] + read-only + + + GPIO42_EDGE_LOW + [10:10] + read-only + + + GPIO42_LEVEL_HIGH + [9:9] + read-only + + + GPIO42_LEVEL_LOW + [8:8] + read-only + + + GPIO41_EDGE_HIGH + [7:7] + read-only + + + GPIO41_EDGE_LOW + [6:6] + read-only + + + GPIO41_LEVEL_HIGH + [5:5] + read-only + + + GPIO41_LEVEL_LOW + [4:4] + read-only + + + GPIO40_EDGE_HIGH + [3:3] + read-only + + + GPIO40_EDGE_LOW + [2:2] + read-only + + + GPIO40_LEVEL_HIGH + [1:1] + read-only + + + GPIO40_LEVEL_LOW + [0:0] + read-only + + + + + + + SYSINFO + 0x40000000 + + 0 + 24 + registers + + + + CHIP_ID + 0x00000000 + JEDEC JEP-106 compliant chip identifier. + 0x00000001 + + + REVISION + [31:28] + read-only + + + PART + [27:12] + read-only + + + MANUFACTURER + [11:1] + read-only + + + STOP_BIT + [0:0] + read-only + + + + + PACKAGE_SEL + 0x00000004 + 0x00000000 + + + PACKAGE_SEL + [0:0] + read-only + + + + + PLATFORM + 0x00000008 + Platform register. Allows software to know what environment it is running in during pre-production development. Post-production, the PLATFORM is always ASIC, non-SIM. + 0x00000000 + + + GATESIM + [4:4] + read-only + + + BATCHSIM + [3:3] + read-only + + + HDLSIM + [2:2] + read-only + + + ASIC + [1:1] + read-only + + + FPGA + [0:0] + read-only + + + + + GITREF_RP2350 + 0x00000014 + Git hash of the chip source. Used to identify chip version. + 0x00000000 + + + GITREF_RP2350 + [31:0] + read-only + + + + + + + SHA256 + SHA-256 hash function implementation + 0x400f8000 + + 0 + 40 + registers + + + + CSR + 0x00000000 + Control and status register + 0x00001206 + + + BSWAP + Enable byte swapping of 32-bit values at the point they are committed to the SHA message scheduler. + + This block's bus interface assembles byte/halfword data into message words in little-endian order, so that DMAing the same buffer with different transfer sizes always gives the same result on a little-endian system like RP2350. + + However, when marshalling bytes into blocks, SHA expects that the first byte is the *most significant* in each message word. To resolve this, once the bus interface has accumulated 32 bits of data (either a word write, two halfword writes in little-endian order, or four byte writes in little-endian order) the final value can be byte-swapped before passing to the actual SHA core. + + This feature is enabled by default because using the SHA core to checksum byte buffers is expected to be more common than having preformatted SHA message words lying around. + [12:12] + read-write + + + DMA_SIZE + Configure DREQ logic for the correct DMA data size. Must be configured before the DMA channel is triggered. + + The SHA-256 core's DREQ logic requests one entire block of data at once, since there is no FIFO, and data goes straight into the core's message schedule and digest hardware. Therefore, when transferring data with DMA, CSR_DMA_SIZE must be configured in advance so that the correct number of transfers can be requested per block. + [9:8] + read-write + + + 8bit + 0 + + + 16bit + 1 + + + 32bit + 2 + + + + + ERR_WDATA_NOT_RDY + Set when a write occurs whilst the SHA-256 core is not ready for data (WDATA_RDY is low). Write one to clear. + [4:4] + read-write + oneToClear + + + SUM_VLD + If 1, the SHA-256 checksum presented in registers SUM0 through SUM7 is currently valid. + + Goes low when WDATA is first written, then returns high once 16 words have been written and the digest of the current 512-bit block has subsequently completed. + [2:2] + read-only + + + WDATA_RDY + If 1, the SHA-256 core is ready to accept more data through the WDATA register. + + After writing 16 words, this flag will go low for 57 cycles whilst the core completes its digest. + [1:1] + read-only + + + START + Write 1 to prepare the SHA-256 core for a new checksum. + + The SUMx registers are initialised to the proper values (fractional bits of square roots of first 8 primes) and internal counters are cleared. This immediately forces WDATA_RDY and SUM_VLD high. + + START must be written before initiating a DMA transfer to the SHA-256 core, because the core will always request 16 transfers at a time (1 512-bit block). Additionally, the DMA channel should be configured for a multiple of 16 32-bit transfers. + [0:0] + write-only + + + + + WDATA + 0x00000004 + Write data register + 0x00000000 + + + WDATA + After pulsing START and writing 16 words of data to this register, WDATA_RDY will go low and the SHA-256 core will complete the digest of the current 512-bit block. + + Software is responsible for ensuring the data is correctly padded and terminated to a whole number of 512-bit blocks. + + After this, WDATA_RDY will return high, and more data can be written (if any). + + This register supports word, halfword and byte writes, so that DMA from non-word-aligned buffers can be supported. The total amount of data per block remains the same (16 words, 32 halfwords or 64 bytes) and byte/halfword transfers must not be mixed within a block. + [31:0] + write-only + + + + + SUM0 + 0x00000008 + 256-bit checksum result. Contents are undefined when CSR_SUM_VLD is 0. + 0x00000000 + + + SUM0 + [31:0] + read-only + + + + + SUM1 + 0x0000000c + 256-bit checksum result. Contents are undefined when CSR_SUM_VLD is 0. + 0x00000000 + + + SUM1 + [31:0] + read-only + + + + + SUM2 + 0x00000010 + 256-bit checksum result. Contents are undefined when CSR_SUM_VLD is 0. + 0x00000000 + + + SUM2 + [31:0] + read-only + + + + + SUM3 + 0x00000014 + 256-bit checksum result. Contents are undefined when CSR_SUM_VLD is 0. + 0x00000000 + + + SUM3 + [31:0] + read-only + + + + + SUM4 + 0x00000018 + 256-bit checksum result. Contents are undefined when CSR_SUM_VLD is 0. + 0x00000000 + + + SUM4 + [31:0] + read-only + + + + + SUM5 + 0x0000001c + 256-bit checksum result. Contents are undefined when CSR_SUM_VLD is 0. + 0x00000000 + + + SUM5 + [31:0] + read-only + + + + + SUM6 + 0x00000020 + 256-bit checksum result. Contents are undefined when CSR_SUM_VLD is 0. + 0x00000000 + + + SUM6 + [31:0] + read-only + + + + + SUM7 + 0x00000024 + 256-bit checksum result. Contents are undefined when CSR_SUM_VLD is 0. + 0x00000000 + + + SUM7 + [31:0] + read-only + + + + + + + HSTX_FIFO + FIFO status and write access for HSTX + 0x50600000 + + 0 + 8 + registers + + + + STAT + 0x00000000 + FIFO status + 0x00000000 + + + WOF + FIFO was written when full. Write 1 to clear. + [10:10] + read-write + oneToClear + + + EMPTY + [9:9] + read-only + + + FULL + [8:8] + read-only + + + LEVEL + [7:0] + read-only + + + + + FIFO + 0x00000004 + Write access to FIFO + 0x00000000 + + + FIFO + [31:0] + write-only + + + + + + + HSTX_CTRL + Control interface to HSTX. For FIFO write access and status, see the HSTX_FIFO register block. + 0x400c0000 + + 0 + 44 + registers + + + + CSR + 0x00000000 + 0x10050600 + + + CLKDIV + Clock period of the generated clock, measured in HSTX clock cycles. Can be odd or even. The generated clock advances only on cycles where the shift register shifts. + + For example, a clkdiv of 5 would generate a complete output clock period for every 5 HSTX clocks (or every 10 half-clocks). + + A CLKDIV value of 0 is mapped to a period of 16 HSTX clock cycles. + [31:28] + read-write + + + CLKPHASE + Set the initial phase of the generated clock. + + A CLKPHASE of 0 means the clock is initially low, and the first rising edge occurs after one half period of the generated clock (i.e. CLKDIV/2 cycles of clk_hstx). Incrementing CLKPHASE by 1 will advance the initial clock phase by one half clk_hstx period. For example, if CLKDIV=2 and CLKPHASE=1: + + * The clock will be initially low + + * The first rising edge will be 0.5 clk_hstx cycles after asserting first data + + * The first falling edge will be 1.5 clk_hstx cycles after asserting first data + + This configuration would be suitable for serialising at a bit rate of clk_hstx with a centre-aligned DDR clock. + + When the HSTX is halted by clearing CSR_EN, the clock generator will return to its initial phase as configured by the CLKPHASE field. + + Note CLKPHASE must be strictly less than double the value of CLKDIV (one full period), else its operation is undefined. + [27:24] + read-write + + + N_SHIFTS + Number of times to shift the shift register before refilling it from the FIFO. (A count of how many times it has been shifted, *not* the total shift distance.) + + A register value of 0 means shift 32 times. + [20:16] + read-write + + + SHIFT + How many bits to right-rotate the shift register by each cycle. + + The use of a rotate rather than a shift allows left shifts to be emulated, by subtracting the left-shift amount from 32. It also allows data to be repeated, when the product of SHIFT and N_SHIFTS is greater than 32. + [12:8] + read-write + + + COUPLED_SEL + Select which PIO to use for coupled mode operation. + [6:5] + read-write + + + COUPLED_MODE + Enable the PIO-to-HSTX 1:1 connection. The HSTX must be clocked *directly* from the system clock (not just from some other clock source of the same frequency) for this synchronous interface to function correctly. + + When COUPLED_MODE is set, BITx_SEL_P and SEL_N indices 24 through 31 will select bits from the 8-bit PIO-to-HSTX path, rather than shifter bits. Indices of 0 through 23 will still index the shift register as normal. + + The PIO outputs connected to the PIO-to-HSTX bus are those same outputs that would appear on the HSTX-capable pins if those pins' FUNCSELs were set to PIO instead of HSTX. + + For example, if HSTX is on GPIOs 12 through 19, then PIO outputs 12 through 19 are connected to the HSTX when coupled mode is engaged. + [4:4] + read-write + + + EXPAND_EN + Enable the command expander. When 0, raw FIFO data is passed directly to the output shift register. When 1, the command expander can perform simple operations such as run length decoding on data between the FIFO and the shift register. + + Do not change CXPD_EN whilst EN is set. It's safe to set CXPD_EN simultaneously with setting EN. + [1:1] + read-write + + + EN + When EN is 1, the HSTX will shift out data as it appears in the FIFO. As long as there is data, the HSTX shift register will shift once per clock cycle, and the frequency of popping from the FIFO is determined by the ratio of SHIFT and SHIFT_THRESH. + + When EN is 0, the FIFO is not popped. The shift counter and clock generator are also reset to their initial state for as long as EN is low. Note the initial phase of the clock generator can be configured by the CLKPHASE field. + + Once the HSTX is enabled again, and data is pushed to the FIFO, the generated clock's first rising edge will be one half-period after the first data is launched. + [0:0] + read-write + + + + + BIT0 + 0x00000004 + Data control register for output bit 0 + 0x00000000 + + + CLK + Connect this output to the generated clock, rather than the data shift register. SEL_P and SEL_N are ignored if this bit is set, but INV can still be set to generate an antiphase clock. + [17:17] + read-write + + + INV + Invert this data output (logical NOT) + [16:16] + read-write + + + SEL_N + Shift register data bit select for the second half of the HSTX clock cycle + [12:8] + read-write + + + SEL_P + Shift register data bit select for the first half of the HSTX clock cycle + [4:0] + read-write + + + + + BIT1 + 0x00000008 + Data control register for output bit 1 + 0x00000000 + + + CLK + Connect this output to the generated clock, rather than the data shift register. SEL_P and SEL_N are ignored if this bit is set, but INV can still be set to generate an antiphase clock. + [17:17] + read-write + + + INV + Invert this data output (logical NOT) + [16:16] + read-write + + + SEL_N + Shift register data bit select for the second half of the HSTX clock cycle + [12:8] + read-write + + + SEL_P + Shift register data bit select for the first half of the HSTX clock cycle + [4:0] + read-write + + + + + BIT2 + 0x0000000c + Data control register for output bit 2 + 0x00000000 + + + CLK + Connect this output to the generated clock, rather than the data shift register. SEL_P and SEL_N are ignored if this bit is set, but INV can still be set to generate an antiphase clock. + [17:17] + read-write + + + INV + Invert this data output (logical NOT) + [16:16] + read-write + + + SEL_N + Shift register data bit select for the second half of the HSTX clock cycle + [12:8] + read-write + + + SEL_P + Shift register data bit select for the first half of the HSTX clock cycle + [4:0] + read-write + + + + + BIT3 + 0x00000010 + Data control register for output bit 3 + 0x00000000 + + + CLK + Connect this output to the generated clock, rather than the data shift register. SEL_P and SEL_N are ignored if this bit is set, but INV can still be set to generate an antiphase clock. + [17:17] + read-write + + + INV + Invert this data output (logical NOT) + [16:16] + read-write + + + SEL_N + Shift register data bit select for the second half of the HSTX clock cycle + [12:8] + read-write + + + SEL_P + Shift register data bit select for the first half of the HSTX clock cycle + [4:0] + read-write + + + + + BIT4 + 0x00000014 + Data control register for output bit 4 + 0x00000000 + + + CLK + Connect this output to the generated clock, rather than the data shift register. SEL_P and SEL_N are ignored if this bit is set, but INV can still be set to generate an antiphase clock. + [17:17] + read-write + + + INV + Invert this data output (logical NOT) + [16:16] + read-write + + + SEL_N + Shift register data bit select for the second half of the HSTX clock cycle + [12:8] + read-write + + + SEL_P + Shift register data bit select for the first half of the HSTX clock cycle + [4:0] + read-write + + + + + BIT5 + 0x00000018 + Data control register for output bit 5 + 0x00000000 + + + CLK + Connect this output to the generated clock, rather than the data shift register. SEL_P and SEL_N are ignored if this bit is set, but INV can still be set to generate an antiphase clock. + [17:17] + read-write + + + INV + Invert this data output (logical NOT) + [16:16] + read-write + + + SEL_N + Shift register data bit select for the second half of the HSTX clock cycle + [12:8] + read-write + + + SEL_P + Shift register data bit select for the first half of the HSTX clock cycle + [4:0] + read-write + + + + + BIT6 + 0x0000001c + Data control register for output bit 6 + 0x00000000 + + + CLK + Connect this output to the generated clock, rather than the data shift register. SEL_P and SEL_N are ignored if this bit is set, but INV can still be set to generate an antiphase clock. + [17:17] + read-write + + + INV + Invert this data output (logical NOT) + [16:16] + read-write + + + SEL_N + Shift register data bit select for the second half of the HSTX clock cycle + [12:8] + read-write + + + SEL_P + Shift register data bit select for the first half of the HSTX clock cycle + [4:0] + read-write + + + + + BIT7 + 0x00000020 + Data control register for output bit 7 + 0x00000000 + + + CLK + Connect this output to the generated clock, rather than the data shift register. SEL_P and SEL_N are ignored if this bit is set, but INV can still be set to generate an antiphase clock. + [17:17] + read-write + + + INV + Invert this data output (logical NOT) + [16:16] + read-write + + + SEL_N + Shift register data bit select for the second half of the HSTX clock cycle + [12:8] + read-write + + + SEL_P + Shift register data bit select for the first half of the HSTX clock cycle + [4:0] + read-write + + + + + EXPAND_SHIFT + 0x00000024 + Configure the optional shifter inside the command expander + 0x01000100 + + + ENC_N_SHIFTS + Number of times to consume from the shift register before refilling it from the FIFO, when the current command is an encoded data command (e.g. TMDS). A register value of 0 means shift 32 times. + [28:24] + read-write + + + ENC_SHIFT + How many bits to right-rotate the shift register by each time data is pushed to the output shifter, when the current command is an encoded data command (e.g. TMDS). + [20:16] + read-write + + + RAW_N_SHIFTS + Number of times to consume from the shift register before refilling it from the FIFO, when the current command is a raw data command. A register value of 0 means shift 32 times. + [12:8] + read-write + + + RAW_SHIFT + How many bits to right-rotate the shift register by each time data is pushed to the output shifter, when the current command is a raw data command. + [4:0] + read-write + + + + + EXPAND_TMDS + 0x00000028 + Configure the optional TMDS encoder inside the command expander + 0x00000000 + + + L2_NBITS + Number of valid data bits for the lane 2 TMDS encoder, starting from bit 7 of the rotated data. Field values of 0 -> 7 encode counts of 1 -> 8 bits. + [23:21] + read-write + + + L2_ROT + Right-rotate applied to the current shifter data before the lane 2 TMDS encoder. + [20:16] + read-write + + + L1_NBITS + Number of valid data bits for the lane 1 TMDS encoder, starting from bit 7 of the rotated data. Field values of 0 -> 7 encode counts of 1 -> 8 bits. + [15:13] + read-write + + + L1_ROT + Right-rotate applied to the current shifter data before the lane 1 TMDS encoder. + [12:8] + read-write + + + L0_NBITS + Number of valid data bits for the lane 0 TMDS encoder, starting from bit 7 of the rotated data. Field values of 0 -> 7 encode counts of 1 -> 8 bits. + [7:5] + read-write + + + L0_ROT + Right-rotate applied to the current shifter data before the lane 0 TMDS encoder. + [4:0] + read-write + + + + + + + EPPB + Cortex-M33 EPPB vendor register block for RP2350 + 0xe0080000 + + 0 + 12 + registers + + + + NMI_MASK0 + 0x00000000 + NMI mask for IRQs 0 through 31. This register is core-local, and is reset by a processor warm reset. + 0x00000000 + + + NMI_MASK0 + [31:0] + read-write + + + + + NMI_MASK1 + 0x00000004 + NMI mask for IRQs 0 though 51. This register is core-local, and is reset by a processor warm reset. + 0x00000000 + + + NMI_MASK1 + [19:0] + read-write + + + + + SLEEPCTRL + 0x00000008 + Nonstandard sleep control register + 0x00000002 + + + WICENACK + Status signal from the processor's interrupt controller. Changes to WICENREQ are eventually reflected in WICENACK. + [2:2] + read-only + + + WICENREQ + Request that the next processor deep sleep is a WIC sleep. After setting this bit, before sleeping, poll WICENACK to ensure the processor interrupt controller has acknowledged the change. + [1:1] + read-write + + + LIGHT_SLEEP + By default, any processor sleep will deassert the system-level clock request. Reenabling the clocks incurs 5 cycles of additional latency on wakeup. + + Setting LIGHT_SLEEP to 1 keeps the clock request asserted during a normal sleep (Arm SCR.SLEEPDEEP = 0), for faster wakeup. Processor deep sleep (Arm SCR.SLEEPDEEP = 1) is not affected, and will always deassert the system-level clock request. + [0:0] + read-write + + + + + + + PPB + TEAL registers accessible through the debug interface + 0xe0000000 + + 0 + 274432 + registers + + + + ITM_STIM0 + 0x00000000 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM1 + 0x00000004 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM2 + 0x00000008 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM3 + 0x0000000c + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM4 + 0x00000010 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM5 + 0x00000014 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM6 + 0x00000018 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM7 + 0x0000001c + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM8 + 0x00000020 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM9 + 0x00000024 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM10 + 0x00000028 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM11 + 0x0000002c + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM12 + 0x00000030 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM13 + 0x00000034 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM14 + 0x00000038 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM15 + 0x0000003c + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM16 + 0x00000040 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM17 + 0x00000044 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM18 + 0x00000048 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM19 + 0x0000004c + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM20 + 0x00000050 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM21 + 0x00000054 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM22 + 0x00000058 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM23 + 0x0000005c + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM24 + 0x00000060 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM25 + 0x00000064 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM26 + 0x00000068 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM27 + 0x0000006c + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM28 + 0x00000070 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM29 + 0x00000074 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM30 + 0x00000078 + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_STIM31 + 0x0000007c + Provides the interface for generating Instrumentation packets + 0x00000000 + + + STIMULUS + Data to write to the Stimulus Port FIFO, for forwarding as an Instrumentation packet. The size of write access determines the type of Instrumentation packet generated. + [31:0] + read-write + + + + + ITM_TER0 + 0x00000e00 + Provide an individual enable bit for each ITM_STIM register + 0x00000000 + + + STIMENA + For STIMENA[m] in ITM_TER*n, controls whether ITM_STIM(32*n + m) is enabled + [31:0] + read-write + + + + + ITM_TPR + 0x00000e40 + Controls which stimulus ports can be accessed by unprivileged code + 0x00000000 + + + PRIVMASK + Bit mask to enable tracing on ITM stimulus ports + [3:0] + read-write + + + + + ITM_TCR + 0x00000e80 + Configures and controls transfers through the ITM interface + 0x00000000 + + + BUSY + Indicates whether the ITM is currently processing events + [23:23] + read-only + + + TRACEBUSID + Identifier for multi-source trace stream formatting. If multi-source trace is in use, the debugger must write a unique non-zero trace ID value to this field + [22:16] + read-write + + + GTSFREQ + Defines how often the ITM generates a global timestamp, based on the global timestamp clock frequency, or disables generation of global timestamps + [11:10] + read-write + + + TSPRESCALE + Local timestamp prescaler, used with the trace packet reference clock + [9:8] + read-write + + + STALLENA + Stall the PE to guarantee delivery of Data Trace packets. + [5:5] + read-write + + + SWOENA + Enables asynchronous clocking of the timestamp counter + [4:4] + read-write + + + TXENA + Enables forwarding of hardware event packet from the DWT unit to the ITM for output to the TPIU + [3:3] + read-write + + + SYNCENA + Enables Synchronization packet transmission for a synchronous TPIU + [2:2] + read-write + + + TSENA + Enables Local timestamp generation + [1:1] + read-write + + + ITMENA + Enables the ITM + [0:0] + read-write + + + + + INT_ATREADY + 0x00000ef0 + Integration Mode: Read ATB Ready + 0x00000000 + + + AFVALID + A read of this bit returns the value of AFVALID + [1:1] + read-only + + + ATREADY + A read of this bit returns the value of ATREADY + [0:0] + read-only + + + + + INT_ATVALID + 0x00000ef8 + Integration Mode: Write ATB Valid + 0x00000000 + + + AFREADY + A write to this bit gives the value of AFREADY + [1:1] + read-write + + + ATREADY + A write to this bit gives the value of ATVALID + [0:0] + read-write + + + + + ITM_ITCTRL + 0x00000f00 + Integration Mode Control Register + 0x00000000 + + + IME + Integration mode enable bit - The possible values are: 0 - The trace unit is not in integration mode. 1 - The trace unit is in integration mode. This mode enables: A debug agent to perform topology detection. SoC test software to perform integration testing. + [0:0] + read-write + + + + + ITM_DEVARCH + 0x00000fbc + Provides CoreSight discovery information for the ITM + 0x47701a01 + + + ARCHITECT + Defines the architect of the component. Bits [31:28] are the JEP106 continuation code (JEP106 bank ID, minus 1) and bits [27:21] are the JEP106 ID code. + [31:21] + read-only + + + PRESENT + Defines that the DEVARCH register is present + [20:20] + read-only + + + REVISION + Defines the architecture revision of the component + [19:16] + read-only + + + ARCHVER + Defines the architecture version of the component + [15:12] + read-only + + + ARCHPART + Defines the architecture of the component + [11:0] + read-only + + + + + ITM_DEVTYPE + 0x00000fcc + Provides CoreSight discovery information for the ITM + 0x00000043 + + + SUB + Component sub-type + [7:4] + read-only + + + MAJOR + Component major type + [3:0] + read-only + + + + + ITM_PIDR4 + 0x00000fd0 + Provides CoreSight discovery information for the ITM + 0x00000004 + + + SIZE + See CoreSight Architecture Specification + [7:4] + read-only + + + DES_2 + See CoreSight Architecture Specification + [3:0] + read-only + + + + + ITM_PIDR5 + 0x00000fd4 + Provides CoreSight discovery information for the ITM + 0x00000000 + + + ITM_PIDR5 + [31:0] + read-write + + + + + ITM_PIDR6 + 0x00000fd8 + Provides CoreSight discovery information for the ITM + 0x00000000 + + + ITM_PIDR6 + [31:0] + read-write + + + + + ITM_PIDR7 + 0x00000fdc + Provides CoreSight discovery information for the ITM + 0x00000000 + + + ITM_PIDR7 + [31:0] + read-write + + + + + ITM_PIDR0 + 0x00000fe0 + Provides CoreSight discovery information for the ITM + 0x00000021 + + + PART_0 + See CoreSight Architecture Specification + [7:0] + read-only + + + + + ITM_PIDR1 + 0x00000fe4 + Provides CoreSight discovery information for the ITM + 0x000000bd + + + DES_0 + See CoreSight Architecture Specification + [7:4] + read-only + + + PART_1 + See CoreSight Architecture Specification + [3:0] + read-only + + + + + ITM_PIDR2 + 0x00000fe8 + Provides CoreSight discovery information for the ITM + 0x0000000b + + + REVISION + See CoreSight Architecture Specification + [7:4] + read-only + + + JEDEC + See CoreSight Architecture Specification + [3:3] + read-only + + + DES_1 + See CoreSight Architecture Specification + [2:0] + read-only + + + + + ITM_PIDR3 + 0x00000fec + Provides CoreSight discovery information for the ITM + 0x00000000 + + + REVAND + See CoreSight Architecture Specification + [7:4] + read-only + + + CMOD + See CoreSight Architecture Specification + [3:0] + read-only + + + + + ITM_CIDR0 + 0x00000ff0 + Provides CoreSight discovery information for the ITM + 0x0000000d + + + PRMBL_0 + See CoreSight Architecture Specification + [7:0] + read-only + + + + + ITM_CIDR1 + 0x00000ff4 + Provides CoreSight discovery information for the ITM + 0x00000090 + + + CLASS + See CoreSight Architecture Specification + [7:4] + read-only + + + PRMBL_1 + See CoreSight Architecture Specification + [3:0] + read-only + + + + + ITM_CIDR2 + 0x00000ff8 + Provides CoreSight discovery information for the ITM + 0x00000005 + + + PRMBL_2 + See CoreSight Architecture Specification + [7:0] + read-only + + + + + ITM_CIDR3 + 0x00000ffc + Provides CoreSight discovery information for the ITM + 0x000000b1 + + + PRMBL_3 + See CoreSight Architecture Specification + [7:0] + read-only + + + + + DWT_CTRL + 0x00001000 + Provides configuration and status information for the DWT unit, and used to control features of the unit + 0x73741824 + + + NUMCOMP + Number of DWT comparators implemented + [31:28] + read-only + + + NOTRCPKT + Indicates whether the implementation does not support trace + [27:27] + read-only + + + NOEXTTRIG + Reserved, RAZ + [26:26] + read-only + + + NOCYCCNT + Indicates whether the implementation does not include a cycle counter + [25:25] + read-only + + + NOPRFCNT + Indicates whether the implementation does not include the profiling counters + [24:24] + read-only + + + CYCDISS + Controls whether the cycle counter is disabled in Secure state + [23:23] + read-write + + + CYCEVTENA + Enables Event Counter packet generation on POSTCNT underflow + [22:22] + read-write + + + FOLDEVTENA + Enables DWT_FOLDCNT counter + [21:21] + read-write + + + LSUEVTENA + Enables DWT_LSUCNT counter + [20:20] + read-write + + + SLEEPEVTENA + Enable DWT_SLEEPCNT counter + [19:19] + read-write + + + EXCEVTENA + Enables DWT_EXCCNT counter + [18:18] + read-write + + + CPIEVTENA + Enables DWT_CPICNT counter + [17:17] + read-write + + + EXTTRCENA + Enables generation of Exception Trace packets + [16:16] + read-write + + + PCSAMPLENA + Enables use of POSTCNT counter as a timer for Periodic PC Sample packet generation + [12:12] + read-write + + + SYNCTAP + Selects the position of the synchronization packet counter tap on the CYCCNT counter. This determines the Synchronization packet rate + [11:10] + read-write + + + CYCTAP + Selects the position of the POSTCNT tap on the CYCCNT counter + [9:9] + read-write + + + POSTINIT + Initial value for the POSTCNT counter + [8:5] + read-write + + + POSTPRESET + Reload value for the POSTCNT counter + [4:1] + read-write + + + CYCCNTENA + Enables CYCCNT + [0:0] + read-write + + + + + DWT_CYCCNT + 0x00001004 + Shows or sets the value of the processor cycle counter, CYCCNT + 0x00000000 + + + CYCCNT + Increments one on each processor clock cycle when DWT_CTRL.CYCCNTENA == 1 and DEMCR.TRCENA == 1. On overflow, CYCCNT wraps to zero + [31:0] + read-write + + + + + DWT_EXCCNT + 0x0000100c + Counts the total cycles spent in exception processing + 0x00000000 + + + EXCCNT + Counts one on each cycle when all of the following are true: - DWT_CTRL.EXCEVTENA == 1 and DEMCR.TRCENA == 1. - No instruction is executed, see DWT_CPICNT. - An exception-entry or exception-exit related operation is in progress. - Either SecureNoninvasiveDebugAllowed() == TRUE, or NS-Req for the operation is set to Non-secure and NoninvasiveDebugAllowed() == TRUE. + [7:0] + read-write + + + + + DWT_LSUCNT + 0x00001014 + Increments on the additional cycles required to execute all load or store instructions + 0x00000000 + + + LSUCNT + Counts one on each cycle when all of the following are true: - DWT_CTRL.LSUEVTENA == 1 and DEMCR.TRCENA == 1. - No instruction is executed, see DWT_CPICNT. - No exception-entry or exception-exit operation is in progress, see DWT_EXCCNT. - A load-store operation is in progress. - Either SecureNoninvasiveDebugAllowed() == TRUE, or NS-Req for the operation is set to Non-secure and NoninvasiveDebugAllowed() == TRUE. + [7:0] + read-write + + + + + DWT_FOLDCNT + 0x00001018 + Increments on the additional cycles required to execute all load or store instructions + 0x00000000 + + + FOLDCNT + Counts on each cycle when all of the following are true: - DWT_CTRL.FOLDEVTENA == 1 and DEMCR.TRCENA == 1. - At least two instructions are executed, see DWT_CPICNT. - Either SecureNoninvasiveDebugAllowed() == TRUE, or the PE is in Non-secure state and NoninvasiveDebugAllowed() == TRUE. The counter is incremented by the number of instructions executed, minus one + [7:0] + read-write + + + + + DWT_COMP0 + 0x00001020 + Provides a reference value for use by watchpoint comparator 0 + 0x00000000 + + + DWT_COMP0 + [31:0] + read-write + + + + + DWT_FUNCTION0 + 0x00001028 + Controls the operation of watchpoint comparator 0 + 0x58000000 + + + ID + Identifies the capabilities for MATCH for comparator *n + [31:27] + read-only + + + MATCHED + Set to 1 when the comparator matches + [24:24] + read-only + + + DATAVSIZE + Defines the size of the object being watched for by Data Value and Data Address comparators + [11:10] + read-write + + + ACTION + Defines the action on a match. This field is ignored and the comparator generates no actions if it is disabled by MATCH + [5:4] + read-write + + + MATCH + Controls the type of match generated by this comparator + [3:0] + read-write + + + + + DWT_COMP1 + 0x00001030 + Provides a reference value for use by watchpoint comparator 1 + 0x00000000 + + + DWT_COMP1 + [31:0] + read-write + + + + + DWT_FUNCTION1 + 0x00001038 + Controls the operation of watchpoint comparator 1 + 0x89000828 + + + ID + Identifies the capabilities for MATCH for comparator *n + [31:27] + read-only + + + MATCHED + Set to 1 when the comparator matches + [24:24] + read-only + + + DATAVSIZE + Defines the size of the object being watched for by Data Value and Data Address comparators + [11:10] + read-write + + + ACTION + Defines the action on a match. This field is ignored and the comparator generates no actions if it is disabled by MATCH + [5:4] + read-write + + + MATCH + Controls the type of match generated by this comparator + [3:0] + read-write + + + + + DWT_COMP2 + 0x00001040 + Provides a reference value for use by watchpoint comparator 2 + 0x00000000 + + + DWT_COMP2 + [31:0] + read-write + + + + + DWT_FUNCTION2 + 0x00001048 + Controls the operation of watchpoint comparator 2 + 0x50000000 + + + ID + Identifies the capabilities for MATCH for comparator *n + [31:27] + read-only + + + MATCHED + Set to 1 when the comparator matches + [24:24] + read-only + + + DATAVSIZE + Defines the size of the object being watched for by Data Value and Data Address comparators + [11:10] + read-write + + + ACTION + Defines the action on a match. This field is ignored and the comparator generates no actions if it is disabled by MATCH + [5:4] + read-write + + + MATCH + Controls the type of match generated by this comparator + [3:0] + read-write + + + + + DWT_COMP3 + 0x00001050 + Provides a reference value for use by watchpoint comparator 3 + 0x00000000 + + + DWT_COMP3 + [31:0] + read-write + + + + + DWT_FUNCTION3 + 0x00001058 + Controls the operation of watchpoint comparator 3 + 0x20000800 + + + ID + Identifies the capabilities for MATCH for comparator *n + [31:27] + read-only + + + MATCHED + Set to 1 when the comparator matches + [24:24] + read-only + + + DATAVSIZE + Defines the size of the object being watched for by Data Value and Data Address comparators + [11:10] + read-write + + + ACTION + Defines the action on a match. This field is ignored and the comparator generates no actions if it is disabled by MATCH + [5:4] + read-write + + + MATCH + Controls the type of match generated by this comparator + [3:0] + read-write + + + + + DWT_DEVARCH + 0x00001fbc + Provides CoreSight discovery information for the DWT + 0x47701a02 + + + ARCHITECT + Defines the architect of the component. Bits [31:28] are the JEP106 continuation code (JEP106 bank ID, minus 1) and bits [27:21] are the JEP106 ID code. + [31:21] + read-only + + + PRESENT + Defines that the DEVARCH register is present + [20:20] + read-only + + + REVISION + Defines the architecture revision of the component + [19:16] + read-only + + + ARCHVER + Defines the architecture version of the component + [15:12] + read-only + + + ARCHPART + Defines the architecture of the component + [11:0] + read-only + + + + + DWT_DEVTYPE + 0x00001fcc + Provides CoreSight discovery information for the DWT + 0x00000000 + + + SUB + Component sub-type + [7:4] + read-only + + + MAJOR + Component major type + [3:0] + read-only + + + + + DWT_PIDR4 + 0x00001fd0 + Provides CoreSight discovery information for the DWT + 0x00000004 + + + SIZE + See CoreSight Architecture Specification + [7:4] + read-only + + + DES_2 + See CoreSight Architecture Specification + [3:0] + read-only + + + + + DWT_PIDR5 + 0x00001fd4 + Provides CoreSight discovery information for the DWT + 0x00000000 + + + DWT_PIDR5 + [31:0] + read-write + + + + + DWT_PIDR6 + 0x00001fd8 + Provides CoreSight discovery information for the DWT + 0x00000000 + + + DWT_PIDR6 + [31:0] + read-write + + + + + DWT_PIDR7 + 0x00001fdc + Provides CoreSight discovery information for the DWT + 0x00000000 + + + DWT_PIDR7 + [31:0] + read-write + + + + + DWT_PIDR0 + 0x00001fe0 + Provides CoreSight discovery information for the DWT + 0x00000021 + + + PART_0 + See CoreSight Architecture Specification + [7:0] + read-only + + + + + DWT_PIDR1 + 0x00001fe4 + Provides CoreSight discovery information for the DWT + 0x000000bd + + + DES_0 + See CoreSight Architecture Specification + [7:4] + read-only + + + PART_1 + See CoreSight Architecture Specification + [3:0] + read-only + + + + + DWT_PIDR2 + 0x00001fe8 + Provides CoreSight discovery information for the DWT + 0x0000000b + + + REVISION + See CoreSight Architecture Specification + [7:4] + read-only + + + JEDEC + See CoreSight Architecture Specification + [3:3] + read-only + + + DES_1 + See CoreSight Architecture Specification + [2:0] + read-only + + + + + DWT_PIDR3 + 0x00001fec + Provides CoreSight discovery information for the DWT + 0x00000000 + + + REVAND + See CoreSight Architecture Specification + [7:4] + read-only + + + CMOD + See CoreSight Architecture Specification + [3:0] + read-only + + + + + DWT_CIDR0 + 0x00001ff0 + Provides CoreSight discovery information for the DWT + 0x0000000d + + + PRMBL_0 + See CoreSight Architecture Specification + [7:0] + read-only + + + + + DWT_CIDR1 + 0x00001ff4 + Provides CoreSight discovery information for the DWT + 0x00000090 + + + CLASS + See CoreSight Architecture Specification + [7:4] + read-only + + + PRMBL_1 + See CoreSight Architecture Specification + [3:0] + read-only + + + + + DWT_CIDR2 + 0x00001ff8 + Provides CoreSight discovery information for the DWT + 0x00000005 + + + PRMBL_2 + See CoreSight Architecture Specification + [7:0] + read-only + + + + + DWT_CIDR3 + 0x00001ffc + Provides CoreSight discovery information for the DWT + 0x000000b1 + + + PRMBL_3 + See CoreSight Architecture Specification + [7:0] + read-only + + + + + FP_CTRL + 0x00002000 + Provides FPB implementation information, and the global enable for the FPB unit + 0x60005580 + + + REV + Flash Patch and Breakpoint Unit architecture revision + [31:28] + read-only + + + NUM_CODE_14_12_ + Indicates the number of implemented instruction address comparators. Zero indicates no Instruction Address comparators are implemented. The Instruction Address comparators are numbered from 0 to NUM_CODE - 1 + [14:12] + read-only + + + NUM_LIT + Indicates the number of implemented literal address comparators. The Literal Address comparators are numbered from NUM_CODE to NUM_CODE + NUM_LIT - 1 + [11:8] + read-only + + + NUM_CODE_7_4_ + Indicates the number of implemented instruction address comparators. Zero indicates no Instruction Address comparators are implemented. The Instruction Address comparators are numbered from 0 to NUM_CODE - 1 + [7:4] + read-only + + + KEY + Writes to the FP_CTRL are ignored unless KEY is concurrently written to one + [1:1] + read-write + + + ENABLE + Enables the FPB + [0:0] + read-write + + + + + FP_REMAP + 0x00002004 + Indicates whether the implementation supports Flash Patch remap and, if it does, holds the target address for remap + 0x00000000 + + + RMPSPT + Indicates whether the FPB unit supports the Flash Patch remap function + [29:29] + read-only + + + REMAP + Holds the bits[28:5] of the Flash Patch remap address + [28:5] + read-only + + + + + FP_COMP0 + 0x00002008 + Holds an address for comparison. The effect of the match depends on the configuration of the FPB and whether the comparator is an instruction address comparator or a literal address comparator + 0x00000000 + + + BE + Selects between flashpatch and breakpoint functionality + [0:0] + read-write + + + + + FP_COMP1 + 0x0000200c + Holds an address for comparison. The effect of the match depends on the configuration of the FPB and whether the comparator is an instruction address comparator or a literal address comparator + 0x00000000 + + + BE + Selects between flashpatch and breakpoint functionality + [0:0] + read-write + + + + + FP_COMP2 + 0x00002010 + Holds an address for comparison. The effect of the match depends on the configuration of the FPB and whether the comparator is an instruction address comparator or a literal address comparator + 0x00000000 + + + BE + Selects between flashpatch and breakpoint functionality + [0:0] + read-write + + + + + FP_COMP3 + 0x00002014 + Holds an address for comparison. The effect of the match depends on the configuration of the FPB and whether the comparator is an instruction address comparator or a literal address comparator + 0x00000000 + + + BE + Selects between flashpatch and breakpoint functionality + [0:0] + read-write + + + + + FP_COMP4 + 0x00002018 + Holds an address for comparison. The effect of the match depends on the configuration of the FPB and whether the comparator is an instruction address comparator or a literal address comparator + 0x00000000 + + + BE + Selects between flashpatch and breakpoint functionality + [0:0] + read-write + + + + + FP_COMP5 + 0x0000201c + Holds an address for comparison. The effect of the match depends on the configuration of the FPB and whether the comparator is an instruction address comparator or a literal address comparator + 0x00000000 + + + BE + Selects between flashpatch and breakpoint functionality + [0:0] + read-write + + + + + FP_COMP6 + 0x00002020 + Holds an address for comparison. The effect of the match depends on the configuration of the FPB and whether the comparator is an instruction address comparator or a literal address comparator + 0x00000000 + + + BE + Selects between flashpatch and breakpoint functionality + [0:0] + read-write + + + + + FP_COMP7 + 0x00002024 + Holds an address for comparison. The effect of the match depends on the configuration of the FPB and whether the comparator is an instruction address comparator or a literal address comparator + 0x00000000 + + + BE + Selects between flashpatch and breakpoint functionality + [0:0] + read-write + + + + + FP_DEVARCH + 0x00002fbc + Provides CoreSight discovery information for the FPB + 0x47701a03 + + + ARCHITECT + Defines the architect of the component. Bits [31:28] are the JEP106 continuation code (JEP106 bank ID, minus 1) and bits [27:21] are the JEP106 ID code. + [31:21] + read-only + + + PRESENT + Defines that the DEVARCH register is present + [20:20] + read-only + + + REVISION + Defines the architecture revision of the component + [19:16] + read-only + + + ARCHVER + Defines the architecture version of the component + [15:12] + read-only + + + ARCHPART + Defines the architecture of the component + [11:0] + read-only + + + + + FP_DEVTYPE + 0x00002fcc + Provides CoreSight discovery information for the FPB + 0x00000000 + + + SUB + Component sub-type + [7:4] + read-only + + + MAJOR + Component major type + [3:0] + read-only + + + + + FP_PIDR4 + 0x00002fd0 + Provides CoreSight discovery information for the FP + 0x00000004 + + + SIZE + See CoreSight Architecture Specification + [7:4] + read-only + + + DES_2 + See CoreSight Architecture Specification + [3:0] + read-only + + + + + FP_PIDR5 + 0x00002fd4 + Provides CoreSight discovery information for the FP + 0x00000000 + + + FP_PIDR5 + [31:0] + read-write + + + + + FP_PIDR6 + 0x00002fd8 + Provides CoreSight discovery information for the FP + 0x00000000 + + + FP_PIDR6 + [31:0] + read-write + + + + + FP_PIDR7 + 0x00002fdc + Provides CoreSight discovery information for the FP + 0x00000000 + + + FP_PIDR7 + [31:0] + read-write + + + + + FP_PIDR0 + 0x00002fe0 + Provides CoreSight discovery information for the FP + 0x00000021 + + + PART_0 + See CoreSight Architecture Specification + [7:0] + read-only + + + + + FP_PIDR1 + 0x00002fe4 + Provides CoreSight discovery information for the FP + 0x000000bd + + + DES_0 + See CoreSight Architecture Specification + [7:4] + read-only + + + PART_1 + See CoreSight Architecture Specification + [3:0] + read-only + + + + + FP_PIDR2 + 0x00002fe8 + Provides CoreSight discovery information for the FP + 0x0000000b + + + REVISION + See CoreSight Architecture Specification + [7:4] + read-only + + + JEDEC + See CoreSight Architecture Specification + [3:3] + read-only + + + DES_1 + See CoreSight Architecture Specification + [2:0] + read-only + + + + + FP_PIDR3 + 0x00002fec + Provides CoreSight discovery information for the FP + 0x00000000 + + + REVAND + See CoreSight Architecture Specification + [7:4] + read-only + + + CMOD + See CoreSight Architecture Specification + [3:0] + read-only + + + + + FP_CIDR0 + 0x00002ff0 + Provides CoreSight discovery information for the FP + 0x0000000d + + + PRMBL_0 + See CoreSight Architecture Specification + [7:0] + read-only + + + + + FP_CIDR1 + 0x00002ff4 + Provides CoreSight discovery information for the FP + 0x00000090 + + + CLASS + See CoreSight Architecture Specification + [7:4] + read-only + + + PRMBL_1 + See CoreSight Architecture Specification + [3:0] + read-only + + + + + FP_CIDR2 + 0x00002ff8 + Provides CoreSight discovery information for the FP + 0x00000005 + + + PRMBL_2 + See CoreSight Architecture Specification + [7:0] + read-only + + + + + FP_CIDR3 + 0x00002ffc + Provides CoreSight discovery information for the FP + 0x000000b1 + + + PRMBL_3 + See CoreSight Architecture Specification + [7:0] + read-only + + + + + ICTR + 0x0000e004 + Provides information about the interrupt controller + 0x00000001 + + + INTLINESNUM + Indicates the number of the highest implemented register in each of the NVIC control register sets, or in the case of NVIC_IPR*n, 4×INTLINESNUM + [3:0] + read-only + + + + + ACTLR + 0x0000e008 + Provides IMPLEMENTATION DEFINED configuration and control options + 0x00000000 + + + EXTEXCLALL + External Exclusives Allowed with no MPU + [29:29] + read-write + + + DISITMATBFLUSH + Disable ATB Flush + [12:12] + read-write + + + FPEXCODIS + Disable FPU exception outputs + [10:10] + read-write + + + DISOOFP + Disable out-of-order FP instruction completion + [9:9] + read-write + + + DISFOLD + Disable dual-issue. + [2:2] + read-write + + + DISMCYCINT + Disable dual-issue. + [0:0] + read-write + + + + + SYST_CSR + 0x0000e010 + Use the SysTick Control and Status Register to enable the SysTick features. + 0x00000000 + + + COUNTFLAG + Returns 1 if timer counted to 0 since last time this was read. Clears on read by application or debugger. + [16:16] + read-only + + + CLKSOURCE + SysTick clock source. Always reads as one if SYST_CALIB reports NOREF. + Selects the SysTick timer clock source: + 0 = External reference clock. + 1 = Processor clock. + [2:2] + read-write + + + TICKINT + Enables SysTick exception request: + 0 = Counting down to zero does not assert the SysTick exception request. + 1 = Counting down to zero to asserts the SysTick exception request. + [1:1] + read-write + + + ENABLE + Enable SysTick counter: + 0 = Counter disabled. + 1 = Counter enabled. + [0:0] + read-write + + + + + SYST_RVR + 0x0000e014 + Use the SysTick Reload Value Register to specify the start value to load into the current value register when the counter reaches 0. It can be any value between 0 and 0x00FFFFFF. A start value of 0 is possible, but has no effect because the SysTick interrupt and COUNTFLAG are activated when counting from 1 to 0. The reset value of this register is UNKNOWN. + To generate a multi-shot timer with a period of N processor clock cycles, use a RELOAD value of N-1. For example, if the SysTick interrupt is required every 100 clock pulses, set RELOAD to 99. + 0x00000000 + + + RELOAD + Value to load into the SysTick Current Value Register when the counter reaches 0. + [23:0] + read-write + + + + + SYST_CVR + 0x0000e018 + Use the SysTick Current Value Register to find the current value in the register. The reset value of this register is UNKNOWN. + 0x00000000 + + + CURRENT + Reads return the current value of the SysTick counter. This register is write-clear. Writing to it with any value clears the register to 0. Clearing this register also clears the COUNTFLAG bit of the SysTick Control and Status Register. + [23:0] + read-write + + + + + SYST_CALIB + 0x0000e01c + Use the SysTick Calibration Value Register to enable software to scale to any required speed using divide and multiply. + 0x00000000 + + + NOREF + If reads as 1, the Reference clock is not provided - the CLKSOURCE bit of the SysTick Control and Status register will be forced to 1 and cannot be cleared to 0. + [31:31] + read-only + + + SKEW + If reads as 1, the calibration value for 10ms is inexact (due to clock frequency). + [30:30] + read-only + + + TENMS + An optional Reload value to be used for 10ms (100Hz) timing, subject to system clock skew errors. If the value reads as 0, the calibration value is not known. + [23:0] + read-only + + + + + NVIC_ISER0 + 0x0000e100 + Enables or reads the enabled state of each group of 32 interrupts + 0x00000000 + + + SETENA + For SETENA[m] in NVIC_ISER*n, indicates whether interrupt 32*n + m is enabled + [31:0] + read-write + + + + + NVIC_ISER1 + 0x0000e104 + Enables or reads the enabled state of each group of 32 interrupts + 0x00000000 + + + SETENA + For SETENA[m] in NVIC_ISER*n, indicates whether interrupt 32*n + m is enabled + [31:0] + read-write + + + + + NVIC_ICER0 + 0x0000e180 + Clears or reads the enabled state of each group of 32 interrupts + 0x00000000 + + + CLRENA + For CLRENA[m] in NVIC_ICER*n, indicates whether interrupt 32*n + m is enabled + [31:0] + read-write + + + + + NVIC_ICER1 + 0x0000e184 + Clears or reads the enabled state of each group of 32 interrupts + 0x00000000 + + + CLRENA + For CLRENA[m] in NVIC_ICER*n, indicates whether interrupt 32*n + m is enabled + [31:0] + read-write + + + + + NVIC_ISPR0 + 0x0000e200 + Enables or reads the pending state of each group of 32 interrupts + 0x00000000 + + + SETPEND + For SETPEND[m] in NVIC_ISPR*n, indicates whether interrupt 32*n + m is pending + [31:0] + read-write + + + + + NVIC_ISPR1 + 0x0000e204 + Enables or reads the pending state of each group of 32 interrupts + 0x00000000 + + + SETPEND + For SETPEND[m] in NVIC_ISPR*n, indicates whether interrupt 32*n + m is pending + [31:0] + read-write + + + + + NVIC_ICPR0 + 0x0000e280 + Clears or reads the pending state of each group of 32 interrupts + 0x00000000 + + + CLRPEND + For CLRPEND[m] in NVIC_ICPR*n, indicates whether interrupt 32*n + m is pending + [31:0] + read-write + + + + + NVIC_ICPR1 + 0x0000e284 + Clears or reads the pending state of each group of 32 interrupts + 0x00000000 + + + CLRPEND + For CLRPEND[m] in NVIC_ICPR*n, indicates whether interrupt 32*n + m is pending + [31:0] + read-write + + + + + NVIC_IABR0 + 0x0000e300 + For each group of 32 interrupts, shows the active state of each interrupt + 0x00000000 + + + ACTIVE + For ACTIVE[m] in NVIC_IABR*n, indicates the active state for interrupt 32*n+m + [31:0] + read-write + + + + + NVIC_IABR1 + 0x0000e304 + For each group of 32 interrupts, shows the active state of each interrupt + 0x00000000 + + + ACTIVE + For ACTIVE[m] in NVIC_IABR*n, indicates the active state for interrupt 32*n+m + [31:0] + read-write + + + + + NVIC_ITNS0 + 0x0000e380 + For each group of 32 interrupts, determines whether each interrupt targets Non-secure or Secure state + 0x00000000 + + + ITNS + For ITNS[m] in NVIC_ITNS*n, `IAAMO the target Security state for interrupt 32*n+m + [31:0] + read-write + + + + + NVIC_ITNS1 + 0x0000e384 + For each group of 32 interrupts, determines whether each interrupt targets Non-secure or Secure state + 0x00000000 + + + ITNS + For ITNS[m] in NVIC_ITNS*n, `IAAMO the target Security state for interrupt 32*n+m + [31:0] + read-write + + + + + NVIC_IPR0 + 0x0000e400 + Sets or reads interrupt priorities + 0x00000000 + + + PRI_N3 + For register NVIC_IPRn, the priority of interrupt number 4*n+3, or RES0 if the PE does not implement this interrupt + [31:28] + read-write + + + PRI_N2 + For register NVIC_IPRn, the priority of interrupt number 4*n+2, or RES0 if the PE does not implement this interrupt + [23:20] + read-write + + + PRI_N1 + For register NVIC_IPRn, the priority of interrupt number 4*n+1, or RES0 if the PE does not implement this interrupt + [15:12] + read-write + + + PRI_N0 + For register NVIC_IPRn, the priority of interrupt number 4*n+0, or RES0 if the PE does not implement this interrupt + [7:4] + read-write + + + + + NVIC_IPR1 + 0x0000e404 + Sets or reads interrupt priorities + 0x00000000 + + + PRI_N3 + For register NVIC_IPRn, the priority of interrupt number 4*n+3, or RES0 if the PE does not implement this interrupt + [31:28] + read-write + + + PRI_N2 + For register NVIC_IPRn, the priority of interrupt number 4*n+2, or RES0 if the PE does not implement this interrupt + [23:20] + read-write + + + PRI_N1 + For register NVIC_IPRn, the priority of interrupt number 4*n+1, or RES0 if the PE does not implement this interrupt + [15:12] + read-write + + + PRI_N0 + For register NVIC_IPRn, the priority of interrupt number 4*n+0, or RES0 if the PE does not implement this interrupt + [7:4] + read-write + + + + + NVIC_IPR2 + 0x0000e408 + Sets or reads interrupt priorities + 0x00000000 + + + PRI_N3 + For register NVIC_IPRn, the priority of interrupt number 4*n+3, or RES0 if the PE does not implement this interrupt + [31:28] + read-write + + + PRI_N2 + For register NVIC_IPRn, the priority of interrupt number 4*n+2, or RES0 if the PE does not implement this interrupt + [23:20] + read-write + + + PRI_N1 + For register NVIC_IPRn, the priority of interrupt number 4*n+1, or RES0 if the PE does not implement this interrupt + [15:12] + read-write + + + PRI_N0 + For register NVIC_IPRn, the priority of interrupt number 4*n+0, or RES0 if the PE does not implement this interrupt + [7:4] + read-write + + + + + NVIC_IPR3 + 0x0000e40c + Sets or reads interrupt priorities + 0x00000000 + + + PRI_N3 + For register NVIC_IPRn, the priority of interrupt number 4*n+3, or RES0 if the PE does not implement this interrupt + [31:28] + read-write + + + PRI_N2 + For register NVIC_IPRn, the priority of interrupt number 4*n+2, or RES0 if the PE does not implement this interrupt + [23:20] + read-write + + + PRI_N1 + For register NVIC_IPRn, the priority of interrupt number 4*n+1, or RES0 if the PE does not implement this interrupt + [15:12] + read-write + + + PRI_N0 + For register NVIC_IPRn, the priority of interrupt number 4*n+0, or RES0 if the PE does not implement this interrupt + [7:4] + read-write + + + + + NVIC_IPR4 + 0x0000e410 + Sets or reads interrupt priorities + 0x00000000 + + + PRI_N3 + For register NVIC_IPRn, the priority of interrupt number 4*n+3, or RES0 if the PE does not implement this interrupt + [31:28] + read-write + + + PRI_N2 + For register NVIC_IPRn, the priority of interrupt number 4*n+2, or RES0 if the PE does not implement this interrupt + [23:20] + read-write + + + PRI_N1 + For register NVIC_IPRn, the priority of interrupt number 4*n+1, or RES0 if the PE does not implement this interrupt + [15:12] + read-write + + + PRI_N0 + For register NVIC_IPRn, the priority of interrupt number 4*n+0, or RES0 if the PE does not implement this interrupt + [7:4] + read-write + + + + + NVIC_IPR5 + 0x0000e414 + Sets or reads interrupt priorities + 0x00000000 + + + PRI_N3 + For register NVIC_IPRn, the priority of interrupt number 4*n+3, or RES0 if the PE does not implement this interrupt + [31:28] + read-write + + + PRI_N2 + For register NVIC_IPRn, the priority of interrupt number 4*n+2, or RES0 if the PE does not implement this interrupt + [23:20] + read-write + + + PRI_N1 + For register NVIC_IPRn, the priority of interrupt number 4*n+1, or RES0 if the PE does not implement this interrupt + [15:12] + read-write + + + PRI_N0 + For register NVIC_IPRn, the priority of interrupt number 4*n+0, or RES0 if the PE does not implement this interrupt + [7:4] + read-write + + + + + NVIC_IPR6 + 0x0000e418 + Sets or reads interrupt priorities + 0x00000000 + + + PRI_N3 + For register NVIC_IPRn, the priority of interrupt number 4*n+3, or RES0 if the PE does not implement this interrupt + [31:28] + read-write + + + PRI_N2 + For register NVIC_IPRn, the priority of interrupt number 4*n+2, or RES0 if the PE does not implement this interrupt + [23:20] + read-write + + + PRI_N1 + For register NVIC_IPRn, the priority of interrupt number 4*n+1, or RES0 if the PE does not implement this interrupt + [15:12] + read-write + + + PRI_N0 + For register NVIC_IPRn, the priority of interrupt number 4*n+0, or RES0 if the PE does not implement this interrupt + [7:4] + read-write + + + + + NVIC_IPR7 + 0x0000e41c + Sets or reads interrupt priorities + 0x00000000 + + + PRI_N3 + For register NVIC_IPRn, the priority of interrupt number 4*n+3, or RES0 if the PE does not implement this interrupt + [31:28] + read-write + + + PRI_N2 + For register NVIC_IPRn, the priority of interrupt number 4*n+2, or RES0 if the PE does not implement this interrupt + [23:20] + read-write + + + PRI_N1 + For register NVIC_IPRn, the priority of interrupt number 4*n+1, or RES0 if the PE does not implement this interrupt + [15:12] + read-write + + + PRI_N0 + For register NVIC_IPRn, the priority of interrupt number 4*n+0, or RES0 if the PE does not implement this interrupt + [7:4] + read-write + + + + + NVIC_IPR8 + 0x0000e420 + Sets or reads interrupt priorities + 0x00000000 + + + PRI_N3 + For register NVIC_IPRn, the priority of interrupt number 4*n+3, or RES0 if the PE does not implement this interrupt + [31:28] + read-write + + + PRI_N2 + For register NVIC_IPRn, the priority of interrupt number 4*n+2, or RES0 if the PE does not implement this interrupt + [23:20] + read-write + + + PRI_N1 + For register NVIC_IPRn, the priority of interrupt number 4*n+1, or RES0 if the PE does not implement this interrupt + [15:12] + read-write + + + PRI_N0 + For register NVIC_IPRn, the priority of interrupt number 4*n+0, or RES0 if the PE does not implement this interrupt + [7:4] + read-write + + + + + NVIC_IPR9 + 0x0000e424 + Sets or reads interrupt priorities + 0x00000000 + + + PRI_N3 + For register NVIC_IPRn, the priority of interrupt number 4*n+3, or RES0 if the PE does not implement this interrupt + [31:28] + read-write + + + PRI_N2 + For register NVIC_IPRn, the priority of interrupt number 4*n+2, or RES0 if the PE does not implement this interrupt + [23:20] + read-write + + + PRI_N1 + For register NVIC_IPRn, the priority of interrupt number 4*n+1, or RES0 if the PE does not implement this interrupt + [15:12] + read-write + + + PRI_N0 + For register NVIC_IPRn, the priority of interrupt number 4*n+0, or RES0 if the PE does not implement this interrupt + [7:4] + read-write + + + + + NVIC_IPR10 + 0x0000e428 + Sets or reads interrupt priorities + 0x00000000 + + + PRI_N3 + For register NVIC_IPRn, the priority of interrupt number 4*n+3, or RES0 if the PE does not implement this interrupt + [31:28] + read-write + + + PRI_N2 + For register NVIC_IPRn, the priority of interrupt number 4*n+2, or RES0 if the PE does not implement this interrupt + [23:20] + read-write + + + PRI_N1 + For register NVIC_IPRn, the priority of interrupt number 4*n+1, or RES0 if the PE does not implement this interrupt + [15:12] + read-write + + + PRI_N0 + For register NVIC_IPRn, the priority of interrupt number 4*n+0, or RES0 if the PE does not implement this interrupt + [7:4] + read-write + + + + + NVIC_IPR11 + 0x0000e42c + Sets or reads interrupt priorities + 0x00000000 + + + PRI_N3 + For register NVIC_IPRn, the priority of interrupt number 4*n+3, or RES0 if the PE does not implement this interrupt + [31:28] + read-write + + + PRI_N2 + For register NVIC_IPRn, the priority of interrupt number 4*n+2, or RES0 if the PE does not implement this interrupt + [23:20] + read-write + + + PRI_N1 + For register NVIC_IPRn, the priority of interrupt number 4*n+1, or RES0 if the PE does not implement this interrupt + [15:12] + read-write + + + PRI_N0 + For register NVIC_IPRn, the priority of interrupt number 4*n+0, or RES0 if the PE does not implement this interrupt + [7:4] + read-write + + + + + NVIC_IPR12 + 0x0000e430 + Sets or reads interrupt priorities + 0x00000000 + + + PRI_N3 + For register NVIC_IPRn, the priority of interrupt number 4*n+3, or RES0 if the PE does not implement this interrupt + [31:28] + read-write + + + PRI_N2 + For register NVIC_IPRn, the priority of interrupt number 4*n+2, or RES0 if the PE does not implement this interrupt + [23:20] + read-write + + + PRI_N1 + For register NVIC_IPRn, the priority of interrupt number 4*n+1, or RES0 if the PE does not implement this interrupt + [15:12] + read-write + + + PRI_N0 + For register NVIC_IPRn, the priority of interrupt number 4*n+0, or RES0 if the PE does not implement this interrupt + [7:4] + read-write + + + + + NVIC_IPR13 + 0x0000e434 + Sets or reads interrupt priorities + 0x00000000 + + + PRI_N3 + For register NVIC_IPRn, the priority of interrupt number 4*n+3, or RES0 if the PE does not implement this interrupt + [31:28] + read-write + + + PRI_N2 + For register NVIC_IPRn, the priority of interrupt number 4*n+2, or RES0 if the PE does not implement this interrupt + [23:20] + read-write + + + PRI_N1 + For register NVIC_IPRn, the priority of interrupt number 4*n+1, or RES0 if the PE does not implement this interrupt + [15:12] + read-write + + + PRI_N0 + For register NVIC_IPRn, the priority of interrupt number 4*n+0, or RES0 if the PE does not implement this interrupt + [7:4] + read-write + + + + + NVIC_IPR14 + 0x0000e438 + Sets or reads interrupt priorities + 0x00000000 + + + PRI_N3 + For register NVIC_IPRn, the priority of interrupt number 4*n+3, or RES0 if the PE does not implement this interrupt + [31:28] + read-write + + + PRI_N2 + For register NVIC_IPRn, the priority of interrupt number 4*n+2, or RES0 if the PE does not implement this interrupt + [23:20] + read-write + + + PRI_N1 + For register NVIC_IPRn, the priority of interrupt number 4*n+1, or RES0 if the PE does not implement this interrupt + [15:12] + read-write + + + PRI_N0 + For register NVIC_IPRn, the priority of interrupt number 4*n+0, or RES0 if the PE does not implement this interrupt + [7:4] + read-write + + + + + NVIC_IPR15 + 0x0000e43c + Sets or reads interrupt priorities + 0x00000000 + + + PRI_N3 + For register NVIC_IPRn, the priority of interrupt number 4*n+3, or RES0 if the PE does not implement this interrupt + [31:28] + read-write + + + PRI_N2 + For register NVIC_IPRn, the priority of interrupt number 4*n+2, or RES0 if the PE does not implement this interrupt + [23:20] + read-write + + + PRI_N1 + For register NVIC_IPRn, the priority of interrupt number 4*n+1, or RES0 if the PE does not implement this interrupt + [15:12] + read-write + + + PRI_N0 + For register NVIC_IPRn, the priority of interrupt number 4*n+0, or RES0 if the PE does not implement this interrupt + [7:4] + read-write + + + + + CPUID + 0x0000ed00 + Provides identification information for the PE, including an implementer code for the device and a device ID number + 0x411fd210 + + + IMPLEMENTER + This field must hold an implementer code that has been assigned by ARM + [31:24] + read-only + + + VARIANT + IMPLEMENTATION DEFINED variant number. Typically, this field is used to distinguish between different product variants, or major revisions of a product + [23:20] + read-only + + + ARCHITECTURE + Defines the Architecture implemented by the PE + [19:16] + read-only + + + PARTNO + IMPLEMENTATION DEFINED primary part number for the device + [15:4] + read-only + + + REVISION + IMPLEMENTATION DEFINED revision number for the device + [3:0] + read-only + + + + + ICSR + 0x0000ed04 + Controls and provides status information for NMI, PendSV, SysTick and interrupts + 0x00000000 + + + PENDNMISET + Indicates whether the NMI exception is pending + [31:31] + read-only + + + PENDNMICLR + Allows the NMI exception pend state to be cleared + [30:30] + read-write + + + PENDSVSET + Indicates whether the PendSV `FTSSS exception is pending + [28:28] + read-only + + + PENDSVCLR + Allows the PendSV exception pend state to be cleared `FTSSS + [27:27] + read-write + + + PENDSTSET + Indicates whether the SysTick `FTSSS exception is pending + [26:26] + read-only + + + PENDSTCLR + Allows the SysTick exception pend state to be cleared `FTSSS + [25:25] + read-write + + + STTNS + Controls whether in a single SysTick implementation, the SysTick is Secure or Non-secure + [24:24] + read-write + + + ISRPREEMPT + Indicates whether a pending exception will be serviced on exit from debug halt state + [23:23] + read-only + + + ISRPENDING + Indicates whether an external interrupt, generated by the NVIC, is pending + [22:22] + read-only + + + VECTPENDING + The exception number of the highest priority pending and enabled interrupt + [20:12] + read-only + + + RETTOBASE + In Handler mode, indicates whether there is more than one active exception + [11:11] + read-only + + + VECTACTIVE + The exception number of the current executing exception + [8:0] + read-only + + + + + VTOR + 0x0000ed08 + The VTOR indicates the offset of the vector table base address from memory address 0x00000000. + 0x00000000 + + + TBLOFF + Vector table base offset field. It contains bits[31:7] of the offset of the table base from the bottom of the memory map. + [31:7] + read-write + + + + + AIRCR + 0x0000ed0c + Use the Application Interrupt and Reset Control Register to: determine data endianness, clear all active state information from debug halt mode, request a system reset. + 0x00000000 + + + VECTKEY + Register key: + Reads as Unknown + On writes, write 0x05FA to VECTKEY, otherwise the write is ignored. + [31:16] + read-write + + + ENDIANESS + Data endianness implemented: + 0 = Little-endian. + [15:15] + read-only + + + PRIS + Prioritize Secure exceptions. The value of this bit defines whether Secure exception priority boosting is enabled. + 0 Priority ranges of Secure and Non-secure exceptions are identical. + 1 Non-secure exceptions are de-prioritized. + [14:14] + read-write + + + BFHFNMINS + BusFault, HardFault, and NMI Non-secure enable. + 0 BusFault, HardFault, and NMI are Secure. + 1 BusFault and NMI are Non-secure and exceptions can target Non-secure HardFault. + [13:13] + read-write + + + PRIGROUP + Interrupt priority grouping field. This field determines the split of group priority from subpriority. + See https://developer.arm.com/documentation/100235/0004/the-cortex-m33-peripherals/system-control-block/application-interrupt-and-reset-control-register?lang=en + [10:8] + read-write + + + SYSRESETREQS + System reset request, Secure state only. + 0 SYSRESETREQ functionality is available to both Security states. + 1 SYSRESETREQ functionality is only available to Secure state. + [3:3] + read-write + + + SYSRESETREQ + Writing 1 to this bit causes the SYSRESETREQ signal to the outer system to be asserted to request a reset. The intention is to force a large system reset of all major components except for debug. The C_HALT bit in the DHCSR is cleared as a result of the system reset requested. The debugger does not lose contact with the device. + [2:2] + read-write + + + VECTCLRACTIVE + Clears all active state information for fixed and configurable exceptions. This bit: is self-clearing, can only be set by the DAP when the core is halted. When set: clears all active exception status of the processor, forces a return to Thread mode, forces an IPSR of 0. A debugger must re-initialize the stack. + [1:1] + read-write + + + + + SCR + 0x0000ed10 + System Control Register. Use the System Control Register for power-management functions: signal to the system when the processor can enter a low power state, control how the processor enters and exits low power states. + 0x00000000 + + + SEVONPEND + Send Event on Pending bit: + 0 = Only enabled interrupts or events can wakeup the processor, disabled interrupts are excluded. + 1 = Enabled events and all interrupts, including disabled interrupts, can wakeup the processor. + When an event or interrupt becomes pending, the event signal wakes up the processor from WFE. If the + processor is not waiting for an event, the event is registered and affects the next WFE. + The processor also wakes up on execution of an SEV instruction or an external event. + [4:4] + read-write + + + SLEEPDEEPS + 0 SLEEPDEEP is available to both security states + 1 SLEEPDEEP is only available to Secure state + [3:3] + read-write + + + SLEEPDEEP + Controls whether the processor uses sleep or deep sleep as its low power mode: + 0 = Sleep. + 1 = Deep sleep. + [2:2] + read-write + + + SLEEPONEXIT + Indicates sleep-on-exit when returning from Handler mode to Thread mode: + 0 = Do not sleep when returning to Thread mode. + 1 = Enter sleep, or deep sleep, on return from an ISR to Thread mode. + Setting this bit to 1 enables an interrupt driven application to avoid returning to an empty main application. + [1:1] + read-write + + + + + CCR + 0x0000ed14 + Sets or returns configuration and control data + 0x00000201 + + + BP + Enables program flow prediction `FTSSS + [18:18] + read-only + + + IC + This is a global enable bit for instruction caches in the selected Security state + [17:17] + read-only + + + DC + Enables data caching of all data accesses to Normal memory `FTSSS + [16:16] + read-only + + + STKOFHFNMIGN + Controls the effect of a stack limit violation while executing at a requested priority less than 0 + [10:10] + read-write + + + RES1 + Reserved, RES1 + [9:9] + read-only + + + BFHFNMIGN + Determines the effect of precise BusFaults on handlers running at a requested priority less than 0 + [8:8] + read-write + + + DIV_0_TRP + Controls the generation of a DIVBYZERO UsageFault when attempting to perform integer division by zero + [4:4] + read-write + + + UNALIGN_TRP + Controls the trapping of unaligned word or halfword accesses + [3:3] + read-write + + + USERSETMPEND + Determines whether unprivileged accesses are permitted to pend interrupts via the STIR + [1:1] + read-write + + + RES1_1 + Reserved, RES1 + [0:0] + read-only + + + + + SHPR1 + 0x0000ed18 + Sets or returns priority for system handlers 4 - 7 + 0x00000000 + + + PRI_7_3 + Priority of system handler 7, SecureFault + [31:29] + read-write + + + PRI_6_3 + Priority of system handler 6, SecureFault + [23:21] + read-write + + + PRI_5_3 + Priority of system handler 5, SecureFault + [15:13] + read-write + + + PRI_4_3 + Priority of system handler 4, SecureFault + [7:5] + read-write + + + + + SHPR2 + 0x0000ed1c + Sets or returns priority for system handlers 8 - 11 + 0x00000000 + + + PRI_11_3 + Priority of system handler 11, SecureFault + [31:29] + read-write + + + PRI_10 + Reserved, RES0 + [23:16] + read-only + + + PRI_9 + Reserved, RES0 + [15:8] + read-only + + + PRI_8 + Reserved, RES0 + [7:0] + read-only + + + + + SHPR3 + 0x0000ed20 + Sets or returns priority for system handlers 12 - 15 + 0x00000000 + + + PRI_15_3 + Priority of system handler 15, SecureFault + [31:29] + read-write + + + PRI_14_3 + Priority of system handler 14, SecureFault + [23:21] + read-write + + + PRI_13 + Reserved, RES0 + [15:8] + read-only + + + PRI_12_3 + Priority of system handler 12, SecureFault + [7:5] + read-write + + + + + SHCSR + 0x0000ed24 + Provides access to the active and pending status of system exceptions + 0x00000000 + + + HARDFAULTPENDED + `IAAMO the pending state of the HardFault exception `CTTSSS + [21:21] + read-write + + + SECUREFAULTPENDED + `IAAMO the pending state of the SecureFault exception + [20:20] + read-write + + + SECUREFAULTENA + `DW the SecureFault exception is enabled + [19:19] + read-write + + + USGFAULTENA + `DW the UsageFault exception is enabled `FTSSS + [18:18] + read-write + + + BUSFAULTENA + `DW the BusFault exception is enabled + [17:17] + read-write + + + MEMFAULTENA + `DW the MemManage exception is enabled `FTSSS + [16:16] + read-write + + + SVCALLPENDED + `IAAMO the pending state of the SVCall exception `FTSSS + [15:15] + read-write + + + BUSFAULTPENDED + `IAAMO the pending state of the BusFault exception + [14:14] + read-write + + + MEMFAULTPENDED + `IAAMO the pending state of the MemManage exception `FTSSS + [13:13] + read-write + + + USGFAULTPENDED + The UsageFault exception is banked between Security states, `IAAMO the pending state of the UsageFault exception `FTSSS + [12:12] + read-write + + + SYSTICKACT + `IAAMO the active state of the SysTick exception `FTSSS + [11:11] + read-write + + + PENDSVACT + `IAAMO the active state of the PendSV exception `FTSSS + [10:10] + read-write + + + MONITORACT + `IAAMO the active state of the DebugMonitor exception + [8:8] + read-write + + + SVCALLACT + `IAAMO the active state of the SVCall exception `FTSSS + [7:7] + read-write + + + NMIACT + `IAAMO the active state of the NMI exception + [5:5] + read-write + + + SECUREFAULTACT + `IAAMO the active state of the SecureFault exception + [4:4] + read-write + + + USGFAULTACT + `IAAMO the active state of the UsageFault exception `FTSSS + [3:3] + read-write + + + HARDFAULTACT + Indicates and allows limited modification of the active state of the HardFault exception `FTSSS + [2:2] + read-write + + + BUSFAULTACT + `IAAMO the active state of the BusFault exception + [1:1] + read-write + + + MEMFAULTACT + `IAAMO the active state of the MemManage exception `FTSSS + [0:0] + read-write + + + + + CFSR + 0x0000ed28 + Contains the three Configurable Fault Status Registers. + + 31:16 UFSR: Provides information on UsageFault exceptions + + 15:8 BFSR: Provides information on BusFault exceptions + + 7:0 MMFSR: Provides information on MemManage exceptions + 0x00000000 + + + UFSR_DIVBYZERO + Sticky flag indicating whether an integer division by zero error has occurred + [25:25] + read-write + + + UFSR_UNALIGNED + Sticky flag indicating whether an unaligned access error has occurred + [24:24] + read-write + + + UFSR_STKOF + Sticky flag indicating whether a stack overflow error has occurred + [20:20] + read-write + + + UFSR_NOCP + Sticky flag indicating whether a coprocessor disabled or not present error has occurred + [19:19] + read-write + + + UFSR_INVPC + Sticky flag indicating whether an integrity check error has occurred + [18:18] + read-write + + + UFSR_INVSTATE + Sticky flag indicating whether an EPSR.T or EPSR.IT validity error has occurred + [17:17] + read-write + + + UFSR_UNDEFINSTR + Sticky flag indicating whether an undefined instruction error has occurred + [16:16] + read-write + + + BFSR_BFARVALID + Indicates validity of the contents of the BFAR register + [15:15] + read-write + + + BFSR_LSPERR + Records whether a BusFault occurred during FP lazy state preservation + [13:13] + read-write + + + BFSR_STKERR + Records whether a derived BusFault occurred during exception entry stacking + [12:12] + read-write + + + BFSR_UNSTKERR + Records whether a derived BusFault occurred during exception return unstacking + [11:11] + read-write + + + BFSR_IMPRECISERR + Records whether an imprecise data access error has occurred + [10:10] + read-write + + + BFSR_PRECISERR + Records whether a precise data access error has occurred + [9:9] + read-write + + + BFSR_IBUSERR + Records whether a BusFault on an instruction prefetch has occurred + [8:8] + read-write + + + MMFSR + Provides information on MemManage exceptions + [7:0] + read-write + + + + + HFSR + 0x0000ed2c + Shows the cause of any HardFaults + 0x00000000 + + + DEBUGEVT + Indicates when a Debug event has occurred + [31:31] + read-write + + + FORCED + Indicates that a fault with configurable priority has been escalated to a HardFault exception, because it could not be made active, because of priority, or because it was disabled + [30:30] + read-write + + + VECTTBL + Indicates when a fault has occurred because of a vector table read error on exception processing + [1:1] + read-write + + + + + DFSR + 0x0000ed30 + Shows which debug event occurred + 0x00000000 + + + EXTERNAL + Sticky flag indicating whether an External debug request debug event has occurred + [4:4] + read-write + + + VCATCH + Sticky flag indicating whether a Vector catch debug event has occurred + [3:3] + read-write + + + DWTTRAP + Sticky flag indicating whether a Watchpoint debug event has occurred + [2:2] + read-write + + + BKPT + Sticky flag indicating whether a Breakpoint debug event has occurred + [1:1] + read-write + + + HALTED + Sticky flag indicating that a Halt request debug event or Step debug event has occurred + [0:0] + read-write + + + + + MMFAR + 0x0000ed34 + Shows the address of the memory location that caused an MPU fault + 0x00000000 + + + ADDRESS + This register is updated with the address of a location that produced a MemManage fault. The MMFSR shows the cause of the fault, and whether this field is valid. This field is valid only when MMFSR.MMARVALID is set, otherwise it is UNKNOWN + [31:0] + read-write + + + + + BFAR + 0x0000ed38 + Shows the address associated with a precise data access BusFault + 0x00000000 + + + ADDRESS + This register is updated with the address of a location that produced a BusFault. The BFSR shows the reason for the fault. This field is valid only when BFSR.BFARVALID is set, otherwise it is UNKNOWN + [31:0] + read-write + + + + + ID_PFR0 + 0x0000ed40 + Gives top-level information about the instruction set supported by the PE + 0x00000030 + + + STATE1 + T32 instruction set support + [7:4] + read-only + + + STATE0 + A32 instruction set support + [3:0] + read-only + + + + + ID_PFR1 + 0x0000ed44 + Gives information about the programmers' model and Extensions support + 0x00000520 + + + MPROGMOD + Identifies support for the M-Profile programmers' model support + [11:8] + read-only + + + SECURITY + Identifies whether the Security Extension is implemented + [7:4] + read-only + + + + + ID_DFR0 + 0x0000ed48 + Provides top level information about the debug system + 0x00200000 + + + MPROFDBG + Indicates the supported M-profile debug architecture + [23:20] + read-only + + + + + ID_AFR0 + 0x0000ed4c + Provides information about the IMPLEMENTATION DEFINED features of the PE + 0x00000000 + + + IMPDEF3 + IMPLEMENTATION DEFINED meaning + [15:12] + read-only + + + IMPDEF2 + IMPLEMENTATION DEFINED meaning + [11:8] + read-only + + + IMPDEF1 + IMPLEMENTATION DEFINED meaning + [7:4] + read-only + + + IMPDEF0 + IMPLEMENTATION DEFINED meaning + [3:0] + read-only + + + + + ID_MMFR0 + 0x0000ed50 + Provides information about the implemented memory model and memory management support + 0x00101f40 + + + AUXREG + Indicates support for Auxiliary Control Registers + [23:20] + read-only + + + TCM + Indicates support for tightly coupled memories (TCMs) + [19:16] + read-only + + + SHARELVL + Indicates the number of shareability levels implemented + [15:12] + read-only + + + OUTERSHR + Indicates the outermost shareability domain implemented + [11:8] + read-only + + + PMSA + Indicates support for the protected memory system architecture (PMSA) + [7:4] + read-only + + + + + ID_MMFR1 + 0x0000ed54 + Provides information about the implemented memory model and memory management support + 0x00000000 + + + ID_MMFR1 + [31:0] + read-write + + + + + ID_MMFR2 + 0x0000ed58 + Provides information about the implemented memory model and memory management support + 0x01000000 + + + WFISTALL + Indicates the support for Wait For Interrupt (WFI) stalling + [27:24] + read-only + + + + + ID_MMFR3 + 0x0000ed5c + Provides information about the implemented memory model and memory management support + 0x00000000 + + + BPMAINT + Indicates the supported branch predictor maintenance + [11:8] + read-only + + + CMAINTSW + Indicates the supported cache maintenance operations by set/way + [7:4] + read-only + + + CMAINTVA + Indicates the supported cache maintenance operations by address + [3:0] + read-only + + + + + ID_ISAR0 + 0x0000ed60 + Provides information about the instruction set implemented by the PE + 0x08092300 + + + DIVIDE + Indicates the supported Divide instructions + [27:24] + read-only + + + DEBUG + Indicates the implemented Debug instructions + [23:20] + read-only + + + COPROC + Indicates the supported Coprocessor instructions + [19:16] + read-only + + + CMPBRANCH + Indicates the supported combined Compare and Branch instructions + [15:12] + read-only + + + BITFIELD + Indicates the supported bit field instructions + [11:8] + read-only + + + BITCOUNT + Indicates the supported bit count instructions + [7:4] + read-only + + + + + ID_ISAR1 + 0x0000ed64 + Provides information about the instruction set implemented by the PE + 0x05725000 + + + INTERWORK + Indicates the implemented Interworking instructions + [27:24] + read-only + + + IMMEDIATE + Indicates the implemented for data-processing instructions with long immediates + [23:20] + read-only + + + IFTHEN + Indicates the implemented If-Then instructions + [19:16] + read-only + + + EXTEND + Indicates the implemented Extend instructions + [15:12] + read-only + + + + + ID_ISAR2 + 0x0000ed68 + Provides information about the instruction set implemented by the PE + 0x30173426 + + + REVERSAL + Indicates the implemented Reversal instructions + [31:28] + read-only + + + MULTU + Indicates the implemented advanced unsigned Multiply instructions + [23:20] + read-only + + + MULTS + Indicates the implemented advanced signed Multiply instructions + [19:16] + read-only + + + MULT + Indicates the implemented additional Multiply instructions + [15:12] + read-only + + + MULTIACCESSINT + Indicates the support for interruptible multi-access instructions + [11:8] + read-only + + + MEMHINT + Indicates the implemented Memory Hint instructions + [7:4] + read-only + + + LOADSTORE + Indicates the implemented additional load/store instructions + [3:0] + read-only + + + + + ID_ISAR3 + 0x0000ed6c + Provides information about the instruction set implemented by the PE + 0x07895729 + + + TRUENOP + Indicates the implemented true NOP instructions + [27:24] + read-only + + + T32COPY + Indicates the support for T32 non flag-setting MOV instructions + [23:20] + read-only + + + TABBRANCH + Indicates the implemented Table Branch instructions + [19:16] + read-only + + + SYNCHPRIM + Used in conjunction with ID_ISAR4.SynchPrim_frac to indicate the implemented Synchronization Primitive instructions + [15:12] + read-only + + + SVC + Indicates the implemented SVC instructions + [11:8] + read-only + + + SIMD + Indicates the implemented SIMD instructions + [7:4] + read-only + + + SATURATE + Indicates the implemented saturating instructions + [3:0] + read-only + + + + + ID_ISAR4 + 0x0000ed70 + Provides information about the instruction set implemented by the PE + 0x01310132 + + + PSR_M + Indicates the implemented M profile instructions to modify the PSRs + [27:24] + read-only + + + SYNCPRIM_FRAC + Used in conjunction with ID_ISAR3.SynchPrim to indicate the implemented Synchronization Primitive instructions + [23:20] + read-only + + + BARRIER + Indicates the implemented Barrier instructions + [19:16] + read-only + + + WRITEBACK + Indicates the support for writeback addressing modes + [11:8] + read-only + + + WITHSHIFTS + Indicates the support for writeback addressing modes + [7:4] + read-only + + + UNPRIV + Indicates the implemented unprivileged instructions + [3:0] + read-only + + + + + ID_ISAR5 + 0x0000ed74 + Provides information about the instruction set implemented by the PE + 0x00000000 + + + ID_ISAR5 + [31:0] + read-write + + + + + CTR + 0x0000ed7c + Provides information about the architecture of the caches. CTR is RES0 if CLIDR is zero. + 0x8000c000 + + + RES1 + Reserved, RES1 + [31:31] + read-only + + + CWG + Log2 of the number of words of the maximum size of memory that can be overwritten as a result of the eviction of a cache entry that has had a memory location in it modified + [27:24] + read-only + + + ERG + Log2 of the number of words of the maximum size of the reservation granule that has been implemented for the Load-Exclusive and Store-Exclusive instructions + [23:20] + read-only + + + DMINLINE + Log2 of the number of words in the smallest cache line of all the data caches and unified caches that are controlled by the PE + [19:16] + read-only + + + RES1_1 + Reserved, RES1 + [15:14] + read-only + + + IMINLINE + Log2 of the number of words in the smallest cache line of all the instruction caches that are controlled by the PE + [3:0] + read-only + + + + + CPACR + 0x0000ed88 + Specifies the access privileges for coprocessors and the FP Extension + 0x00000000 + + + CP11 + The value in this field is ignored. If the implementation does not include the FP Extension, this field is RAZ/WI. If the value of this bit is not programmed to the same value as the CP10 field, then the value is UNKNOWN + [23:22] + read-write + + + CP10 + Defines the access rights for the floating-point functionality + [21:20] + read-write + + + CP7 + Controls access privileges for coprocessor 7 + [15:14] + read-write + + + CP6 + Controls access privileges for coprocessor 6 + [13:12] + read-write + + + CP5 + Controls access privileges for coprocessor 5 + [11:10] + read-write + + + CP4 + Controls access privileges for coprocessor 4 + [9:8] + read-write + + + CP3 + Controls access privileges for coprocessor 3 + [7:6] + read-write + + + CP2 + Controls access privileges for coprocessor 2 + [5:4] + read-write + + + CP1 + Controls access privileges for coprocessor 1 + [3:2] + read-write + + + CP0 + Controls access privileges for coprocessor 0 + [1:0] + read-write + + + + + NSACR + 0x0000ed8c + Defines the Non-secure access permissions for both the FP Extension and coprocessors CP0 to CP7 + 0x00000000 + + + CP11 + Enables Non-secure access to the Floating-point Extension + [11:11] + read-write + + + CP10 + Enables Non-secure access to the Floating-point Extension + [10:10] + read-write + + + CP7 + Enables Non-secure access to coprocessor CP7 + [7:7] + read-write + + + CP6 + Enables Non-secure access to coprocessor CP6 + [6:6] + read-write + + + CP5 + Enables Non-secure access to coprocessor CP5 + [5:5] + read-write + + + CP4 + Enables Non-secure access to coprocessor CP4 + [4:4] + read-write + + + CP3 + Enables Non-secure access to coprocessor CP3 + [3:3] + read-write + + + CP2 + Enables Non-secure access to coprocessor CP2 + [2:2] + read-write + + + CP1 + Enables Non-secure access to coprocessor CP1 + [1:1] + read-write + + + CP0 + Enables Non-secure access to coprocessor CP0 + [0:0] + read-write + + + + + MPU_TYPE + 0x0000ed90 + The MPU Type Register indicates how many regions the MPU `FTSSS supports + 0x00000800 + + + DREGION + Number of regions supported by the MPU + [15:8] + read-only + + + SEPARATE + Indicates support for separate instructions and data address regions + [0:0] + read-only + + + + + MPU_CTRL + 0x0000ed94 + Enables the MPU and, when the MPU is enabled, controls whether the default memory map is enabled as a background region for privileged accesses, and whether the MPU is enabled for HardFaults, NMIs, and exception handlers when FAULTMASK is set to 1 + 0x00000000 + + + PRIVDEFENA + Controls whether the default memory map is enabled for privileged software + [2:2] + read-write + + + HFNMIENA + Controls whether handlers executing with priority less than 0 access memory with the MPU enabled or disabled. This applies to HardFaults, NMIs, and exception handlers when FAULTMASK is set to 1 + [1:1] + read-write + + + ENABLE + Enables the MPU + [0:0] + read-write + + + + + MPU_RNR + 0x0000ed98 + Selects the region currently accessed by MPU_RBAR and MPU_RLAR + 0x00000000 + + + REGION + Indicates the memory region accessed by MPU_RBAR and MPU_RLAR + [2:0] + read-write + + + + + MPU_RBAR + 0x0000ed9c + Provides indirect read and write access to the base address of the currently selected MPU region `FTSSS + 0x00000000 + + + BASE + Contains bits [31:5] of the lower inclusive limit of the selected MPU memory region. This value is zero extended to provide the base address to be checked against + [31:5] + read-write + + + SH + Defines the Shareability domain of this region for Normal memory + [4:3] + read-write + + + AP + Defines the access permissions for this region + [2:1] + read-write + + + XN + Defines whether code can be executed from this region + [0:0] + read-write + + + + + MPU_RLAR + 0x0000eda0 + Provides indirect read and write access to the limit address of the currently selected MPU region `FTSSS + 0x00000000 + + + LIMIT + Contains bits [31:5] of the upper inclusive limit of the selected MPU memory region. This value is postfixed with 0x1F to provide the limit address to be checked against + [31:5] + read-write + + + ATTRINDX + Associates a set of attributes in the MPU_MAIR0 and MPU_MAIR1 fields + [3:1] + read-write + + + EN + Region enable + [0:0] + read-write + + + + + MPU_RBAR_A1 + 0x0000eda4 + Provides indirect read and write access to the base address of the MPU region selected by MPU_RNR[7:2]:(1[1:0]) `FTSSS + 0x00000000 + + + BASE + Contains bits [31:5] of the lower inclusive limit of the selected MPU memory region. This value is zero extended to provide the base address to be checked against + [31:5] + read-write + + + SH + Defines the Shareability domain of this region for Normal memory + [4:3] + read-write + + + AP + Defines the access permissions for this region + [2:1] + read-write + + + XN + Defines whether code can be executed from this region + [0:0] + read-write + + + + + MPU_RLAR_A1 + 0x0000eda8 + Provides indirect read and write access to the limit address of the currently selected MPU region selected by MPU_RNR[7:2]:(1[1:0]) `FTSSS + 0x00000000 + + + LIMIT + Contains bits [31:5] of the upper inclusive limit of the selected MPU memory region. This value is postfixed with 0x1F to provide the limit address to be checked against + [31:5] + read-write + + + ATTRINDX + Associates a set of attributes in the MPU_MAIR0 and MPU_MAIR1 fields + [3:1] + read-write + + + EN + Region enable + [0:0] + read-write + + + + + MPU_RBAR_A2 + 0x0000edac + Provides indirect read and write access to the base address of the MPU region selected by MPU_RNR[7:2]:(2[1:0]) `FTSSS + 0x00000000 + + + BASE + Contains bits [31:5] of the lower inclusive limit of the selected MPU memory region. This value is zero extended to provide the base address to be checked against + [31:5] + read-write + + + SH + Defines the Shareability domain of this region for Normal memory + [4:3] + read-write + + + AP + Defines the access permissions for this region + [2:1] + read-write + + + XN + Defines whether code can be executed from this region + [0:0] + read-write + + + + + MPU_RLAR_A2 + 0x0000edb0 + Provides indirect read and write access to the limit address of the currently selected MPU region selected by MPU_RNR[7:2]:(2[1:0]) `FTSSS + 0x00000000 + + + LIMIT + Contains bits [31:5] of the upper inclusive limit of the selected MPU memory region. This value is postfixed with 0x1F to provide the limit address to be checked against + [31:5] + read-write + + + ATTRINDX + Associates a set of attributes in the MPU_MAIR0 and MPU_MAIR1 fields + [3:1] + read-write + + + EN + Region enable + [0:0] + read-write + + + + + MPU_RBAR_A3 + 0x0000edb4 + Provides indirect read and write access to the base address of the MPU region selected by MPU_RNR[7:2]:(3[1:0]) `FTSSS + 0x00000000 + + + BASE + Contains bits [31:5] of the lower inclusive limit of the selected MPU memory region. This value is zero extended to provide the base address to be checked against + [31:5] + read-write + + + SH + Defines the Shareability domain of this region for Normal memory + [4:3] + read-write + + + AP + Defines the access permissions for this region + [2:1] + read-write + + + XN + Defines whether code can be executed from this region + [0:0] + read-write + + + + + MPU_RLAR_A3 + 0x0000edb8 + Provides indirect read and write access to the limit address of the currently selected MPU region selected by MPU_RNR[7:2]:(3[1:0]) `FTSSS + 0x00000000 + + + LIMIT + Contains bits [31:5] of the upper inclusive limit of the selected MPU memory region. This value is postfixed with 0x1F to provide the limit address to be checked against + [31:5] + read-write + + + ATTRINDX + Associates a set of attributes in the MPU_MAIR0 and MPU_MAIR1 fields + [3:1] + read-write + + + EN + Region enable + [0:0] + read-write + + + + + MPU_MAIR0 + 0x0000edc0 + Along with MPU_MAIR1, provides the memory attribute encodings corresponding to the AttrIndex values + 0x00000000 + + + ATTR3 + Memory attribute encoding for MPU regions with an AttrIndex of 3 + [31:24] + read-write + + + ATTR2 + Memory attribute encoding for MPU regions with an AttrIndex of 2 + [23:16] + read-write + + + ATTR1 + Memory attribute encoding for MPU regions with an AttrIndex of 1 + [15:8] + read-write + + + ATTR0 + Memory attribute encoding for MPU regions with an AttrIndex of 0 + [7:0] + read-write + + + + + MPU_MAIR1 + 0x0000edc4 + Along with MPU_MAIR0, provides the memory attribute encodings corresponding to the AttrIndex values + 0x00000000 + + + ATTR7 + Memory attribute encoding for MPU regions with an AttrIndex of 7 + [31:24] + read-write + + + ATTR6 + Memory attribute encoding for MPU regions with an AttrIndex of 6 + [23:16] + read-write + + + ATTR5 + Memory attribute encoding for MPU regions with an AttrIndex of 5 + [15:8] + read-write + + + ATTR4 + Memory attribute encoding for MPU regions with an AttrIndex of 4 + [7:0] + read-write + + + + + SAU_CTRL + 0x0000edd0 + Allows enabling of the Security Attribution Unit + 0x00000000 + + + ALLNS + When SAU_CTRL.ENABLE is 0 this bit controls if the memory is marked as Non-secure or Secure + [1:1] + read-write + + + ENABLE + Enables the SAU + [0:0] + read-write + + + + + SAU_TYPE + 0x0000edd4 + Indicates the number of regions implemented by the Security Attribution Unit + 0x00000008 + + + SREGION + The number of implemented SAU regions + [7:0] + read-only + + + + + SAU_RNR + 0x0000edd8 + Selects the region currently accessed by SAU_RBAR and SAU_RLAR + 0x00000000 + + + REGION + Indicates the SAU region accessed by SAU_RBAR and SAU_RLAR + [7:0] + read-write + + + + + SAU_RBAR + 0x0000eddc + Provides indirect read and write access to the base address of the currently selected SAU region + 0x00000000 + + + BADDR + Holds bits [31:5] of the base address for the selected SAU region + [31:5] + read-write + + + + + SAU_RLAR + 0x0000ede0 + Provides indirect read and write access to the limit address of the currently selected SAU region + 0x00000000 + + + LADDR + Holds bits [31:5] of the limit address for the selected SAU region + [31:5] + read-write + + + NSC + Controls whether Non-secure state is permitted to execute an SG instruction from this region + [1:1] + read-write + + + ENABLE + SAU region enable + [0:0] + read-write + + + + + SFSR + 0x0000ede4 + Provides information about any security related faults + 0x00000000 + + + LSERR + Sticky flag indicating that an error occurred during lazy state activation or deactivation + [7:7] + read-write + + + SFARVALID + This bit is set when the SFAR register contains a valid value. As with similar fields, such as BFSR.BFARVALID and MMFSR.MMARVALID, this bit can be cleared by other exceptions, such as BusFault + [6:6] + read-write + + + LSPERR + Stick flag indicating that an SAU or IDAU violation occurred during the lazy preservation of floating-point state + [5:5] + read-write + + + INVTRAN + Sticky flag indicating that an exception was raised due to a branch that was not flagged as being domain crossing causing a transition from Secure to Non-secure memory + [4:4] + read-write + + + AUVIOL + Sticky flag indicating that an attempt was made to access parts of the address space that are marked as Secure with NS-Req for the transaction set to Non-secure. This bit is not set if the violation occurred during lazy state preservation. See LSPERR + [3:3] + read-write + + + INVER + This can be caused by EXC_RETURN.DCRS being set to 0 when returning from an exception in the Non-secure state, or by EXC_RETURN.ES being set to 1 when returning from an exception in the Non-secure state + [2:2] + read-write + + + INVIS + This bit is set if the integrity signature in an exception stack frame is found to be invalid during the unstacking operation + [1:1] + read-write + + + INVEP + This bit is set if a function call from the Non-secure state or exception targets a non-SG instruction in the Secure state. This bit is also set if the target address is a SG instruction, but there is no matching SAU/IDAU region with the NSC flag set + [0:0] + read-write + + + + + SFAR + 0x0000ede8 + Shows the address of the memory location that caused a Security violation + 0x00000000 + + + ADDRESS + The address of an access that caused a attribution unit violation. This field is only valid when SFSR.SFARVALID is set. This allows the actual flip flops associated with this register to be shared with other fault address registers. If an implementation chooses to share the storage in this way, care must be taken to not leak Secure address information to the Non-secure state. One way of achieving this is to share the SFAR register with the MMFAR_S register, which is not accessible to the Non-secure state + [31:0] + read-write + + + + + DHCSR + 0x0000edf0 + Controls halting debug + 0x00000000 + + + S_RESTART_ST + Indicates the PE has processed a request to clear DHCSR.C_HALT to 0. That is, either a write to DHCSR that clears DHCSR.C_HALT from 1 to 0, or an External Restart Request + [26:26] + read-only + + + S_RESET_ST + Indicates whether the PE has been reset since the last read of the DHCSR + [25:25] + read-only + + + S_RETIRE_ST + Set to 1 every time the PE retires one of more instructions + [24:24] + read-only + + + S_SDE + Indicates whether Secure invasive debug is allowed + [20:20] + read-only + + + S_LOCKUP + Indicates whether the PE is in Lockup state + [19:19] + read-only + + + S_SLEEP + Indicates whether the PE is sleeping + [18:18] + read-only + + + S_HALT + Indicates whether the PE is in Debug state + [17:17] + read-only + + + S_REGRDY + Handshake flag to transfers through the DCRDR + [16:16] + read-only + + + C_SNAPSTALL + Allow imprecise entry to Debug state + [5:5] + read-write + + + C_MASKINTS + When debug is enabled, the debugger can write to this bit to mask PendSV, SysTick and external configurable interrupts + [3:3] + read-write + + + C_STEP + Enable single instruction step + [2:2] + read-write + + + C_HALT + PE enter Debug state halt request + [1:1] + read-write + + + C_DEBUGEN + Enable Halting debug + [0:0] + read-write + + + + + DCRSR + 0x0000edf4 + With the DCRDR, provides debug access to the general-purpose registers, special-purpose registers, and the FP extension registers. A write to the DCRSR specifies the register to transfer, whether the transfer is a read or write, and starts the transfer + 0x00000000 + + + REGWNR + Specifies the access type for the transfer + [16:16] + read-write + + + REGSEL + Specifies the general-purpose register, special-purpose register, or FP register to transfer + [6:0] + read-write + + + + + DCRDR + 0x0000edf8 + With the DCRSR, provides debug access to the general-purpose registers, special-purpose registers, and the FP Extension registers. If the Main Extension is implemented, it can also be used for message passing between an external debugger and a debug agent running on the PE + 0x00000000 + + + DBGTMP + Provides debug access for reading and writing the general-purpose registers, special-purpose registers, and Floating-point Extension registers + [31:0] + read-write + + + + + DEMCR + 0x0000edfc + Manages vector catch behavior and DebugMonitor handling when debugging + 0x00000000 + + + TRCENA + Global enable for all DWT and ITM features + [24:24] + read-write + + + SDME + Indicates whether the DebugMonitor targets the Secure or the Non-secure state and whether debug events are allowed in Secure state + [20:20] + read-only + + + MON_REQ + DebugMonitor semaphore bit + [19:19] + read-write + + + MON_STEP + Enable DebugMonitor stepping + [18:18] + read-write + + + MON_PEND + Sets or clears the pending state of the DebugMonitor exception + [17:17] + read-write + + + MON_EN + Enable the DebugMonitor exception + [16:16] + read-write + + + VC_SFERR + SecureFault exception halting debug vector catch enable + [11:11] + read-write + + + VC_HARDERR + HardFault exception halting debug vector catch enable + [10:10] + read-write + + + VC_INTERR + Enable halting debug vector catch for faults during exception entry and return + [9:9] + read-write + + + VC_BUSERR + BusFault exception halting debug vector catch enable + [8:8] + read-write + + + VC_STATERR + Enable halting debug trap on a UsageFault exception caused by a state information error, for example an Undefined Instruction exception + [7:7] + read-write + + + VC_CHKERR + Enable halting debug trap on a UsageFault exception caused by a checking error, for example an alignment check error + [6:6] + read-write + + + VC_NOCPERR + Enable halting debug trap on a UsageFault caused by an access to a coprocessor + [5:5] + read-write + + + VC_MMERR + Enable halting debug trap on a MemManage exception + [4:4] + read-write + + + VC_CORERESET + Enable Reset Vector Catch. This causes a warm reset to halt a running system + [0:0] + read-write + + + + + DSCSR + 0x0000ee08 + Provides control and status information for Secure debug + 0x00000000 + + + CDSKEY + Writes to the CDS bit are ignored unless CDSKEY is concurrently written to zero + [17:17] + read-write + + + CDS + This field indicates the current Security state of the processor + [16:16] + read-write + + + SBRSEL + If SBRSELEN is 1 this bit selects whether the Non-secure or the Secure version of the memory-mapped Banked registers are accessible to the debugger + [1:1] + read-write + + + SBRSELEN + Controls whether the SBRSEL field or the current Security state of the processor selects which version of the memory-mapped Banked registers are accessed to the debugger + [0:0] + read-write + + + + + STIR + 0x0000ef00 + Provides a mechanism for software to generate an interrupt + 0x00000000 + + + INTID + Indicates the interrupt to be pended. The value written is (ExceptionNumber - 16) + [8:0] + read-write + + + + + FPCCR + 0x0000ef34 + Holds control data for the Floating-point extension + 0x20000472 + + + ASPEN + When this bit is set to 1, execution of a floating-point instruction sets the CONTROL.FPCA bit to 1 + [31:31] + read-write + + + LSPEN + Enables lazy context save of floating-point state + [30:30] + read-write + + + LSPENS + This bit controls whether the LSPEN bit is writeable from the Non-secure state + [29:29] + read-write + + + CLRONRET + Clear floating-point caller saved registers on exception return + [28:28] + read-write + + + CLRONRETS + This bit controls whether the CLRONRET bit is writeable from the Non-secure state + [27:27] + read-write + + + TS + Treat floating-point registers as Secure enable + [26:26] + read-write + + + UFRDY + Indicates whether the software executing when the PE allocated the floating-point stack frame was able to set the UsageFault exception to pending + [10:10] + read-write + + + SPLIMVIOL + This bit is banked between the Security states and indicates whether the floating-point context violates the stack pointer limit that was active when lazy state preservation was activated. SPLIMVIOL modifies the lazy floating-point state preservation behavior + [9:9] + read-write + + + MONRDY + Indicates whether the software executing when the PE allocated the floating-point stack frame was able to set the DebugMonitor exception to pending + [8:8] + read-write + + + SFRDY + Indicates whether the software executing when the PE allocated the floating-point stack frame was able to set the SecureFault exception to pending. This bit is only present in the Secure version of the register, and behaves as RAZ/WI when accessed from the Non-secure state + [7:7] + read-write + + + BFRDY + Indicates whether the software executing when the PE allocated the floating-point stack frame was able to set the BusFault exception to pending + [6:6] + read-write + + + MMRDY + Indicates whether the software executing when the PE allocated the floating-point stack frame was able to set the MemManage exception to pending + [5:5] + read-write + + + HFRDY + Indicates whether the software executing when the PE allocated the floating-point stack frame was able to set the HardFault exception to pending + [4:4] + read-write + + + THREAD + Indicates the PE mode when it allocated the floating-point stack frame + [3:3] + read-write + + + S + Security status of the floating-point context. This bit is only present in the Secure version of the register, and behaves as RAZ/WI when accessed from the Non-secure state. This bit is updated whenever lazy state preservation is activated, or when a floating-point instruction is executed + [2:2] + read-write + + + USER + Indicates the privilege level of the software executing when the PE allocated the floating-point stack frame + [1:1] + read-write + + + LSPACT + Indicates whether lazy preservation of the floating-point state is active + [0:0] + read-write + + + + + FPCAR + 0x0000ef38 + Holds the location of the unpopulated floating-point register space allocated on an exception stack frame + 0x00000000 + + + ADDRESS + The location of the unpopulated floating-point register space allocated on an exception stack frame + [31:3] + read-write + + + + + FPDSCR + 0x0000ef3c + Holds the default values for the floating-point status control data that the PE assigns to the FPSCR when it creates a new floating-point context + 0x00000000 + + + AHP + Default value for FPSCR.AHP + [26:26] + read-write + + + DN + Default value for FPSCR.DN + [25:25] + read-write + + + FZ + Default value for FPSCR.FZ + [24:24] + read-write + + + RMODE + Default value for FPSCR.RMode + [23:22] + read-write + + + + + MVFR0 + 0x0000ef40 + Describes the features provided by the Floating-point Extension + 0x60540601 + + + FPROUND + Indicates the rounding modes supported by the FP Extension + [31:28] + read-only + + + FPSQRT + Indicates the support for FP square root operations + [23:20] + read-only + + + FPDIVIDE + Indicates the support for FP divide operations + [19:16] + read-only + + + FPDP + Indicates support for FP double-precision operations + [11:8] + read-only + + + FPSP + Indicates support for FP single-precision operations + [7:4] + read-only + + + SIMDREG + Indicates size of FP register file + [3:0] + read-only + + + + + MVFR1 + 0x0000ef44 + Describes the features provided by the Floating-point Extension + 0x85000089 + + + FMAC + Indicates whether the FP Extension implements the fused multiply accumulate instructions + [31:28] + read-only + + + FPHP + Indicates whether the FP Extension implements half-precision FP conversion instructions + [27:24] + read-only + + + FPDNAN + Indicates whether the FP hardware implementation supports NaN propagation + [7:4] + read-only + + + FPFTZ + Indicates whether subnormals are always flushed-to-zero + [3:0] + read-only + + + + + MVFR2 + 0x0000ef48 + Describes the features provided by the Floating-point Extension + 0x00000060 + + + FPMISC + Indicates support for miscellaneous FP features + [7:4] + read-only + + + + + DDEVARCH + 0x0000efbc + Provides CoreSight discovery information for the SCS + 0x47702a04 + + + ARCHITECT + Defines the architect of the component. Bits [31:28] are the JEP106 continuation code (JEP106 bank ID, minus 1) and bits [27:21] are the JEP106 ID code. + [31:21] + read-only + + + PRESENT + Defines that the DEVARCH register is present + [20:20] + read-only + + + REVISION + Defines the architecture revision of the component + [19:16] + read-only + + + ARCHVER + Defines the architecture version of the component + [15:12] + read-only + + + ARCHPART + Defines the architecture of the component + [11:0] + read-only + + + + + DDEVTYPE + 0x0000efcc + Provides CoreSight discovery information for the SCS + 0x00000000 + + + SUB + Component sub-type + [7:4] + read-only + + + MAJOR + CoreSight major type + [3:0] + read-only + + + + + DPIDR4 + 0x0000efd0 + Provides CoreSight discovery information for the SCS + 0x00000004 + + + SIZE + See CoreSight Architecture Specification + [7:4] + read-only + + + DES_2 + See CoreSight Architecture Specification + [3:0] + read-only + + + + + DPIDR5 + 0x0000efd4 + Provides CoreSight discovery information for the SCS + 0x00000000 + + + DPIDR5 + [31:0] + read-write + + + + + DPIDR6 + 0x0000efd8 + Provides CoreSight discovery information for the SCS + 0x00000000 + + + DPIDR6 + [31:0] + read-write + + + + + DPIDR7 + 0x0000efdc + Provides CoreSight discovery information for the SCS + 0x00000000 + + + DPIDR7 + [31:0] + read-write + + + + + DPIDR0 + 0x0000efe0 + Provides CoreSight discovery information for the SCS + 0x00000021 + + + PART_0 + See CoreSight Architecture Specification + [7:0] + read-only + + + + + DPIDR1 + 0x0000efe4 + Provides CoreSight discovery information for the SCS + 0x000000bd + + + DES_0 + See CoreSight Architecture Specification + [7:4] + read-only + + + PART_1 + See CoreSight Architecture Specification + [3:0] + read-only + + + + + DPIDR2 + 0x0000efe8 + Provides CoreSight discovery information for the SCS + 0x0000000b + + + REVISION + See CoreSight Architecture Specification + [7:4] + read-only + + + JEDEC + See CoreSight Architecture Specification + [3:3] + read-only + + + DES_1 + See CoreSight Architecture Specification + [2:0] + read-only + + + + + DPIDR3 + 0x0000efec + Provides CoreSight discovery information for the SCS + 0x00000000 + + + REVAND + See CoreSight Architecture Specification + [7:4] + read-only + + + CMOD + See CoreSight Architecture Specification + [3:0] + read-only + + + + + DCIDR0 + 0x0000eff0 + Provides CoreSight discovery information for the SCS + 0x0000000d + + + PRMBL_0 + See CoreSight Architecture Specification + [7:0] + read-only + + + + + DCIDR1 + 0x0000eff4 + Provides CoreSight discovery information for the SCS + 0x00000090 + + + CLASS + See CoreSight Architecture Specification + [7:4] + read-only + + + PRMBL_1 + See CoreSight Architecture Specification + [3:0] + read-only + + + + + DCIDR2 + 0x0000eff8 + Provides CoreSight discovery information for the SCS + 0x00000005 + + + PRMBL_2 + See CoreSight Architecture Specification + [7:0] + read-only + + + + + DCIDR3 + 0x0000effc + Provides CoreSight discovery information for the SCS + 0x000000b1 + + + PRMBL_3 + See CoreSight Architecture Specification + [7:0] + read-only + + + + + TRCPRGCTLR + 0x00041004 + Programming Control Register + 0x00000000 + + + EN + Trace Unit Enable + [0:0] + read-write + + + + + TRCSTATR + 0x0004100c + The TRCSTATR indicates the ETM-Teal status + 0x00000000 + + + PMSTABLE + Indicates whether the ETM-Teal registers are stable and can be read + [1:1] + read-only + + + IDLE + Indicates that the trace unit is inactive + [0:0] + read-only + + + + + TRCCONFIGR + 0x00041010 + The TRCCONFIGR sets the basic tracing options for the trace unit + 0x00000000 + + + RS + Return stack enable + [12:12] + read-write + + + TS + Global timestamp tracing + [11:11] + read-write + + + COND + Conditional instruction tracing + [10:5] + read-write + + + CCI + Cycle counting in instruction trace + [4:4] + read-write + + + BB + Branch broadcast mode + [3:3] + read-write + + + + + TRCEVENTCTL0R + 0x00041020 + The TRCEVENTCTL0R controls the tracing of events in the trace stream. The events also drive the ETM-Teal external outputs. + 0x00000000 + + + TYPE1 + Selects the resource type for event 1 + [15:15] + read-write + + + SEL1 + Selects the resource number, based on the value of TYPE1: When TYPE1 is 0, selects a single selected resource from 0-15 defined by SEL1[2:0]. When TYPE1 is 1, selects a Boolean combined resource pair from 0-7 defined by SEL1[2:0] + [10:8] + read-write + + + TYPE0 + Selects the resource type for event 0 + [7:7] + read-write + + + SEL0 + Selects the resource number, based on the value of TYPE0: When TYPE1 is 0, selects a single selected resource from 0-15 defined by SEL0[2:0]. When TYPE1 is 1, selects a Boolean combined resource pair from 0-7 defined by SEL0[2:0] + [2:0] + read-write + + + + + TRCEVENTCTL1R + 0x00041024 + The TRCEVENTCTL1R controls how the events selected by TRCEVENTCTL0R behave + 0x00000000 + + + LPOVERRIDE + Low power state behavior override + [12:12] + read-write + + + ATB + ATB enabled + [11:11] + read-write + + + INSTEN1 + One bit per event, to enable generation of an event element in the instruction trace stream when the selected event occurs + [1:1] + read-write + + + INSTEN0 + One bit per event, to enable generation of an event element in the instruction trace stream when the selected event occurs + [0:0] + read-write + + + + + TRCSTALLCTLR + 0x0004102c + The TRCSTALLCTLR enables ETM-Teal to stall the processor if the ETM-Teal FIFO goes over the programmed level to minimize risk of overflow + 0x00000000 + + + INSTPRIORITY + Reserved, RES0 + [10:10] + read-only + + + ISTALL + Stall processor based on instruction trace buffer space + [8:8] + read-write + + + LEVEL + Threshold at which stalling becomes active. This provides four levels. This level can be varied to optimize the level of invasion caused by stalling, balanced against the risk of a FIFO overflow + [3:2] + read-write + + + + + TRCTSCTLR + 0x00041030 + The TRCTSCTLR controls the insertion of global timestamps into the trace stream. A timestamp is always inserted into the instruction trace stream + 0x00000000 + + + TYPE0 + Selects the resource type for event 0 + [7:7] + read-write + + + SEL0 + Selects the resource number, based on the value of TYPE0: When TYPE1 is 0, selects a single selected resource from 0-15 defined by SEL0[2:0]. When TYPE1 is 1, selects a Boolean combined resource pair from 0-7 defined by SEL0[2:0] + [1:0] + read-write + + + + + TRCSYNCPR + 0x00041034 + The TRCSYNCPR specifies the period of trace synchronization of the trace streams. TRCSYNCPR defines a number of bytes of trace between requests for trace synchronization. This value is always a power of two + 0x0000000a + + + PERIOD + Defines the number of bytes of trace between trace synchronization requests as a total of the number of bytes generated by the instruction stream. The number of bytes is 2N where N is the value of this field: - A value of zero disables these periodic trace synchronization requests, but does not disable other trace synchronization requests. - The minimum value that can be programmed, other than zero, is 8, providing a minimum trace synchronization period of 256 bytes. - The maximum value is 20, providing a maximum trace synchronization period of 2^20 bytes + [4:0] + read-only + + + + + TRCCCCTLR + 0x00041038 + The TRCCCCTLR sets the threshold value for instruction trace cycle counting. The threshold represents the minimum interval between cycle count trace packets + 0x00000000 + + + THRESHOLD + Instruction trace cycle count threshold + [11:0] + read-write + + + + + TRCVICTLR + 0x00041080 + The TRCVICTLR controls instruction trace filtering + 0x00000000 + + + EXLEVEL_S3 + In Secure state, each bit controls whether instruction tracing is enabled for the corresponding exception level + [19:19] + read-write + + + EXLEVEL_S0 + In Secure state, each bit controls whether instruction tracing is enabled for the corresponding exception level + [16:16] + read-write + + + TRCERR + Selects whether a system error exception must always be traced + [11:11] + read-write + + + TRCRESET + Selects whether a reset exception must always be traced + [10:10] + read-write + + + SSSTATUS + Indicates the current status of the start/stop logic + [9:9] + read-write + + + TYPE0 + Selects the resource type for event 0 + [7:7] + read-write + + + SEL0 + Selects the resource number, based on the value of TYPE0: When TYPE1 is 0, selects a single selected resource from 0-15 defined by SEL0[2:0]. When TYPE1 is 1, selects a Boolean combined resource pair from 0-7 defined by SEL0[2:0] + [1:0] + read-write + + + + + TRCCNTRLDVR0 + 0x00041140 + The TRCCNTRLDVR defines the reload value for the reduced function counter + 0x00000000 + + + VALUE + Defines the reload value for the counter. This value is loaded into the counter each time the reload event occurs + [15:0] + read-write + + + + + TRCIDR8 + 0x00041180 + TRCIDR8 + 0x00000000 + + + MAXSPEC + reads as `ImpDef + [31:0] + read-only + + + + + TRCIDR9 + 0x00041184 + TRCIDR9 + 0x00000000 + + + NUMP0KEY + reads as `ImpDef + [31:0] + read-only + + + + + TRCIDR10 + 0x00041188 + TRCIDR10 + 0x00000000 + + + NUMP1KEY + reads as `ImpDef + [31:0] + read-only + + + + + TRCIDR11 + 0x0004118c + TRCIDR11 + 0x00000000 + + + NUMP1SPC + reads as `ImpDef + [31:0] + read-only + + + + + TRCIDR12 + 0x00041190 + TRCIDR12 + 0x00000001 + + + NUMCONDKEY + reads as `ImpDef + [31:0] + read-only + + + + + TRCIDR13 + 0x00041194 + TRCIDR13 + 0x00000000 + + + NUMCONDSPC + reads as `ImpDef + [31:0] + read-only + + + + + TRCIMSPEC + 0x000411c0 + The TRCIMSPEC shows the presence of any IMPLEMENTATION SPECIFIC features, and enables any features that are provided + 0x00000000 + + + SUPPORT + Reserved, RES0 + [3:0] + read-only + + + + + TRCIDR0 + 0x000411e0 + TRCIDR0 + 0x280006e1 + + + COMMOPT + reads as `ImpDef + [29:29] + read-only + + + TSSIZE + reads as `ImpDef + [28:24] + read-only + + + TRCEXDATA + reads as `ImpDef + [17:17] + read-only + + + QSUPP + reads as `ImpDef + [16:15] + read-only + + + QFILT + reads as `ImpDef + [14:14] + read-only + + + CONDTYPE + reads as `ImpDef + [13:12] + read-only + + + NUMEVENT + reads as `ImpDef + [11:10] + read-only + + + RETSTACK + reads as `ImpDef + [9:9] + read-only + + + TRCCCI + reads as `ImpDef + [7:7] + read-only + + + TRCCOND + reads as `ImpDef + [6:6] + read-only + + + TRCBB + reads as `ImpDef + [5:5] + read-only + + + TRCDATA + reads as `ImpDef + [4:3] + read-only + + + INSTP0 + reads as `ImpDef + [2:1] + read-only + + + RES1 + Reserved, RES1 + [0:0] + read-only + + + + + TRCIDR1 + 0x000411e4 + TRCIDR1 + 0x4100f421 + + + DESIGNER + reads as `ImpDef + [31:24] + read-only + + + RES1 + Reserved, RES1 + [15:12] + read-only + + + TRCARCHMAJ + reads as 0b0100 + [11:8] + read-only + + + TRCARCHMIN + reads as 0b0000 + [7:4] + read-only + + + REVISION + reads as `ImpDef + [3:0] + read-only + + + + + TRCIDR2 + 0x000411e8 + TRCIDR2 + 0x00000004 + + + CCSIZE + reads as `ImpDef + [28:25] + read-only + + + DVSIZE + reads as `ImpDef + [24:20] + read-only + + + DASIZE + reads as `ImpDef + [19:15] + read-only + + + VMIDSIZE + reads as `ImpDef + [14:10] + read-only + + + CIDSIZE + reads as `ImpDef + [9:5] + read-only + + + IASIZE + reads as `ImpDef + [4:0] + read-only + + + + + TRCIDR3 + 0x000411ec + TRCIDR3 + 0x0f090004 + + + NOOVERFLOW + reads as `ImpDef + [31:31] + read-only + + + NUMPROC + reads as `ImpDef + [30:28] + read-only + + + SYSSTALL + reads as `ImpDef + [27:27] + read-only + + + STALLCTL + reads as `ImpDef + [26:26] + read-only + + + SYNCPR + reads as `ImpDef + [25:25] + read-only + + + TRCERR + reads as `ImpDef + [24:24] + read-only + + + EXLEVEL_NS + reads as `ImpDef + [23:20] + read-only + + + EXLEVEL_S + reads as `ImpDef + [19:16] + read-only + + + CCITMIN + reads as `ImpDef + [11:0] + read-only + + + + + TRCIDR4 + 0x000411f0 + TRCIDR4 + 0x00114000 + + + NUMVMIDC + reads as `ImpDef + [31:28] + read-only + + + NUMCIDC + reads as `ImpDef + [27:24] + read-only + + + NUMSSCC + reads as `ImpDef + [23:20] + read-only + + + NUMRSPAIR + reads as `ImpDef + [19:16] + read-only + + + NUMPC + reads as `ImpDef + [15:12] + read-only + + + SUPPDAC + reads as `ImpDef + [8:8] + read-only + + + NUMDVC + reads as `ImpDef + [7:4] + read-only + + + NUMACPAIRS + reads as `ImpDef + [3:0] + read-only + + + + + TRCIDR5 + 0x000411f4 + TRCIDR5 + 0x90c70004 + + + REDFUNCNTR + reads as `ImpDef + [31:31] + read-only + + + NUMCNTR + reads as `ImpDef + [30:28] + read-only + + + NUMSEQSTATE + reads as `ImpDef + [27:25] + read-only + + + LPOVERRIDE + reads as `ImpDef + [23:23] + read-only + + + ATBTRIG + reads as `ImpDef + [22:22] + read-only + + + TRACEIDSIZE + reads as 0x07 + [21:16] + read-only + + + NUMEXTINSEL + reads as `ImpDef + [11:9] + read-only + + + NUMEXTIN + reads as `ImpDef + [8:0] + read-only + + + + + TRCIDR6 + 0x000411f8 + TRCIDR6 + 0x00000000 + + + TRCIDR6 + [31:0] + read-write + + + + + TRCIDR7 + 0x000411fc + TRCIDR7 + 0x00000000 + + + TRCIDR7 + [31:0] + read-write + + + + + TRCRSCTLR2 + 0x00041208 + The TRCRSCTLR controls the trace resources + 0x00000000 + + + PAIRINV + Inverts the result of a combined pair of resources. This bit is only implemented on the lower register for a pair of resource selectors + [21:21] + read-write + + + INV + Inverts the selected resources + [20:20] + read-write + + + GROUP + Selects a group of resource + [18:16] + read-write + + + SELECT + Selects one or more resources from the wanted group. One bit is provided per resource from the group + [7:0] + read-write + + + + + TRCRSCTLR3 + 0x0004120c + The TRCRSCTLR controls the trace resources + 0x00000000 + + + PAIRINV + Inverts the result of a combined pair of resources. This bit is only implemented on the lower register for a pair of resource selectors + [21:21] + read-write + + + INV + Inverts the selected resources + [20:20] + read-write + + + GROUP + Selects a group of resource + [18:16] + read-write + + + SELECT + Selects one or more resources from the wanted group. One bit is provided per resource from the group + [7:0] + read-write + + + + + TRCSSCSR + 0x000412a0 + Controls the corresponding single-shot comparator resource + 0x00000000 + + + STATUS + Single-shot status bit. Indicates if any of the comparators, that TRCSSCCRn.SAC or TRCSSCCRn.ARC selects, have matched + [31:31] + read-write + + + PC + Reserved, RES1 + [3:3] + read-only + + + DV + Reserved, RES0 + [2:2] + read-only + + + DA + Reserved, RES0 + [1:1] + read-only + + + INST + Reserved, RES0 + [0:0] + read-only + + + + + TRCSSPCICR + 0x000412c0 + Selects the PE comparator inputs for Single-shot control + 0x00000000 + + + PC + Selects one or more PE comparator inputs for Single-shot control. TRCIDR4.NUMPC defines the size of the PC field. 1 bit is provided for each implemented PE comparator input. For example, if bit[1] == 1 this selects PE comparator input 1 for Single-shot control + [3:0] + read-write + + + + + TRCPDCR + 0x00041310 + Requests the system to provide power to the trace unit + 0x00000000 + + + PU + Powerup request bit: + [3:3] + read-write + + + + + TRCPDSR + 0x00041314 + Returns the following information about the trace unit: - OS Lock status. - Core power domain status. - Power interruption status + 0x00000003 + + + OSLK + OS Lock status bit: + [5:5] + read-only + + + STICKYPD + Sticky powerdown status bit. Indicates whether the trace register state is valid: + [1:1] + read-only + + + POWER + Power status bit: + [0:0] + read-only + + + + + TRCITATBIDR + 0x00041ee4 + Trace Integration ATB Identification Register + 0x00000000 + + + ID + Trace ID + [6:0] + read-write + + + + + TRCITIATBINR + 0x00041ef4 + Trace Integration Instruction ATB In Register + 0x00000000 + + + AFVALIDM + Integration Mode instruction AFVALIDM in + [1:1] + read-write + + + ATREADYM + Integration Mode instruction ATREADYM in + [0:0] + read-write + + + + + TRCITIATBOUTR + 0x00041efc + Trace Integration Instruction ATB Out Register + 0x00000000 + + + AFREADY + Integration Mode instruction AFREADY out + [1:1] + read-write + + + ATVALID + Integration Mode instruction ATVALID out + [0:0] + read-write + + + + + TRCCLAIMSET + 0x00041fa0 + Claim Tag Set Register + 0x0000000f + + + SET3 + When a write to one of these bits occurs, with the value: + [3:3] + read-write + + + SET2 + When a write to one of these bits occurs, with the value: + [2:2] + read-write + + + SET1 + When a write to one of these bits occurs, with the value: + [1:1] + read-write + + + SET0 + When a write to one of these bits occurs, with the value: + [0:0] + read-write + + + + + TRCCLAIMCLR + 0x00041fa4 + Claim Tag Clear Register + 0x00000000 + + + CLR3 + When a write to one of these bits occurs, with the value: + [3:3] + read-write + + + CLR2 + When a write to one of these bits occurs, with the value: + [2:2] + read-write + + + CLR1 + When a write to one of these bits occurs, with the value: + [1:1] + read-write + + + CLR0 + When a write to one of these bits occurs, with the value: + [0:0] + read-write + + + + + TRCAUTHSTATUS + 0x00041fb8 + Returns the level of tracing that the trace unit can support + 0x00000000 + + + SNID + Indicates whether the system enables the trace unit to support Secure non-invasive debug: + [7:6] + read-only + + + SID + Indicates whether the trace unit supports Secure invasive debug: + [5:4] + read-only + + + NSNID + Indicates whether the system enables the trace unit to support Non-secure non-invasive debug: + [3:2] + read-only + + + NSID + Indicates whether the trace unit supports Non-secure invasive debug: + [1:0] + read-only + + + + + TRCDEVARCH + 0x00041fbc + TRCDEVARCH + 0x47724a13 + + + ARCHITECT + reads as 0b01000111011 + [31:21] + read-only + + + PRESENT + reads as 0b1 + [20:20] + read-only + + + REVISION + reads as 0b0000 + [19:16] + read-only + + + ARCHID + reads as 0b0100101000010011 + [15:0] + read-only + + + + + TRCDEVID + 0x00041fc8 + TRCDEVID + 0x00000000 + + + TRCDEVID + [31:0] + read-write + + + + + TRCDEVTYPE + 0x00041fcc + TRCDEVTYPE + 0x00000013 + + + SUB + reads as 0b0001 + [7:4] + read-only + + + MAJOR + reads as 0b0011 + [3:0] + read-only + + + + + TRCPIDR4 + 0x00041fd0 + TRCPIDR4 + 0x00000004 + + + SIZE + reads as `ImpDef + [7:4] + read-only + + + DES_2 + reads as `ImpDef + [3:0] + read-only + + + + + TRCPIDR5 + 0x00041fd4 + TRCPIDR5 + 0x00000000 + + + TRCPIDR5 + [31:0] + read-write + + + + + TRCPIDR6 + 0x00041fd8 + TRCPIDR6 + 0x00000000 + + + TRCPIDR6 + [31:0] + read-write + + + + + TRCPIDR7 + 0x00041fdc + TRCPIDR7 + 0x00000000 + + + TRCPIDR7 + [31:0] + read-write + + + + + TRCPIDR0 + 0x00041fe0 + TRCPIDR0 + 0x00000021 + + + PART_0 + reads as `ImpDef + [7:0] + read-only + + + + + TRCPIDR1 + 0x00041fe4 + TRCPIDR1 + 0x000000bd + + + DES_0 + reads as `ImpDef + [7:4] + read-only + + + PART_0 + reads as `ImpDef + [3:0] + read-only + + + + + TRCPIDR2 + 0x00041fe8 + TRCPIDR2 + 0x0000002b + + + REVISION + reads as `ImpDef + [7:4] + read-only + + + JEDEC + reads as 0b1 + [3:3] + read-only + + + DES_0 + reads as `ImpDef + [2:0] + read-only + + + + + TRCPIDR3 + 0x00041fec + TRCPIDR3 + 0x00000000 + + + REVAND + reads as `ImpDef + [7:4] + read-only + + + CMOD + reads as `ImpDef + [3:0] + read-only + + + + + TRCCIDR0 + 0x00041ff0 + TRCCIDR0 + 0x0000000d + + + PRMBL_0 + reads as 0b00001101 + [7:0] + read-only + + + + + TRCCIDR1 + 0x00041ff4 + TRCCIDR1 + 0x00000090 + + + CLASS + reads as 0b1001 + [7:4] + read-only + + + PRMBL_1 + reads as 0b0000 + [3:0] + read-only + + + + + TRCCIDR2 + 0x00041ff8 + TRCCIDR2 + 0x00000005 + + + PRMBL_2 + reads as 0b00000101 + [7:0] + read-only + + + + + TRCCIDR3 + 0x00041ffc + TRCCIDR3 + 0x000000b1 + + + PRMBL_3 + reads as 0b10110001 + [7:0] + read-only + + + + + CTICONTROL + 0x00042000 + CTI Control Register + 0x00000000 + + + GLBEN + Enables or disables the CTI + [0:0] + read-write + + + + + CTIINTACK + 0x00042010 + CTI Interrupt Acknowledge Register + 0x00000000 + + + INTACK + Acknowledges the corresponding ctitrigout output. There is one bit of the register for each ctitrigout output. When a 1 is written to a bit in this register, the corresponding ctitrigout is acknowledged, causing it to be cleared. + [7:0] + read-write + + + + + CTIAPPSET + 0x00042014 + CTI Application Trigger Set Register + 0x00000000 + + + APPSET + Setting a bit HIGH generates a channel event for the selected channel. There is one bit of the register for each channel + [3:0] + read-write + + + + + CTIAPPCLEAR + 0x00042018 + CTI Application Trigger Clear Register + 0x00000000 + + + APPCLEAR + Sets the corresponding bits in the CTIAPPSET to 0. There is one bit of the register for each channel. + [3:0] + read-write + + + + + CTIAPPPULSE + 0x0004201c + CTI Application Pulse Register + 0x00000000 + + + APPULSE + Setting a bit HIGH generates a channel event pulse for the selected channel. There is one bit of the register for each channel. + [3:0] + read-write + + + + + CTIINEN0 + 0x00042020 + CTI Trigger to Channel Enable Registers + 0x00000000 + + + TRIGINEN + Enables a cross trigger event to the corresponding channel when a ctitrigin input is activated. There is one bit of the field for each of the four channels + [3:0] + read-write + + + + + CTIINEN1 + 0x00042024 + CTI Trigger to Channel Enable Registers + 0x00000000 + + + TRIGINEN + Enables a cross trigger event to the corresponding channel when a ctitrigin input is activated. There is one bit of the field for each of the four channels + [3:0] + read-write + + + + + CTIINEN2 + 0x00042028 + CTI Trigger to Channel Enable Registers + 0x00000000 + + + TRIGINEN + Enables a cross trigger event to the corresponding channel when a ctitrigin input is activated. There is one bit of the field for each of the four channels + [3:0] + read-write + + + + + CTIINEN3 + 0x0004202c + CTI Trigger to Channel Enable Registers + 0x00000000 + + + TRIGINEN + Enables a cross trigger event to the corresponding channel when a ctitrigin input is activated. There is one bit of the field for each of the four channels + [3:0] + read-write + + + + + CTIINEN4 + 0x00042030 + CTI Trigger to Channel Enable Registers + 0x00000000 + + + TRIGINEN + Enables a cross trigger event to the corresponding channel when a ctitrigin input is activated. There is one bit of the field for each of the four channels + [3:0] + read-write + + + + + CTIINEN5 + 0x00042034 + CTI Trigger to Channel Enable Registers + 0x00000000 + + + TRIGINEN + Enables a cross trigger event to the corresponding channel when a ctitrigin input is activated. There is one bit of the field for each of the four channels + [3:0] + read-write + + + + + CTIINEN6 + 0x00042038 + CTI Trigger to Channel Enable Registers + 0x00000000 + + + TRIGINEN + Enables a cross trigger event to the corresponding channel when a ctitrigin input is activated. There is one bit of the field for each of the four channels + [3:0] + read-write + + + + + CTIINEN7 + 0x0004203c + CTI Trigger to Channel Enable Registers + 0x00000000 + + + TRIGINEN + Enables a cross trigger event to the corresponding channel when a ctitrigin input is activated. There is one bit of the field for each of the four channels + [3:0] + read-write + + + + + CTIOUTEN0 + 0x000420a0 + CTI Trigger to Channel Enable Registers + 0x00000000 + + + TRIGOUTEN + Enables a cross trigger event to ctitrigout when the corresponding channel is activated. There is one bit of the field for each of the four channels. + [3:0] + read-write + + + + + CTIOUTEN1 + 0x000420a4 + CTI Trigger to Channel Enable Registers + 0x00000000 + + + TRIGOUTEN + Enables a cross trigger event to ctitrigout when the corresponding channel is activated. There is one bit of the field for each of the four channels. + [3:0] + read-write + + + + + CTIOUTEN2 + 0x000420a8 + CTI Trigger to Channel Enable Registers + 0x00000000 + + + TRIGOUTEN + Enables a cross trigger event to ctitrigout when the corresponding channel is activated. There is one bit of the field for each of the four channels. + [3:0] + read-write + + + + + CTIOUTEN3 + 0x000420ac + CTI Trigger to Channel Enable Registers + 0x00000000 + + + TRIGOUTEN + Enables a cross trigger event to ctitrigout when the corresponding channel is activated. There is one bit of the field for each of the four channels. + [3:0] + read-write + + + + + CTIOUTEN4 + 0x000420b0 + CTI Trigger to Channel Enable Registers + 0x00000000 + + + TRIGOUTEN + Enables a cross trigger event to ctitrigout when the corresponding channel is activated. There is one bit of the field for each of the four channels. + [3:0] + read-write + + + + + CTIOUTEN5 + 0x000420b4 + CTI Trigger to Channel Enable Registers + 0x00000000 + + + TRIGOUTEN + Enables a cross trigger event to ctitrigout when the corresponding channel is activated. There is one bit of the field for each of the four channels. + [3:0] + read-write + + + + + CTIOUTEN6 + 0x000420b8 + CTI Trigger to Channel Enable Registers + 0x00000000 + + + TRIGOUTEN + Enables a cross trigger event to ctitrigout when the corresponding channel is activated. There is one bit of the field for each of the four channels. + [3:0] + read-write + + + + + CTIOUTEN7 + 0x000420bc + CTI Trigger to Channel Enable Registers + 0x00000000 + + + TRIGOUTEN + Enables a cross trigger event to ctitrigout when the corresponding channel is activated. There is one bit of the field for each of the four channels. + [3:0] + read-write + + + + + CTITRIGINSTATUS + 0x00042130 + CTI Trigger to Channel Enable Registers + 0x00000000 + + + TRIGINSTATUS + Shows the status of the ctitrigin inputs. There is one bit of the field for each trigger input.Because the register provides a view of the raw ctitrigin inputs, the reset value is UNKNOWN. + [7:0] + read-only + + + + + CTITRIGOUTSTATUS + 0x00042134 + CTI Trigger In Status Register + 0x00000000 + + + TRIGOUTSTATUS + Shows the status of the ctitrigout outputs. There is one bit of the field for each trigger output. + [7:0] + read-only + + + + + CTICHINSTATUS + 0x00042138 + CTI Channel In Status Register + 0x00000000 + + + CTICHOUTSTATUS + Shows the status of the ctichout outputs. There is one bit of the field for each channel output + [3:0] + read-only + + + + + CTIGATE + 0x00042140 + Enable CTI Channel Gate register + 0x0000000f + + + CTIGATEEN3 + Enable ctichout3. Set to 0 to disable channel propagation. + [3:3] + read-write + + + CTIGATEEN2 + Enable ctichout2. Set to 0 to disable channel propagation. + [2:2] + read-write + + + CTIGATEEN1 + Enable ctichout1. Set to 0 to disable channel propagation. + [1:1] + read-write + + + CTIGATEEN0 + Enable ctichout0. Set to 0 to disable channel propagation. + [0:0] + read-write + + + + + ASICCTL + 0x00042144 + External Multiplexer Control register + 0x00000000 + + + ASICCTL + [31:0] + read-write + + + + + ITCHOUT + 0x00042ee4 + Integration Test Channel Output register + 0x00000000 + + + CTCHOUT + Sets the value of the ctichout outputs + [3:0] + read-write + + + + + ITTRIGOUT + 0x00042ee8 + Integration Test Trigger Output register + 0x00000000 + + + CTTRIGOUT + Sets the value of the ctitrigout outputs + [7:0] + read-write + + + + + ITCHIN + 0x00042ef4 + Integration Test Channel Input register + 0x00000000 + + + CTCHIN + Reads the value of the ctichin inputs. + [3:0] + read-only + + + + + ITCTRL + 0x00042f00 + Integration Mode Control register + 0x00000000 + + + IME + Integration Mode Enable + [0:0] + read-write + + + + + DEVARCH + 0x00042fbc + Device Architecture register + 0x47701a14 + + + ARCHITECT + Indicates the component architect + [31:21] + read-only + + + PRESENT + Indicates whether the DEVARCH register is present + [20:20] + read-only + + + REVISION + Indicates the architecture revision + [19:16] + read-only + + + ARCHID + Indicates the component + [15:0] + read-only + + + + + DEVID + 0x00042fc8 + Device Configuration register + 0x00040800 + + + NUMCH + Number of ECT channels available + [19:16] + read-only + + + NUMTRIG + Number of ECT triggers available. + [15:8] + read-only + + + EXTMUXNUM + Indicates the number of multiplexers available on Trigger Inputs and Trigger Outputs that are using asicctl. The default value of 0b00000 indicates that no multiplexing is present. This value of this bit depends on the Verilog define EXTMUXNUM that you must change accordingly. + [4:0] + read-only + + + + + DEVTYPE + 0x00042fcc + Device Type Identifier register + 0x00000014 + + + SUB + Sub-classification of the type of the debug component as specified in the ARM Architecture Specification within the major classification as specified in the MAJOR field. + [7:4] + read-only + + + MAJOR + Major classification of the type of the debug component as specified in the ARM Architecture Specification for this debug and trace component. + [3:0] + read-only + + + + + PIDR4 + 0x00042fd0 + CoreSight Peripheral ID4 + 0x00000004 + + + SIZE + Always 0b0000. Indicates that the device only occupies 4KB of memory + [7:4] + read-only + + + DES_2 + Together, PIDR1.DES_0, PIDR2.DES_1, and PIDR4.DES_2 identify the designer of the component. + [3:0] + read-only + + + + + PIDR5 + 0x00042fd4 + CoreSight Peripheral ID5 + 0x00000000 + + + PIDR5 + [31:0] + read-write + + + + + PIDR6 + 0x00042fd8 + CoreSight Peripheral ID6 + 0x00000000 + + + PIDR6 + [31:0] + read-write + + + + + PIDR7 + 0x00042fdc + CoreSight Peripheral ID7 + 0x00000000 + + + PIDR7 + [31:0] + read-write + + + + + PIDR0 + 0x00042fe0 + CoreSight Peripheral ID0 + 0x00000021 + + + PART_0 + Bits[7:0] of the 12-bit part number of the component. The designer of the component assigns this part number. + [7:0] + read-only + + + + + PIDR1 + 0x00042fe4 + CoreSight Peripheral ID1 + 0x000000bd + + + DES_0 + Together, PIDR1.DES_0, PIDR2.DES_1, and PIDR4.DES_2 identify the designer of the component. + [7:4] + read-only + + + PART_1 + Bits[11:8] of the 12-bit part number of the component. The designer of the component assigns this part number. + [3:0] + read-only + + + + + PIDR2 + 0x00042fe8 + CoreSight Peripheral ID2 + 0x0000000b + + + REVISION + This device is at r1p0 + [7:4] + read-only + + + JEDEC + Always 1. Indicates that the JEDEC-assigned designer ID is used. + [3:3] + read-only + + + DES_1 + Together, PIDR1.DES_0, PIDR2.DES_1, and PIDR4.DES_2 identify the designer of the component. + [2:0] + read-only + + + + + PIDR3 + 0x00042fec + CoreSight Peripheral ID3 + 0x00000000 + + + REVAND + Indicates minor errata fixes specific to the revision of the component being used, for example metal fixes after implementation. In most cases, this field is 0b0000. ARM recommends that the component designers ensure that a metal fix can change this field if required, for example, by driving it from registers that reset to 0b0000. + [7:4] + read-only + + + CMOD + Customer Modified. Indicates whether the customer has modified the behavior of the component. In most cases, this field is 0b0000. Customers change this value when they make authorized modifications to this component. + [3:0] + read-only + + + + + CIDR0 + 0x00042ff0 + CoreSight Component ID0 + 0x0000000d + + + PRMBL_0 + Preamble[0]. Contains bits[7:0] of the component identification code + [7:0] + read-only + + + + + CIDR1 + 0x00042ff4 + CoreSight Component ID1 + 0x00000090 + + + CLASS + Class of the component, for example, whether the component is a ROM table or a generic CoreSight component. Contains bits[15:12] of the component identification code. + [7:4] + read-only + + + PRMBL_1 + Preamble[1]. Contains bits[11:8] of the component identification code. + [3:0] + read-only + + + + + CIDR2 + 0x00042ff8 + CoreSight Component ID2 + 0x00000005 + + + PRMBL_2 + Preamble[2]. Contains bits[23:16] of the component identification code. + [7:0] + read-only + + + + + CIDR3 + 0x00042ffc + CoreSight Component ID3 + 0x000000b1 + + + PRMBL_3 + Preamble[3]. Contains bits[31:24] of the component identification code. + [7:0] + read-only + + + + + + + PPB_NS + 0xe0020000 + + + QMI + QSPI Memory Interface. + + Provides a memory-mapped interface to up to two SPI/DSPI/QSPI flash or PSRAM devices. Also provides a serial interface for programming and configuration of the external device. + 0x400d0000 + + 0 + 84 + registers + + + + DIRECT_CSR + 0x00000000 + Control and status for direct serial mode + + Direct serial mode allows the processor to send and receive raw serial frames, for programming, configuration and control of the external memory devices. Only SPI mode 0 (CPOL=0 CPHA=0) is supported. + 0x01800000 + + + RXDELAY + Delay the read data sample timing, in units of one half of a system clock cycle. (Not necessarily half of an SCK cycle.) + [31:30] + read-write + + + CLKDIV + Clock divisor for direct serial mode. Divisors of 1..255 are encoded directly, and the maximum divisor of 256 is encoded by a value of CLKDIV=0. + + The clock divisor can be changed on-the-fly by software, without halting or otherwise coordinating with the serial interface. The serial interface will sample the latest clock divisor each time it begins the transmission of a new byte. + [29:22] + read-write + + + RXLEVEL + Current level of DIRECT_RX FIFO + [20:18] + read-only + + + RXFULL + When 1, the DIRECT_RX FIFO is currently full. The serial interface will be stalled until data is popped; the interface will not begin a new serial frame when the DIRECT_TX FIFO is empty or the DIRECT_RX FIFO is full. + [17:17] + read-only + + + RXEMPTY + When 1, the DIRECT_RX FIFO is currently empty. If the processor attempts to read more data, the FIFO state is not affected, but the value returned to the processor is undefined. + [16:16] + read-only + + + TXLEVEL + Current level of DIRECT_TX FIFO + [14:12] + read-only + + + TXEMPTY + When 1, the DIRECT_TX FIFO is currently empty. Unless the processor pushes more data, transmission will stop and BUSY will go low once the current 8-bit serial frame completes. + [11:11] + read-only + + + TXFULL + When 1, the DIRECT_TX FIFO is currently full. If the processor tries to write more data, that data will be ignored. + [10:10] + read-only + + + AUTO_CS1N + When 1, automatically assert the CS1n chip select line whenever the BUSY flag is set. + [7:7] + read-write + + + AUTO_CS0N + When 1, automatically assert the CS0n chip select line whenever the BUSY flag is set. + [6:6] + read-write + + + ASSERT_CS1N + When 1, assert (i.e. drive low) the CS1n chip select line. + + Note that this applies even when DIRECT_CSR_EN is 0. + [3:3] + read-write + + + ASSERT_CS0N + When 1, assert (i.e. drive low) the CS0n chip select line. + + Note that this applies even when DIRECT_CSR_EN is 0. + [2:2] + read-write + + + BUSY + Direct mode busy flag. If 1, data is currently being shifted in/out (or would be if the interface were not stalled on the RX FIFO), and the chip select must not yet be deasserted. + + The busy flag will also be set to 1 if a memory-mapped transfer is still in progress when direct mode is enabled. Direct mode blocks new memory-mapped transfers, but can't halt a transfer that is already in progress. If there is a chance that memory-mapped transfers may be in progress, the busy flag should be polled for 0 before asserting the chip select. + + (In practice you will usually discover this timing condition through other means, because any subsequent memory-mapped transfers when direct mode is enabled will return bus errors, which are difficult to ignore.) + [1:1] + read-only + + + EN + Enable direct mode. + + In direct mode, software controls the chip select lines, and can perform direct SPI transfers by pushing data to the DIRECT_TX FIFO, and popping the same amount of data from the DIRECT_RX FIFO. + + Memory-mapped accesses will generate bus errors when direct serial mode is enabled. + [0:0] + read-write + + + + + DIRECT_TX + 0x00000004 + Transmit FIFO for direct mode + 0x00000000 + + + NOPUSH + Inhibit the RX FIFO push that would correspond to this TX FIFO entry. + + Useful to avoid garbage appearing in the RX FIFO when pushing the command at the beginning of a SPI transfer. + [20:20] + write-only + + + OE + Output enable (active-high). For single width (SPI), this field is ignored, and SD0 is always set to output, with SD1 always set to input. + + For dual and quad width (DSPI/QSPI), this sets whether the relevant SDx pads are set to output whilst transferring this FIFO record. In this case the command/address should have OE set, and the data transfer should have OE set or clear depending on the direction of the transfer. + [19:19] + write-only + + + DWIDTH + Data width. If 0, hardware will transmit the 8 LSBs of the DIRECT_TX DATA field, and return an 8-bit value in the 8 LSBs of DIRECT_RX. If 1, the full 16-bit width is used. 8-bit and 16-bit transfers can be mixed freely. + [18:18] + write-only + + + IWIDTH + Configure whether this FIFO record is transferred with single/dual/quad interface width (0/1/2). Different widths can be mixed freely. + [17:16] + write-only + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + DATA + Data pushed here will be clocked out falling edges of SCK (or before the very first rising edge of SCK, if this is the first pulse). For each byte clocked out, the interface will simultaneously sample one byte, on rising edges of SCK, and push this to the DIRECT_RX FIFO. + + For 16-bit data, the least-significant byte is transmitted first. + [15:0] + write-only + + + + + DIRECT_RX + 0x00000008 + Receive FIFO for direct mode + 0x00000000 + + + DIRECT_RX + With each byte clocked out on the serial interface, one byte will simultaneously be clocked in, and will appear in this FIFO. The serial interface will stall when this FIFO is full, to avoid dropping data. + + When 16-bit data is pushed into the TX FIFO, the corresponding RX FIFO push will also contain 16 bits of data. The least-significant byte is the first one received. + [15:0] + read-only + modify + + + + + M0_TIMING + 0x0000000c + Timing configuration register for memory address window 0. + 0x40000004 + + + COOLDOWN + Chip select cooldown period. When a memory transfer finishes, the chip select remains asserted for 64 x COOLDOWN system clock cycles, plus half an SCK clock period (rounded up for odd SCK divisors). After this cooldown expires, the chip select is always deasserted to save power. + + If the next memory access arrives within the cooldown period, the QMI may be able to append more SCK cycles to the currently ongoing SPI transfer, rather than starting a new transfer. This reduces access latency and increases bus throughput. + + Specifically, the next access must be in the same direction (read/write), access the same memory window (chip select 0/1), and follow sequentially the address of the last transfer. If any of these are false, the new access will first deassert the chip select, then begin a new transfer. + + If COOLDOWN is 0, the address alignment configured by PAGEBREAK has been reached, or the total chip select assertion limit MAX_SELECT has been reached, the cooldown period is skipped, and the chip select will always be deasserted one half SCK period after the transfer finishes. + [31:30] + read-write + + + PAGEBREAK + When page break is enabled, chip select will automatically deassert when crossing certain power-of-2-aligned address boundaries. The next access will always begin a new read/write SPI burst, even if the address of the next access follows in sequence with the last access before the page boundary. + + Some flash and PSRAM devices forbid crossing page boundaries with a single read/write transfer, or restrict the operating frequency for transfers that do cross page a boundary. This option allows the QMI to safely support those devices. + + This field has no effect when COOLDOWN is disabled. + [29:28] + read-write + + + NONE + 0 + No page boundary is enforced + + + 256 + 1 + Break bursts crossing a 256-byte page boundary + + + 1024 + 2 + Break bursts crossing a 1024-byte quad-page boundary + + + 4096 + 3 + Break bursts crossing a 4096-byte sector boundary + + + + + SELECT_SETUP + Add up to one additional system clock cycle of setup between chip select assertion and the first rising edge of SCK. + + The default setup time is one half SCK period, which is usually sufficient except for very high SCK frequencies with some flash devices. + [25:25] + read-write + + + SELECT_HOLD + Add up to three additional system clock cycles of active hold between the last falling edge of SCK and the deassertion of this window's chip select. + + The default hold time is one system clock cycle. Note that flash datasheets usually give chip select active hold time from the last *rising* edge of SCK, and so even zero hold from the last falling edge would be safe. + + Note that this is a minimum hold time guaranteed by the QMI: the actual chip select active hold may be slightly longer for read transfers with low clock divisors and/or high sample delays. Specifically, if the point two cycles after the last RX data sample is later than the last SCK falling edge, then the hold time is measured from *this* point. + + Note also that, in case the final SCK pulse is masked to save energy (true for non-DTR reads when COOLDOWN is disabled or PAGE_BREAK is reached), all of QMI's timing logic behaves as though the clock pulse were still present. The SELECT_HOLD time is applied from the point where the last SCK falling edge would be if the clock pulse were not masked. + [24:23] + read-write + + + MAX_SELECT + Enforce a maximum assertion duration for this window's chip select, in units of 64 system clock cycles. If 0, the QMI is permitted to keep the chip select asserted indefinitely when servicing sequential memory accesses (see COOLDOWN). + + This feature is required to meet timing constraints of PSRAM devices, which specify a maximum chip select assertion so they can perform DRAM refresh cycles. See also MIN_DESELECT, which can enforce a minimum deselect time. + + If a memory access is in progress at the time MAX_SELECT is reached, the QMI will wait for the access to complete before deasserting the chip select. This additional time must be accounted for to calculate a safe MAX_SELECT value. In the worst case, this may be a fully-formed serial transfer, including command prefix and address, with a data payload as large as one cache line. + [22:17] + read-write + + + MIN_DESELECT + After this window's chip select is deasserted, it remains deasserted for half an SCK cycle (rounded up to an integer number of system clock cycles), plus MIN_DESELECT additional system clock cycles, before the QMI reasserts either chip select pin. + + Nonzero values may be required for PSRAM devices which enforce a longer minimum CS deselect time, so that they can perform internal DRAM refresh cycles whilst deselected. + [16:12] + read-write + + + RXDELAY + Delay the read data sample timing, in units of one half of a system clock cycle. (Not necessarily half of an SCK cycle.) An RXDELAY of 0 means the sample is captured at the SDI input registers simultaneously with the rising edge of SCK launched from the SCK output register. + + At higher SCK frequencies, RXDELAY may need to be increased to account for the round trip delay of the pads, and the clock-to-Q delay of the QSPI memory device. + [10:8] + read-write + + + CLKDIV + Clock divisor. Odd and even divisors are supported. Defines the SCK clock period in units of 1 system clock cycle. Divisors 1..255 are encoded directly, and a divisor of 256 is encoded with a value of CLKDIV=0. + + The clock divisor can be changed on-the-fly, even when the QMI is currently accessing memory in this address window. All other parameters must only be changed when the QMI is idle. + + If software is increasing CLKDIV in anticipation of an increase in the system clock frequency, a dummy access to either memory window (and appropriate processor barriers/fences) must be inserted after the Mx_TIMING write to ensure the SCK divisor change is in effect _before_ the system clock is changed. + [7:0] + read-write + + + + + M0_RFMT + 0x00000010 + Read transfer format configuration for memory address window 0. + + Configure the bus width of each transfer phase individually, and configure the length or presence of the command prefix, command suffix and dummy/turnaround transfer phases. Only 24-bit addresses are supported. + + The reset value of the M0_RFMT register is configured to support a basic 03h serial read transfer with no additional configuration. + 0x00001000 + + + DTR + Enable double transfer rate (DTR) for read commands: address, suffix and read data phases are active on both edges of SCK. SDO data is launched centre-aligned on each SCK edge, and SDI data is captured on the SCK edge that follows its launch. + + DTR is implemented by halving the clock rate; SCK has a period of 2 x CLK_DIV throughout the transfer. The prefix and dummy phases are still single transfer rate. + + If the suffix is quad-width, it must be 0 or 8 bits in length, to ensure an even number of SCK edges. + [28:28] + read-write + + + DUMMY_LEN + Length of dummy phase between command suffix and data phase, in units of 4 bits. (i.e. 1 cycle for quad width, 2 for dual, 4 for single) + [18:16] + read-write + + + NONE + 0 + No dummy phase + + + 4 + 1 + 4 dummy bits + + + 8 + 2 + 8 dummy bits + + + 12 + 3 + 12 dummy bits + + + 16 + 4 + 16 dummy bits + + + 20 + 5 + 20 dummy bits + + + 24 + 6 + 24 dummy bits + + + 28 + 7 + 28 dummy bits + + + + + SUFFIX_LEN + Length of post-address command suffix, in units of 4 bits. (i.e. 1 cycle for quad width, 2 for dual, 4 for single) + + Only values of 0 and 8 bits are supported. + [15:14] + read-write + + + NONE + 0 + No suffix + + + 8 + 2 + 8-bit suffix + + + + + PREFIX_LEN + Length of command prefix, in units of 8 bits. (i.e. 2 cycles for quad width, 4 for dual, 8 for single) + [12:12] + read-write + + + NONE + 0 + No prefix + + + 8 + 1 + 8-bit prefix + + + + + DATA_WIDTH + The width used for the data transfer + [9:8] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + DUMMY_WIDTH + The width used for the dummy phase, if any. + + If width is single, SD0/MOSI is held asserted low during the dummy phase, and SD1...SD3 are tristated. If width is dual/quad, all IOs are tristated during the dummy phase. + [7:6] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + SUFFIX_WIDTH + The width used for the post-address command suffix, if any + [5:4] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + ADDR_WIDTH + The transfer width used for the address. The address phase always transfers 24 bits in total. + [3:2] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + PREFIX_WIDTH + The transfer width used for the command prefix, if any + [1:0] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + + + M0_RCMD + 0x00000014 + Command constants used for reads from memory address window 0. + + The reset value of the M0_RCMD register is configured to support a basic 03h serial read transfer with no additional configuration. + 0x0000a003 + + + SUFFIX + The command suffix bits following the address, if Mx_RFMT_SUFFIX_LEN is nonzero. + [15:8] + read-write + + + PREFIX + The command prefix bits to prepend on each new transfer, if Mx_RFMT_PREFIX_LEN is nonzero. + [7:0] + read-write + + + + + M0_WFMT + 0x00000018 + Write transfer format configuration for memory address window 0. + + Configure the bus width of each transfer phase individually, and configure the length or presence of the command prefix, command suffix and dummy/turnaround transfer phases. Only 24-bit addresses are supported. + + The reset value of the M0_WFMT register is configured to support a basic 02h serial write transfer. However, writes to this window must first be enabled via the XIP_CTRL_WRITABLE_M0 bit, as XIP memory is read-only by default. + 0x00001000 + + + DTR + Enable double transfer rate (DTR) for write commands: address, suffix and write data phases are active on both edges of SCK. SDO data is launched centre-aligned on each SCK edge, and SDI data is captured on the SCK edge that follows its launch. + + DTR is implemented by halving the clock rate; SCK has a period of 2 x CLK_DIV throughout the transfer. The prefix and dummy phases are still single transfer rate. + + If the suffix is quad-width, it must be 0 or 8 bits in length, to ensure an even number of SCK edges. + [28:28] + read-write + + + DUMMY_LEN + Length of dummy phase between command suffix and data phase, in units of 4 bits. (i.e. 1 cycle for quad width, 2 for dual, 4 for single) + [18:16] + read-write + + + NONE + 0 + No dummy phase + + + 4 + 1 + 4 dummy bits + + + 8 + 2 + 8 dummy bits + + + 12 + 3 + 12 dummy bits + + + 16 + 4 + 16 dummy bits + + + 20 + 5 + 20 dummy bits + + + 24 + 6 + 24 dummy bits + + + 28 + 7 + 28 dummy bits + + + + + SUFFIX_LEN + Length of post-address command suffix, in units of 4 bits. (i.e. 1 cycle for quad width, 2 for dual, 4 for single) + + Only values of 0 and 8 bits are supported. + [15:14] + read-write + + + NONE + 0 + No suffix + + + 8 + 2 + 8-bit suffix + + + + + PREFIX_LEN + Length of command prefix, in units of 8 bits. (i.e. 2 cycles for quad width, 4 for dual, 8 for single) + [12:12] + read-write + + + NONE + 0 + No prefix + + + 8 + 1 + 8-bit prefix + + + + + DATA_WIDTH + The width used for the data transfer + [9:8] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + DUMMY_WIDTH + The width used for the dummy phase, if any. + + If width is single, SD0/MOSI is held asserted low during the dummy phase, and SD1...SD3 are tristated. If width is dual/quad, all IOs are tristated during the dummy phase. + [7:6] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + SUFFIX_WIDTH + The width used for the post-address command suffix, if any + [5:4] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + ADDR_WIDTH + The transfer width used for the address. The address phase always transfers 24 bits in total. + [3:2] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + PREFIX_WIDTH + The transfer width used for the command prefix, if any + [1:0] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + + + M0_WCMD + 0x0000001c + Command constants used for writes to memory address window 0. + + The reset value of the M0_WCMD register is configured to support a basic 02h serial write transfer with no additional configuration. + 0x0000a002 + + + SUFFIX + The command suffix bits following the address, if Mx_WFMT_SUFFIX_LEN is nonzero. + [15:8] + read-write + + + PREFIX + The command prefix bits to prepend on each new transfer, if Mx_WFMT_PREFIX_LEN is nonzero. + [7:0] + read-write + + + + + M1_TIMING + 0x00000020 + Timing configuration register for memory address window 1. + 0x40000004 + + + COOLDOWN + Chip select cooldown period. When a memory transfer finishes, the chip select remains asserted for 64 x COOLDOWN system clock cycles, plus half an SCK clock period (rounded up for odd SCK divisors). After this cooldown expires, the chip select is always deasserted to save power. + + If the next memory access arrives within the cooldown period, the QMI may be able to append more SCK cycles to the currently ongoing SPI transfer, rather than starting a new transfer. This reduces access latency and increases bus throughput. + + Specifically, the next access must be in the same direction (read/write), access the same memory window (chip select 0/1), and follow sequentially the address of the last transfer. If any of these are false, the new access will first deassert the chip select, then begin a new transfer. + + If COOLDOWN is 0, the address alignment configured by PAGEBREAK has been reached, or the total chip select assertion limit MAX_SELECT has been reached, the cooldown period is skipped, and the chip select will always be deasserted one half SCK period after the transfer finishes. + [31:30] + read-write + + + PAGEBREAK + When page break is enabled, chip select will automatically deassert when crossing certain power-of-2-aligned address boundaries. The next access will always begin a new read/write SPI burst, even if the address of the next access follows in sequence with the last access before the page boundary. + + Some flash and PSRAM devices forbid crossing page boundaries with a single read/write transfer, or restrict the operating frequency for transfers that do cross page a boundary. This option allows the QMI to safely support those devices. + + This field has no effect when COOLDOWN is disabled. + [29:28] + read-write + + + NONE + 0 + No page boundary is enforced + + + 256 + 1 + Break bursts crossing a 256-byte page boundary + + + 1024 + 2 + Break bursts crossing a 1024-byte quad-page boundary + + + 4096 + 3 + Break bursts crossing a 4096-byte sector boundary + + + + + SELECT_SETUP + Add up to one additional system clock cycle of setup between chip select assertion and the first rising edge of SCK. + + The default setup time is one half SCK period, which is usually sufficient except for very high SCK frequencies with some flash devices. + [25:25] + read-write + + + SELECT_HOLD + Add up to three additional system clock cycles of active hold between the last falling edge of SCK and the deassertion of this window's chip select. + + The default hold time is one system clock cycle. Note that flash datasheets usually give chip select active hold time from the last *rising* edge of SCK, and so even zero hold from the last falling edge would be safe. + + Note that this is a minimum hold time guaranteed by the QMI: the actual chip select active hold may be slightly longer for read transfers with low clock divisors and/or high sample delays. Specifically, if the point two cycles after the last RX data sample is later than the last SCK falling edge, then the hold time is measured from *this* point. + + Note also that, in case the final SCK pulse is masked to save energy (true for non-DTR reads when COOLDOWN is disabled or PAGE_BREAK is reached), all of QMI's timing logic behaves as though the clock pulse were still present. The SELECT_HOLD time is applied from the point where the last SCK falling edge would be if the clock pulse were not masked. + [24:23] + read-write + + + MAX_SELECT + Enforce a maximum assertion duration for this window's chip select, in units of 64 system clock cycles. If 0, the QMI is permitted to keep the chip select asserted indefinitely when servicing sequential memory accesses (see COOLDOWN). + + This feature is required to meet timing constraints of PSRAM devices, which specify a maximum chip select assertion so they can perform DRAM refresh cycles. See also MIN_DESELECT, which can enforce a minimum deselect time. + + If a memory access is in progress at the time MAX_SELECT is reached, the QMI will wait for the access to complete before deasserting the chip select. This additional time must be accounted for to calculate a safe MAX_SELECT value. In the worst case, this may be a fully-formed serial transfer, including command prefix and address, with a data payload as large as one cache line. + [22:17] + read-write + + + MIN_DESELECT + After this window's chip select is deasserted, it remains deasserted for half an SCK cycle (rounded up to an integer number of system clock cycles), plus MIN_DESELECT additional system clock cycles, before the QMI reasserts either chip select pin. + + Nonzero values may be required for PSRAM devices which enforce a longer minimum CS deselect time, so that they can perform internal DRAM refresh cycles whilst deselected. + [16:12] + read-write + + + RXDELAY + Delay the read data sample timing, in units of one half of a system clock cycle. (Not necessarily half of an SCK cycle.) An RXDELAY of 0 means the sample is captured at the SDI input registers simultaneously with the rising edge of SCK launched from the SCK output register. + + At higher SCK frequencies, RXDELAY may need to be increased to account for the round trip delay of the pads, and the clock-to-Q delay of the QSPI memory device. + [10:8] + read-write + + + CLKDIV + Clock divisor. Odd and even divisors are supported. Defines the SCK clock period in units of 1 system clock cycle. Divisors 1..255 are encoded directly, and a divisor of 256 is encoded with a value of CLKDIV=0. + + The clock divisor can be changed on-the-fly, even when the QMI is currently accessing memory in this address window. All other parameters must only be changed when the QMI is idle. + + If software is increasing CLKDIV in anticipation of an increase in the system clock frequency, a dummy access to either memory window (and appropriate processor barriers/fences) must be inserted after the Mx_TIMING write to ensure the SCK divisor change is in effect _before_ the system clock is changed. + [7:0] + read-write + + + + + M1_RFMT + 0x00000024 + Read transfer format configuration for memory address window 1. + + Configure the bus width of each transfer phase individually, and configure the length or presence of the command prefix, command suffix and dummy/turnaround transfer phases. Only 24-bit addresses are supported. + + The reset value of the M1_RFMT register is configured to support a basic 03h serial read transfer with no additional configuration. + 0x00001000 + + + DTR + Enable double transfer rate (DTR) for read commands: address, suffix and read data phases are active on both edges of SCK. SDO data is launched centre-aligned on each SCK edge, and SDI data is captured on the SCK edge that follows its launch. + + DTR is implemented by halving the clock rate; SCK has a period of 2 x CLK_DIV throughout the transfer. The prefix and dummy phases are still single transfer rate. + + If the suffix is quad-width, it must be 0 or 8 bits in length, to ensure an even number of SCK edges. + [28:28] + read-write + + + DUMMY_LEN + Length of dummy phase between command suffix and data phase, in units of 4 bits. (i.e. 1 cycle for quad width, 2 for dual, 4 for single) + [18:16] + read-write + + + NONE + 0 + No dummy phase + + + 4 + 1 + 4 dummy bits + + + 8 + 2 + 8 dummy bits + + + 12 + 3 + 12 dummy bits + + + 16 + 4 + 16 dummy bits + + + 20 + 5 + 20 dummy bits + + + 24 + 6 + 24 dummy bits + + + 28 + 7 + 28 dummy bits + + + + + SUFFIX_LEN + Length of post-address command suffix, in units of 4 bits. (i.e. 1 cycle for quad width, 2 for dual, 4 for single) + + Only values of 0 and 8 bits are supported. + [15:14] + read-write + + + NONE + 0 + No suffix + + + 8 + 2 + 8-bit suffix + + + + + PREFIX_LEN + Length of command prefix, in units of 8 bits. (i.e. 2 cycles for quad width, 4 for dual, 8 for single) + [12:12] + read-write + + + NONE + 0 + No prefix + + + 8 + 1 + 8-bit prefix + + + + + DATA_WIDTH + The width used for the data transfer + [9:8] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + DUMMY_WIDTH + The width used for the dummy phase, if any. + + If width is single, SD0/MOSI is held asserted low during the dummy phase, and SD1...SD3 are tristated. If width is dual/quad, all IOs are tristated during the dummy phase. + [7:6] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + SUFFIX_WIDTH + The width used for the post-address command suffix, if any + [5:4] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + ADDR_WIDTH + The transfer width used for the address. The address phase always transfers 24 bits in total. + [3:2] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + PREFIX_WIDTH + The transfer width used for the command prefix, if any + [1:0] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + + + M1_RCMD + 0x00000028 + Command constants used for reads from memory address window 1. + + The reset value of the M1_RCMD register is configured to support a basic 03h serial read transfer with no additional configuration. + 0x0000a003 + + + SUFFIX + The command suffix bits following the address, if Mx_RFMT_SUFFIX_LEN is nonzero. + [15:8] + read-write + + + PREFIX + The command prefix bits to prepend on each new transfer, if Mx_RFMT_PREFIX_LEN is nonzero. + [7:0] + read-write + + + + + M1_WFMT + 0x0000002c + Write transfer format configuration for memory address window 1. + + Configure the bus width of each transfer phase individually, and configure the length or presence of the command prefix, command suffix and dummy/turnaround transfer phases. Only 24-bit addresses are supported. + + The reset value of the M1_WFMT register is configured to support a basic 02h serial write transfer. However, writes to this window must first be enabled via the XIP_CTRL_WRITABLE_M1 bit, as XIP memory is read-only by default. + 0x00001000 + + + DTR + Enable double transfer rate (DTR) for write commands: address, suffix and write data phases are active on both edges of SCK. SDO data is launched centre-aligned on each SCK edge, and SDI data is captured on the SCK edge that follows its launch. + + DTR is implemented by halving the clock rate; SCK has a period of 2 x CLK_DIV throughout the transfer. The prefix and dummy phases are still single transfer rate. + + If the suffix is quad-width, it must be 0 or 8 bits in length, to ensure an even number of SCK edges. + [28:28] + read-write + + + DUMMY_LEN + Length of dummy phase between command suffix and data phase, in units of 4 bits. (i.e. 1 cycle for quad width, 2 for dual, 4 for single) + [18:16] + read-write + + + NONE + 0 + No dummy phase + + + 4 + 1 + 4 dummy bits + + + 8 + 2 + 8 dummy bits + + + 12 + 3 + 12 dummy bits + + + 16 + 4 + 16 dummy bits + + + 20 + 5 + 20 dummy bits + + + 24 + 6 + 24 dummy bits + + + 28 + 7 + 28 dummy bits + + + + + SUFFIX_LEN + Length of post-address command suffix, in units of 4 bits. (i.e. 1 cycle for quad width, 2 for dual, 4 for single) + + Only values of 0 and 8 bits are supported. + [15:14] + read-write + + + NONE + 0 + No suffix + + + 8 + 2 + 8-bit suffix + + + + + PREFIX_LEN + Length of command prefix, in units of 8 bits. (i.e. 2 cycles for quad width, 4 for dual, 8 for single) + [12:12] + read-write + + + NONE + 0 + No prefix + + + 8 + 1 + 8-bit prefix + + + + + DATA_WIDTH + The width used for the data transfer + [9:8] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + DUMMY_WIDTH + The width used for the dummy phase, if any. + + If width is single, SD0/MOSI is held asserted low during the dummy phase, and SD1...SD3 are tristated. If width is dual/quad, all IOs are tristated during the dummy phase. + [7:6] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + SUFFIX_WIDTH + The width used for the post-address command suffix, if any + [5:4] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + ADDR_WIDTH + The transfer width used for the address. The address phase always transfers 24 bits in total. + [3:2] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + PREFIX_WIDTH + The transfer width used for the command prefix, if any + [1:0] + read-write + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + + + M1_WCMD + 0x00000030 + Command constants used for writes to memory address window 1. + + The reset value of the M1_WCMD register is configured to support a basic 02h serial write transfer with no additional configuration. + 0x0000a002 + + + SUFFIX + The command suffix bits following the address, if Mx_WFMT_SUFFIX_LEN is nonzero. + [15:8] + read-write + + + PREFIX + The command prefix bits to prepend on each new transfer, if Mx_WFMT_PREFIX_LEN is nonzero. + [7:0] + read-write + + + + + ATRANS0 + 0x00000034 + Configure address translation for XIP virtual addresses 0x000000 through 0x3fffff (a 4 MiB window starting at +0 MiB). + + Address translation allows a program image to be executed in place at multiple physical flash addresses (for example, a double-buffered flash image for over-the-air updates), without the overhead of position-independent code. + + At reset, the address translation registers are initialised to an identity mapping, so that they can be ignored if address translation is not required. + + Note that the XIP cache is fully virtually addressed, so a cache flush is required after changing the address translation. + 0x04000000 + + + SIZE + Translation aperture size for this virtual address range, in units of 4 kiB (one flash sector). + + Bits 21:12 of the virtual address are compared to SIZE. Offsets greater than SIZE return a bus error, and do not cause a QSPI access. + [26:16] + read-write + + + BASE + Physical address base for this virtual address range, in units of 4 kiB (one flash sector). + + Taking a 24-bit virtual address, firstly bits 23:22 (the two MSBs) are masked to zero, and then BASE is added to bits 23:12 (the upper 12 bits) to form the physical address. Translation wraps on a 16 MiB boundary. + [11:0] + read-write + + + + + ATRANS1 + 0x00000038 + Configure address translation for XIP virtual addresses 0x400000 through 0x7fffff (a 4 MiB window starting at +4 MiB). + + Address translation allows a program image to be executed in place at multiple physical flash addresses (for example, a double-buffered flash image for over-the-air updates), without the overhead of position-independent code. + + At reset, the address translation registers are initialised to an identity mapping, so that they can be ignored if address translation is not required. + + Note that the XIP cache is fully virtually addressed, so a cache flush is required after changing the address translation. + 0x04000400 + + + SIZE + Translation aperture size for this virtual address range, in units of 4 kiB (one flash sector). + + Bits 21:12 of the virtual address are compared to SIZE. Offsets greater than SIZE return a bus error, and do not cause a QSPI access. + [26:16] + read-write + + + BASE + Physical address base for this virtual address range, in units of 4 kiB (one flash sector). + + Taking a 24-bit virtual address, firstly bits 23:22 (the two MSBs) are masked to zero, and then BASE is added to bits 23:12 (the upper 12 bits) to form the physical address. Translation wraps on a 16 MiB boundary. + [11:0] + read-write + + + + + ATRANS2 + 0x0000003c + Configure address translation for XIP virtual addresses 0x800000 through 0xbfffff (a 4 MiB window starting at +8 MiB). + + Address translation allows a program image to be executed in place at multiple physical flash addresses (for example, a double-buffered flash image for over-the-air updates), without the overhead of position-independent code. + + At reset, the address translation registers are initialised to an identity mapping, so that they can be ignored if address translation is not required. + + Note that the XIP cache is fully virtually addressed, so a cache flush is required after changing the address translation. + 0x04000800 + + + SIZE + Translation aperture size for this virtual address range, in units of 4 kiB (one flash sector). + + Bits 21:12 of the virtual address are compared to SIZE. Offsets greater than SIZE return a bus error, and do not cause a QSPI access. + [26:16] + read-write + + + BASE + Physical address base for this virtual address range, in units of 4 kiB (one flash sector). + + Taking a 24-bit virtual address, firstly bits 23:22 (the two MSBs) are masked to zero, and then BASE is added to bits 23:12 (the upper 12 bits) to form the physical address. Translation wraps on a 16 MiB boundary. + [11:0] + read-write + + + + + ATRANS3 + 0x00000040 + Configure address translation for XIP virtual addresses 0xc00000 through 0xffffff (a 4 MiB window starting at +12 MiB). + + Address translation allows a program image to be executed in place at multiple physical flash addresses (for example, a double-buffered flash image for over-the-air updates), without the overhead of position-independent code. + + At reset, the address translation registers are initialised to an identity mapping, so that they can be ignored if address translation is not required. + + Note that the XIP cache is fully virtually addressed, so a cache flush is required after changing the address translation. + 0x04000c00 + + + SIZE + Translation aperture size for this virtual address range, in units of 4 kiB (one flash sector). + + Bits 21:12 of the virtual address are compared to SIZE. Offsets greater than SIZE return a bus error, and do not cause a QSPI access. + [26:16] + read-write + + + BASE + Physical address base for this virtual address range, in units of 4 kiB (one flash sector). + + Taking a 24-bit virtual address, firstly bits 23:22 (the two MSBs) are masked to zero, and then BASE is added to bits 23:12 (the upper 12 bits) to form the physical address. Translation wraps on a 16 MiB boundary. + [11:0] + read-write + + + + + ATRANS4 + 0x00000044 + Configure address translation for XIP virtual addresses 0x1000000 through 0x13fffff (a 4 MiB window starting at +16 MiB). + + Address translation allows a program image to be executed in place at multiple physical flash addresses (for example, a double-buffered flash image for over-the-air updates), without the overhead of position-independent code. + + At reset, the address translation registers are initialised to an identity mapping, so that they can be ignored if address translation is not required. + + Note that the XIP cache is fully virtually addressed, so a cache flush is required after changing the address translation. + 0x04000000 + + + SIZE + Translation aperture size for this virtual address range, in units of 4 kiB (one flash sector). + + Bits 21:12 of the virtual address are compared to SIZE. Offsets greater than SIZE return a bus error, and do not cause a QSPI access. + [26:16] + read-write + + + BASE + Physical address base for this virtual address range, in units of 4 kiB (one flash sector). + + Taking a 24-bit virtual address, firstly bits 23:22 (the two MSBs) are masked to zero, and then BASE is added to bits 23:12 (the upper 12 bits) to form the physical address. Translation wraps on a 16 MiB boundary. + [11:0] + read-write + + + + + ATRANS5 + 0x00000048 + Configure address translation for XIP virtual addresses 0x1400000 through 0x17fffff (a 4 MiB window starting at +20 MiB). + + Address translation allows a program image to be executed in place at multiple physical flash addresses (for example, a double-buffered flash image for over-the-air updates), without the overhead of position-independent code. + + At reset, the address translation registers are initialised to an identity mapping, so that they can be ignored if address translation is not required. + + Note that the XIP cache is fully virtually addressed, so a cache flush is required after changing the address translation. + 0x04000400 + + + SIZE + Translation aperture size for this virtual address range, in units of 4 kiB (one flash sector). + + Bits 21:12 of the virtual address are compared to SIZE. Offsets greater than SIZE return a bus error, and do not cause a QSPI access. + [26:16] + read-write + + + BASE + Physical address base for this virtual address range, in units of 4 kiB (one flash sector). + + Taking a 24-bit virtual address, firstly bits 23:22 (the two MSBs) are masked to zero, and then BASE is added to bits 23:12 (the upper 12 bits) to form the physical address. Translation wraps on a 16 MiB boundary. + [11:0] + read-write + + + + + ATRANS6 + 0x0000004c + Configure address translation for XIP virtual addresses 0x1800000 through 0x1bfffff (a 4 MiB window starting at +24 MiB). + + Address translation allows a program image to be executed in place at multiple physical flash addresses (for example, a double-buffered flash image for over-the-air updates), without the overhead of position-independent code. + + At reset, the address translation registers are initialised to an identity mapping, so that they can be ignored if address translation is not required. + + Note that the XIP cache is fully virtually addressed, so a cache flush is required after changing the address translation. + 0x04000800 + + + SIZE + Translation aperture size for this virtual address range, in units of 4 kiB (one flash sector). + + Bits 21:12 of the virtual address are compared to SIZE. Offsets greater than SIZE return a bus error, and do not cause a QSPI access. + [26:16] + read-write + + + BASE + Physical address base for this virtual address range, in units of 4 kiB (one flash sector). + + Taking a 24-bit virtual address, firstly bits 23:22 (the two MSBs) are masked to zero, and then BASE is added to bits 23:12 (the upper 12 bits) to form the physical address. Translation wraps on a 16 MiB boundary. + [11:0] + read-write + + + + + ATRANS7 + 0x00000050 + Configure address translation for XIP virtual addresses 0x1c00000 through 0x1ffffff (a 4 MiB window starting at +28 MiB). + + Address translation allows a program image to be executed in place at multiple physical flash addresses (for example, a double-buffered flash image for over-the-air updates), without the overhead of position-independent code. + + At reset, the address translation registers are initialised to an identity mapping, so that they can be ignored if address translation is not required. + + Note that the XIP cache is fully virtually addressed, so a cache flush is required after changing the address translation. + 0x04000c00 + + + SIZE + Translation aperture size for this virtual address range, in units of 4 kiB (one flash sector). + + Bits 21:12 of the virtual address are compared to SIZE. Offsets greater than SIZE return a bus error, and do not cause a QSPI access. + [26:16] + read-write + + + BASE + Physical address base for this virtual address range, in units of 4 kiB (one flash sector). + + Taking a 24-bit virtual address, firstly bits 23:22 (the two MSBs) are masked to zero, and then BASE is added to bits 23:12 (the upper 12 bits) to form the physical address. Translation wraps on a 16 MiB boundary. + [11:0] + read-write + + + + + + + XIP_CTRL + QSPI flash execute-in-place block + 0x400c8000 + + 0 + 32 + registers + + + + CTRL + 0x00000000 + Cache control register. Read-only from a Non-secure context. + 0x00000083 + + + WRITABLE_M1 + If 1, enable writes to XIP memory window 1 (addresses 0x11000000 through 0x11ffffff, and their uncached mirrors). If 0, this region is read-only. + + XIP memory is *read-only by default*. This bit must be set to enable writes if a RAM device is attached on QSPI chip select 1. + + The default read-only behaviour avoids two issues with writing to a read-only QSPI device (e.g. flash). First, a write will initially appear to succeed due to caching, but the data will eventually be lost when the written line is evicted, causing unpredictable behaviour. + + Second, when a written line is evicted, it will cause a write command to be issued to the flash, which can break the flash out of its continuous read mode. After this point, flash reads will return garbage. This is a security concern, as it allows Non-secure software to break Secure flash reads if it has permission to write to any flash address. + + Note the read-only behaviour is implemented by downgrading writes to reads, so writes will still cause allocation of an address, but have no other effect. + [11:11] + read-write + + + WRITABLE_M0 + If 1, enable writes to XIP memory window 0 (addresses 0x10000000 through 0x10ffffff, and their uncached mirrors). If 0, this region is read-only. + + XIP memory is *read-only by default*. This bit must be set to enable writes if a RAM device is attached on QSPI chip select 0. + + The default read-only behaviour avoids two issues with writing to a read-only QSPI device (e.g. flash). First, a write will initially appear to succeed due to caching, but the data will eventually be lost when the written line is evicted, causing unpredictable behaviour. + + Second, when a written line is evicted, it will cause a write command to be issued to the flash, which can break the flash out of its continuous read mode. After this point, flash reads will return garbage. This is a security concern, as it allows Non-secure software to break Secure flash reads if it has permission to write to any flash address. + + Note the read-only behaviour is implemented by downgrading writes to reads, so writes will still cause allocation of an address, but have no other effect. + [10:10] + read-write + + + SPLIT_WAYS + When 1, route all cached+Secure accesses to way 0 of the cache, and route all cached+Non-secure accesses to way 1 of the cache. + + This partitions the cache into two half-sized direct-mapped regions, such that Non-secure code can not observe cache line state changes caused by Secure execution. + + A full cache flush is required when changing the value of SPLIT_WAYS. The flush should be performed whilst SPLIT_WAYS is 0, so that both cache ways are accessible for invalidation. + [9:9] + read-write + + + MAINT_NONSEC + When 0, Non-secure accesses to the cache maintenance address window (addr[27] == 1, addr[26] == 0) will generate a bus error. When 1, Non-secure accesses can perform cache maintenance operations by writing to the cache maintenance address window. + + Cache maintenance operations may be used to corrupt Secure data by invalidating cache lines inappropriately, or map Secure content into a Non-secure region by pinning cache lines. Therefore this bit should generally be set to 0, unless Secure code is not using the cache. + + Care should also be taken to clear the cache data memory and tag memory before granting maintenance operations to Non-secure code. + [8:8] + read-write + + + NO_UNTRANSLATED_NONSEC + When 1, Non-secure accesses to the uncached, untranslated window (addr[27:26] == 3) will generate a bus error. + [7:7] + read-write + + + NO_UNTRANSLATED_SEC + When 1, Secure accesses to the uncached, untranslated window (addr[27:26] == 3) will generate a bus error. + [6:6] + read-write + + + NO_UNCACHED_NONSEC + When 1, Non-secure accesses to the uncached window (addr[27:26] == 1) will generate a bus error. This may reduce the number of SAU/MPU/PMP regions required to protect flash contents. + + Note this does not disable access to the uncached, untranslated window -- see NO_UNTRANSLATED_SEC. + [5:5] + read-write + + + NO_UNCACHED_SEC + When 1, Secure accesses to the uncached window (addr[27:26] == 1) will generate a bus error. This may reduce the number of SAU/MPU/PMP regions required to protect flash contents. + + Note this does not disable access to the uncached, untranslated window -- see NO_UNTRANSLATED_SEC. + [4:4] + read-write + + + POWER_DOWN + When 1, the cache memories are powered down. They retain state, but can not be accessed. This reduces static power dissipation. Writing 1 to this bit forces CTRL_EN_SECURE and CTRL_EN_NONSECURE to 0, i.e. the cache cannot be enabled when powered down. + [3:3] + read-write + + + EN_NONSECURE + When 1, enable the cache for Non-secure accesses. When enabled, Non-secure XIP accesses to the cached (addr[26] == 0) window will query the cache, and QSPI accesses are performed only if the requested data is not present. When disabled, Secure access ignore the cache contents, and always access the QSPI interface. + + Accesses to the uncached (addr[26] == 1) window will never query the cache, irrespective of this bit. + [1:1] + read-write + + + EN_SECURE + When 1, enable the cache for Secure accesses. When enabled, Secure XIP accesses to the cached (addr[26] == 0) window will query the cache, and QSPI accesses are performed only if the requested data is not present. When disabled, Secure access ignore the cache contents, and always access the QSPI interface. + + Accesses to the uncached (addr[26] == 1) window will never query the cache, irrespective of this bit. + + There is no cache-as-SRAM address window. Cache lines are allocated for SRAM-like use by individually pinning them, and keeping the cache enabled. + [0:0] + read-write + + + + + STAT + 0x00000008 + 0x00000002 + + + FIFO_FULL + When 1, indicates the XIP streaming FIFO is completely full. + The streaming FIFO is 2 entries deep, so the full and empty + flag allow its level to be ascertained. + [2:2] + read-only + + + FIFO_EMPTY + When 1, indicates the XIP streaming FIFO is completely empty. + [1:1] + read-only + + + + + CTR_HIT + 0x0000000c + Cache Hit counter + 0x00000000 + + + CTR_HIT + A 32 bit saturating counter that increments upon each cache hit, + i.e. when an XIP access is serviced directly from cached data. + Write any value to clear. + [31:0] + read-write + oneToClear + + + + + CTR_ACC + 0x00000010 + Cache Access counter + 0x00000000 + + + CTR_ACC + A 32 bit saturating counter that increments upon each XIP access, + whether the cache is hit or not. This includes noncacheable accesses. + Write any value to clear. + [31:0] + read-write + oneToClear + + + + + STREAM_ADDR + 0x00000014 + FIFO stream address + 0x00000000 + + + STREAM_ADDR + The address of the next word to be streamed from flash to the streaming FIFO. + Increments automatically after each flash access. + Write the initial access address here before starting a streaming read. + [31:2] + read-write + + + + + STREAM_CTR + 0x00000018 + FIFO stream control + 0x00000000 + + + STREAM_CTR + Write a nonzero value to start a streaming read. This will then + progress in the background, using flash idle cycles to transfer + a linear data block from flash to the streaming FIFO. + Decrements automatically (1 at a time) as the stream + progresses, and halts on reaching 0. + Write 0 to halt an in-progress stream, and discard any in-flight + read, so that a new stream can immediately be started (after + draining the FIFO and reinitialising STREAM_ADDR) + [21:0] + read-write + + + + + STREAM_FIFO + 0x0000001c + FIFO stream data + 0x00000000 + + + STREAM_FIFO + Streamed data is buffered here, for retrieval by the system DMA. + This FIFO can also be accessed via the XIP_AUX slave, to avoid exposing + the DMA to bus stalls caused by other XIP traffic. + [31:0] + read-only + modify + + + + + + + XIP_AUX + Auxiliary DMA access to XIP FIFOs, via fast AHB bus access + 0x50500000 + + 0 + 12 + registers + + + + STREAM + 0x00000000 + Read the XIP stream FIFO (fast bus access to XIP_CTRL_STREAM_FIFO) + 0x00000000 + + + STREAM + [31:0] + read-only + modify + + + + + QMI_DIRECT_TX + 0x00000004 + Write to the QMI direct-mode TX FIFO (fast bus access to QMI_DIRECT_TX) + 0x00000000 + + + NOPUSH + Inhibit the RX FIFO push that would correspond to this TX FIFO entry. + + Useful to avoid garbage appearing in the RX FIFO when pushing the command at the beginning of a SPI transfer. + [20:20] + write-only + + + OE + Output enable (active-high). For single width (SPI), this field is ignored, and SD0 is always set to output, with SD1 always set to input. + + For dual and quad width (DSPI/QSPI), this sets whether the relevant SDx pads are set to output whilst transferring this FIFO record. In this case the command/address should have OE set, and the data transfer should have OE set or clear depending on the direction of the transfer. + [19:19] + write-only + + + DWIDTH + Data width. If 0, hardware will transmit the 8 LSBs of the DIRECT_TX DATA field, and return an 8-bit value in the 8 LSBs of DIRECT_RX. If 1, the full 16-bit width is used. 8-bit and 16-bit transfers can be mixed freely. + [18:18] + write-only + + + IWIDTH + Configure whether this FIFO record is transferred with single/dual/quad interface width (0/1/2). Different widths can be mixed freely. + [17:16] + write-only + + + S + 0 + Single width + + + D + 1 + Dual width + + + Q + 2 + Quad width + + + + + DATA + Data pushed here will be clocked out falling edges of SCK (or before the very first rising edge of SCK, if this is the first pulse). For each byte clocked out, the interface will simultaneously sample one byte, on rising edges of SCK, and push this to the DIRECT_RX FIFO. + + For 16-bit data, the least-significant byte is transmitted first. + [15:0] + write-only + + + + + QMI_DIRECT_RX + 0x00000008 + Read from the QMI direct-mode RX FIFO (fast bus access to QMI_DIRECT_RX) + 0x00000000 + + + QMI_DIRECT_RX + With each byte clocked out on the serial interface, one byte will simultaneously be clocked in, and will appear in this FIFO. The serial interface will stall when this FIFO is full, to avoid dropping data. + + When 16-bit data is pushed into the TX FIFO, the corresponding RX FIFO push will also contain 16 bits of data. The least-significant byte is the first one received. + [15:0] + read-only + modify + + + + + + + SYSCFG + Register block for various chip control signals + 0x40008000 + + 0 + 24 + registers + + + + PROC_CONFIG + 0x00000000 + Configuration for processors + 0x00000000 + + + PROC1_HALTED + Indication that proc1 has halted + [1:1] + read-only + + + PROC0_HALTED + Indication that proc0 has halted + [0:0] + read-only + + + + + PROC_IN_SYNC_BYPASS + 0x00000004 + For each bit, if 1, bypass the input synchronizer between that GPIO + and the GPIO input register in the SIO. The input synchronizers should + generally be unbypassed, to avoid injecting metastabilities into processors. + If you're feeling brave, you can bypass to save two cycles of input + latency. This register applies to GPIO 0...31. + 0x00000000 + + + GPIO + [31:0] + read-write + + + + + PROC_IN_SYNC_BYPASS_HI + 0x00000008 + For each bit, if 1, bypass the input synchronizer between that GPIO + and the GPIO input register in the SIO. The input synchronizers should + generally be unbypassed, to avoid injecting metastabilities into processors. + If you're feeling brave, you can bypass to save two cycles of input + latency. This register applies to GPIO 32...47. USB GPIO 56..57 QSPI GPIO 58..63 + 0x00000000 + + + QSPI_SD + [31:28] + read-write + + + QSPI_CSN + [27:27] + read-write + + + QSPI_SCK + [26:26] + read-write + + + USB_DM + [25:25] + read-write + + + USB_DP + [24:24] + read-write + + + GPIO + [15:0] + read-write + + + + + DBGFORCE + 0x0000000c + Directly control the chip SWD debug port + 0x00000006 + + + ATTACH + Attach chip debug port to syscfg controls, and disconnect it from external SWD pads. + [3:3] + read-write + + + SWCLK + Directly drive SWCLK, if ATTACH is set + [2:2] + read-write + + + SWDI + Directly drive SWDIO input, if ATTACH is set + [1:1] + read-write + + + SWDO + Observe the value of SWDIO output. + [0:0] + read-only + + + + + MEMPOWERDOWN + 0x00000010 + Control PD pins to memories. + Set high to put memories to a low power state. In this state the memories will retain contents but not be accessible + Use with caution + 0x00000000 + + + BOOTRAM + [12:12] + read-write + + + ROM + [11:11] + read-write + + + USB + [10:10] + read-write + + + SRAM9 + [9:9] + read-write + + + SRAM8 + [8:8] + read-write + + + SRAM7 + [7:7] + read-write + + + SRAM6 + [6:6] + read-write + + + SRAM5 + [5:5] + read-write + + + SRAM4 + [4:4] + read-write + + + SRAM3 + [3:3] + read-write + + + SRAM2 + [2:2] + read-write + + + SRAM1 + [1:1] + read-write + + + SRAM0 + [0:0] + read-write + + + + + AUXCTRL + 0x00000014 + Auxiliary system control register + 0x00000000 + + + AUXCTRL + * Bits 7:2: Reserved + + * Bit 1: When clear, the LPOSC output is XORed into the TRNG ROSC output as an additional, uncorrelated entropy source. When set, this behaviour is disabled. + + * Bit 0: Force POWMAN clock to switch to LPOSC, by asserting its WDRESET input. This must be set before initiating a watchdog reset of the RSM from a stage that includes CLOCKS, if POWMAN is running from clk_ref at the point that the watchdog reset takes place. Otherwise, the short pulse generated on clk_ref by the reset of the CLOCKS block may affect POWMAN register state. + [7:0] + read-write + + + + + + + XOSC + Controls the crystal oscillator + 0x40048000 + + 0 + 20 + registers + + + + CTRL + 0x00000000 + Crystal Oscillator Control + 0x00000000 + + + ENABLE + On power-up this field is initialised to DISABLE and the chip runs from the ROSC. + If the chip has subsequently been programmed to run from the XOSC then setting this field to DISABLE may lock-up the chip. If this is a concern then run the clk_ref from the ROSC and enable the clk_sys RESUS feature. + The 12-bit code is intended to give some protection against accidental writes. An invalid setting will retain the previous value. The actual value being used can be read from STATUS_ENABLED + [23:12] + read-write + + + DISABLE + 3358 + + + ENABLE + 4011 + + + + + FREQ_RANGE + The 12-bit code is intended to give some protection against accidental writes. An invalid setting will retain the previous value. The actual value being used can be read from STATUS_FREQ_RANGE + [11:0] + read-write + + + 1_15MHZ + 2720 + + + 10_30MHZ + 2721 + + + 25_60MHZ + 2722 + + + 40_100MHZ + 2723 + + + + + + + STATUS + 0x00000004 + Crystal Oscillator Status + 0x00000000 + + + STABLE + Oscillator is running and stable + [31:31] + read-only + + + BADWRITE + An invalid value has been written to CTRL_ENABLE or CTRL_FREQ_RANGE or DORMANT + [24:24] + read-write + oneToClear + + + ENABLED + Oscillator is enabled but not necessarily running and stable, resets to 0 + [12:12] + read-only + + + FREQ_RANGE + The current frequency range setting + [1:0] + read-only + + + 1_15MHZ + 0 + + + 10_30MHZ + 1 + + + 25_60MHZ + 2 + + + 40_100MHZ + 3 + + + + + + + DORMANT + 0x00000008 + Crystal Oscillator pause control + 0x00000000 + + + DORMANT + This is used to save power by pausing the XOSC + On power-up this field is initialised to WAKE + An invalid write will also select WAKE + Warning: stop the PLLs before selecting dormant mode + Warning: setup the irq before selecting dormant mode + [31:0] + read-write + + + dormant + 1668246881 + + + WAKE + 2002873189 + + + + + + + STARTUP + 0x0000000c + Controls the startup delay + 0x00000000 + + + X4 + Multiplies the startup_delay by 4, just in case. The reset value is controlled by a mask-programmable tiecell and is provided in case we are booting from XOSC and the default startup delay is insufficient. The reset value is 0x0. + [20:20] + read-write + + + DELAY + in multiples of 256*xtal_period. The reset value of 0xc4 corresponds to approx 50 000 cycles. + [13:0] + read-write + + + + + COUNT + 0x00000010 + A down counter running at the xosc frequency which counts to zero and stops. + Can be used for short software pauses when setting up time sensitive hardware. + To start the counter, write a non-zero value. Reads will return 1 while the count is running and 0 when it has finished. + Minimum count value is 4. Count values <4 will be treated as count value =4. + Note that synchronisation to the register clock domain costs 2 register clock cycles and the counter cannot compensate for that. + 0x00000000 + + + COUNT + [15:0] + read-write + + + + + + + PLL_SYS + 0x40050000 + + 0 + 32 + registers + + + PLL_SYS_IRQ + 42 + + + + CS + 0x00000000 + Control and Status + GENERAL CONSTRAINTS: + Reference clock frequency min=5MHz, max=800MHz + Feedback divider min=16, max=320 + VCO frequency min=750MHz, max=1600MHz + 0x00000001 + + + LOCK + PLL is locked + [31:31] + read-only + + + LOCK_N + PLL is not locked + Ideally this is cleared when PLL lock is seen and this should never normally be set + [30:30] + read-write + oneToClear + + + BYPASS + Passes the reference clock to the output instead of the divided VCO. The VCO continues to run so the user can switch between the reference clock and the divided VCO but the output will glitch when doing so. + [8:8] + read-write + + + REFDIV + Divides the PLL input reference clock. + Behaviour is undefined for div=0. + PLL output will be unpredictable during refdiv changes, wait for lock=1 before using it. + [5:0] + read-write + + + + + PWR + 0x00000004 + Controls the PLL power modes. + 0x0000002d + + + VCOPD + PLL VCO powerdown + To save power set high when PLL output not required or bypass=1. + [5:5] + read-write + + + POSTDIVPD + PLL post divider powerdown + To save power set high when PLL output not required or bypass=1. + [3:3] + read-write + + + DSMPD + PLL DSM powerdown + Nothing is achieved by setting this low. + [2:2] + read-write + + + PD + PLL powerdown + To save power set high when PLL output not required. + [0:0] + read-write + + + + + FBDIV_INT + 0x00000008 + Feedback divisor + (note: this PLL does not support fractional division) + 0x00000000 + + + FBDIV_INT + see ctrl reg description for constraints + [11:0] + read-write + + + + + PRIM + 0x0000000c + Controls the PLL post dividers for the primary output + (note: this PLL does not have a secondary output) + the primary output is driven from VCO divided by postdiv1*postdiv2 + 0x00077000 + + + POSTDIV1 + divide by 1-7 + [18:16] + read-write + + + POSTDIV2 + divide by 1-7 + [14:12] + read-write + + + + + INTR + 0x00000010 + Raw Interrupts + 0x00000000 + + + LOCK_N_STICKY + [0:0] + read-write + oneToClear + + + + + INTE + 0x00000014 + Interrupt Enable + 0x00000000 + + + LOCK_N_STICKY + [0:0] + read-write + + + + + INTF + 0x00000018 + Interrupt Force + 0x00000000 + + + LOCK_N_STICKY + [0:0] + read-write + + + + + INTS + 0x0000001c + Interrupt status after masking & forcing + 0x00000000 + + + LOCK_N_STICKY + [0:0] + read-only + + + + + + + PLL_USB + 0x40058000 + + PLL_USB_IRQ + 43 + + + + ACCESSCTRL + Hardware access control registers + 0x40060000 + + 0 + 236 + registers + + + + LOCK + 0x00000000 + Once a LOCK bit is written to 1, ACCESSCTRL silently ignores writes from that master. LOCK is writable only by a Secure, Privileged processor or debugger. + + LOCK bits are only writable when their value is zero. Once set, they can never be cleared, except by a full reset of ACCESSCTRL + + Setting the LOCK bit does not affect whether an access raises a bus error. Unprivileged writes, or writes from the DMA, will continue to raise bus errors. All other accesses will continue not to. + 0x00000004 + + + DEBUG + [3:3] + read-write + + + DMA + [2:2] + read-only + + + CORE1 + [1:1] + read-write + + + CORE0 + [0:0] + read-write + + + + + FORCE_CORE_NS + 0x00000004 + Force core 1's bus accesses to always be Non-secure, no matter the core's internal state. + + Useful for schemes where one core is designated as the Non-secure core, since some peripherals may filter individual registers internally based on security state but not on master ID. + 0x00000000 + + + CORE1 + [1:1] + read-write + + + + + CFGRESET + 0x00000008 + Write 1 to reset all ACCESSCTRL configuration, except for the LOCK and FORCE_CORE_NS registers. + + This bit is used in the RP2350 bootrom to quickly restore ACCESSCTRL to a known state during the boot path. + + Note that, like all registers in ACCESSCTRL, this register is not writable when the writer's corresponding LOCK bit is set, therefore a master which has been locked out of ACCESSCTRL can not use the CFGRESET register to disturb its contents. + 0x00000000 + + + CFGRESET + [0:0] + write-only + + + + + GPIO_NSMASK0 + 0x0000000c + Control whether GPIO0...31 are accessible to Non-secure code. Writable only by a Secure, Privileged processor or debugger. + + 0 -> Secure access only + + 1 -> Secure + Non-secure access + 0x00000000 + + + GPIO_NSMASK0 + [31:0] + read-write + + + + + GPIO_NSMASK1 + 0x00000010 + Control whether GPIO32..47 are accessible to Non-secure code, and whether QSPI and USB bitbang are accessible through the Non-secure SIO. Writable only by a Secure, Privileged processor or debugger. + 0x00000000 + + + QSPI_SD + [31:28] + read-write + + + QSPI_CSN + [27:27] + read-write + + + QSPI_SCK + [26:26] + read-write + + + USB_DM + [25:25] + read-write + + + USB_DP + [24:24] + read-write + + + GPIO + [15:0] + read-write + + + + + ROM + 0x00000014 + Control whether debugger, DMA, core 0 and core 1 can access ROM, and at what security/privilege levels they can do so. + + Defaults to fully open access. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000ff + + + DBG + If 1, ROM can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, ROM can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, ROM can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, ROM can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, ROM can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, ROM can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, ROM can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, ROM can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + XIP_MAIN + 0x00000018 + Control whether debugger, DMA, core 0 and core 1 can access XIP_MAIN, and at what security/privilege levels they can do so. + + Defaults to fully open access. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000ff + + + DBG + If 1, XIP_MAIN can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, XIP_MAIN can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, XIP_MAIN can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, XIP_MAIN can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, XIP_MAIN can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, XIP_MAIN can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, XIP_MAIN can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, XIP_MAIN can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + SRAM0 + 0x0000001c + Control whether debugger, DMA, core 0 and core 1 can access SRAM0, and at what security/privilege levels they can do so. + + Defaults to fully open access. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000ff + + + DBG + If 1, SRAM0 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, SRAM0 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, SRAM0 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, SRAM0 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, SRAM0 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, SRAM0 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, SRAM0 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, SRAM0 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + SRAM1 + 0x00000020 + Control whether debugger, DMA, core 0 and core 1 can access SRAM1, and at what security/privilege levels they can do so. + + Defaults to fully open access. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000ff + + + DBG + If 1, SRAM1 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, SRAM1 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, SRAM1 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, SRAM1 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, SRAM1 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, SRAM1 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, SRAM1 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, SRAM1 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + SRAM2 + 0x00000024 + Control whether debugger, DMA, core 0 and core 1 can access SRAM2, and at what security/privilege levels they can do so. + + Defaults to fully open access. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000ff + + + DBG + If 1, SRAM2 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, SRAM2 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, SRAM2 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, SRAM2 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, SRAM2 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, SRAM2 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, SRAM2 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, SRAM2 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + SRAM3 + 0x00000028 + Control whether debugger, DMA, core 0 and core 1 can access SRAM3, and at what security/privilege levels they can do so. + + Defaults to fully open access. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000ff + + + DBG + If 1, SRAM3 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, SRAM3 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, SRAM3 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, SRAM3 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, SRAM3 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, SRAM3 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, SRAM3 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, SRAM3 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + SRAM4 + 0x0000002c + Control whether debugger, DMA, core 0 and core 1 can access SRAM4, and at what security/privilege levels they can do so. + + Defaults to fully open access. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000ff + + + DBG + If 1, SRAM4 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, SRAM4 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, SRAM4 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, SRAM4 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, SRAM4 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, SRAM4 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, SRAM4 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, SRAM4 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + SRAM5 + 0x00000030 + Control whether debugger, DMA, core 0 and core 1 can access SRAM5, and at what security/privilege levels they can do so. + + Defaults to fully open access. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000ff + + + DBG + If 1, SRAM5 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, SRAM5 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, SRAM5 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, SRAM5 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, SRAM5 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, SRAM5 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, SRAM5 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, SRAM5 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + SRAM6 + 0x00000034 + Control whether debugger, DMA, core 0 and core 1 can access SRAM6, and at what security/privilege levels they can do so. + + Defaults to fully open access. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000ff + + + DBG + If 1, SRAM6 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, SRAM6 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, SRAM6 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, SRAM6 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, SRAM6 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, SRAM6 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, SRAM6 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, SRAM6 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + SRAM7 + 0x00000038 + Control whether debugger, DMA, core 0 and core 1 can access SRAM7, and at what security/privilege levels they can do so. + + Defaults to fully open access. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000ff + + + DBG + If 1, SRAM7 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, SRAM7 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, SRAM7 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, SRAM7 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, SRAM7 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, SRAM7 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, SRAM7 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, SRAM7 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + SRAM8 + 0x0000003c + Control whether debugger, DMA, core 0 and core 1 can access SRAM8, and at what security/privilege levels they can do so. + + Defaults to fully open access. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000ff + + + DBG + If 1, SRAM8 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, SRAM8 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, SRAM8 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, SRAM8 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, SRAM8 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, SRAM8 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, SRAM8 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, SRAM8 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + SRAM9 + 0x00000040 + Control whether debugger, DMA, core 0 and core 1 can access SRAM9, and at what security/privilege levels they can do so. + + Defaults to fully open access. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000ff + + + DBG + If 1, SRAM9 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, SRAM9 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, SRAM9 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, SRAM9 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, SRAM9 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, SRAM9 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, SRAM9 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, SRAM9 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + DMA + 0x00000044 + Control whether debugger, DMA, core 0 and core 1 can access DMA, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, DMA can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, DMA can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, DMA can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, DMA can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, DMA can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, DMA can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, DMA can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, DMA can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + USBCTRL + 0x00000048 + Control whether debugger, DMA, core 0 and core 1 can access USBCTRL, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, USBCTRL can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, USBCTRL can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, USBCTRL can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, USBCTRL can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, USBCTRL can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, USBCTRL can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, USBCTRL can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, USBCTRL can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + PIO0 + 0x0000004c + Control whether debugger, DMA, core 0 and core 1 can access PIO0, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, PIO0 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, PIO0 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, PIO0 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, PIO0 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, PIO0 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, PIO0 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, PIO0 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, PIO0 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + PIO1 + 0x00000050 + Control whether debugger, DMA, core 0 and core 1 can access PIO1, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, PIO1 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, PIO1 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, PIO1 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, PIO1 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, PIO1 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, PIO1 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, PIO1 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, PIO1 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + PIO2 + 0x00000054 + Control whether debugger, DMA, core 0 and core 1 can access PIO2, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, PIO2 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, PIO2 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, PIO2 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, PIO2 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, PIO2 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, PIO2 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, PIO2 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, PIO2 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + CORESIGHT_TRACE + 0x00000058 + Control whether debugger, DMA, core 0 and core 1 can access CORESIGHT_TRACE, and at what security/privilege levels they can do so. + + Defaults to Secure, Privileged processor or debug access only. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000b8 + + + DBG + If 1, CORESIGHT_TRACE can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, CORESIGHT_TRACE can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, CORESIGHT_TRACE can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, CORESIGHT_TRACE can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, CORESIGHT_TRACE can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, CORESIGHT_TRACE can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, CORESIGHT_TRACE can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, CORESIGHT_TRACE can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + CORESIGHT_PERIPH + 0x0000005c + Control whether debugger, DMA, core 0 and core 1 can access CORESIGHT_PERIPH, and at what security/privilege levels they can do so. + + Defaults to Secure, Privileged processor or debug access only. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000b8 + + + DBG + If 1, CORESIGHT_PERIPH can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, CORESIGHT_PERIPH can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, CORESIGHT_PERIPH can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, CORESIGHT_PERIPH can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, CORESIGHT_PERIPH can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, CORESIGHT_PERIPH can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, CORESIGHT_PERIPH can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, CORESIGHT_PERIPH can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + SYSINFO + 0x00000060 + Control whether debugger, DMA, core 0 and core 1 can access SYSINFO, and at what security/privilege levels they can do so. + + Defaults to fully open access. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000ff + + + DBG + If 1, SYSINFO can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, SYSINFO can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, SYSINFO can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, SYSINFO can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, SYSINFO can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, SYSINFO can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, SYSINFO can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, SYSINFO can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + RESETS + 0x00000064 + Control whether debugger, DMA, core 0 and core 1 can access RESETS, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, RESETS can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, RESETS can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, RESETS can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, RESETS can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, RESETS can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, RESETS can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, RESETS can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, RESETS can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + IO_BANK0 + 0x00000068 + Control whether debugger, DMA, core 0 and core 1 can access IO_BANK0, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, IO_BANK0 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, IO_BANK0 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, IO_BANK0 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, IO_BANK0 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, IO_BANK0 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, IO_BANK0 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, IO_BANK0 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, IO_BANK0 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + IO_BANK1 + 0x0000006c + Control whether debugger, DMA, core 0 and core 1 can access IO_BANK1, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, IO_BANK1 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, IO_BANK1 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, IO_BANK1 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, IO_BANK1 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, IO_BANK1 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, IO_BANK1 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, IO_BANK1 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, IO_BANK1 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + PADS_BANK0 + 0x00000070 + Control whether debugger, DMA, core 0 and core 1 can access PADS_BANK0, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, PADS_BANK0 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, PADS_BANK0 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, PADS_BANK0 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, PADS_BANK0 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, PADS_BANK0 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, PADS_BANK0 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, PADS_BANK0 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, PADS_BANK0 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + PADS_QSPI + 0x00000074 + Control whether debugger, DMA, core 0 and core 1 can access PADS_QSPI, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, PADS_QSPI can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, PADS_QSPI can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, PADS_QSPI can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, PADS_QSPI can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, PADS_QSPI can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, PADS_QSPI can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, PADS_QSPI can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, PADS_QSPI can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + BUSCTRL + 0x00000078 + Control whether debugger, DMA, core 0 and core 1 can access BUSCTRL, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, BUSCTRL can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, BUSCTRL can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, BUSCTRL can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, BUSCTRL can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, BUSCTRL can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, BUSCTRL can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, BUSCTRL can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, BUSCTRL can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + ADC0 + 0x0000007c + Control whether debugger, DMA, core 0 and core 1 can access ADC0, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, ADC0 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, ADC0 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, ADC0 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, ADC0 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, ADC0 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, ADC0 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, ADC0 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, ADC0 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + HSTX + 0x00000080 + Control whether debugger, DMA, core 0 and core 1 can access HSTX, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, HSTX can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, HSTX can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, HSTX can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, HSTX can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, HSTX can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, HSTX can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, HSTX can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, HSTX can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + I2C0 + 0x00000084 + Control whether debugger, DMA, core 0 and core 1 can access I2C0, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, I2C0 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, I2C0 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, I2C0 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, I2C0 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, I2C0 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, I2C0 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, I2C0 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, I2C0 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + I2C1 + 0x00000088 + Control whether debugger, DMA, core 0 and core 1 can access I2C1, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, I2C1 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, I2C1 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, I2C1 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, I2C1 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, I2C1 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, I2C1 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, I2C1 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, I2C1 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + PWM + 0x0000008c + Control whether debugger, DMA, core 0 and core 1 can access PWM, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, PWM can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, PWM can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, PWM can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, PWM can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, PWM can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, PWM can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, PWM can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, PWM can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + SPI0 + 0x00000090 + Control whether debugger, DMA, core 0 and core 1 can access SPI0, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, SPI0 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, SPI0 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, SPI0 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, SPI0 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, SPI0 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, SPI0 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, SPI0 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, SPI0 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + SPI1 + 0x00000094 + Control whether debugger, DMA, core 0 and core 1 can access SPI1, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, SPI1 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, SPI1 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, SPI1 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, SPI1 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, SPI1 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, SPI1 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, SPI1 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, SPI1 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + TIMER0 + 0x00000098 + Control whether debugger, DMA, core 0 and core 1 can access TIMER0, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, TIMER0 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, TIMER0 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, TIMER0 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, TIMER0 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, TIMER0 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, TIMER0 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, TIMER0 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, TIMER0 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + TIMER1 + 0x0000009c + Control whether debugger, DMA, core 0 and core 1 can access TIMER1, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, TIMER1 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, TIMER1 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, TIMER1 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, TIMER1 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, TIMER1 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, TIMER1 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, TIMER1 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, TIMER1 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + UART0 + 0x000000a0 + Control whether debugger, DMA, core 0 and core 1 can access UART0, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, UART0 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, UART0 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, UART0 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, UART0 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, UART0 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, UART0 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, UART0 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, UART0 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + UART1 + 0x000000a4 + Control whether debugger, DMA, core 0 and core 1 can access UART1, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, UART1 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, UART1 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, UART1 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, UART1 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, UART1 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, UART1 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, UART1 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, UART1 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + OTP + 0x000000a8 + Control whether debugger, DMA, core 0 and core 1 can access OTP, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, OTP can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, OTP can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, OTP can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, OTP can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, OTP can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, OTP can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, OTP can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, OTP can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + TBMAN + 0x000000ac + Control whether debugger, DMA, core 0 and core 1 can access TBMAN, and at what security/privilege levels they can do so. + + Defaults to Secure access from any master. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000fc + + + DBG + If 1, TBMAN can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, TBMAN can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, TBMAN can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, TBMAN can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, TBMAN can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, TBMAN can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, TBMAN can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, TBMAN can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + POWMAN + 0x000000b0 + Control whether debugger, DMA, core 0 and core 1 can access POWMAN, and at what security/privilege levels they can do so. + + Defaults to Secure, Privileged processor or debug access only. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000b8 + + + DBG + If 1, POWMAN can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, POWMAN can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, POWMAN can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, POWMAN can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, POWMAN can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, POWMAN can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, POWMAN can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, POWMAN can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + TRNG + 0x000000b4 + Control whether debugger, DMA, core 0 and core 1 can access TRNG, and at what security/privilege levels they can do so. + + Defaults to Secure, Privileged processor or debug access only. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000b8 + + + DBG + If 1, TRNG can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, TRNG can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, TRNG can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, TRNG can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, TRNG can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, TRNG can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, TRNG can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, TRNG can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + SHA256 + 0x000000b8 + Control whether debugger, DMA, core 0 and core 1 can access SHA256, and at what security/privilege levels they can do so. + + Defaults to Secure, Privileged access only. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000f8 + + + DBG + If 1, SHA256 can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, SHA256 can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, SHA256 can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, SHA256 can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, SHA256 can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, SHA256 can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, SHA256 can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, SHA256 can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + SYSCFG + 0x000000bc + Control whether debugger, DMA, core 0 and core 1 can access SYSCFG, and at what security/privilege levels they can do so. + + Defaults to Secure, Privileged processor or debug access only. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000b8 + + + DBG + If 1, SYSCFG can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, SYSCFG can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, SYSCFG can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, SYSCFG can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, SYSCFG can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, SYSCFG can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, SYSCFG can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, SYSCFG can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + CLOCKS + 0x000000c0 + Control whether debugger, DMA, core 0 and core 1 can access CLOCKS, and at what security/privilege levels they can do so. + + Defaults to Secure, Privileged processor or debug access only. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000b8 + + + DBG + If 1, CLOCKS can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, CLOCKS can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, CLOCKS can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, CLOCKS can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, CLOCKS can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, CLOCKS can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, CLOCKS can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, CLOCKS can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + XOSC + 0x000000c4 + Control whether debugger, DMA, core 0 and core 1 can access XOSC, and at what security/privilege levels they can do so. + + Defaults to Secure, Privileged processor or debug access only. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000b8 + + + DBG + If 1, XOSC can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, XOSC can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, XOSC can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, XOSC can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, XOSC can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, XOSC can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, XOSC can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, XOSC can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + ROSC + 0x000000c8 + Control whether debugger, DMA, core 0 and core 1 can access ROSC, and at what security/privilege levels they can do so. + + Defaults to Secure, Privileged processor or debug access only. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000b8 + + + DBG + If 1, ROSC can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, ROSC can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, ROSC can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, ROSC can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, ROSC can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, ROSC can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, ROSC can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, ROSC can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + PLL_SYS + 0x000000cc + Control whether debugger, DMA, core 0 and core 1 can access PLL_SYS, and at what security/privilege levels they can do so. + + Defaults to Secure, Privileged processor or debug access only. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000b8 + + + DBG + If 1, PLL_SYS can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, PLL_SYS can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, PLL_SYS can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, PLL_SYS can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, PLL_SYS can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, PLL_SYS can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, PLL_SYS can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, PLL_SYS can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + PLL_USB + 0x000000d0 + Control whether debugger, DMA, core 0 and core 1 can access PLL_USB, and at what security/privilege levels they can do so. + + Defaults to Secure, Privileged processor or debug access only. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000b8 + + + DBG + If 1, PLL_USB can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, PLL_USB can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, PLL_USB can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, PLL_USB can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, PLL_USB can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, PLL_USB can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, PLL_USB can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, PLL_USB can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + TICKS + 0x000000d4 + Control whether debugger, DMA, core 0 and core 1 can access TICKS, and at what security/privilege levels they can do so. + + Defaults to Secure, Privileged processor or debug access only. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000b8 + + + DBG + If 1, TICKS can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, TICKS can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, TICKS can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, TICKS can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, TICKS can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, TICKS can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, TICKS can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, TICKS can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + WATCHDOG + 0x000000d8 + Control whether debugger, DMA, core 0 and core 1 can access WATCHDOG, and at what security/privilege levels they can do so. + + Defaults to Secure, Privileged processor or debug access only. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000b8 + + + DBG + If 1, WATCHDOG can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, WATCHDOG can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, WATCHDOG can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, WATCHDOG can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, WATCHDOG can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, WATCHDOG can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, WATCHDOG can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, WATCHDOG can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + RSM + 0x000000dc + Control whether debugger, DMA, core 0 and core 1 can access RSM, and at what security/privilege levels they can do so. + + Defaults to Secure, Privileged processor or debug access only. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000b8 + + + DBG + If 1, RSM can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, RSM can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, RSM can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, RSM can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, RSM can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, RSM can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, RSM can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, RSM can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + XIP_CTRL + 0x000000e0 + Control whether debugger, DMA, core 0 and core 1 can access XIP_CTRL, and at what security/privilege levels they can do so. + + Defaults to Secure, Privileged processor or debug access only. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000b8 + + + DBG + If 1, XIP_CTRL can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, XIP_CTRL can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, XIP_CTRL can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, XIP_CTRL can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, XIP_CTRL can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, XIP_CTRL can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, XIP_CTRL can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, XIP_CTRL can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + XIP_QMI + 0x000000e4 + Control whether debugger, DMA, core 0 and core 1 can access XIP_QMI, and at what security/privilege levels they can do so. + + Defaults to Secure, Privileged processor or debug access only. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000b8 + + + DBG + If 1, XIP_QMI can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, XIP_QMI can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, XIP_QMI can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, XIP_QMI can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, XIP_QMI can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, XIP_QMI can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, XIP_QMI can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, XIP_QMI can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + XIP_AUX + 0x000000e8 + Control whether debugger, DMA, core 0 and core 1 can access XIP_AUX, and at what security/privilege levels they can do so. + + Defaults to Secure, Privileged access only. + + This register is writable only from a Secure, Privileged processor or debugger, with the exception of the NSU bit, which becomes Non-secure-Privileged-writable when the NSP bit is set. + 0x000000f8 + + + DBG + If 1, XIP_AUX can be accessed by the debugger, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [7:7] + read-write + + + DMA + If 1, XIP_AUX can be accessed by the DMA, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [6:6] + read-write + + + CORE1 + If 1, XIP_AUX can be accessed by core 1, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [5:5] + read-write + + + CORE0 + If 1, XIP_AUX can be accessed by core 0, at security/privilege levels permitted by SP/NSP/SU/NSU in this register. + [4:4] + read-write + + + SP + If 1, XIP_AUX can be accessed from a Secure, Privileged context. + [3:3] + read-write + + + SU + If 1, and SP is also set, XIP_AUX can be accessed from a Secure, Unprivileged context. + [2:2] + read-write + + + NSP + If 1, XIP_AUX can be accessed from a Non-secure, Privileged context. + [1:1] + read-write + + + NSU + If 1, and NSP is also set, XIP_AUX can be accessed from a Non-secure, Unprivileged context. + + This bit is writable from a Non-secure, Privileged context, if and only if the NSP bit is set. + [0:0] + read-write + + + + + + + UART0 + 0x40070000 + + 0 + 4096 + registers + + + UART0_IRQ + 33 + + + + UARTDR + 0x00000000 + Data Register, UARTDR + 0x00000000 + + + OE + Overrun error. This bit is set to 1 if data is received and the receive FIFO is already full. This is cleared to 0 once there is an empty space in the FIFO and a new character can be written to it. + [11:11] + read-only + + + BE + Break error. This bit is set to 1 if a break condition was detected, indicating that the received data input was held LOW for longer than a full-word transmission time (defined as start, data, parity and stop bits). In FIFO mode, this error is associated with the character at the top of the FIFO. When a break occurs, only one 0 character is loaded into the FIFO. The next character is only enabled after the receive data input goes to a 1 (marking state), and the next valid start bit is received. + [10:10] + read-only + + + PE + Parity error. When set to 1, it indicates that the parity of the received data character does not match the parity that the EPS and SPS bits in the Line Control Register, UARTLCR_H. In FIFO mode, this error is associated with the character at the top of the FIFO. + [9:9] + read-only + + + FE + Framing error. When set to 1, it indicates that the received character did not have a valid stop bit (a valid stop bit is 1). In FIFO mode, this error is associated with the character at the top of the FIFO. + [8:8] + read-only + + + DATA + Receive (read) data character. Transmit (write) data character. + [7:0] + read-write + modify + + + + + UARTRSR + 0x00000004 + Receive Status Register/Error Clear Register, UARTRSR/UARTECR + 0x00000000 + + + OE + Overrun error. This bit is set to 1 if data is received and the FIFO is already full. This bit is cleared to 0 by a write to UARTECR. The FIFO contents remain valid because no more data is written when the FIFO is full, only the contents of the shift register are overwritten. The CPU must now read the data, to empty the FIFO. + [3:3] + read-write + oneToClear + + + BE + Break error. This bit is set to 1 if a break condition was detected, indicating that the received data input was held LOW for longer than a full-word transmission time (defined as start, data, parity, and stop bits). This bit is cleared to 0 after a write to UARTECR. In FIFO mode, this error is associated with the character at the top of the FIFO. When a break occurs, only one 0 character is loaded into the FIFO. The next character is only enabled after the receive data input goes to a 1 (marking state) and the next valid start bit is received. + [2:2] + read-write + oneToClear + + + PE + Parity error. When set to 1, it indicates that the parity of the received data character does not match the parity that the EPS and SPS bits in the Line Control Register, UARTLCR_H. This bit is cleared to 0 by a write to UARTECR. In FIFO mode, this error is associated with the character at the top of the FIFO. + [1:1] + read-write + oneToClear + + + FE + Framing error. When set to 1, it indicates that the received character did not have a valid stop bit (a valid stop bit is 1). This bit is cleared to 0 by a write to UARTECR. In FIFO mode, this error is associated with the character at the top of the FIFO. + [0:0] + read-write + oneToClear + + + + + UARTFR + 0x00000018 + Flag Register, UARTFR + 0x00000090 + + + RI + Ring indicator. This bit is the complement of the UART ring indicator, nUARTRI, modem status input. That is, the bit is 1 when nUARTRI is LOW. + [8:8] + read-only + + + TXFE + Transmit FIFO empty. The meaning of this bit depends on the state of the FEN bit in the Line Control Register, UARTLCR_H. If the FIFO is disabled, this bit is set when the transmit holding register is empty. If the FIFO is enabled, the TXFE bit is set when the transmit FIFO is empty. This bit does not indicate if there is data in the transmit shift register. + [7:7] + read-only + + + RXFF + Receive FIFO full. The meaning of this bit depends on the state of the FEN bit in the UARTLCR_H Register. If the FIFO is disabled, this bit is set when the receive holding register is full. If the FIFO is enabled, the RXFF bit is set when the receive FIFO is full. + [6:6] + read-only + + + TXFF + Transmit FIFO full. The meaning of this bit depends on the state of the FEN bit in the UARTLCR_H Register. If the FIFO is disabled, this bit is set when the transmit holding register is full. If the FIFO is enabled, the TXFF bit is set when the transmit FIFO is full. + [5:5] + read-only + + + RXFE + Receive FIFO empty. The meaning of this bit depends on the state of the FEN bit in the UARTLCR_H Register. If the FIFO is disabled, this bit is set when the receive holding register is empty. If the FIFO is enabled, the RXFE bit is set when the receive FIFO is empty. + [4:4] + read-only + + + BUSY + UART busy. If this bit is set to 1, the UART is busy transmitting data. This bit remains set until the complete byte, including all the stop bits, has been sent from the shift register. This bit is set as soon as the transmit FIFO becomes non-empty, regardless of whether the UART is enabled or not. + [3:3] + read-only + + + DCD + Data carrier detect. This bit is the complement of the UART data carrier detect, nUARTDCD, modem status input. That is, the bit is 1 when nUARTDCD is LOW. + [2:2] + read-only + + + DSR + Data set ready. This bit is the complement of the UART data set ready, nUARTDSR, modem status input. That is, the bit is 1 when nUARTDSR is LOW. + [1:1] + read-only + + + CTS + Clear to send. This bit is the complement of the UART clear to send, nUARTCTS, modem status input. That is, the bit is 1 when nUARTCTS is LOW. + [0:0] + read-only + + + + + UARTILPR + 0x00000020 + IrDA Low-Power Counter Register, UARTILPR + 0x00000000 + + + ILPDVSR + 8-bit low-power divisor value. These bits are cleared to 0 at reset. + [7:0] + read-write + + + + + UARTIBRD + 0x00000024 + Integer Baud Rate Register, UARTIBRD + 0x00000000 + + + BAUD_DIVINT + The integer baud rate divisor. These bits are cleared to 0 on reset. + [15:0] + read-write + + + + + UARTFBRD + 0x00000028 + Fractional Baud Rate Register, UARTFBRD + 0x00000000 + + + BAUD_DIVFRAC + The fractional baud rate divisor. These bits are cleared to 0 on reset. + [5:0] + read-write + + + + + UARTLCR_H + 0x0000002c + Line Control Register, UARTLCR_H + 0x00000000 + + + SPS + Stick parity select. 0 = stick parity is disabled 1 = either: * if the EPS bit is 0 then the parity bit is transmitted and checked as a 1 * if the EPS bit is 1 then the parity bit is transmitted and checked as a 0. This bit has no effect when the PEN bit disables parity checking and generation. + [7:7] + read-write + + + WLEN + Word length. These bits indicate the number of data bits transmitted or received in a frame as follows: b11 = 8 bits b10 = 7 bits b01 = 6 bits b00 = 5 bits. + [6:5] + read-write + + + FEN + Enable FIFOs: 0 = FIFOs are disabled (character mode) that is, the FIFOs become 1-byte-deep holding registers 1 = transmit and receive FIFO buffers are enabled (FIFO mode). + [4:4] + read-write + + + STP2 + Two stop bits select. If this bit is set to 1, two stop bits are transmitted at the end of the frame. The receive logic does not check for two stop bits being received. + [3:3] + read-write + + + EPS + Even parity select. Controls the type of parity the UART uses during transmission and reception: 0 = odd parity. The UART generates or checks for an odd number of 1s in the data and parity bits. 1 = even parity. The UART generates or checks for an even number of 1s in the data and parity bits. This bit has no effect when the PEN bit disables parity checking and generation. + [2:2] + read-write + + + PEN + Parity enable: 0 = parity is disabled and no parity bit added to the data frame 1 = parity checking and generation is enabled. + [1:1] + read-write + + + BRK + Send break. If this bit is set to 1, a low-level is continually output on the UARTTXD output, after completing transmission of the current character. For the proper execution of the break command, the software must set this bit for at least two complete frames. For normal use, this bit must be cleared to 0. + [0:0] + read-write + + + + + UARTCR + 0x00000030 + Control Register, UARTCR + 0x00000300 + + + CTSEN + CTS hardware flow control enable. If this bit is set to 1, CTS hardware flow control is enabled. Data is only transmitted when the nUARTCTS signal is asserted. + [15:15] + read-write + + + RTSEN + RTS hardware flow control enable. If this bit is set to 1, RTS hardware flow control is enabled. Data is only requested when there is space in the receive FIFO for it to be received. + [14:14] + read-write + + + OUT2 + This bit is the complement of the UART Out2 (nUARTOut2) modem status output. That is, when the bit is programmed to a 1, the output is 0. For DTE this can be used as Ring Indicator (RI). + [13:13] + read-write + + + OUT1 + This bit is the complement of the UART Out1 (nUARTOut1) modem status output. That is, when the bit is programmed to a 1 the output is 0. For DTE this can be used as Data Carrier Detect (DCD). + [12:12] + read-write + + + RTS + Request to send. This bit is the complement of the UART request to send, nUARTRTS, modem status output. That is, when the bit is programmed to a 1 then nUARTRTS is LOW. + [11:11] + read-write + + + DTR + Data transmit ready. This bit is the complement of the UART data transmit ready, nUARTDTR, modem status output. That is, when the bit is programmed to a 1 then nUARTDTR is LOW. + [10:10] + read-write + + + RXE + Receive enable. If this bit is set to 1, the receive section of the UART is enabled. Data reception occurs for either UART signals or SIR signals depending on the setting of the SIREN bit. When the UART is disabled in the middle of reception, it completes the current character before stopping. + [9:9] + read-write + + + TXE + Transmit enable. If this bit is set to 1, the transmit section of the UART is enabled. Data transmission occurs for either UART signals, or SIR signals depending on the setting of the SIREN bit. When the UART is disabled in the middle of transmission, it completes the current character before stopping. + [8:8] + read-write + + + LBE + Loopback enable. If this bit is set to 1 and the SIREN bit is set to 1 and the SIRTEST bit in the Test Control Register, UARTTCR is set to 1, then the nSIROUT path is inverted, and fed through to the SIRIN path. The SIRTEST bit in the test register must be set to 1 to override the normal half-duplex SIR operation. This must be the requirement for accessing the test registers during normal operation, and SIRTEST must be cleared to 0 when loopback testing is finished. This feature reduces the amount of external coupling required during system test. If this bit is set to 1, and the SIRTEST bit is set to 0, the UARTTXD path is fed through to the UARTRXD path. In either SIR mode or UART mode, when this bit is set, the modem outputs are also fed through to the modem inputs. This bit is cleared to 0 on reset, to disable loopback. + [7:7] + read-write + + + SIRLP + SIR low-power IrDA mode. This bit selects the IrDA encoding mode. If this bit is cleared to 0, low-level bits are transmitted as an active high pulse with a width of 3 / 16th of the bit period. If this bit is set to 1, low-level bits are transmitted with a pulse width that is 3 times the period of the IrLPBaud16 input signal, regardless of the selected bit rate. Setting this bit uses less power, but might reduce transmission distances. + [2:2] + read-write + + + SIREN + SIR enable: 0 = IrDA SIR ENDEC is disabled. nSIROUT remains LOW (no light pulse generated), and signal transitions on SIRIN have no effect. 1 = IrDA SIR ENDEC is enabled. Data is transmitted and received on nSIROUT and SIRIN. UARTTXD remains HIGH, in the marking state. Signal transitions on UARTRXD or modem status inputs have no effect. This bit has no effect if the UARTEN bit disables the UART. + [1:1] + read-write + + + UARTEN + UART enable: 0 = UART is disabled. If the UART is disabled in the middle of transmission or reception, it completes the current character before stopping. 1 = the UART is enabled. Data transmission and reception occurs for either UART signals or SIR signals depending on the setting of the SIREN bit. + [0:0] + read-write + + + + + UARTIFLS + 0x00000034 + Interrupt FIFO Level Select Register, UARTIFLS + 0x00000012 + + + RXIFLSEL + Receive interrupt FIFO level select. The trigger points for the receive interrupt are as follows: b000 = Receive FIFO becomes >= 1 / 8 full b001 = Receive FIFO becomes >= 1 / 4 full b010 = Receive FIFO becomes >= 1 / 2 full b011 = Receive FIFO becomes >= 3 / 4 full b100 = Receive FIFO becomes >= 7 / 8 full b101-b111 = reserved. + [5:3] + read-write + + + TXIFLSEL + Transmit interrupt FIFO level select. The trigger points for the transmit interrupt are as follows: b000 = Transmit FIFO becomes <= 1 / 8 full b001 = Transmit FIFO becomes <= 1 / 4 full b010 = Transmit FIFO becomes <= 1 / 2 full b011 = Transmit FIFO becomes <= 3 / 4 full b100 = Transmit FIFO becomes <= 7 / 8 full b101-b111 = reserved. + [2:0] + read-write + + + + + UARTIMSC + 0x00000038 + Interrupt Mask Set/Clear Register, UARTIMSC + 0x00000000 + + + OEIM + Overrun error interrupt mask. A read returns the current mask for the UARTOEINTR interrupt. On a write of 1, the mask of the UARTOEINTR interrupt is set. A write of 0 clears the mask. + [10:10] + read-write + + + BEIM + Break error interrupt mask. A read returns the current mask for the UARTBEINTR interrupt. On a write of 1, the mask of the UARTBEINTR interrupt is set. A write of 0 clears the mask. + [9:9] + read-write + + + PEIM + Parity error interrupt mask. A read returns the current mask for the UARTPEINTR interrupt. On a write of 1, the mask of the UARTPEINTR interrupt is set. A write of 0 clears the mask. + [8:8] + read-write + + + FEIM + Framing error interrupt mask. A read returns the current mask for the UARTFEINTR interrupt. On a write of 1, the mask of the UARTFEINTR interrupt is set. A write of 0 clears the mask. + [7:7] + read-write + + + RTIM + Receive timeout interrupt mask. A read returns the current mask for the UARTRTINTR interrupt. On a write of 1, the mask of the UARTRTINTR interrupt is set. A write of 0 clears the mask. + [6:6] + read-write + + + TXIM + Transmit interrupt mask. A read returns the current mask for the UARTTXINTR interrupt. On a write of 1, the mask of the UARTTXINTR interrupt is set. A write of 0 clears the mask. + [5:5] + read-write + + + RXIM + Receive interrupt mask. A read returns the current mask for the UARTRXINTR interrupt. On a write of 1, the mask of the UARTRXINTR interrupt is set. A write of 0 clears the mask. + [4:4] + read-write + + + DSRMIM + nUARTDSR modem interrupt mask. A read returns the current mask for the UARTDSRINTR interrupt. On a write of 1, the mask of the UARTDSRINTR interrupt is set. A write of 0 clears the mask. + [3:3] + read-write + + + DCDMIM + nUARTDCD modem interrupt mask. A read returns the current mask for the UARTDCDINTR interrupt. On a write of 1, the mask of the UARTDCDINTR interrupt is set. A write of 0 clears the mask. + [2:2] + read-write + + + CTSMIM + nUARTCTS modem interrupt mask. A read returns the current mask for the UARTCTSINTR interrupt. On a write of 1, the mask of the UARTCTSINTR interrupt is set. A write of 0 clears the mask. + [1:1] + read-write + + + RIMIM + nUARTRI modem interrupt mask. A read returns the current mask for the UARTRIINTR interrupt. On a write of 1, the mask of the UARTRIINTR interrupt is set. A write of 0 clears the mask. + [0:0] + read-write + + + + + UARTRIS + 0x0000003c + Raw Interrupt Status Register, UARTRIS + 0x00000000 + + + OERIS + Overrun error interrupt status. Returns the raw interrupt state of the UARTOEINTR interrupt. + [10:10] + read-only + + + BERIS + Break error interrupt status. Returns the raw interrupt state of the UARTBEINTR interrupt. + [9:9] + read-only + + + PERIS + Parity error interrupt status. Returns the raw interrupt state of the UARTPEINTR interrupt. + [8:8] + read-only + + + FERIS + Framing error interrupt status. Returns the raw interrupt state of the UARTFEINTR interrupt. + [7:7] + read-only + + + RTRIS + Receive timeout interrupt status. Returns the raw interrupt state of the UARTRTINTR interrupt. a + [6:6] + read-only + + + TXRIS + Transmit interrupt status. Returns the raw interrupt state of the UARTTXINTR interrupt. + [5:5] + read-only + + + RXRIS + Receive interrupt status. Returns the raw interrupt state of the UARTRXINTR interrupt. + [4:4] + read-only + + + DSRRMIS + nUARTDSR modem interrupt status. Returns the raw interrupt state of the UARTDSRINTR interrupt. + [3:3] + read-only + + + DCDRMIS + nUARTDCD modem interrupt status. Returns the raw interrupt state of the UARTDCDINTR interrupt. + [2:2] + read-only + + + CTSRMIS + nUARTCTS modem interrupt status. Returns the raw interrupt state of the UARTCTSINTR interrupt. + [1:1] + read-only + + + RIRMIS + nUARTRI modem interrupt status. Returns the raw interrupt state of the UARTRIINTR interrupt. + [0:0] + read-only + + + + + UARTMIS + 0x00000040 + Masked Interrupt Status Register, UARTMIS + 0x00000000 + + + OEMIS + Overrun error masked interrupt status. Returns the masked interrupt state of the UARTOEINTR interrupt. + [10:10] + read-only + + + BEMIS + Break error masked interrupt status. Returns the masked interrupt state of the UARTBEINTR interrupt. + [9:9] + read-only + + + PEMIS + Parity error masked interrupt status. Returns the masked interrupt state of the UARTPEINTR interrupt. + [8:8] + read-only + + + FEMIS + Framing error masked interrupt status. Returns the masked interrupt state of the UARTFEINTR interrupt. + [7:7] + read-only + + + RTMIS + Receive timeout masked interrupt status. Returns the masked interrupt state of the UARTRTINTR interrupt. + [6:6] + read-only + + + TXMIS + Transmit masked interrupt status. Returns the masked interrupt state of the UARTTXINTR interrupt. + [5:5] + read-only + + + RXMIS + Receive masked interrupt status. Returns the masked interrupt state of the UARTRXINTR interrupt. + [4:4] + read-only + + + DSRMMIS + nUARTDSR modem masked interrupt status. Returns the masked interrupt state of the UARTDSRINTR interrupt. + [3:3] + read-only + + + DCDMMIS + nUARTDCD modem masked interrupt status. Returns the masked interrupt state of the UARTDCDINTR interrupt. + [2:2] + read-only + + + CTSMMIS + nUARTCTS modem masked interrupt status. Returns the masked interrupt state of the UARTCTSINTR interrupt. + [1:1] + read-only + + + RIMMIS + nUARTRI modem masked interrupt status. Returns the masked interrupt state of the UARTRIINTR interrupt. + [0:0] + read-only + + + + + UARTICR + 0x00000044 + Interrupt Clear Register, UARTICR + 0x00000000 + + + OEIC + Overrun error interrupt clear. Clears the UARTOEINTR interrupt. + [10:10] + read-write + oneToClear + + + BEIC + Break error interrupt clear. Clears the UARTBEINTR interrupt. + [9:9] + read-write + oneToClear + + + PEIC + Parity error interrupt clear. Clears the UARTPEINTR interrupt. + [8:8] + read-write + oneToClear + + + FEIC + Framing error interrupt clear. Clears the UARTFEINTR interrupt. + [7:7] + read-write + oneToClear + + + RTIC + Receive timeout interrupt clear. Clears the UARTRTINTR interrupt. + [6:6] + read-write + oneToClear + + + TXIC + Transmit interrupt clear. Clears the UARTTXINTR interrupt. + [5:5] + read-write + oneToClear + + + RXIC + Receive interrupt clear. Clears the UARTRXINTR interrupt. + [4:4] + read-write + oneToClear + + + DSRMIC + nUARTDSR modem interrupt clear. Clears the UARTDSRINTR interrupt. + [3:3] + read-write + oneToClear + + + DCDMIC + nUARTDCD modem interrupt clear. Clears the UARTDCDINTR interrupt. + [2:2] + read-write + oneToClear + + + CTSMIC + nUARTCTS modem interrupt clear. Clears the UARTCTSINTR interrupt. + [1:1] + read-write + oneToClear + + + RIMIC + nUARTRI modem interrupt clear. Clears the UARTRIINTR interrupt. + [0:0] + read-write + oneToClear + + + + + UARTDMACR + 0x00000048 + DMA Control Register, UARTDMACR + 0x00000000 + + + DMAONERR + DMA on error. If this bit is set to 1, the DMA receive request outputs, UARTRXDMASREQ or UARTRXDMABREQ, are disabled when the UART error interrupt is asserted. + [2:2] + read-write + + + TXDMAE + Transmit DMA enable. If this bit is set to 1, DMA for the transmit FIFO is enabled. + [1:1] + read-write + + + RXDMAE + Receive DMA enable. If this bit is set to 1, DMA for the receive FIFO is enabled. + [0:0] + read-write + + + + + UARTPERIPHID0 + 0x00000fe0 + UARTPeriphID0 Register + 0x00000011 + + + PARTNUMBER0 + These bits read back as 0x11 + [7:0] + read-only + + + + + UARTPERIPHID1 + 0x00000fe4 + UARTPeriphID1 Register + 0x00000010 + + + DESIGNER0 + These bits read back as 0x1 + [7:4] + read-only + + + PARTNUMBER1 + These bits read back as 0x0 + [3:0] + read-only + + + + + UARTPERIPHID2 + 0x00000fe8 + UARTPeriphID2 Register + 0x00000034 + + + REVISION + This field depends on the revision of the UART: r1p0 0x0 r1p1 0x1 r1p3 0x2 r1p4 0x2 r1p5 0x3 + [7:4] + read-only + + + DESIGNER1 + These bits read back as 0x4 + [3:0] + read-only + + + + + UARTPERIPHID3 + 0x00000fec + UARTPeriphID3 Register + 0x00000000 + + + CONFIGURATION + These bits read back as 0x00 + [7:0] + read-only + + + + + UARTPCELLID0 + 0x00000ff0 + UARTPCellID0 Register + 0x0000000d + + + UARTPCELLID0 + These bits read back as 0x0D + [7:0] + read-only + + + + + UARTPCELLID1 + 0x00000ff4 + UARTPCellID1 Register + 0x000000f0 + + + UARTPCELLID1 + These bits read back as 0xF0 + [7:0] + read-only + + + + + UARTPCELLID2 + 0x00000ff8 + UARTPCellID2 Register + 0x00000005 + + + UARTPCELLID2 + These bits read back as 0x05 + [7:0] + read-only + + + + + UARTPCELLID3 + 0x00000ffc + UARTPCellID3 Register + 0x000000b1 + + + UARTPCELLID3 + These bits read back as 0xB1 + [7:0] + read-only + + + + + + + UART1 + 0x40078000 + + UART1_IRQ + 34 + + + + ROSC + 0x400e8000 + + 0 + 40 + registers + + + + CTRL + 0x00000000 + Ring Oscillator control + 0x00000aa0 + + + ENABLE + On power-up this field is initialised to ENABLE + The system clock must be switched to another source before setting this field to DISABLE otherwise the chip will lock up + The 12-bit code is intended to give some protection against accidental writes. An invalid setting will enable the oscillator. + [23:12] + read-write + + + DISABLE + 3358 + + + ENABLE + 4011 + + + + + FREQ_RANGE + Controls the number of delay stages in the ROSC ring + LOW uses stages 0 to 7 + MEDIUM uses stages 2 to 7 + HIGH uses stages 4 to 7 + TOOHIGH uses stages 6 to 7 and should not be used because its frequency exceeds design specifications + The clock output will not glitch when changing the range up one step at a time + The clock output will glitch when changing the range down + Note: the values here are gray coded which is why HIGH comes before TOOHIGH + [11:0] + read-write + + + LOW + 4004 + + + MEDIUM + 4005 + + + HIGH + 4007 + + + TOOHIGH + 4006 + + + + + + + FREQA + 0x00000004 + The FREQA & FREQB registers control the frequency by controlling the drive strength of each stage + The drive strength has 4 levels determined by the number of bits set + Increasing the number of bits set increases the drive strength and increases the oscillation frequency + 0 bits set is the default drive strength + 1 bit set doubles the drive strength + 2 bits set triples drive strength + 3 bits set quadruples drive strength + For frequency randomisation set both DS0_RANDOM=1 & DS1_RANDOM=1 + 0x00000000 + + + PASSWD + Set to 0x9696 to apply the settings + Any other value in this field will set all drive strengths to 0 + [31:16] + read-write + + + PASS + 38550 + + + + + DS3 + Stage 3 drive strength + [14:12] + read-write + + + DS2 + Stage 2 drive strength + [10:8] + read-write + + + DS1_RANDOM + Randomises the stage 1 drive strength + [7:7] + read-write + + + DS1 + Stage 1 drive strength + [6:4] + read-write + + + DS0_RANDOM + Randomises the stage 0 drive strength + [3:3] + read-write + + + DS0 + Stage 0 drive strength + [2:0] + read-write + + + + + FREQB + 0x00000008 + For a detailed description see freqa register + 0x00000000 + + + PASSWD + Set to 0x9696 to apply the settings + Any other value in this field will set all drive strengths to 0 + [31:16] + read-write + + + PASS + 38550 + + + + + DS7 + Stage 7 drive strength + [14:12] + read-write + + + DS6 + Stage 6 drive strength + [10:8] + read-write + + + DS5 + Stage 5 drive strength + [6:4] + read-write + + + DS4 + Stage 4 drive strength + [2:0] + read-write + + + + + RANDOM + 0x0000000c + Loads a value to the LFSR randomiser + 0x3f04b16d + + + SEED + [31:0] + read-write + + + + + DORMANT + 0x00000010 + Ring Oscillator pause control + 0x00000000 + + + DORMANT + This is used to save power by pausing the ROSC + On power-up this field is initialised to WAKE + An invalid write will also select WAKE + Warning: setup the irq before selecting dormant mode + [31:0] + read-write + + + dormant + 1668246881 + + + WAKE + 2002873189 + + + + + + + DIV + 0x00000014 + Controls the output divider + 0x00000000 + + + DIV + set to 0xaa00 + div where + div = 0 divides by 128 + div = 1-127 divides by div + any other value sets div=128 + this register resets to div=32 + [15:0] + read-write + + + PASS + 43520 + + + + + + + PHASE + 0x00000018 + Controls the phase shifted output + 0x00000008 + + + PASSWD + set to 0xaa + any other value enables the output with shift=0 + [11:4] + read-write + + + ENABLE + enable the phase-shifted output + this can be changed on-the-fly + [3:3] + read-write + + + FLIP + invert the phase-shifted output + this is ignored when div=1 + [2:2] + read-write + + + SHIFT + phase shift the phase-shifted output by SHIFT input clocks + this can be changed on-the-fly + must be set to 0 before setting div=1 + [1:0] + read-write + + + + + STATUS + 0x0000001c + Ring Oscillator Status + 0x00000000 + + + STABLE + Oscillator is running and stable + [31:31] + read-only + + + BADWRITE + An invalid value has been written to CTRL_ENABLE or CTRL_FREQ_RANGE or FREQA or FREQB or DIV or PHASE or DORMANT + [24:24] + read-write + oneToClear + + + DIV_RUNNING + post-divider is running + this resets to 0 but transitions to 1 during chip startup + [16:16] + read-only + + + ENABLED + Oscillator is enabled but not necessarily running and stable + this resets to 0 but transitions to 1 during chip startup + [12:12] + read-only + + + + + RANDOMBIT + 0x00000020 + This just reads the state of the oscillator output so randomness is compromised if the ring oscillator is stopped or run at a harmonic of the bus frequency + 0x00000001 + + + RANDOMBIT + [0:0] + read-only + + + + + COUNT + 0x00000024 + A down counter running at the ROSC frequency which counts to zero and stops. + To start the counter write a non-zero value. + Can be used for short software pauses when setting up time sensitive hardware. + 0x00000000 + + + COUNT + [15:0] + read-write + + + + + + + POWMAN + Controls vreg, bor, lposc, chip resets & xosc startup, powman and provides scratch register for general use and for bootcode use + 0x40100000 + + 0 + 240 + registers + + + POWMAN_IRQ_POW + 44 + + + POWMAN_IRQ_TIMER + 45 + + + + BADPASSWD + 0x00000000 + Indicates a bad password has been used + 0x00000000 + + + BADPASSWD + [0:0] + read-write + oneToClear + + + + + VREG_CTRL + 0x00000004 + Voltage Regulator Control + 0x00008050 + + + RST_N + returns the regulator to its startup settings + 0 - reset + 1 - not reset (default) + [15:15] + read-write + + + UNLOCK + unlocks the VREG control interface after power up + 0 - Locked (default) + 1 - Unlocked + It cannot be relocked when it is unlocked. + [13:13] + read-write + + + ISOLATE + isolates the VREG control interface + 0 - not isolated (default) + 1 - isolated + [12:12] + read-write + + + DISABLE_VOLTAGE_LIMIT + 0=not disabled, 1=enabled + [8:8] + read-write + + + HT_TH + high temperature protection threshold + regulator power transistors are disabled when junction temperature exceeds threshold + 000 - 100C + 001 - 105C + 010 - 110C + 011 - 115C + 100 - 120C + 101 - 125C + 110 - 135C + 111 - 150C + [6:4] + read-write + + + + + VREG_STS + 0x00000008 + Voltage Regulator Status + 0x00000000 + + + VOUT_OK + output regulation status + 0=not in regulation, 1=in regulation + [4:4] + read-only + + + STARTUP + startup status + 0=startup complete, 1=starting up + [0:0] + read-only + + + + + VREG + 0x0000000c + Voltage Regulator Settings + 0x000000b0 + + + UPDATE_IN_PROGRESS + regulator state is being updated + writes to the vreg register will be ignored when this field is set + [15:15] + read-only + + + VSEL + output voltage select + the regulator output voltage is limited to 1.3V unless the voltage limit + is disabled using the disable_voltage_limit field in the vreg_ctrl register + 00000 - 0.55V + 00001 - 0.60V + 00010 - 0.65V + 00011 - 0.70V + 00100 - 0.75V + 00101 - 0.80V + 00110 - 0.85V + 00111 - 0.90V + 01000 - 0.95V + 01001 - 1.00V + 01010 - 1.05V + 01011 - 1.10V (default) + 01100 - 1.15V + 01101 - 1.20V + 01110 - 1.25V + 01111 - 1.30V + 10000 - 1.35V + 10001 - 1.40V + 10010 - 1.50V + 10011 - 1.60V + 10100 - 1.65V + 10101 - 1.70V + 10110 - 1.80V + 10111 - 1.90V + 11000 - 2.00V + 11001 - 2.35V + 11010 - 2.50V + 11011 - 2.65V + 11100 - 2.80V + 11101 - 3.00V + 11110 - 3.15V + 11111 - 3.30V + [8:4] + read-write + + + HIZ + high impedance mode select + 0=not in high impedance mode, 1=in high impedance mode + [1:1] + read-write + + + + + VREG_LP_ENTRY + 0x00000010 + Voltage Regulator Low Power Entry Settings + 0x000000b4 + + + VSEL + output voltage select + the regulator output voltage is limited to 1.3V unless the voltage limit + is disabled using the disable_voltage_limit field in the vreg_ctrl register + 00000 - 0.55V + 00001 - 0.60V + 00010 - 0.65V + 00011 - 0.70V + 00100 - 0.75V + 00101 - 0.80V + 00110 - 0.85V + 00111 - 0.90V + 01000 - 0.95V + 01001 - 1.00V + 01010 - 1.05V + 01011 - 1.10V (default) + 01100 - 1.15V + 01101 - 1.20V + 01110 - 1.25V + 01111 - 1.30V + 10000 - 1.35V + 10001 - 1.40V + 10010 - 1.50V + 10011 - 1.60V + 10100 - 1.65V + 10101 - 1.70V + 10110 - 1.80V + 10111 - 1.90V + 11000 - 2.00V + 11001 - 2.35V + 11010 - 2.50V + 11011 - 2.65V + 11100 - 2.80V + 11101 - 3.00V + 11110 - 3.15V + 11111 - 3.30V + [8:4] + read-write + + + MODE + selects either normal (switching) mode or low power (linear) mode + low power mode can only be selected for output voltages up to 1.3V + 0 = normal mode (switching) + 1 = low power mode (linear) + [2:2] + read-write + + + HIZ + high impedance mode select + 0=not in high impedance mode, 1=in high impedance mode + [1:1] + read-write + + + + + VREG_LP_EXIT + 0x00000014 + Voltage Regulator Low Power Exit Settings + 0x000000b0 + + + VSEL + output voltage select + the regulator output voltage is limited to 1.3V unless the voltage limit + is disabled using the disable_voltage_limit field in the vreg_ctrl register + 00000 - 0.55V + 00001 - 0.60V + 00010 - 0.65V + 00011 - 0.70V + 00100 - 0.75V + 00101 - 0.80V + 00110 - 0.85V + 00111 - 0.90V + 01000 - 0.95V + 01001 - 1.00V + 01010 - 1.05V + 01011 - 1.10V (default) + 01100 - 1.15V + 01101 - 1.20V + 01110 - 1.25V + 01111 - 1.30V + 10000 - 1.35V + 10001 - 1.40V + 10010 - 1.50V + 10011 - 1.60V + 10100 - 1.65V + 10101 - 1.70V + 10110 - 1.80V + 10111 - 1.90V + 11000 - 2.00V + 11001 - 2.35V + 11010 - 2.50V + 11011 - 2.65V + 11100 - 2.80V + 11101 - 3.00V + 11110 - 3.15V + 11111 - 3.30V + [8:4] + read-write + + + MODE + selects either normal (switching) mode or low power (linear) mode + low power mode can only be selected for output voltages up to 1.3V + 0 = normal mode (switching) + 1 = low power mode (linear) + [2:2] + read-write + + + HIZ + high impedance mode select + 0=not in high impedance mode, 1=in high impedance mode + [1:1] + read-write + + + + + BOD_CTRL + 0x00000018 + Brown-out Detection Control + 0x00000000 + + + ISOLATE + isolates the brown-out detection control interface + 0 - not isolated (default) + 1 - isolated + [12:12] + read-write + + + + + BOD + 0x0000001c + Brown-out Detection Settings + 0x000000b1 + + + VSEL + threshold select + 00000 - 0.473V + 00001 - 0.516V + 00010 - 0.559V + 00011 - 0.602V + 00100 - 0.645VS + 00101 - 0.688V + 00110 - 0.731V + 00111 - 0.774V + 01000 - 0.817V + 01001 - 0.860V (default) + 01010 - 0.903V + 01011 - 0.946V + 01100 - 0.989V + 01101 - 1.032V + 01110 - 1.075V + 01111 - 1.118V + 10000 - 1.161 + 10001 - 1.204V + [8:4] + read-write + + + EN + enable brown-out detection + 0=not enabled, 1=enabled + [0:0] + read-write + + + + + BOD_LP_ENTRY + 0x00000020 + Brown-out Detection Low Power Entry Settings + 0x000000b0 + + + VSEL + threshold select + 00000 - 0.473V + 00001 - 0.516V + 00010 - 0.559V + 00011 - 0.602V + 00100 - 0.645VS + 00101 - 0.688V + 00110 - 0.731V + 00111 - 0.774V + 01000 - 0.817V + 01001 - 0.860V (default) + 01010 - 0.903V + 01011 - 0.946V + 01100 - 0.989V + 01101 - 1.032V + 01110 - 1.075V + 01111 - 1.118V + 10000 - 1.161 + 10001 - 1.204V + [8:4] + read-write + + + EN + enable brown-out detection + 0=not enabled, 1=enabled + [0:0] + read-write + + + + + BOD_LP_EXIT + 0x00000024 + Brown-out Detection Low Power Exit Settings + 0x000000b1 + + + VSEL + threshold select + 00000 - 0.473V + 00001 - 0.516V + 00010 - 0.559V + 00011 - 0.602V + 00100 - 0.645VS + 00101 - 0.688V + 00110 - 0.731V + 00111 - 0.774V + 01000 - 0.817V + 01001 - 0.860V (default) + 01010 - 0.903V + 01011 - 0.946V + 01100 - 0.989V + 01101 - 1.032V + 01110 - 1.075V + 01111 - 1.118V + 10000 - 1.161 + 10001 - 1.204V + [8:4] + read-write + + + EN + enable brown-out detection + 0=not enabled, 1=enabled + [0:0] + read-write + + + + + LPOSC + 0x00000028 + Low power oscillator control register. + 0x00000203 + + + TRIM + Frequency trim - the trim step is typically 1% of the reset frequency, but can be up to 3% + [9:4] + read-write + + + MODE + This feature has been removed + [1:0] + read-write + + + + + CHIP_RESET + 0x0000002c + Chip reset control and status + 0x00000000 + + + HAD_WATCHDOG_RESET_RSM + Last reset was a watchdog timeout which was configured to reset the power-on state machine + This resets: + double_tap flag no + DP no + RPAP no + rescue_flag no + timer no + powman no + swcore no + psm yes + and does not change the power state + [28:28] + read-only + + + HAD_HZD_SYS_RESET_REQ + Last reset was a system reset from the hazard debugger + This resets: + double_tap flag no + DP no + RPAP no + rescue_flag no + timer no + powman no + swcore no + psm yes + and does not change the power state + [27:27] + read-only + + + HAD_GLITCH_DETECT + Last reset was due to a power supply glitch + This resets: + double_tap flag no + DP no + RPAP no + rescue_flag no + timer no + powman no + swcore no + psm yes + and does not change the power state + [26:26] + read-only + + + HAD_SWCORE_PD + Last reset was a switched core powerdown + This resets: + double_tap flag no + DP no + RPAP no + rescue_flag no + timer no + powman no + swcore yes + psm yes + then starts the power sequencer + [25:25] + read-only + + + HAD_WATCHDOG_RESET_SWCORE + Last reset was a watchdog timeout which was configured to reset the switched-core + This resets: + double_tap flag no + DP no + RPAP no + rescue_flag no + timer no + powman no + swcore yes + psm yes + then starts the power sequencer + [24:24] + read-only + + + HAD_WATCHDOG_RESET_POWMAN + Last reset was a watchdog timeout which was configured to reset the power manager + This resets: + double_tap flag no + DP no + RPAP no + rescue_flag no + timer yes + powman yes + swcore yes + psm yes + then starts the power sequencer + [23:23] + read-only + + + HAD_WATCHDOG_RESET_POWMAN_ASYNC + Last reset was a watchdog timeout which was configured to reset the power manager asynchronously + This resets: + double_tap flag no + DP no + RPAP no + rescue_flag no + timer yes + powman yes + swcore yes + psm yes + then starts the power sequencer + [22:22] + read-only + + + HAD_RESCUE + Last reset was a rescue reset from the debugger + This resets: + double_tap flag no + DP no + RPAP no + rescue_flag no, it sets this flag + timer yes + powman yes + swcore yes + psm yes + then starts the power sequencer + [21:21] + read-only + + + HAD_DP_RESET_REQ + Last reset was an reset request from the arm debugger + This resets: + double_tap flag no + DP no + RPAP no + rescue_flag yes + timer yes + powman yes + swcore yes + psm yes + then starts the power sequencer + [19:19] + read-only + + + HAD_RUN_LOW + Last reset was from the RUN pin + This resets: + double_tap flag no + DP yes + RPAP yes + rescue_flag yes + timer yes + powman yes + swcore yes + psm yes + then starts the power sequencer + [18:18] + read-only + + + HAD_BOR + Last reset was from the brown-out detection block + This resets: + double_tap flag yes + DP yes + RPAP yes + rescue_flag yes + timer yes + powman yes + swcore yes + psm yes + then starts the power sequencer + [17:17] + read-only + + + HAD_POR + Last reset was from the power-on reset + This resets: + double_tap flag yes + DP yes + RPAP yes + rescue_flag yes + timer yes + powman yes + swcore yes + psm yes + then starts the power sequencer + [16:16] + read-only + + + RESCUE_FLAG + This is set by a rescue reset from the RP-AP. + Its purpose is to halt before the bootrom before booting from flash in order to recover from a boot lock-up. + The debugger can then attach once the bootrom has been halted and flash some working code that does not lock up. + [4:4] + read-write + oneToClear + + + DOUBLE_TAP + This flag is set by double-tapping RUN. It tells bootcode to go into the bootloader. + [0:0] + read-write + + + + + WDSEL + 0x00000030 + Allows a watchdog reset to reset the internal state of powman in addition to the power-on state machine (PSM). + Note that powman ignores watchdog resets that do not select at least the CLOCKS stage or earlier stages in the PSM. If using these bits, it's recommended to set PSM_WDSEL to all-ones in addition to the desired bits in this register. Failing to select CLOCKS or earlier will result in the POWMAN_WDSEL register having no effect. + 0x00000000 + + + RESET_RSM + If set to 1, a watchdog reset will run the full power-on state machine (PSM) sequence + From a user perspective it is the same as setting RSM_WDSEL_PROC_COLD + From a hardware debug perspective it has the same effect as a reset from a glitch detector + [12:12] + read-write + + + RESET_SWCORE + If set to 1, a watchdog reset will reset the switched core power domain and run the full power-on state machine (PSM) sequence + From a user perspective it is the same as setting RSM_WDSEL_PROC_COLD + From a hardware debug perspective it has the same effect as a power-on reset for the switched core power domain + [8:8] + read-write + + + RESET_POWMAN + If set to 1, a watchdog reset will restore powman defaults, reset the timer, reset the switched core power domain + and run the full power-on state machine (PSM) sequence + This relies on clk_ref running. Use reset_powman_async if that may not be true + [4:4] + read-write + + + RESET_POWMAN_ASYNC + If set to 1, a watchdog reset will restore powman defaults, reset the timer, + reset the switched core domain and run the full power-on state machine (PSM) sequence + This does not rely on clk_ref running + [0:0] + read-write + + + + + SEQ_CFG + 0x00000034 + For configuration of the power sequencer + Writes are ignored while POWMAN_STATE_CHANGING=1 + 0x001011f0 + + + USING_FAST_POWCK + 0 indicates the POWMAN clock is running from the low power oscillator (32kHz) + 1 indicates the POWMAN clock is running from the reference clock (2-50MHz) + [20:20] + read-only + + + USING_BOD_LP + Indicates the brown-out detector (BOD) mode + 0 = BOD high power mode which is the default + 1 = BOD low power mode + [17:17] + read-only + + + USING_VREG_LP + Indicates the voltage regulator (VREG) mode + 0 = VREG high power mode which is the default + 1 = VREG low power mode + [16:16] + read-only + + + USE_FAST_POWCK + selects the reference clock (clk_ref) as the source of the POWMAN clock when switched-core is powered. The POWMAN clock always switches to the slow clock (lposc) when switched-core is powered down because the fast clock stops running. + 0 always run the POWMAN clock from the slow clock (lposc) + 1 run the POWMAN clock from the fast clock when available + This setting takes effect when a power up sequence is next run + [12:12] + read-write + + + RUN_LPOSC_IN_LP + Set to 0 to stop the low power osc when the switched-core is powered down, which is unwise if using it to clock the timer + This setting takes effect when the swcore is next powered down + [8:8] + read-write + + + USE_BOD_HP + Set to 0 to prevent automatic switching to bod high power mode when switched-core is powered up + This setting takes effect when the swcore is next powered up + [7:7] + read-write + + + USE_BOD_LP + Set to 0 to prevent automatic switching to bod low power mode when switched-core is powered down + This setting takes effect when the swcore is next powered down + [6:6] + read-write + + + USE_VREG_HP + Set to 0 to prevent automatic switching to vreg high power mode when switched-core is powered up + This setting takes effect when the swcore is next powered up + [5:5] + read-write + + + USE_VREG_LP + Set to 0 to prevent automatic switching to vreg low power mode when switched-core is powered down + This setting takes effect when the swcore is next powered down + [4:4] + read-write + + + HW_PWRUP_SRAM0 + Specifies the power state of SRAM0 when powering up swcore from a low power state (P1.xxx) to a high power state (P0.0xx). + 0=power-up + 1=no change + [1:1] + read-write + + + HW_PWRUP_SRAM1 + Specifies the power state of SRAM1 when powering up swcore from a low power state (P1.xxx) to a high power state (P0.0xx). + 0=power-up + 1=no change + [0:0] + read-write + + + + + STATE + 0x00000038 + This register controls the power state of the 4 power domains. + The current power state is indicated in POWMAN_STATE_CURRENT which is read-only. + To change the state, write to POWMAN_STATE_REQ. + The coding of POWMAN_STATE_CURRENT & POWMAN_STATE_REQ corresponds to the power states + defined in the datasheet: + bit 3 = SWCORE + bit 2 = XIP cache + bit 1 = SRAM0 + bit 0 = SRAM1 + 0 = powered up + 1 = powered down + When POWMAN_STATE_REQ is written, the POWMAN_STATE_WAITING flag is set while the Power Manager determines what is required. If an invalid transition is requested the Power Manager will still register the request in POWMAN_STATE_REQ but will also set the POWMAN_BAD_REQ flag. It will then implement the power-up requests and ignore the power down requests. To do nothing would risk entering an unrecoverable lock-up state. Invalid requests are: any combination of power up and power down requests any request that results in swcore boing powered and xip unpowered If the request is to power down the switched-core domain then POWMAN_STATE_WAITING stays active until the processors halt. During this time the POWMAN_STATE_REQ field can be re-written to change or cancel the request. When the power state transition begins the POWMAN_STATE_WAITING_flag is cleared, the POWMAN_STATE_CHANGING flag is set and POWMAN register writes are ignored until the transition completes. + 0x0000000f + + + CHANGING + [13:13] + read-only + + + WAITING + [12:12] + read-only + + + BAD_HW_REQ + Bad hardware initiated state request. Went back to state 0 (i.e. everything powered up) + [11:11] + read-only + + + BAD_SW_REQ + Bad software initiated state request. No action taken. + [10:10] + read-only + + + PWRUP_WHILE_WAITING + Request ignored because of a pending pwrup request. See current_pwrup_req. Note this blocks powering up AND powering down. + [9:9] + read-write + oneToClear + + + REQ_IGNORED + [8:8] + read-write + oneToClear + + + REQ + [7:4] + read-write + + + CURRENT + [3:0] + read-only + + + + + POW_FASTDIV + 0x0000003c + 0x00000040 + + + POW_FASTDIV + divides the POWMAN clock to provide a tick for the delay module and state machines + when clk_pow is running from the slow clock it is not divided + when clk_pow is running from the fast clock it is divided by tick_div + [10:0] + read-write + + + + + POW_DELAY + 0x00000040 + power state machine delays + 0x00002011 + + + SRAM_STEP + timing between the sram0 and sram1 power state machine steps + measured in units of the powman tick period (>=1us), 0 gives a delay of 1 unit + [15:8] + read-write + + + XIP_STEP + timing between the xip power state machine steps + measured in units of the lposc period, 0 gives a delay of 1 unit + [7:4] + read-write + + + SWCORE_STEP + timing between the swcore power state machine steps + measured in units of the lposc period, 0 gives a delay of 1 unit + [3:0] + read-write + + + + + EXT_CTRL0 + 0x00000044 + Configures a gpio as a power mode aware control output + 0x0000003f + + + LP_EXIT_STATE + output level when exiting the low power state + [14:14] + read-write + + + LP_ENTRY_STATE + output level when entering the low power state + [13:13] + read-write + + + INIT_STATE + [12:12] + read-write + + + INIT + [8:8] + read-write + + + GPIO_SELECT + selects from gpio 0->30 + set to 31 to disable this feature + [5:0] + read-write + + + + + EXT_CTRL1 + 0x00000048 + Configures a gpio as a power mode aware control output + 0x0000003f + + + LP_EXIT_STATE + output level when exiting the low power state + [14:14] + read-write + + + LP_ENTRY_STATE + output level when entering the low power state + [13:13] + read-write + + + INIT_STATE + [12:12] + read-write + + + INIT + [8:8] + read-write + + + GPIO_SELECT + selects from gpio 0->30 + set to 31 to disable this feature + [5:0] + read-write + + + + + EXT_TIME_REF + 0x0000004c + Select a GPIO to use as a time reference, the source can be used to drive the low power clock at 32kHz, or to provide a 1ms tick to the timer, or provide a 1Hz tick to the timer. The tick selection is controlled by the POWMAN_TIMER register. + 0x00000000 + + + DRIVE_LPCK + Use the selected GPIO to drive the 32kHz low power clock, in place of LPOSC. This field must only be written when POWMAN_TIMER_RUN=0 + [4:4] + read-write + + + SOURCE_SEL + 0 -> gpio12 + 1 -> gpio20 + 2 -> gpio14 + 3 -> gpio22 + [1:0] + read-write + + + + + LPOSC_FREQ_KHZ_INT + 0x00000050 + Informs the AON Timer of the integer component of the clock frequency when running off the LPOSC. + 0x00000020 + + + LPOSC_FREQ_KHZ_INT + Integer component of the LPOSC or GPIO clock source frequency in kHz. Default = 32 This field must only be written when POWMAN_TIMER_RUN=0 or POWMAN_TIMER_USING_XOSC=1 + [5:0] + read-write + + + + + LPOSC_FREQ_KHZ_FRAC + 0x00000054 + Informs the AON Timer of the fractional component of the clock frequency when running off the LPOSC. + 0x0000c49c + + + LPOSC_FREQ_KHZ_FRAC + Fractional component of the LPOSC or GPIO clock source frequency in kHz. Default = 0.768 This field must only be written when POWMAN_TIMER_RUN=0 or POWMAN_TIMER_USING_XOSC=1 + [15:0] + read-write + + + + + XOSC_FREQ_KHZ_INT + 0x00000058 + Informs the AON Timer of the integer component of the clock frequency when running off the XOSC. + 0x00002ee0 + + + XOSC_FREQ_KHZ_INT + Integer component of the XOSC frequency in kHz. Default = 12000 Must be >1 This field must only be written when POWMAN_TIMER_RUN=0 or POWMAN_TIMER_USING_XOSC=0 + [15:0] + read-write + + + + + XOSC_FREQ_KHZ_FRAC + 0x0000005c + Informs the AON Timer of the fractional component of the clock frequency when running off the XOSC. + 0x00000000 + + + XOSC_FREQ_KHZ_FRAC + Fractional component of the XOSC frequency in kHz. This field must only be written when POWMAN_TIMER_RUN=0 or POWMAN_TIMER_USING_XOSC=0 + [15:0] + read-write + + + + + SET_TIME_63TO48 + 0x00000060 + 0x00000000 + + + SET_TIME_63TO48 + For setting the time, do not use for reading the time, use POWMAN_READ_TIME_UPPER and POWMAN_READ_TIME_LOWER. This field must only be written when POWMAN_TIMER_RUN=0 + [15:0] + read-write + + + + + SET_TIME_47TO32 + 0x00000064 + 0x00000000 + + + SET_TIME_47TO32 + For setting the time, do not use for reading the time, use POWMAN_READ_TIME_UPPER and POWMAN_READ_TIME_LOWER. This field must only be written when POWMAN_TIMER_RUN=0 + [15:0] + read-write + + + + + SET_TIME_31TO16 + 0x00000068 + 0x00000000 + + + SET_TIME_31TO16 + For setting the time, do not use for reading the time, use POWMAN_READ_TIME_UPPER and POWMAN_READ_TIME_LOWER. This field must only be written when POWMAN_TIMER_RUN=0 + [15:0] + read-write + + + + + SET_TIME_15TO0 + 0x0000006c + 0x00000000 + + + SET_TIME_15TO0 + For setting the time, do not use for reading the time, use POWMAN_READ_TIME_UPPER and POWMAN_READ_TIME_LOWER. This field must only be written when POWMAN_TIMER_RUN=0 + [15:0] + read-write + + + + + READ_TIME_UPPER + 0x00000070 + 0x00000000 + + + READ_TIME_UPPER + For reading bits 63:32 of the timer. When reading all 64 bits it is possible for the LOWER count to rollover during the read. It is recommended to read UPPER, then LOWER, then re-read UPPER and, if it has changed, re-read LOWER. + [31:0] + read-only + + + + + READ_TIME_LOWER + 0x00000074 + 0x00000000 + + + READ_TIME_LOWER + For reading bits 31:0 of the timer. + [31:0] + read-only + + + + + ALARM_TIME_63TO48 + 0x00000078 + 0x00000000 + + + ALARM_TIME_63TO48 + This field must only be written when POWMAN_ALARM_ENAB=0 + [15:0] + read-write + + + + + ALARM_TIME_47TO32 + 0x0000007c + 0x00000000 + + + ALARM_TIME_47TO32 + This field must only be written when POWMAN_ALARM_ENAB=0 + [15:0] + read-write + + + + + ALARM_TIME_31TO16 + 0x00000080 + 0x00000000 + + + ALARM_TIME_31TO16 + This field must only be written when POWMAN_ALARM_ENAB=0 + [15:0] + read-write + + + + + ALARM_TIME_15TO0 + 0x00000084 + 0x00000000 + + + ALARM_TIME_15TO0 + This field must only be written when POWMAN_ALARM_ENAB=0 + [15:0] + read-write + + + + + TIMER + 0x00000088 + 0x00000000 + + + USING_GPIO_1HZ + Timer is synchronised to a 1hz gpio source + [19:19] + read-only + + + USING_GPIO_1KHZ + Timer is running from a 1khz gpio source + [18:18] + read-only + + + USING_LPOSC + Timer is running from lposc + [17:17] + read-only + + + USING_XOSC + Timer is running from xosc + [16:16] + read-only + + + USE_GPIO_1HZ + Selects the gpio source as the reference for the sec counter. The msec counter will continue to use the lposc or xosc reference. + [13:13] + read-write + + + USE_GPIO_1KHZ + switch to gpio as the source of the 1kHz timer tick + [10:10] + write-only + + + USE_XOSC + switch to xosc as the source of the 1kHz timer tick + [9:9] + write-only + + + USE_LPOSC + Switch to lposc as the source of the 1kHz timer tick + [8:8] + write-only + + + ALARM + Alarm has fired. Write to 1 to clear the alarm. + [6:6] + read-write + oneToClear + + + PWRUP_ON_ALARM + Alarm wakes the chip from low power mode + [5:5] + read-write + + + ALARM_ENAB + Enables the alarm. The alarm must be disabled while writing the alarm time. + [4:4] + read-write + + + CLEAR + Clears the timer, does not disable the timer and does not affect the alarm. This control can be written at any time. + [2:2] + write-only + + + RUN + Timer enable. Setting this bit causes the timer to begin counting up from its current value. Clearing this bit stops the timer from counting. + + Before enabling the timer, set the POWMAN_LPOSC_FREQ* and POWMAN_XOSC_FREQ* registers to configure the count rate, and initialise the current time by writing to SET_TIME_63TO48 through SET_TIME_15TO0. You must not write to the SET_TIME_x registers when the timer is running. + + Once configured, start the timer by setting POWMAN_TIMER_RUN=1. This will start the timer running from the LPOSC. When the XOSC is available switch the reference clock to XOSC then select it as the timer clock by setting POWMAN_TIMER_USE_XOSC=1 + [1:1] + read-write + + + NONSEC_WRITE + Control whether Non-secure software can write to the timer registers. All other registers are hardwired to be inaccessible to Non-secure. + [0:0] + read-write + + + + + PWRUP0 + 0x0000008c + 4 GPIO powerup events can be configured to wake the chip up from a low power state. + The pwrups are level/edge sensitive and can be set to trigger on a high/rising or low/falling event + The number of gpios available depends on the package option. An invalid selection will be ignored + source = 0 selects gpio0 + . + . + source = 47 selects gpio47 + source = 48 selects qspi_ss + source = 49 selects qspi_sd0 + source = 50 selects qspi_sd1 + source = 51 selects qspi_sd2 + source = 52 selects qspi_sd3 + source = 53 selects qspi_sclk + level = 0 triggers the pwrup when the source is low + level = 1 triggers the pwrup when the source is high + 0x0000003f + + + RAW_STATUS + Value of selected gpio pin (only if enable == 1) + [10:10] + read-only + + + STATUS + Status of gpio wakeup. Write to 1 to clear a latched edge detect. + [9:9] + read-write + oneToClear + + + MODE + Edge or level detect. Edge will detect a 0 to 1 transition (or 1 to 0 transition). Level will detect a 1 or 0. Both types of event get latched into the current_pwrup_req register. + [8:8] + read-write + + + level + 0 + + + edge + 1 + + + + + DIRECTION + [7:7] + read-write + + + low_falling + 0 + + + high_rising + 1 + + + + + ENABLE + Set to 1 to enable the wakeup source. Set to 0 to disable the wakeup source and clear a pending wakeup event. + If using edge detect a latched edge needs to be cleared by writing 1 to the status register also. + [6:6] + read-write + + + SOURCE + [5:0] + read-write + + + + + PWRUP1 + 0x00000090 + 4 GPIO powerup events can be configured to wake the chip up from a low power state. + The pwrups are level/edge sensitive and can be set to trigger on a high/rising or low/falling event + The number of gpios available depends on the package option. An invalid selection will be ignored + source = 0 selects gpio0 + . + . + source = 47 selects gpio47 + source = 48 selects qspi_ss + source = 49 selects qspi_sd0 + source = 50 selects qspi_sd1 + source = 51 selects qspi_sd2 + source = 52 selects qspi_sd3 + source = 53 selects qspi_sclk + level = 0 triggers the pwrup when the source is low + level = 1 triggers the pwrup when the source is high + 0x0000003f + + + RAW_STATUS + Value of selected gpio pin (only if enable == 1) + [10:10] + read-only + + + STATUS + Status of gpio wakeup. Write to 1 to clear a latched edge detect. + [9:9] + read-write + oneToClear + + + MODE + Edge or level detect. Edge will detect a 0 to 1 transition (or 1 to 0 transition). Level will detect a 1 or 0. Both types of event get latched into the current_pwrup_req register. + [8:8] + read-write + + + level + 0 + + + edge + 1 + + + + + DIRECTION + [7:7] + read-write + + + low_falling + 0 + + + high_rising + 1 + + + + + ENABLE + Set to 1 to enable the wakeup source. Set to 0 to disable the wakeup source and clear a pending wakeup event. + If using edge detect a latched edge needs to be cleared by writing 1 to the status register also. + [6:6] + read-write + + + SOURCE + [5:0] + read-write + + + + + PWRUP2 + 0x00000094 + 4 GPIO powerup events can be configured to wake the chip up from a low power state. + The pwrups are level/edge sensitive and can be set to trigger on a high/rising or low/falling event + The number of gpios available depends on the package option. An invalid selection will be ignored + source = 0 selects gpio0 + . + . + source = 47 selects gpio47 + source = 48 selects qspi_ss + source = 49 selects qspi_sd0 + source = 50 selects qspi_sd1 + source = 51 selects qspi_sd2 + source = 52 selects qspi_sd3 + source = 53 selects qspi_sclk + level = 0 triggers the pwrup when the source is low + level = 1 triggers the pwrup when the source is high + 0x0000003f + + + RAW_STATUS + Value of selected gpio pin (only if enable == 1) + [10:10] + read-only + + + STATUS + Status of gpio wakeup. Write to 1 to clear a latched edge detect. + [9:9] + read-write + oneToClear + + + MODE + Edge or level detect. Edge will detect a 0 to 1 transition (or 1 to 0 transition). Level will detect a 1 or 0. Both types of event get latched into the current_pwrup_req register. + [8:8] + read-write + + + level + 0 + + + edge + 1 + + + + + DIRECTION + [7:7] + read-write + + + low_falling + 0 + + + high_rising + 1 + + + + + ENABLE + Set to 1 to enable the wakeup source. Set to 0 to disable the wakeup source and clear a pending wakeup event. + If using edge detect a latched edge needs to be cleared by writing 1 to the status register also. + [6:6] + read-write + + + SOURCE + [5:0] + read-write + + + + + PWRUP3 + 0x00000098 + 4 GPIO powerup events can be configured to wake the chip up from a low power state. + The pwrups are level/edge sensitive and can be set to trigger on a high/rising or low/falling event + The number of gpios available depends on the package option. An invalid selection will be ignored + source = 0 selects gpio0 + . + . + source = 47 selects gpio47 + source = 48 selects qspi_ss + source = 49 selects qspi_sd0 + source = 50 selects qspi_sd1 + source = 51 selects qspi_sd2 + source = 52 selects qspi_sd3 + source = 53 selects qspi_sclk + level = 0 triggers the pwrup when the source is low + level = 1 triggers the pwrup when the source is high + 0x0000003f + + + RAW_STATUS + Value of selected gpio pin (only if enable == 1) + [10:10] + read-only + + + STATUS + Status of gpio wakeup. Write to 1 to clear a latched edge detect. + [9:9] + read-write + oneToClear + + + MODE + Edge or level detect. Edge will detect a 0 to 1 transition (or 1 to 0 transition). Level will detect a 1 or 0. Both types of event get latched into the current_pwrup_req register. + [8:8] + read-write + + + level + 0 + + + edge + 1 + + + + + DIRECTION + [7:7] + read-write + + + low_falling + 0 + + + high_rising + 1 + + + + + ENABLE + Set to 1 to enable the wakeup source. Set to 0 to disable the wakeup source and clear a pending wakeup event. + If using edge detect a latched edge needs to be cleared by writing 1 to the status register also. + [6:6] + read-write + + + SOURCE + [5:0] + read-write + + + + + CURRENT_PWRUP_REQ + 0x0000009c + Indicates current powerup request state + pwrup events can be cleared by removing the enable from the pwrup register. The alarm pwrup req can be cleared by clearing timer.alarm_enab + 0 = chip reset, for the source of the last reset see POWMAN_CHIP_RESET + 1 = pwrup0 + 2 = pwrup1 + 3 = pwrup2 + 4 = pwrup3 + 5 = coresight_pwrup + 6 = alarm_pwrup + 0x00000000 + + + CURRENT_PWRUP_REQ + [6:0] + read-only + + + + + LAST_SWCORE_PWRUP + 0x000000a0 + Indicates which pwrup source triggered the last switched-core power up + 0 = chip reset, for the source of the last reset see POWMAN_CHIP_RESET + 1 = pwrup0 + 2 = pwrup1 + 3 = pwrup2 + 4 = pwrup3 + 5 = coresight_pwrup + 6 = alarm_pwrup + 0x00000000 + + + LAST_SWCORE_PWRUP + [6:0] + read-only + + + + + DBG_PWRCFG + 0x000000a4 + 0x00000000 + + + IGNORE + Ignore pwrup req from debugger. If pwrup req is asserted then this will prevent power down and set powerdown blocked. Set ignore to stop paying attention to pwrup_req + [0:0] + read-write + + + + + BOOTDIS + 0x000000a8 + Tell the bootrom to ignore the BOOT0..3 registers following the next RSM reset (e.g. the next core power down/up). + + If an early boot stage has soft-locked some OTP pages in order to protect their contents from later stages, there is a risk that Secure code running at a later stage can unlock the pages by powering the core up and down. + + This register can be used to ensure that the bootloader runs as normal on the next power up, preventing Secure code at a later stage from accessing OTP in its unlocked state. + + Should be used in conjunction with the OTP BOOTDIS register. + 0x00000000 + + + NEXT + This flag always ORs writes into its current contents. It can be set but not cleared by software. + + The BOOTDIS_NEXT bit is OR'd into the BOOTDIS_NOW bit when the core is powered down. Simultaneously, the BOOTDIS_NEXT bit is cleared. Setting this bit means that the BOOT0..3 registers will be ignored following the next reset of the RSM by powman. + + This flag should be set by an early boot stage that has soft-locked OTP pages, to prevent later stages from unlocking it by power cycling. + [1:1] + read-write + + + NOW + When powman resets the RSM, the current value of BOOTDIS_NEXT is OR'd into BOOTDIS_NOW, and BOOTDIS_NEXT is cleared. + + The bootrom checks this flag before reading the BOOT0..3 registers. If it is set, the bootrom clears it, and ignores the BOOT registers. This prevents Secure software from diverting the boot path before a bootloader has had the chance to soft lock OTP pages containing sensitive data. + [0:0] + read-write + oneToClear + + + + + DBGCONFIG + 0x000000ac + 0x00000000 + + + DP_INSTID + Configure DP instance ID for SWD multidrop selection. + Recommend that this is NOT changed until you require debug access in multi-chip environment + [3:0] + read-write + + + + + SCRATCH0 + 0x000000b0 + Scratch register. Information persists in low power mode + 0x00000000 + + + SCRATCH0 + [31:0] + read-write + + + + + SCRATCH1 + 0x000000b4 + Scratch register. Information persists in low power mode + 0x00000000 + + + SCRATCH1 + [31:0] + read-write + + + + + SCRATCH2 + 0x000000b8 + Scratch register. Information persists in low power mode + 0x00000000 + + + SCRATCH2 + [31:0] + read-write + + + + + SCRATCH3 + 0x000000bc + Scratch register. Information persists in low power mode + 0x00000000 + + + SCRATCH3 + [31:0] + read-write + + + + + SCRATCH4 + 0x000000c0 + Scratch register. Information persists in low power mode + 0x00000000 + + + SCRATCH4 + [31:0] + read-write + + + + + SCRATCH5 + 0x000000c4 + Scratch register. Information persists in low power mode + 0x00000000 + + + SCRATCH5 + [31:0] + read-write + + + + + SCRATCH6 + 0x000000c8 + Scratch register. Information persists in low power mode + 0x00000000 + + + SCRATCH6 + [31:0] + read-write + + + + + SCRATCH7 + 0x000000cc + Scratch register. Information persists in low power mode + 0x00000000 + + + SCRATCH7 + [31:0] + read-write + + + + + BOOT0 + 0x000000d0 + Scratch register. Information persists in low power mode + 0x00000000 + + + BOOT0 + [31:0] + read-write + + + + + BOOT1 + 0x000000d4 + Scratch register. Information persists in low power mode + 0x00000000 + + + BOOT1 + [31:0] + read-write + + + + + BOOT2 + 0x000000d8 + Scratch register. Information persists in low power mode + 0x00000000 + + + BOOT2 + [31:0] + read-write + + + + + BOOT3 + 0x000000dc + Scratch register. Information persists in low power mode + 0x00000000 + + + BOOT3 + [31:0] + read-write + + + + + INTR + 0x000000e0 + Raw Interrupts + 0x00000000 + + + PWRUP_WHILE_WAITING + Source is state.pwrup_while_waiting + [3:3] + read-only + + + STATE_REQ_IGNORED + Source is state.req_ignored + [2:2] + read-only + + + TIMER + [1:1] + read-only + + + VREG_OUTPUT_LOW + [0:0] + read-write + oneToClear + + + + + INTE + 0x000000e4 + Interrupt Enable + 0x00000000 + + + PWRUP_WHILE_WAITING + Source is state.pwrup_while_waiting + [3:3] + read-write + + + STATE_REQ_IGNORED + Source is state.req_ignored + [2:2] + read-write + + + TIMER + [1:1] + read-write + + + VREG_OUTPUT_LOW + [0:0] + read-write + + + + + INTF + 0x000000e8 + Interrupt Force + 0x00000000 + + + PWRUP_WHILE_WAITING + Source is state.pwrup_while_waiting + [3:3] + read-write + + + STATE_REQ_IGNORED + Source is state.req_ignored + [2:2] + read-write + + + TIMER + [1:1] + read-write + + + VREG_OUTPUT_LOW + [0:0] + read-write + + + + + INTS + 0x000000ec + Interrupt status after masking & forcing + 0x00000000 + + + PWRUP_WHILE_WAITING + Source is state.pwrup_while_waiting + [3:3] + read-only + + + STATE_REQ_IGNORED + Source is state.req_ignored + [2:2] + read-only + + + TIMER + [1:1] + read-only + + + VREG_OUTPUT_LOW + [0:0] + read-only + + + + + + + WATCHDOG + 0x400d8000 + + 0 + 44 + registers + + + + CTRL + 0x00000000 + Watchdog control + The rst_wdsel register determines which subsystems are reset when the watchdog is triggered. + The watchdog can be triggered in software. + 0x07000000 + + + TRIGGER + Trigger a watchdog reset + [31:31] + write-only + + + ENABLE + When not enabled the watchdog timer is paused + [30:30] + read-write + + + PAUSE_DBG1 + Pause the watchdog timer when processor 1 is in debug mode + [26:26] + read-write + + + PAUSE_DBG0 + Pause the watchdog timer when processor 0 is in debug mode + [25:25] + read-write + + + PAUSE_JTAG + Pause the watchdog timer when JTAG is accessing the bus fabric + [24:24] + read-write + + + TIME + Indicates the time in usec before a watchdog reset will be triggered + [23:0] + read-only + + + + + LOAD + 0x00000004 + Load the watchdog timer. The maximum setting is 0xffffff which corresponds to approximately 16 seconds. + 0x00000000 + + + LOAD + [23:0] + write-only + + + + + REASON + 0x00000008 + Logs the reason for the last reset. Both bits are zero for the case of a hardware reset. + + Additionally, as of RP2350, a debugger warm reset of either core (SYSRESETREQ or hartreset) will also clear the watchdog reason register, so that software loaded under the debugger following a watchdog timeout will not continue to see the timeout condition. + 0x00000000 + + + FORCE + [1:1] + read-only + + + TIMER + [0:0] + read-only + + + + + SCRATCH0 + 0x0000000c + Scratch register. Information persists through soft reset of the chip. + 0x00000000 + + + SCRATCH0 + [31:0] + read-write + + + + + SCRATCH1 + 0x00000010 + Scratch register. Information persists through soft reset of the chip. + 0x00000000 + + + SCRATCH1 + [31:0] + read-write + + + + + SCRATCH2 + 0x00000014 + Scratch register. Information persists through soft reset of the chip. + 0x00000000 + + + SCRATCH2 + [31:0] + read-write + + + + + SCRATCH3 + 0x00000018 + Scratch register. Information persists through soft reset of the chip. + 0x00000000 + + + SCRATCH3 + [31:0] + read-write + + + + + SCRATCH4 + 0x0000001c + Scratch register. Information persists through soft reset of the chip. + 0x00000000 + + + SCRATCH4 + [31:0] + read-write + + + + + SCRATCH5 + 0x00000020 + Scratch register. Information persists through soft reset of the chip. + 0x00000000 + + + SCRATCH5 + [31:0] + read-write + + + + + SCRATCH6 + 0x00000024 + Scratch register. Information persists through soft reset of the chip. + 0x00000000 + + + SCRATCH6 + [31:0] + read-write + + + + + SCRATCH7 + 0x00000028 + Scratch register. Information persists through soft reset of the chip. + 0x00000000 + + + SCRATCH7 + [31:0] + read-write + + + + + + + DMA + DMA with separate read and write masters + 0x50000000 + + 0 + 3016 + registers + + + DMA_IRQ_0 + 10 + + + DMA_IRQ_1 + 11 + + + DMA_IRQ_2 + 12 + + + DMA_IRQ_3 + 13 + + + + CH0_READ_ADDR + 0x00000000 + DMA Channel 0 Read Address pointer + 0x00000000 + + + CH0_READ_ADDR + This register updates automatically each time a read completes. The current value is the next address to be read by this channel. + [31:0] + read-write + + + + + CH0_WRITE_ADDR + 0x00000004 + DMA Channel 0 Write Address pointer + 0x00000000 + + + CH0_WRITE_ADDR + This register updates automatically each time a write completes. The current value is the next address to be written by this channel. + [31:0] + read-write + + + + + CH0_TRANS_COUNT + 0x00000008 + DMA Channel 0 Transfer Count + 0x00000000 + + + MODE + When MODE is 0x0, the transfer count decrements with each transfer until 0, and then the channel triggers the next channel indicated by CTRL_CHAIN_TO. + + When MODE is 0x1, the transfer count decrements with each transfer until 0, and then the channel re-triggers itself, in addition to the trigger indicated by CTRL_CHAIN_TO. This is useful for e.g. an endless ring-buffer DMA with periodic interrupts. + + When MODE is 0xf, the transfer count does not decrement. The DMA channel performs an endless sequence of transfers, never triggering other channels or raising interrupts, until an ABORT is raised. + + All other values are reserved. + [31:28] + read-write + + + NORMAL + 0 + + + TRIGGER_SELF + 1 + + + ENDLESS + 15 + + + + + COUNT + 28-bit transfer count (256 million transfers maximum). + + Program the number of bus transfers a channel will perform before halting. Note that, if transfers are larger than one byte in size, this is not equal to the number of bytes transferred (see CTRL_DATA_SIZE). + + When the channel is active, reading this register shows the number of transfers remaining, updating automatically each time a write transfer completes. + + Writing this register sets the RELOAD value for the transfer counter. Each time this channel is triggered, the RELOAD value is copied into the live transfer counter. The channel can be started multiple times, and will perform the same number of transfers each time, as programmed by most recent write. + + The RELOAD value can be observed at CHx_DBG_TCR. If TRANS_COUNT is used as a trigger, the written value is used immediately as the length of the new transfer sequence, as well as being written to RELOAD. + [27:0] + read-write + + + + + CH0_CTRL_TRIG + 0x0000000c + DMA Channel 0 Control and Status + 0x00000000 + + + AHB_ERROR + Logical OR of the READ_ERROR and WRITE_ERROR flags. The channel halts when it encounters any bus error, and always raises its channel IRQ flag. + [31:31] + read-only + + + READ_ERROR + If 1, the channel received a read bus error. Write one to clear. + READ_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 3 transfers later) + [30:30] + read-write + oneToClear + + + WRITE_ERROR + If 1, the channel received a write bus error. Write one to clear. + WRITE_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 5 transfers later) + [29:29] + read-write + oneToClear + + + BUSY + This flag goes high when the channel starts a new transfer sequence, and low when the last transfer of that sequence completes. Clearing EN while BUSY is high pauses the channel, and BUSY will stay high while paused. + + To terminate a sequence early (and clear the BUSY flag), see CHAN_ABORT. + [26:26] + read-only + + + SNIFF_EN + If 1, this channel's data transfers are visible to the sniff hardware, and each transfer will advance the state of the checksum. This only applies if the sniff hardware is enabled, and has this channel selected. + + This allows checksum to be enabled or disabled on a per-control- block basis. + [25:25] + read-write + + + BSWAP + Apply byte-swap transformation to DMA data. + For byte data, this has no effect. For halfword data, the two bytes of each halfword are swapped. For word data, the four bytes of each word are swapped to reverse order. + [24:24] + read-write + + + IRQ_QUIET + In QUIET mode, the channel does not generate IRQs at the end of every transfer block. Instead, an IRQ is raised when NULL is written to a trigger register, indicating the end of a control block chain. + + This reduces the number of interrupts to be serviced by the CPU when transferring a DMA chain of many small control blocks. + [23:23] + read-write + + + TREQ_SEL + Select a Transfer Request signal. + The channel uses the transfer request signal to pace its data transfer rate. Sources for TREQ signals are internal (TIMERS) or external (DREQ, a Data Request from the system). + 0x0 to 0x3a -> select DREQ n as TREQ + [22:17] + read-write + + + PIO0_TX0 + 0 + Select PIO0's TX FIFO 0 as TREQ + + + PIO0_TX1 + 1 + Select PIO0's TX FIFO 1 as TREQ + + + PIO0_TX2 + 2 + Select PIO0's TX FIFO 2 as TREQ + + + PIO0_TX3 + 3 + Select PIO0's TX FIFO 3 as TREQ + + + PIO0_RX0 + 4 + Select PIO0's RX FIFO 0 as TREQ + + + PIO0_RX1 + 5 + Select PIO0's RX FIFO 1 as TREQ + + + PIO0_RX2 + 6 + Select PIO0's RX FIFO 2 as TREQ + + + PIO0_RX3 + 7 + Select PIO0's RX FIFO 3 as TREQ + + + PIO1_TX0 + 8 + Select PIO1's TX FIFO 0 as TREQ + + + PIO1_TX1 + 9 + Select PIO1's TX FIFO 1 as TREQ + + + PIO1_TX2 + 10 + Select PIO1's TX FIFO 2 as TREQ + + + PIO1_TX3 + 11 + Select PIO1's TX FIFO 3 as TREQ + + + PIO1_RX0 + 12 + Select PIO1's RX FIFO 0 as TREQ + + + PIO1_RX1 + 13 + Select PIO1's RX FIFO 1 as TREQ + + + PIO1_RX2 + 14 + Select PIO1's RX FIFO 2 as TREQ + + + PIO1_RX3 + 15 + Select PIO1's RX FIFO 3 as TREQ + + + PIO2_TX0 + 16 + Select PIO2's TX FIFO 0 as TREQ + + + PIO2_TX1 + 17 + Select PIO2's TX FIFO 1 as TREQ + + + PIO2_TX2 + 18 + Select PIO2's TX FIFO 2 as TREQ + + + PIO2_TX3 + 19 + Select PIO2's TX FIFO 3 as TREQ + + + PIO2_RX0 + 20 + Select PIO2's RX FIFO 0 as TREQ + + + PIO2_RX1 + 21 + Select PIO2's RX FIFO 1 as TREQ + + + PIO2_RX2 + 22 + Select PIO2's RX FIFO 2 as TREQ + + + PIO2_RX3 + 23 + Select PIO2's RX FIFO 3 as TREQ + + + SPI0_TX + 24 + Select SPI0's TX FIFO as TREQ + + + SPI0_RX + 25 + Select SPI0's RX FIFO as TREQ + + + SPI1_TX + 26 + Select SPI1's TX FIFO as TREQ + + + SPI1_RX + 27 + Select SPI1's RX FIFO as TREQ + + + UART0_TX + 28 + Select UART0's TX FIFO as TREQ + + + UART0_RX + 29 + Select UART0's RX FIFO as TREQ + + + UART1_TX + 30 + Select UART1's TX FIFO as TREQ + + + UART1_RX + 31 + Select UART1's RX FIFO as TREQ + + + PWM_WRAP0 + 32 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP1 + 33 + Select PWM Counter 1's Wrap Value as TREQ + + + PWM_WRAP2 + 34 + Select PWM Counter 2's Wrap Value as TREQ + + + PWM_WRAP3 + 35 + Select PWM Counter 3's Wrap Value as TREQ + + + PWM_WRAP4 + 36 + Select PWM Counter 4's Wrap Value as TREQ + + + PWM_WRAP5 + 37 + Select PWM Counter 5's Wrap Value as TREQ + + + PWM_WRAP6 + 38 + Select PWM Counter 6's Wrap Value as TREQ + + + PWM_WRAP7 + 39 + Select PWM Counter 7's Wrap Value as TREQ + + + PWM_WRAP8 + 40 + Select PWM Counter 8's Wrap Value as TREQ + + + PWM_WRAP9 + 41 + Select PWM Counter 9's Wrap Value as TREQ + + + PWM_WRAP10 + 42 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP11 + 43 + Select PWM Counter 1's Wrap Value as TREQ + + + I2C0_TX + 44 + Select I2C0's TX FIFO as TREQ + + + I2C0_RX + 45 + Select I2C0's RX FIFO as TREQ + + + I2C1_TX + 46 + Select I2C1's TX FIFO as TREQ + + + I2C1_RX + 47 + Select I2C1's RX FIFO as TREQ + + + ADC + 48 + Select the ADC as TREQ + + + XIP_STREAM + 49 + Select the XIP Streaming FIFO as TREQ + + + XIP_QMITX + 50 + Select XIP_QMITX as TREQ + + + XIP_QMIRX + 51 + Select XIP_QMIRX as TREQ + + + HSTX + 52 + Select HSTX as TREQ + + + CORESIGHT + 53 + Select CORESIGHT as TREQ + + + SHA256 + 54 + Select SHA256 as TREQ + + + TIMER0 + 59 + Select Timer 0 as TREQ + + + TIMER1 + 60 + Select Timer 1 as TREQ + + + TIMER2 + 61 + Select Timer 2 as TREQ (Optional) + + + TIMER3 + 62 + Select Timer 3 as TREQ (Optional) + + + PERMANENT + 63 + Permanent request, for unpaced transfers. + + + + + CHAIN_TO + When this channel completes, it will trigger the channel indicated by CHAIN_TO. Disable by setting CHAIN_TO = _(this channel)_. + + Note this field resets to 0, so channels 1 and above will chain to channel 0 by default. Set this field to avoid this behaviour. + [16:13] + read-write + + + RING_SEL + Select whether RING_SIZE applies to read or write addresses. + If 0, read addresses are wrapped on a (1 << RING_SIZE) boundary. If 1, write addresses are wrapped. + [12:12] + read-write + + + RING_SIZE + Size of address wrap region. If 0, don't wrap. For values n > 0, only the lower n bits of the address will change. This wraps the address on a (1 << n) byte boundary, facilitating access to naturally-aligned ring buffers. + + Ring sizes between 2 and 32768 bytes are possible. This can apply to either read or write addresses, based on value of RING_SEL. + [11:8] + read-write + + + RING_NONE + 0 + + + + + INCR_WRITE_REV + If 1, and INCR_WRITE is 1, the write address is decremented rather than incremented with each transfer. + + If 1, and INCR_WRITE is 0, this otherwise-unused combination causes the write address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [7:7] + read-write + + + INCR_WRITE + If 1, the write address increments with each transfer. If 0, each write is directed to the same, initial address. + + Generally this should be disabled for memory-to-peripheral transfers. + [6:6] + read-write + + + INCR_READ_REV + If 1, and INCR_READ is 1, the read address is decremented rather than incremented with each transfer. + + If 1, and INCR_READ is 0, this otherwise-unused combination causes the read address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [5:5] + read-write + + + INCR_READ + If 1, the read address increments with each transfer. If 0, each read is directed to the same, initial address. + + Generally this should be disabled for peripheral-to-memory transfers. + [4:4] + read-write + + + DATA_SIZE + Set the size of each bus transfer (byte/halfword/word). READ_ADDR and WRITE_ADDR advance by this amount (1/2/4 bytes) with each transfer. + [3:2] + read-write + + + SIZE_BYTE + 0 + + + SIZE_HALFWORD + 1 + + + SIZE_WORD + 2 + + + + + HIGH_PRIORITY + HIGH_PRIORITY gives a channel preferential treatment in issue scheduling: in each scheduling round, all high priority channels are considered first, and then only a single low priority channel, before returning to the high priority channels. + + This only affects the order in which the DMA schedules channels. The DMA's bus priority is not changed. If the DMA is not saturated then a low priority channel will see no loss of throughput. + [1:1] + read-write + + + EN + DMA Channel Enable. + When 1, the channel will respond to triggering events, which will cause it to become BUSY and start transferring data. When 0, the channel will ignore triggers, stop issuing transfers, and pause the current transfer sequence (i.e. BUSY will remain high if already high) + [0:0] + read-write + + + + + CH0_AL1_CTRL + 0x00000010 + Alias for channel 0 CTRL register + 0x00000000 + + + CH0_AL1_CTRL + [31:0] + read-write + + + + + CH0_AL1_READ_ADDR + 0x00000014 + Alias for channel 0 READ_ADDR register + 0x00000000 + + + CH0_AL1_READ_ADDR + [31:0] + read-write + + + + + CH0_AL1_WRITE_ADDR + 0x00000018 + Alias for channel 0 WRITE_ADDR register + 0x00000000 + + + CH0_AL1_WRITE_ADDR + [31:0] + read-write + + + + + CH0_AL1_TRANS_COUNT_TRIG + 0x0000001c + Alias for channel 0 TRANS_COUNT register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH0_AL1_TRANS_COUNT_TRIG + [31:0] + read-write + + + + + CH0_AL2_CTRL + 0x00000020 + Alias for channel 0 CTRL register + 0x00000000 + + + CH0_AL2_CTRL + [31:0] + read-write + + + + + CH0_AL2_TRANS_COUNT + 0x00000024 + Alias for channel 0 TRANS_COUNT register + 0x00000000 + + + CH0_AL2_TRANS_COUNT + [31:0] + read-write + + + + + CH0_AL2_READ_ADDR + 0x00000028 + Alias for channel 0 READ_ADDR register + 0x00000000 + + + CH0_AL2_READ_ADDR + [31:0] + read-write + + + + + CH0_AL2_WRITE_ADDR_TRIG + 0x0000002c + Alias for channel 0 WRITE_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH0_AL2_WRITE_ADDR_TRIG + [31:0] + read-write + + + + + CH0_AL3_CTRL + 0x00000030 + Alias for channel 0 CTRL register + 0x00000000 + + + CH0_AL3_CTRL + [31:0] + read-write + + + + + CH0_AL3_WRITE_ADDR + 0x00000034 + Alias for channel 0 WRITE_ADDR register + 0x00000000 + + + CH0_AL3_WRITE_ADDR + [31:0] + read-write + + + + + CH0_AL3_TRANS_COUNT + 0x00000038 + Alias for channel 0 TRANS_COUNT register + 0x00000000 + + + CH0_AL3_TRANS_COUNT + [31:0] + read-write + + + + + CH0_AL3_READ_ADDR_TRIG + 0x0000003c + Alias for channel 0 READ_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH0_AL3_READ_ADDR_TRIG + [31:0] + read-write + + + + + CH1_READ_ADDR + 0x00000040 + DMA Channel 1 Read Address pointer + 0x00000000 + + + CH1_READ_ADDR + This register updates automatically each time a read completes. The current value is the next address to be read by this channel. + [31:0] + read-write + + + + + CH1_WRITE_ADDR + 0x00000044 + DMA Channel 1 Write Address pointer + 0x00000000 + + + CH1_WRITE_ADDR + This register updates automatically each time a write completes. The current value is the next address to be written by this channel. + [31:0] + read-write + + + + + CH1_TRANS_COUNT + 0x00000048 + DMA Channel 1 Transfer Count + 0x00000000 + + + MODE + When MODE is 0x0, the transfer count decrements with each transfer until 0, and then the channel triggers the next channel indicated by CTRL_CHAIN_TO. + + When MODE is 0x1, the transfer count decrements with each transfer until 0, and then the channel re-triggers itself, in addition to the trigger indicated by CTRL_CHAIN_TO. This is useful for e.g. an endless ring-buffer DMA with periodic interrupts. + + When MODE is 0xf, the transfer count does not decrement. The DMA channel performs an endless sequence of transfers, never triggering other channels or raising interrupts, until an ABORT is raised. + + All other values are reserved. + [31:28] + read-write + + + NORMAL + 0 + + + TRIGGER_SELF + 1 + + + ENDLESS + 15 + + + + + COUNT + 28-bit transfer count (256 million transfers maximum). + + Program the number of bus transfers a channel will perform before halting. Note that, if transfers are larger than one byte in size, this is not equal to the number of bytes transferred (see CTRL_DATA_SIZE). + + When the channel is active, reading this register shows the number of transfers remaining, updating automatically each time a write transfer completes. + + Writing this register sets the RELOAD value for the transfer counter. Each time this channel is triggered, the RELOAD value is copied into the live transfer counter. The channel can be started multiple times, and will perform the same number of transfers each time, as programmed by most recent write. + + The RELOAD value can be observed at CHx_DBG_TCR. If TRANS_COUNT is used as a trigger, the written value is used immediately as the length of the new transfer sequence, as well as being written to RELOAD. + [27:0] + read-write + + + + + CH1_CTRL_TRIG + 0x0000004c + DMA Channel 1 Control and Status + 0x00000000 + + + AHB_ERROR + Logical OR of the READ_ERROR and WRITE_ERROR flags. The channel halts when it encounters any bus error, and always raises its channel IRQ flag. + [31:31] + read-only + + + READ_ERROR + If 1, the channel received a read bus error. Write one to clear. + READ_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 3 transfers later) + [30:30] + read-write + oneToClear + + + WRITE_ERROR + If 1, the channel received a write bus error. Write one to clear. + WRITE_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 5 transfers later) + [29:29] + read-write + oneToClear + + + BUSY + This flag goes high when the channel starts a new transfer sequence, and low when the last transfer of that sequence completes. Clearing EN while BUSY is high pauses the channel, and BUSY will stay high while paused. + + To terminate a sequence early (and clear the BUSY flag), see CHAN_ABORT. + [26:26] + read-only + + + SNIFF_EN + If 1, this channel's data transfers are visible to the sniff hardware, and each transfer will advance the state of the checksum. This only applies if the sniff hardware is enabled, and has this channel selected. + + This allows checksum to be enabled or disabled on a per-control- block basis. + [25:25] + read-write + + + BSWAP + Apply byte-swap transformation to DMA data. + For byte data, this has no effect. For halfword data, the two bytes of each halfword are swapped. For word data, the four bytes of each word are swapped to reverse order. + [24:24] + read-write + + + IRQ_QUIET + In QUIET mode, the channel does not generate IRQs at the end of every transfer block. Instead, an IRQ is raised when NULL is written to a trigger register, indicating the end of a control block chain. + + This reduces the number of interrupts to be serviced by the CPU when transferring a DMA chain of many small control blocks. + [23:23] + read-write + + + TREQ_SEL + Select a Transfer Request signal. + The channel uses the transfer request signal to pace its data transfer rate. Sources for TREQ signals are internal (TIMERS) or external (DREQ, a Data Request from the system). + 0x0 to 0x3a -> select DREQ n as TREQ + [22:17] + read-write + + + PIO0_TX0 + 0 + Select PIO0's TX FIFO 0 as TREQ + + + PIO0_TX1 + 1 + Select PIO0's TX FIFO 1 as TREQ + + + PIO0_TX2 + 2 + Select PIO0's TX FIFO 2 as TREQ + + + PIO0_TX3 + 3 + Select PIO0's TX FIFO 3 as TREQ + + + PIO0_RX0 + 4 + Select PIO0's RX FIFO 0 as TREQ + + + PIO0_RX1 + 5 + Select PIO0's RX FIFO 1 as TREQ + + + PIO0_RX2 + 6 + Select PIO0's RX FIFO 2 as TREQ + + + PIO0_RX3 + 7 + Select PIO0's RX FIFO 3 as TREQ + + + PIO1_TX0 + 8 + Select PIO1's TX FIFO 0 as TREQ + + + PIO1_TX1 + 9 + Select PIO1's TX FIFO 1 as TREQ + + + PIO1_TX2 + 10 + Select PIO1's TX FIFO 2 as TREQ + + + PIO1_TX3 + 11 + Select PIO1's TX FIFO 3 as TREQ + + + PIO1_RX0 + 12 + Select PIO1's RX FIFO 0 as TREQ + + + PIO1_RX1 + 13 + Select PIO1's RX FIFO 1 as TREQ + + + PIO1_RX2 + 14 + Select PIO1's RX FIFO 2 as TREQ + + + PIO1_RX3 + 15 + Select PIO1's RX FIFO 3 as TREQ + + + PIO2_TX0 + 16 + Select PIO2's TX FIFO 0 as TREQ + + + PIO2_TX1 + 17 + Select PIO2's TX FIFO 1 as TREQ + + + PIO2_TX2 + 18 + Select PIO2's TX FIFO 2 as TREQ + + + PIO2_TX3 + 19 + Select PIO2's TX FIFO 3 as TREQ + + + PIO2_RX0 + 20 + Select PIO2's RX FIFO 0 as TREQ + + + PIO2_RX1 + 21 + Select PIO2's RX FIFO 1 as TREQ + + + PIO2_RX2 + 22 + Select PIO2's RX FIFO 2 as TREQ + + + PIO2_RX3 + 23 + Select PIO2's RX FIFO 3 as TREQ + + + SPI0_TX + 24 + Select SPI0's TX FIFO as TREQ + + + SPI0_RX + 25 + Select SPI0's RX FIFO as TREQ + + + SPI1_TX + 26 + Select SPI1's TX FIFO as TREQ + + + SPI1_RX + 27 + Select SPI1's RX FIFO as TREQ + + + UART0_TX + 28 + Select UART0's TX FIFO as TREQ + + + UART0_RX + 29 + Select UART0's RX FIFO as TREQ + + + UART1_TX + 30 + Select UART1's TX FIFO as TREQ + + + UART1_RX + 31 + Select UART1's RX FIFO as TREQ + + + PWM_WRAP0 + 32 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP1 + 33 + Select PWM Counter 1's Wrap Value as TREQ + + + PWM_WRAP2 + 34 + Select PWM Counter 2's Wrap Value as TREQ + + + PWM_WRAP3 + 35 + Select PWM Counter 3's Wrap Value as TREQ + + + PWM_WRAP4 + 36 + Select PWM Counter 4's Wrap Value as TREQ + + + PWM_WRAP5 + 37 + Select PWM Counter 5's Wrap Value as TREQ + + + PWM_WRAP6 + 38 + Select PWM Counter 6's Wrap Value as TREQ + + + PWM_WRAP7 + 39 + Select PWM Counter 7's Wrap Value as TREQ + + + PWM_WRAP8 + 40 + Select PWM Counter 8's Wrap Value as TREQ + + + PWM_WRAP9 + 41 + Select PWM Counter 9's Wrap Value as TREQ + + + PWM_WRAP10 + 42 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP11 + 43 + Select PWM Counter 1's Wrap Value as TREQ + + + I2C0_TX + 44 + Select I2C0's TX FIFO as TREQ + + + I2C0_RX + 45 + Select I2C0's RX FIFO as TREQ + + + I2C1_TX + 46 + Select I2C1's TX FIFO as TREQ + + + I2C1_RX + 47 + Select I2C1's RX FIFO as TREQ + + + ADC + 48 + Select the ADC as TREQ + + + XIP_STREAM + 49 + Select the XIP Streaming FIFO as TREQ + + + XIP_QMITX + 50 + Select XIP_QMITX as TREQ + + + XIP_QMIRX + 51 + Select XIP_QMIRX as TREQ + + + HSTX + 52 + Select HSTX as TREQ + + + CORESIGHT + 53 + Select CORESIGHT as TREQ + + + SHA256 + 54 + Select SHA256 as TREQ + + + TIMER0 + 59 + Select Timer 0 as TREQ + + + TIMER1 + 60 + Select Timer 1 as TREQ + + + TIMER2 + 61 + Select Timer 2 as TREQ (Optional) + + + TIMER3 + 62 + Select Timer 3 as TREQ (Optional) + + + PERMANENT + 63 + Permanent request, for unpaced transfers. + + + + + CHAIN_TO + When this channel completes, it will trigger the channel indicated by CHAIN_TO. Disable by setting CHAIN_TO = _(this channel)_. + + Note this field resets to 0, so channels 1 and above will chain to channel 0 by default. Set this field to avoid this behaviour. + [16:13] + read-write + + + RING_SEL + Select whether RING_SIZE applies to read or write addresses. + If 0, read addresses are wrapped on a (1 << RING_SIZE) boundary. If 1, write addresses are wrapped. + [12:12] + read-write + + + RING_SIZE + Size of address wrap region. If 0, don't wrap. For values n > 0, only the lower n bits of the address will change. This wraps the address on a (1 << n) byte boundary, facilitating access to naturally-aligned ring buffers. + + Ring sizes between 2 and 32768 bytes are possible. This can apply to either read or write addresses, based on value of RING_SEL. + [11:8] + read-write + + + RING_NONE + 0 + + + + + INCR_WRITE_REV + If 1, and INCR_WRITE is 1, the write address is decremented rather than incremented with each transfer. + + If 1, and INCR_WRITE is 0, this otherwise-unused combination causes the write address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [7:7] + read-write + + + INCR_WRITE + If 1, the write address increments with each transfer. If 0, each write is directed to the same, initial address. + + Generally this should be disabled for memory-to-peripheral transfers. + [6:6] + read-write + + + INCR_READ_REV + If 1, and INCR_READ is 1, the read address is decremented rather than incremented with each transfer. + + If 1, and INCR_READ is 0, this otherwise-unused combination causes the read address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [5:5] + read-write + + + INCR_READ + If 1, the read address increments with each transfer. If 0, each read is directed to the same, initial address. + + Generally this should be disabled for peripheral-to-memory transfers. + [4:4] + read-write + + + DATA_SIZE + Set the size of each bus transfer (byte/halfword/word). READ_ADDR and WRITE_ADDR advance by this amount (1/2/4 bytes) with each transfer. + [3:2] + read-write + + + SIZE_BYTE + 0 + + + SIZE_HALFWORD + 1 + + + SIZE_WORD + 2 + + + + + HIGH_PRIORITY + HIGH_PRIORITY gives a channel preferential treatment in issue scheduling: in each scheduling round, all high priority channels are considered first, and then only a single low priority channel, before returning to the high priority channels. + + This only affects the order in which the DMA schedules channels. The DMA's bus priority is not changed. If the DMA is not saturated then a low priority channel will see no loss of throughput. + [1:1] + read-write + + + EN + DMA Channel Enable. + When 1, the channel will respond to triggering events, which will cause it to become BUSY and start transferring data. When 0, the channel will ignore triggers, stop issuing transfers, and pause the current transfer sequence (i.e. BUSY will remain high if already high) + [0:0] + read-write + + + + + CH1_AL1_CTRL + 0x00000050 + Alias for channel 1 CTRL register + 0x00000000 + + + CH1_AL1_CTRL + [31:0] + read-write + + + + + CH1_AL1_READ_ADDR + 0x00000054 + Alias for channel 1 READ_ADDR register + 0x00000000 + + + CH1_AL1_READ_ADDR + [31:0] + read-write + + + + + CH1_AL1_WRITE_ADDR + 0x00000058 + Alias for channel 1 WRITE_ADDR register + 0x00000000 + + + CH1_AL1_WRITE_ADDR + [31:0] + read-write + + + + + CH1_AL1_TRANS_COUNT_TRIG + 0x0000005c + Alias for channel 1 TRANS_COUNT register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH1_AL1_TRANS_COUNT_TRIG + [31:0] + read-write + + + + + CH1_AL2_CTRL + 0x00000060 + Alias for channel 1 CTRL register + 0x00000000 + + + CH1_AL2_CTRL + [31:0] + read-write + + + + + CH1_AL2_TRANS_COUNT + 0x00000064 + Alias for channel 1 TRANS_COUNT register + 0x00000000 + + + CH1_AL2_TRANS_COUNT + [31:0] + read-write + + + + + CH1_AL2_READ_ADDR + 0x00000068 + Alias for channel 1 READ_ADDR register + 0x00000000 + + + CH1_AL2_READ_ADDR + [31:0] + read-write + + + + + CH1_AL2_WRITE_ADDR_TRIG + 0x0000006c + Alias for channel 1 WRITE_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH1_AL2_WRITE_ADDR_TRIG + [31:0] + read-write + + + + + CH1_AL3_CTRL + 0x00000070 + Alias for channel 1 CTRL register + 0x00000000 + + + CH1_AL3_CTRL + [31:0] + read-write + + + + + CH1_AL3_WRITE_ADDR + 0x00000074 + Alias for channel 1 WRITE_ADDR register + 0x00000000 + + + CH1_AL3_WRITE_ADDR + [31:0] + read-write + + + + + CH1_AL3_TRANS_COUNT + 0x00000078 + Alias for channel 1 TRANS_COUNT register + 0x00000000 + + + CH1_AL3_TRANS_COUNT + [31:0] + read-write + + + + + CH1_AL3_READ_ADDR_TRIG + 0x0000007c + Alias for channel 1 READ_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH1_AL3_READ_ADDR_TRIG + [31:0] + read-write + + + + + CH2_READ_ADDR + 0x00000080 + DMA Channel 2 Read Address pointer + 0x00000000 + + + CH2_READ_ADDR + This register updates automatically each time a read completes. The current value is the next address to be read by this channel. + [31:0] + read-write + + + + + CH2_WRITE_ADDR + 0x00000084 + DMA Channel 2 Write Address pointer + 0x00000000 + + + CH2_WRITE_ADDR + This register updates automatically each time a write completes. The current value is the next address to be written by this channel. + [31:0] + read-write + + + + + CH2_TRANS_COUNT + 0x00000088 + DMA Channel 2 Transfer Count + 0x00000000 + + + MODE + When MODE is 0x0, the transfer count decrements with each transfer until 0, and then the channel triggers the next channel indicated by CTRL_CHAIN_TO. + + When MODE is 0x1, the transfer count decrements with each transfer until 0, and then the channel re-triggers itself, in addition to the trigger indicated by CTRL_CHAIN_TO. This is useful for e.g. an endless ring-buffer DMA with periodic interrupts. + + When MODE is 0xf, the transfer count does not decrement. The DMA channel performs an endless sequence of transfers, never triggering other channels or raising interrupts, until an ABORT is raised. + + All other values are reserved. + [31:28] + read-write + + + NORMAL + 0 + + + TRIGGER_SELF + 1 + + + ENDLESS + 15 + + + + + COUNT + 28-bit transfer count (256 million transfers maximum). + + Program the number of bus transfers a channel will perform before halting. Note that, if transfers are larger than one byte in size, this is not equal to the number of bytes transferred (see CTRL_DATA_SIZE). + + When the channel is active, reading this register shows the number of transfers remaining, updating automatically each time a write transfer completes. + + Writing this register sets the RELOAD value for the transfer counter. Each time this channel is triggered, the RELOAD value is copied into the live transfer counter. The channel can be started multiple times, and will perform the same number of transfers each time, as programmed by most recent write. + + The RELOAD value can be observed at CHx_DBG_TCR. If TRANS_COUNT is used as a trigger, the written value is used immediately as the length of the new transfer sequence, as well as being written to RELOAD. + [27:0] + read-write + + + + + CH2_CTRL_TRIG + 0x0000008c + DMA Channel 2 Control and Status + 0x00000000 + + + AHB_ERROR + Logical OR of the READ_ERROR and WRITE_ERROR flags. The channel halts when it encounters any bus error, and always raises its channel IRQ flag. + [31:31] + read-only + + + READ_ERROR + If 1, the channel received a read bus error. Write one to clear. + READ_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 3 transfers later) + [30:30] + read-write + oneToClear + + + WRITE_ERROR + If 1, the channel received a write bus error. Write one to clear. + WRITE_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 5 transfers later) + [29:29] + read-write + oneToClear + + + BUSY + This flag goes high when the channel starts a new transfer sequence, and low when the last transfer of that sequence completes. Clearing EN while BUSY is high pauses the channel, and BUSY will stay high while paused. + + To terminate a sequence early (and clear the BUSY flag), see CHAN_ABORT. + [26:26] + read-only + + + SNIFF_EN + If 1, this channel's data transfers are visible to the sniff hardware, and each transfer will advance the state of the checksum. This only applies if the sniff hardware is enabled, and has this channel selected. + + This allows checksum to be enabled or disabled on a per-control- block basis. + [25:25] + read-write + + + BSWAP + Apply byte-swap transformation to DMA data. + For byte data, this has no effect. For halfword data, the two bytes of each halfword are swapped. For word data, the four bytes of each word are swapped to reverse order. + [24:24] + read-write + + + IRQ_QUIET + In QUIET mode, the channel does not generate IRQs at the end of every transfer block. Instead, an IRQ is raised when NULL is written to a trigger register, indicating the end of a control block chain. + + This reduces the number of interrupts to be serviced by the CPU when transferring a DMA chain of many small control blocks. + [23:23] + read-write + + + TREQ_SEL + Select a Transfer Request signal. + The channel uses the transfer request signal to pace its data transfer rate. Sources for TREQ signals are internal (TIMERS) or external (DREQ, a Data Request from the system). + 0x0 to 0x3a -> select DREQ n as TREQ + [22:17] + read-write + + + PIO0_TX0 + 0 + Select PIO0's TX FIFO 0 as TREQ + + + PIO0_TX1 + 1 + Select PIO0's TX FIFO 1 as TREQ + + + PIO0_TX2 + 2 + Select PIO0's TX FIFO 2 as TREQ + + + PIO0_TX3 + 3 + Select PIO0's TX FIFO 3 as TREQ + + + PIO0_RX0 + 4 + Select PIO0's RX FIFO 0 as TREQ + + + PIO0_RX1 + 5 + Select PIO0's RX FIFO 1 as TREQ + + + PIO0_RX2 + 6 + Select PIO0's RX FIFO 2 as TREQ + + + PIO0_RX3 + 7 + Select PIO0's RX FIFO 3 as TREQ + + + PIO1_TX0 + 8 + Select PIO1's TX FIFO 0 as TREQ + + + PIO1_TX1 + 9 + Select PIO1's TX FIFO 1 as TREQ + + + PIO1_TX2 + 10 + Select PIO1's TX FIFO 2 as TREQ + + + PIO1_TX3 + 11 + Select PIO1's TX FIFO 3 as TREQ + + + PIO1_RX0 + 12 + Select PIO1's RX FIFO 0 as TREQ + + + PIO1_RX1 + 13 + Select PIO1's RX FIFO 1 as TREQ + + + PIO1_RX2 + 14 + Select PIO1's RX FIFO 2 as TREQ + + + PIO1_RX3 + 15 + Select PIO1's RX FIFO 3 as TREQ + + + PIO2_TX0 + 16 + Select PIO2's TX FIFO 0 as TREQ + + + PIO2_TX1 + 17 + Select PIO2's TX FIFO 1 as TREQ + + + PIO2_TX2 + 18 + Select PIO2's TX FIFO 2 as TREQ + + + PIO2_TX3 + 19 + Select PIO2's TX FIFO 3 as TREQ + + + PIO2_RX0 + 20 + Select PIO2's RX FIFO 0 as TREQ + + + PIO2_RX1 + 21 + Select PIO2's RX FIFO 1 as TREQ + + + PIO2_RX2 + 22 + Select PIO2's RX FIFO 2 as TREQ + + + PIO2_RX3 + 23 + Select PIO2's RX FIFO 3 as TREQ + + + SPI0_TX + 24 + Select SPI0's TX FIFO as TREQ + + + SPI0_RX + 25 + Select SPI0's RX FIFO as TREQ + + + SPI1_TX + 26 + Select SPI1's TX FIFO as TREQ + + + SPI1_RX + 27 + Select SPI1's RX FIFO as TREQ + + + UART0_TX + 28 + Select UART0's TX FIFO as TREQ + + + UART0_RX + 29 + Select UART0's RX FIFO as TREQ + + + UART1_TX + 30 + Select UART1's TX FIFO as TREQ + + + UART1_RX + 31 + Select UART1's RX FIFO as TREQ + + + PWM_WRAP0 + 32 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP1 + 33 + Select PWM Counter 1's Wrap Value as TREQ + + + PWM_WRAP2 + 34 + Select PWM Counter 2's Wrap Value as TREQ + + + PWM_WRAP3 + 35 + Select PWM Counter 3's Wrap Value as TREQ + + + PWM_WRAP4 + 36 + Select PWM Counter 4's Wrap Value as TREQ + + + PWM_WRAP5 + 37 + Select PWM Counter 5's Wrap Value as TREQ + + + PWM_WRAP6 + 38 + Select PWM Counter 6's Wrap Value as TREQ + + + PWM_WRAP7 + 39 + Select PWM Counter 7's Wrap Value as TREQ + + + PWM_WRAP8 + 40 + Select PWM Counter 8's Wrap Value as TREQ + + + PWM_WRAP9 + 41 + Select PWM Counter 9's Wrap Value as TREQ + + + PWM_WRAP10 + 42 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP11 + 43 + Select PWM Counter 1's Wrap Value as TREQ + + + I2C0_TX + 44 + Select I2C0's TX FIFO as TREQ + + + I2C0_RX + 45 + Select I2C0's RX FIFO as TREQ + + + I2C1_TX + 46 + Select I2C1's TX FIFO as TREQ + + + I2C1_RX + 47 + Select I2C1's RX FIFO as TREQ + + + ADC + 48 + Select the ADC as TREQ + + + XIP_STREAM + 49 + Select the XIP Streaming FIFO as TREQ + + + XIP_QMITX + 50 + Select XIP_QMITX as TREQ + + + XIP_QMIRX + 51 + Select XIP_QMIRX as TREQ + + + HSTX + 52 + Select HSTX as TREQ + + + CORESIGHT + 53 + Select CORESIGHT as TREQ + + + SHA256 + 54 + Select SHA256 as TREQ + + + TIMER0 + 59 + Select Timer 0 as TREQ + + + TIMER1 + 60 + Select Timer 1 as TREQ + + + TIMER2 + 61 + Select Timer 2 as TREQ (Optional) + + + TIMER3 + 62 + Select Timer 3 as TREQ (Optional) + + + PERMANENT + 63 + Permanent request, for unpaced transfers. + + + + + CHAIN_TO + When this channel completes, it will trigger the channel indicated by CHAIN_TO. Disable by setting CHAIN_TO = _(this channel)_. + + Note this field resets to 0, so channels 1 and above will chain to channel 0 by default. Set this field to avoid this behaviour. + [16:13] + read-write + + + RING_SEL + Select whether RING_SIZE applies to read or write addresses. + If 0, read addresses are wrapped on a (1 << RING_SIZE) boundary. If 1, write addresses are wrapped. + [12:12] + read-write + + + RING_SIZE + Size of address wrap region. If 0, don't wrap. For values n > 0, only the lower n bits of the address will change. This wraps the address on a (1 << n) byte boundary, facilitating access to naturally-aligned ring buffers. + + Ring sizes between 2 and 32768 bytes are possible. This can apply to either read or write addresses, based on value of RING_SEL. + [11:8] + read-write + + + RING_NONE + 0 + + + + + INCR_WRITE_REV + If 1, and INCR_WRITE is 1, the write address is decremented rather than incremented with each transfer. + + If 1, and INCR_WRITE is 0, this otherwise-unused combination causes the write address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [7:7] + read-write + + + INCR_WRITE + If 1, the write address increments with each transfer. If 0, each write is directed to the same, initial address. + + Generally this should be disabled for memory-to-peripheral transfers. + [6:6] + read-write + + + INCR_READ_REV + If 1, and INCR_READ is 1, the read address is decremented rather than incremented with each transfer. + + If 1, and INCR_READ is 0, this otherwise-unused combination causes the read address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [5:5] + read-write + + + INCR_READ + If 1, the read address increments with each transfer. If 0, each read is directed to the same, initial address. + + Generally this should be disabled for peripheral-to-memory transfers. + [4:4] + read-write + + + DATA_SIZE + Set the size of each bus transfer (byte/halfword/word). READ_ADDR and WRITE_ADDR advance by this amount (1/2/4 bytes) with each transfer. + [3:2] + read-write + + + SIZE_BYTE + 0 + + + SIZE_HALFWORD + 1 + + + SIZE_WORD + 2 + + + + + HIGH_PRIORITY + HIGH_PRIORITY gives a channel preferential treatment in issue scheduling: in each scheduling round, all high priority channels are considered first, and then only a single low priority channel, before returning to the high priority channels. + + This only affects the order in which the DMA schedules channels. The DMA's bus priority is not changed. If the DMA is not saturated then a low priority channel will see no loss of throughput. + [1:1] + read-write + + + EN + DMA Channel Enable. + When 1, the channel will respond to triggering events, which will cause it to become BUSY and start transferring data. When 0, the channel will ignore triggers, stop issuing transfers, and pause the current transfer sequence (i.e. BUSY will remain high if already high) + [0:0] + read-write + + + + + CH2_AL1_CTRL + 0x00000090 + Alias for channel 2 CTRL register + 0x00000000 + + + CH2_AL1_CTRL + [31:0] + read-write + + + + + CH2_AL1_READ_ADDR + 0x00000094 + Alias for channel 2 READ_ADDR register + 0x00000000 + + + CH2_AL1_READ_ADDR + [31:0] + read-write + + + + + CH2_AL1_WRITE_ADDR + 0x00000098 + Alias for channel 2 WRITE_ADDR register + 0x00000000 + + + CH2_AL1_WRITE_ADDR + [31:0] + read-write + + + + + CH2_AL1_TRANS_COUNT_TRIG + 0x0000009c + Alias for channel 2 TRANS_COUNT register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH2_AL1_TRANS_COUNT_TRIG + [31:0] + read-write + + + + + CH2_AL2_CTRL + 0x000000a0 + Alias for channel 2 CTRL register + 0x00000000 + + + CH2_AL2_CTRL + [31:0] + read-write + + + + + CH2_AL2_TRANS_COUNT + 0x000000a4 + Alias for channel 2 TRANS_COUNT register + 0x00000000 + + + CH2_AL2_TRANS_COUNT + [31:0] + read-write + + + + + CH2_AL2_READ_ADDR + 0x000000a8 + Alias for channel 2 READ_ADDR register + 0x00000000 + + + CH2_AL2_READ_ADDR + [31:0] + read-write + + + + + CH2_AL2_WRITE_ADDR_TRIG + 0x000000ac + Alias for channel 2 WRITE_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH2_AL2_WRITE_ADDR_TRIG + [31:0] + read-write + + + + + CH2_AL3_CTRL + 0x000000b0 + Alias for channel 2 CTRL register + 0x00000000 + + + CH2_AL3_CTRL + [31:0] + read-write + + + + + CH2_AL3_WRITE_ADDR + 0x000000b4 + Alias for channel 2 WRITE_ADDR register + 0x00000000 + + + CH2_AL3_WRITE_ADDR + [31:0] + read-write + + + + + CH2_AL3_TRANS_COUNT + 0x000000b8 + Alias for channel 2 TRANS_COUNT register + 0x00000000 + + + CH2_AL3_TRANS_COUNT + [31:0] + read-write + + + + + CH2_AL3_READ_ADDR_TRIG + 0x000000bc + Alias for channel 2 READ_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH2_AL3_READ_ADDR_TRIG + [31:0] + read-write + + + + + CH3_READ_ADDR + 0x000000c0 + DMA Channel 3 Read Address pointer + 0x00000000 + + + CH3_READ_ADDR + This register updates automatically each time a read completes. The current value is the next address to be read by this channel. + [31:0] + read-write + + + + + CH3_WRITE_ADDR + 0x000000c4 + DMA Channel 3 Write Address pointer + 0x00000000 + + + CH3_WRITE_ADDR + This register updates automatically each time a write completes. The current value is the next address to be written by this channel. + [31:0] + read-write + + + + + CH3_TRANS_COUNT + 0x000000c8 + DMA Channel 3 Transfer Count + 0x00000000 + + + MODE + When MODE is 0x0, the transfer count decrements with each transfer until 0, and then the channel triggers the next channel indicated by CTRL_CHAIN_TO. + + When MODE is 0x1, the transfer count decrements with each transfer until 0, and then the channel re-triggers itself, in addition to the trigger indicated by CTRL_CHAIN_TO. This is useful for e.g. an endless ring-buffer DMA with periodic interrupts. + + When MODE is 0xf, the transfer count does not decrement. The DMA channel performs an endless sequence of transfers, never triggering other channels or raising interrupts, until an ABORT is raised. + + All other values are reserved. + [31:28] + read-write + + + NORMAL + 0 + + + TRIGGER_SELF + 1 + + + ENDLESS + 15 + + + + + COUNT + 28-bit transfer count (256 million transfers maximum). + + Program the number of bus transfers a channel will perform before halting. Note that, if transfers are larger than one byte in size, this is not equal to the number of bytes transferred (see CTRL_DATA_SIZE). + + When the channel is active, reading this register shows the number of transfers remaining, updating automatically each time a write transfer completes. + + Writing this register sets the RELOAD value for the transfer counter. Each time this channel is triggered, the RELOAD value is copied into the live transfer counter. The channel can be started multiple times, and will perform the same number of transfers each time, as programmed by most recent write. + + The RELOAD value can be observed at CHx_DBG_TCR. If TRANS_COUNT is used as a trigger, the written value is used immediately as the length of the new transfer sequence, as well as being written to RELOAD. + [27:0] + read-write + + + + + CH3_CTRL_TRIG + 0x000000cc + DMA Channel 3 Control and Status + 0x00000000 + + + AHB_ERROR + Logical OR of the READ_ERROR and WRITE_ERROR flags. The channel halts when it encounters any bus error, and always raises its channel IRQ flag. + [31:31] + read-only + + + READ_ERROR + If 1, the channel received a read bus error. Write one to clear. + READ_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 3 transfers later) + [30:30] + read-write + oneToClear + + + WRITE_ERROR + If 1, the channel received a write bus error. Write one to clear. + WRITE_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 5 transfers later) + [29:29] + read-write + oneToClear + + + BUSY + This flag goes high when the channel starts a new transfer sequence, and low when the last transfer of that sequence completes. Clearing EN while BUSY is high pauses the channel, and BUSY will stay high while paused. + + To terminate a sequence early (and clear the BUSY flag), see CHAN_ABORT. + [26:26] + read-only + + + SNIFF_EN + If 1, this channel's data transfers are visible to the sniff hardware, and each transfer will advance the state of the checksum. This only applies if the sniff hardware is enabled, and has this channel selected. + + This allows checksum to be enabled or disabled on a per-control- block basis. + [25:25] + read-write + + + BSWAP + Apply byte-swap transformation to DMA data. + For byte data, this has no effect. For halfword data, the two bytes of each halfword are swapped. For word data, the four bytes of each word are swapped to reverse order. + [24:24] + read-write + + + IRQ_QUIET + In QUIET mode, the channel does not generate IRQs at the end of every transfer block. Instead, an IRQ is raised when NULL is written to a trigger register, indicating the end of a control block chain. + + This reduces the number of interrupts to be serviced by the CPU when transferring a DMA chain of many small control blocks. + [23:23] + read-write + + + TREQ_SEL + Select a Transfer Request signal. + The channel uses the transfer request signal to pace its data transfer rate. Sources for TREQ signals are internal (TIMERS) or external (DREQ, a Data Request from the system). + 0x0 to 0x3a -> select DREQ n as TREQ + [22:17] + read-write + + + PIO0_TX0 + 0 + Select PIO0's TX FIFO 0 as TREQ + + + PIO0_TX1 + 1 + Select PIO0's TX FIFO 1 as TREQ + + + PIO0_TX2 + 2 + Select PIO0's TX FIFO 2 as TREQ + + + PIO0_TX3 + 3 + Select PIO0's TX FIFO 3 as TREQ + + + PIO0_RX0 + 4 + Select PIO0's RX FIFO 0 as TREQ + + + PIO0_RX1 + 5 + Select PIO0's RX FIFO 1 as TREQ + + + PIO0_RX2 + 6 + Select PIO0's RX FIFO 2 as TREQ + + + PIO0_RX3 + 7 + Select PIO0's RX FIFO 3 as TREQ + + + PIO1_TX0 + 8 + Select PIO1's TX FIFO 0 as TREQ + + + PIO1_TX1 + 9 + Select PIO1's TX FIFO 1 as TREQ + + + PIO1_TX2 + 10 + Select PIO1's TX FIFO 2 as TREQ + + + PIO1_TX3 + 11 + Select PIO1's TX FIFO 3 as TREQ + + + PIO1_RX0 + 12 + Select PIO1's RX FIFO 0 as TREQ + + + PIO1_RX1 + 13 + Select PIO1's RX FIFO 1 as TREQ + + + PIO1_RX2 + 14 + Select PIO1's RX FIFO 2 as TREQ + + + PIO1_RX3 + 15 + Select PIO1's RX FIFO 3 as TREQ + + + PIO2_TX0 + 16 + Select PIO2's TX FIFO 0 as TREQ + + + PIO2_TX1 + 17 + Select PIO2's TX FIFO 1 as TREQ + + + PIO2_TX2 + 18 + Select PIO2's TX FIFO 2 as TREQ + + + PIO2_TX3 + 19 + Select PIO2's TX FIFO 3 as TREQ + + + PIO2_RX0 + 20 + Select PIO2's RX FIFO 0 as TREQ + + + PIO2_RX1 + 21 + Select PIO2's RX FIFO 1 as TREQ + + + PIO2_RX2 + 22 + Select PIO2's RX FIFO 2 as TREQ + + + PIO2_RX3 + 23 + Select PIO2's RX FIFO 3 as TREQ + + + SPI0_TX + 24 + Select SPI0's TX FIFO as TREQ + + + SPI0_RX + 25 + Select SPI0's RX FIFO as TREQ + + + SPI1_TX + 26 + Select SPI1's TX FIFO as TREQ + + + SPI1_RX + 27 + Select SPI1's RX FIFO as TREQ + + + UART0_TX + 28 + Select UART0's TX FIFO as TREQ + + + UART0_RX + 29 + Select UART0's RX FIFO as TREQ + + + UART1_TX + 30 + Select UART1's TX FIFO as TREQ + + + UART1_RX + 31 + Select UART1's RX FIFO as TREQ + + + PWM_WRAP0 + 32 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP1 + 33 + Select PWM Counter 1's Wrap Value as TREQ + + + PWM_WRAP2 + 34 + Select PWM Counter 2's Wrap Value as TREQ + + + PWM_WRAP3 + 35 + Select PWM Counter 3's Wrap Value as TREQ + + + PWM_WRAP4 + 36 + Select PWM Counter 4's Wrap Value as TREQ + + + PWM_WRAP5 + 37 + Select PWM Counter 5's Wrap Value as TREQ + + + PWM_WRAP6 + 38 + Select PWM Counter 6's Wrap Value as TREQ + + + PWM_WRAP7 + 39 + Select PWM Counter 7's Wrap Value as TREQ + + + PWM_WRAP8 + 40 + Select PWM Counter 8's Wrap Value as TREQ + + + PWM_WRAP9 + 41 + Select PWM Counter 9's Wrap Value as TREQ + + + PWM_WRAP10 + 42 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP11 + 43 + Select PWM Counter 1's Wrap Value as TREQ + + + I2C0_TX + 44 + Select I2C0's TX FIFO as TREQ + + + I2C0_RX + 45 + Select I2C0's RX FIFO as TREQ + + + I2C1_TX + 46 + Select I2C1's TX FIFO as TREQ + + + I2C1_RX + 47 + Select I2C1's RX FIFO as TREQ + + + ADC + 48 + Select the ADC as TREQ + + + XIP_STREAM + 49 + Select the XIP Streaming FIFO as TREQ + + + XIP_QMITX + 50 + Select XIP_QMITX as TREQ + + + XIP_QMIRX + 51 + Select XIP_QMIRX as TREQ + + + HSTX + 52 + Select HSTX as TREQ + + + CORESIGHT + 53 + Select CORESIGHT as TREQ + + + SHA256 + 54 + Select SHA256 as TREQ + + + TIMER0 + 59 + Select Timer 0 as TREQ + + + TIMER1 + 60 + Select Timer 1 as TREQ + + + TIMER2 + 61 + Select Timer 2 as TREQ (Optional) + + + TIMER3 + 62 + Select Timer 3 as TREQ (Optional) + + + PERMANENT + 63 + Permanent request, for unpaced transfers. + + + + + CHAIN_TO + When this channel completes, it will trigger the channel indicated by CHAIN_TO. Disable by setting CHAIN_TO = _(this channel)_. + + Note this field resets to 0, so channels 1 and above will chain to channel 0 by default. Set this field to avoid this behaviour. + [16:13] + read-write + + + RING_SEL + Select whether RING_SIZE applies to read or write addresses. + If 0, read addresses are wrapped on a (1 << RING_SIZE) boundary. If 1, write addresses are wrapped. + [12:12] + read-write + + + RING_SIZE + Size of address wrap region. If 0, don't wrap. For values n > 0, only the lower n bits of the address will change. This wraps the address on a (1 << n) byte boundary, facilitating access to naturally-aligned ring buffers. + + Ring sizes between 2 and 32768 bytes are possible. This can apply to either read or write addresses, based on value of RING_SEL. + [11:8] + read-write + + + RING_NONE + 0 + + + + + INCR_WRITE_REV + If 1, and INCR_WRITE is 1, the write address is decremented rather than incremented with each transfer. + + If 1, and INCR_WRITE is 0, this otherwise-unused combination causes the write address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [7:7] + read-write + + + INCR_WRITE + If 1, the write address increments with each transfer. If 0, each write is directed to the same, initial address. + + Generally this should be disabled for memory-to-peripheral transfers. + [6:6] + read-write + + + INCR_READ_REV + If 1, and INCR_READ is 1, the read address is decremented rather than incremented with each transfer. + + If 1, and INCR_READ is 0, this otherwise-unused combination causes the read address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [5:5] + read-write + + + INCR_READ + If 1, the read address increments with each transfer. If 0, each read is directed to the same, initial address. + + Generally this should be disabled for peripheral-to-memory transfers. + [4:4] + read-write + + + DATA_SIZE + Set the size of each bus transfer (byte/halfword/word). READ_ADDR and WRITE_ADDR advance by this amount (1/2/4 bytes) with each transfer. + [3:2] + read-write + + + SIZE_BYTE + 0 + + + SIZE_HALFWORD + 1 + + + SIZE_WORD + 2 + + + + + HIGH_PRIORITY + HIGH_PRIORITY gives a channel preferential treatment in issue scheduling: in each scheduling round, all high priority channels are considered first, and then only a single low priority channel, before returning to the high priority channels. + + This only affects the order in which the DMA schedules channels. The DMA's bus priority is not changed. If the DMA is not saturated then a low priority channel will see no loss of throughput. + [1:1] + read-write + + + EN + DMA Channel Enable. + When 1, the channel will respond to triggering events, which will cause it to become BUSY and start transferring data. When 0, the channel will ignore triggers, stop issuing transfers, and pause the current transfer sequence (i.e. BUSY will remain high if already high) + [0:0] + read-write + + + + + CH3_AL1_CTRL + 0x000000d0 + Alias for channel 3 CTRL register + 0x00000000 + + + CH3_AL1_CTRL + [31:0] + read-write + + + + + CH3_AL1_READ_ADDR + 0x000000d4 + Alias for channel 3 READ_ADDR register + 0x00000000 + + + CH3_AL1_READ_ADDR + [31:0] + read-write + + + + + CH3_AL1_WRITE_ADDR + 0x000000d8 + Alias for channel 3 WRITE_ADDR register + 0x00000000 + + + CH3_AL1_WRITE_ADDR + [31:0] + read-write + + + + + CH3_AL1_TRANS_COUNT_TRIG + 0x000000dc + Alias for channel 3 TRANS_COUNT register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH3_AL1_TRANS_COUNT_TRIG + [31:0] + read-write + + + + + CH3_AL2_CTRL + 0x000000e0 + Alias for channel 3 CTRL register + 0x00000000 + + + CH3_AL2_CTRL + [31:0] + read-write + + + + + CH3_AL2_TRANS_COUNT + 0x000000e4 + Alias for channel 3 TRANS_COUNT register + 0x00000000 + + + CH3_AL2_TRANS_COUNT + [31:0] + read-write + + + + + CH3_AL2_READ_ADDR + 0x000000e8 + Alias for channel 3 READ_ADDR register + 0x00000000 + + + CH3_AL2_READ_ADDR + [31:0] + read-write + + + + + CH3_AL2_WRITE_ADDR_TRIG + 0x000000ec + Alias for channel 3 WRITE_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH3_AL2_WRITE_ADDR_TRIG + [31:0] + read-write + + + + + CH3_AL3_CTRL + 0x000000f0 + Alias for channel 3 CTRL register + 0x00000000 + + + CH3_AL3_CTRL + [31:0] + read-write + + + + + CH3_AL3_WRITE_ADDR + 0x000000f4 + Alias for channel 3 WRITE_ADDR register + 0x00000000 + + + CH3_AL3_WRITE_ADDR + [31:0] + read-write + + + + + CH3_AL3_TRANS_COUNT + 0x000000f8 + Alias for channel 3 TRANS_COUNT register + 0x00000000 + + + CH3_AL3_TRANS_COUNT + [31:0] + read-write + + + + + CH3_AL3_READ_ADDR_TRIG + 0x000000fc + Alias for channel 3 READ_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH3_AL3_READ_ADDR_TRIG + [31:0] + read-write + + + + + CH4_READ_ADDR + 0x00000100 + DMA Channel 4 Read Address pointer + 0x00000000 + + + CH4_READ_ADDR + This register updates automatically each time a read completes. The current value is the next address to be read by this channel. + [31:0] + read-write + + + + + CH4_WRITE_ADDR + 0x00000104 + DMA Channel 4 Write Address pointer + 0x00000000 + + + CH4_WRITE_ADDR + This register updates automatically each time a write completes. The current value is the next address to be written by this channel. + [31:0] + read-write + + + + + CH4_TRANS_COUNT + 0x00000108 + DMA Channel 4 Transfer Count + 0x00000000 + + + MODE + When MODE is 0x0, the transfer count decrements with each transfer until 0, and then the channel triggers the next channel indicated by CTRL_CHAIN_TO. + + When MODE is 0x1, the transfer count decrements with each transfer until 0, and then the channel re-triggers itself, in addition to the trigger indicated by CTRL_CHAIN_TO. This is useful for e.g. an endless ring-buffer DMA with periodic interrupts. + + When MODE is 0xf, the transfer count does not decrement. The DMA channel performs an endless sequence of transfers, never triggering other channels or raising interrupts, until an ABORT is raised. + + All other values are reserved. + [31:28] + read-write + + + NORMAL + 0 + + + TRIGGER_SELF + 1 + + + ENDLESS + 15 + + + + + COUNT + 28-bit transfer count (256 million transfers maximum). + + Program the number of bus transfers a channel will perform before halting. Note that, if transfers are larger than one byte in size, this is not equal to the number of bytes transferred (see CTRL_DATA_SIZE). + + When the channel is active, reading this register shows the number of transfers remaining, updating automatically each time a write transfer completes. + + Writing this register sets the RELOAD value for the transfer counter. Each time this channel is triggered, the RELOAD value is copied into the live transfer counter. The channel can be started multiple times, and will perform the same number of transfers each time, as programmed by most recent write. + + The RELOAD value can be observed at CHx_DBG_TCR. If TRANS_COUNT is used as a trigger, the written value is used immediately as the length of the new transfer sequence, as well as being written to RELOAD. + [27:0] + read-write + + + + + CH4_CTRL_TRIG + 0x0000010c + DMA Channel 4 Control and Status + 0x00000000 + + + AHB_ERROR + Logical OR of the READ_ERROR and WRITE_ERROR flags. The channel halts when it encounters any bus error, and always raises its channel IRQ flag. + [31:31] + read-only + + + READ_ERROR + If 1, the channel received a read bus error. Write one to clear. + READ_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 3 transfers later) + [30:30] + read-write + oneToClear + + + WRITE_ERROR + If 1, the channel received a write bus error. Write one to clear. + WRITE_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 5 transfers later) + [29:29] + read-write + oneToClear + + + BUSY + This flag goes high when the channel starts a new transfer sequence, and low when the last transfer of that sequence completes. Clearing EN while BUSY is high pauses the channel, and BUSY will stay high while paused. + + To terminate a sequence early (and clear the BUSY flag), see CHAN_ABORT. + [26:26] + read-only + + + SNIFF_EN + If 1, this channel's data transfers are visible to the sniff hardware, and each transfer will advance the state of the checksum. This only applies if the sniff hardware is enabled, and has this channel selected. + + This allows checksum to be enabled or disabled on a per-control- block basis. + [25:25] + read-write + + + BSWAP + Apply byte-swap transformation to DMA data. + For byte data, this has no effect. For halfword data, the two bytes of each halfword are swapped. For word data, the four bytes of each word are swapped to reverse order. + [24:24] + read-write + + + IRQ_QUIET + In QUIET mode, the channel does not generate IRQs at the end of every transfer block. Instead, an IRQ is raised when NULL is written to a trigger register, indicating the end of a control block chain. + + This reduces the number of interrupts to be serviced by the CPU when transferring a DMA chain of many small control blocks. + [23:23] + read-write + + + TREQ_SEL + Select a Transfer Request signal. + The channel uses the transfer request signal to pace its data transfer rate. Sources for TREQ signals are internal (TIMERS) or external (DREQ, a Data Request from the system). + 0x0 to 0x3a -> select DREQ n as TREQ + [22:17] + read-write + + + PIO0_TX0 + 0 + Select PIO0's TX FIFO 0 as TREQ + + + PIO0_TX1 + 1 + Select PIO0's TX FIFO 1 as TREQ + + + PIO0_TX2 + 2 + Select PIO0's TX FIFO 2 as TREQ + + + PIO0_TX3 + 3 + Select PIO0's TX FIFO 3 as TREQ + + + PIO0_RX0 + 4 + Select PIO0's RX FIFO 0 as TREQ + + + PIO0_RX1 + 5 + Select PIO0's RX FIFO 1 as TREQ + + + PIO0_RX2 + 6 + Select PIO0's RX FIFO 2 as TREQ + + + PIO0_RX3 + 7 + Select PIO0's RX FIFO 3 as TREQ + + + PIO1_TX0 + 8 + Select PIO1's TX FIFO 0 as TREQ + + + PIO1_TX1 + 9 + Select PIO1's TX FIFO 1 as TREQ + + + PIO1_TX2 + 10 + Select PIO1's TX FIFO 2 as TREQ + + + PIO1_TX3 + 11 + Select PIO1's TX FIFO 3 as TREQ + + + PIO1_RX0 + 12 + Select PIO1's RX FIFO 0 as TREQ + + + PIO1_RX1 + 13 + Select PIO1's RX FIFO 1 as TREQ + + + PIO1_RX2 + 14 + Select PIO1's RX FIFO 2 as TREQ + + + PIO1_RX3 + 15 + Select PIO1's RX FIFO 3 as TREQ + + + PIO2_TX0 + 16 + Select PIO2's TX FIFO 0 as TREQ + + + PIO2_TX1 + 17 + Select PIO2's TX FIFO 1 as TREQ + + + PIO2_TX2 + 18 + Select PIO2's TX FIFO 2 as TREQ + + + PIO2_TX3 + 19 + Select PIO2's TX FIFO 3 as TREQ + + + PIO2_RX0 + 20 + Select PIO2's RX FIFO 0 as TREQ + + + PIO2_RX1 + 21 + Select PIO2's RX FIFO 1 as TREQ + + + PIO2_RX2 + 22 + Select PIO2's RX FIFO 2 as TREQ + + + PIO2_RX3 + 23 + Select PIO2's RX FIFO 3 as TREQ + + + SPI0_TX + 24 + Select SPI0's TX FIFO as TREQ + + + SPI0_RX + 25 + Select SPI0's RX FIFO as TREQ + + + SPI1_TX + 26 + Select SPI1's TX FIFO as TREQ + + + SPI1_RX + 27 + Select SPI1's RX FIFO as TREQ + + + UART0_TX + 28 + Select UART0's TX FIFO as TREQ + + + UART0_RX + 29 + Select UART0's RX FIFO as TREQ + + + UART1_TX + 30 + Select UART1's TX FIFO as TREQ + + + UART1_RX + 31 + Select UART1's RX FIFO as TREQ + + + PWM_WRAP0 + 32 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP1 + 33 + Select PWM Counter 1's Wrap Value as TREQ + + + PWM_WRAP2 + 34 + Select PWM Counter 2's Wrap Value as TREQ + + + PWM_WRAP3 + 35 + Select PWM Counter 3's Wrap Value as TREQ + + + PWM_WRAP4 + 36 + Select PWM Counter 4's Wrap Value as TREQ + + + PWM_WRAP5 + 37 + Select PWM Counter 5's Wrap Value as TREQ + + + PWM_WRAP6 + 38 + Select PWM Counter 6's Wrap Value as TREQ + + + PWM_WRAP7 + 39 + Select PWM Counter 7's Wrap Value as TREQ + + + PWM_WRAP8 + 40 + Select PWM Counter 8's Wrap Value as TREQ + + + PWM_WRAP9 + 41 + Select PWM Counter 9's Wrap Value as TREQ + + + PWM_WRAP10 + 42 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP11 + 43 + Select PWM Counter 1's Wrap Value as TREQ + + + I2C0_TX + 44 + Select I2C0's TX FIFO as TREQ + + + I2C0_RX + 45 + Select I2C0's RX FIFO as TREQ + + + I2C1_TX + 46 + Select I2C1's TX FIFO as TREQ + + + I2C1_RX + 47 + Select I2C1's RX FIFO as TREQ + + + ADC + 48 + Select the ADC as TREQ + + + XIP_STREAM + 49 + Select the XIP Streaming FIFO as TREQ + + + XIP_QMITX + 50 + Select XIP_QMITX as TREQ + + + XIP_QMIRX + 51 + Select XIP_QMIRX as TREQ + + + HSTX + 52 + Select HSTX as TREQ + + + CORESIGHT + 53 + Select CORESIGHT as TREQ + + + SHA256 + 54 + Select SHA256 as TREQ + + + TIMER0 + 59 + Select Timer 0 as TREQ + + + TIMER1 + 60 + Select Timer 1 as TREQ + + + TIMER2 + 61 + Select Timer 2 as TREQ (Optional) + + + TIMER3 + 62 + Select Timer 3 as TREQ (Optional) + + + PERMANENT + 63 + Permanent request, for unpaced transfers. + + + + + CHAIN_TO + When this channel completes, it will trigger the channel indicated by CHAIN_TO. Disable by setting CHAIN_TO = _(this channel)_. + + Note this field resets to 0, so channels 1 and above will chain to channel 0 by default. Set this field to avoid this behaviour. + [16:13] + read-write + + + RING_SEL + Select whether RING_SIZE applies to read or write addresses. + If 0, read addresses are wrapped on a (1 << RING_SIZE) boundary. If 1, write addresses are wrapped. + [12:12] + read-write + + + RING_SIZE + Size of address wrap region. If 0, don't wrap. For values n > 0, only the lower n bits of the address will change. This wraps the address on a (1 << n) byte boundary, facilitating access to naturally-aligned ring buffers. + + Ring sizes between 2 and 32768 bytes are possible. This can apply to either read or write addresses, based on value of RING_SEL. + [11:8] + read-write + + + RING_NONE + 0 + + + + + INCR_WRITE_REV + If 1, and INCR_WRITE is 1, the write address is decremented rather than incremented with each transfer. + + If 1, and INCR_WRITE is 0, this otherwise-unused combination causes the write address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [7:7] + read-write + + + INCR_WRITE + If 1, the write address increments with each transfer. If 0, each write is directed to the same, initial address. + + Generally this should be disabled for memory-to-peripheral transfers. + [6:6] + read-write + + + INCR_READ_REV + If 1, and INCR_READ is 1, the read address is decremented rather than incremented with each transfer. + + If 1, and INCR_READ is 0, this otherwise-unused combination causes the read address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [5:5] + read-write + + + INCR_READ + If 1, the read address increments with each transfer. If 0, each read is directed to the same, initial address. + + Generally this should be disabled for peripheral-to-memory transfers. + [4:4] + read-write + + + DATA_SIZE + Set the size of each bus transfer (byte/halfword/word). READ_ADDR and WRITE_ADDR advance by this amount (1/2/4 bytes) with each transfer. + [3:2] + read-write + + + SIZE_BYTE + 0 + + + SIZE_HALFWORD + 1 + + + SIZE_WORD + 2 + + + + + HIGH_PRIORITY + HIGH_PRIORITY gives a channel preferential treatment in issue scheduling: in each scheduling round, all high priority channels are considered first, and then only a single low priority channel, before returning to the high priority channels. + + This only affects the order in which the DMA schedules channels. The DMA's bus priority is not changed. If the DMA is not saturated then a low priority channel will see no loss of throughput. + [1:1] + read-write + + + EN + DMA Channel Enable. + When 1, the channel will respond to triggering events, which will cause it to become BUSY and start transferring data. When 0, the channel will ignore triggers, stop issuing transfers, and pause the current transfer sequence (i.e. BUSY will remain high if already high) + [0:0] + read-write + + + + + CH4_AL1_CTRL + 0x00000110 + Alias for channel 4 CTRL register + 0x00000000 + + + CH4_AL1_CTRL + [31:0] + read-write + + + + + CH4_AL1_READ_ADDR + 0x00000114 + Alias for channel 4 READ_ADDR register + 0x00000000 + + + CH4_AL1_READ_ADDR + [31:0] + read-write + + + + + CH4_AL1_WRITE_ADDR + 0x00000118 + Alias for channel 4 WRITE_ADDR register + 0x00000000 + + + CH4_AL1_WRITE_ADDR + [31:0] + read-write + + + + + CH4_AL1_TRANS_COUNT_TRIG + 0x0000011c + Alias for channel 4 TRANS_COUNT register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH4_AL1_TRANS_COUNT_TRIG + [31:0] + read-write + + + + + CH4_AL2_CTRL + 0x00000120 + Alias for channel 4 CTRL register + 0x00000000 + + + CH4_AL2_CTRL + [31:0] + read-write + + + + + CH4_AL2_TRANS_COUNT + 0x00000124 + Alias for channel 4 TRANS_COUNT register + 0x00000000 + + + CH4_AL2_TRANS_COUNT + [31:0] + read-write + + + + + CH4_AL2_READ_ADDR + 0x00000128 + Alias for channel 4 READ_ADDR register + 0x00000000 + + + CH4_AL2_READ_ADDR + [31:0] + read-write + + + + + CH4_AL2_WRITE_ADDR_TRIG + 0x0000012c + Alias for channel 4 WRITE_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH4_AL2_WRITE_ADDR_TRIG + [31:0] + read-write + + + + + CH4_AL3_CTRL + 0x00000130 + Alias for channel 4 CTRL register + 0x00000000 + + + CH4_AL3_CTRL + [31:0] + read-write + + + + + CH4_AL3_WRITE_ADDR + 0x00000134 + Alias for channel 4 WRITE_ADDR register + 0x00000000 + + + CH4_AL3_WRITE_ADDR + [31:0] + read-write + + + + + CH4_AL3_TRANS_COUNT + 0x00000138 + Alias for channel 4 TRANS_COUNT register + 0x00000000 + + + CH4_AL3_TRANS_COUNT + [31:0] + read-write + + + + + CH4_AL3_READ_ADDR_TRIG + 0x0000013c + Alias for channel 4 READ_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH4_AL3_READ_ADDR_TRIG + [31:0] + read-write + + + + + CH5_READ_ADDR + 0x00000140 + DMA Channel 5 Read Address pointer + 0x00000000 + + + CH5_READ_ADDR + This register updates automatically each time a read completes. The current value is the next address to be read by this channel. + [31:0] + read-write + + + + + CH5_WRITE_ADDR + 0x00000144 + DMA Channel 5 Write Address pointer + 0x00000000 + + + CH5_WRITE_ADDR + This register updates automatically each time a write completes. The current value is the next address to be written by this channel. + [31:0] + read-write + + + + + CH5_TRANS_COUNT + 0x00000148 + DMA Channel 5 Transfer Count + 0x00000000 + + + MODE + When MODE is 0x0, the transfer count decrements with each transfer until 0, and then the channel triggers the next channel indicated by CTRL_CHAIN_TO. + + When MODE is 0x1, the transfer count decrements with each transfer until 0, and then the channel re-triggers itself, in addition to the trigger indicated by CTRL_CHAIN_TO. This is useful for e.g. an endless ring-buffer DMA with periodic interrupts. + + When MODE is 0xf, the transfer count does not decrement. The DMA channel performs an endless sequence of transfers, never triggering other channels or raising interrupts, until an ABORT is raised. + + All other values are reserved. + [31:28] + read-write + + + NORMAL + 0 + + + TRIGGER_SELF + 1 + + + ENDLESS + 15 + + + + + COUNT + 28-bit transfer count (256 million transfers maximum). + + Program the number of bus transfers a channel will perform before halting. Note that, if transfers are larger than one byte in size, this is not equal to the number of bytes transferred (see CTRL_DATA_SIZE). + + When the channel is active, reading this register shows the number of transfers remaining, updating automatically each time a write transfer completes. + + Writing this register sets the RELOAD value for the transfer counter. Each time this channel is triggered, the RELOAD value is copied into the live transfer counter. The channel can be started multiple times, and will perform the same number of transfers each time, as programmed by most recent write. + + The RELOAD value can be observed at CHx_DBG_TCR. If TRANS_COUNT is used as a trigger, the written value is used immediately as the length of the new transfer sequence, as well as being written to RELOAD. + [27:0] + read-write + + + + + CH5_CTRL_TRIG + 0x0000014c + DMA Channel 5 Control and Status + 0x00000000 + + + AHB_ERROR + Logical OR of the READ_ERROR and WRITE_ERROR flags. The channel halts when it encounters any bus error, and always raises its channel IRQ flag. + [31:31] + read-only + + + READ_ERROR + If 1, the channel received a read bus error. Write one to clear. + READ_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 3 transfers later) + [30:30] + read-write + oneToClear + + + WRITE_ERROR + If 1, the channel received a write bus error. Write one to clear. + WRITE_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 5 transfers later) + [29:29] + read-write + oneToClear + + + BUSY + This flag goes high when the channel starts a new transfer sequence, and low when the last transfer of that sequence completes. Clearing EN while BUSY is high pauses the channel, and BUSY will stay high while paused. + + To terminate a sequence early (and clear the BUSY flag), see CHAN_ABORT. + [26:26] + read-only + + + SNIFF_EN + If 1, this channel's data transfers are visible to the sniff hardware, and each transfer will advance the state of the checksum. This only applies if the sniff hardware is enabled, and has this channel selected. + + This allows checksum to be enabled or disabled on a per-control- block basis. + [25:25] + read-write + + + BSWAP + Apply byte-swap transformation to DMA data. + For byte data, this has no effect. For halfword data, the two bytes of each halfword are swapped. For word data, the four bytes of each word are swapped to reverse order. + [24:24] + read-write + + + IRQ_QUIET + In QUIET mode, the channel does not generate IRQs at the end of every transfer block. Instead, an IRQ is raised when NULL is written to a trigger register, indicating the end of a control block chain. + + This reduces the number of interrupts to be serviced by the CPU when transferring a DMA chain of many small control blocks. + [23:23] + read-write + + + TREQ_SEL + Select a Transfer Request signal. + The channel uses the transfer request signal to pace its data transfer rate. Sources for TREQ signals are internal (TIMERS) or external (DREQ, a Data Request from the system). + 0x0 to 0x3a -> select DREQ n as TREQ + [22:17] + read-write + + + PIO0_TX0 + 0 + Select PIO0's TX FIFO 0 as TREQ + + + PIO0_TX1 + 1 + Select PIO0's TX FIFO 1 as TREQ + + + PIO0_TX2 + 2 + Select PIO0's TX FIFO 2 as TREQ + + + PIO0_TX3 + 3 + Select PIO0's TX FIFO 3 as TREQ + + + PIO0_RX0 + 4 + Select PIO0's RX FIFO 0 as TREQ + + + PIO0_RX1 + 5 + Select PIO0's RX FIFO 1 as TREQ + + + PIO0_RX2 + 6 + Select PIO0's RX FIFO 2 as TREQ + + + PIO0_RX3 + 7 + Select PIO0's RX FIFO 3 as TREQ + + + PIO1_TX0 + 8 + Select PIO1's TX FIFO 0 as TREQ + + + PIO1_TX1 + 9 + Select PIO1's TX FIFO 1 as TREQ + + + PIO1_TX2 + 10 + Select PIO1's TX FIFO 2 as TREQ + + + PIO1_TX3 + 11 + Select PIO1's TX FIFO 3 as TREQ + + + PIO1_RX0 + 12 + Select PIO1's RX FIFO 0 as TREQ + + + PIO1_RX1 + 13 + Select PIO1's RX FIFO 1 as TREQ + + + PIO1_RX2 + 14 + Select PIO1's RX FIFO 2 as TREQ + + + PIO1_RX3 + 15 + Select PIO1's RX FIFO 3 as TREQ + + + PIO2_TX0 + 16 + Select PIO2's TX FIFO 0 as TREQ + + + PIO2_TX1 + 17 + Select PIO2's TX FIFO 1 as TREQ + + + PIO2_TX2 + 18 + Select PIO2's TX FIFO 2 as TREQ + + + PIO2_TX3 + 19 + Select PIO2's TX FIFO 3 as TREQ + + + PIO2_RX0 + 20 + Select PIO2's RX FIFO 0 as TREQ + + + PIO2_RX1 + 21 + Select PIO2's RX FIFO 1 as TREQ + + + PIO2_RX2 + 22 + Select PIO2's RX FIFO 2 as TREQ + + + PIO2_RX3 + 23 + Select PIO2's RX FIFO 3 as TREQ + + + SPI0_TX + 24 + Select SPI0's TX FIFO as TREQ + + + SPI0_RX + 25 + Select SPI0's RX FIFO as TREQ + + + SPI1_TX + 26 + Select SPI1's TX FIFO as TREQ + + + SPI1_RX + 27 + Select SPI1's RX FIFO as TREQ + + + UART0_TX + 28 + Select UART0's TX FIFO as TREQ + + + UART0_RX + 29 + Select UART0's RX FIFO as TREQ + + + UART1_TX + 30 + Select UART1's TX FIFO as TREQ + + + UART1_RX + 31 + Select UART1's RX FIFO as TREQ + + + PWM_WRAP0 + 32 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP1 + 33 + Select PWM Counter 1's Wrap Value as TREQ + + + PWM_WRAP2 + 34 + Select PWM Counter 2's Wrap Value as TREQ + + + PWM_WRAP3 + 35 + Select PWM Counter 3's Wrap Value as TREQ + + + PWM_WRAP4 + 36 + Select PWM Counter 4's Wrap Value as TREQ + + + PWM_WRAP5 + 37 + Select PWM Counter 5's Wrap Value as TREQ + + + PWM_WRAP6 + 38 + Select PWM Counter 6's Wrap Value as TREQ + + + PWM_WRAP7 + 39 + Select PWM Counter 7's Wrap Value as TREQ + + + PWM_WRAP8 + 40 + Select PWM Counter 8's Wrap Value as TREQ + + + PWM_WRAP9 + 41 + Select PWM Counter 9's Wrap Value as TREQ + + + PWM_WRAP10 + 42 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP11 + 43 + Select PWM Counter 1's Wrap Value as TREQ + + + I2C0_TX + 44 + Select I2C0's TX FIFO as TREQ + + + I2C0_RX + 45 + Select I2C0's RX FIFO as TREQ + + + I2C1_TX + 46 + Select I2C1's TX FIFO as TREQ + + + I2C1_RX + 47 + Select I2C1's RX FIFO as TREQ + + + ADC + 48 + Select the ADC as TREQ + + + XIP_STREAM + 49 + Select the XIP Streaming FIFO as TREQ + + + XIP_QMITX + 50 + Select XIP_QMITX as TREQ + + + XIP_QMIRX + 51 + Select XIP_QMIRX as TREQ + + + HSTX + 52 + Select HSTX as TREQ + + + CORESIGHT + 53 + Select CORESIGHT as TREQ + + + SHA256 + 54 + Select SHA256 as TREQ + + + TIMER0 + 59 + Select Timer 0 as TREQ + + + TIMER1 + 60 + Select Timer 1 as TREQ + + + TIMER2 + 61 + Select Timer 2 as TREQ (Optional) + + + TIMER3 + 62 + Select Timer 3 as TREQ (Optional) + + + PERMANENT + 63 + Permanent request, for unpaced transfers. + + + + + CHAIN_TO + When this channel completes, it will trigger the channel indicated by CHAIN_TO. Disable by setting CHAIN_TO = _(this channel)_. + + Note this field resets to 0, so channels 1 and above will chain to channel 0 by default. Set this field to avoid this behaviour. + [16:13] + read-write + + + RING_SEL + Select whether RING_SIZE applies to read or write addresses. + If 0, read addresses are wrapped on a (1 << RING_SIZE) boundary. If 1, write addresses are wrapped. + [12:12] + read-write + + + RING_SIZE + Size of address wrap region. If 0, don't wrap. For values n > 0, only the lower n bits of the address will change. This wraps the address on a (1 << n) byte boundary, facilitating access to naturally-aligned ring buffers. + + Ring sizes between 2 and 32768 bytes are possible. This can apply to either read or write addresses, based on value of RING_SEL. + [11:8] + read-write + + + RING_NONE + 0 + + + + + INCR_WRITE_REV + If 1, and INCR_WRITE is 1, the write address is decremented rather than incremented with each transfer. + + If 1, and INCR_WRITE is 0, this otherwise-unused combination causes the write address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [7:7] + read-write + + + INCR_WRITE + If 1, the write address increments with each transfer. If 0, each write is directed to the same, initial address. + + Generally this should be disabled for memory-to-peripheral transfers. + [6:6] + read-write + + + INCR_READ_REV + If 1, and INCR_READ is 1, the read address is decremented rather than incremented with each transfer. + + If 1, and INCR_READ is 0, this otherwise-unused combination causes the read address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [5:5] + read-write + + + INCR_READ + If 1, the read address increments with each transfer. If 0, each read is directed to the same, initial address. + + Generally this should be disabled for peripheral-to-memory transfers. + [4:4] + read-write + + + DATA_SIZE + Set the size of each bus transfer (byte/halfword/word). READ_ADDR and WRITE_ADDR advance by this amount (1/2/4 bytes) with each transfer. + [3:2] + read-write + + + SIZE_BYTE + 0 + + + SIZE_HALFWORD + 1 + + + SIZE_WORD + 2 + + + + + HIGH_PRIORITY + HIGH_PRIORITY gives a channel preferential treatment in issue scheduling: in each scheduling round, all high priority channels are considered first, and then only a single low priority channel, before returning to the high priority channels. + + This only affects the order in which the DMA schedules channels. The DMA's bus priority is not changed. If the DMA is not saturated then a low priority channel will see no loss of throughput. + [1:1] + read-write + + + EN + DMA Channel Enable. + When 1, the channel will respond to triggering events, which will cause it to become BUSY and start transferring data. When 0, the channel will ignore triggers, stop issuing transfers, and pause the current transfer sequence (i.e. BUSY will remain high if already high) + [0:0] + read-write + + + + + CH5_AL1_CTRL + 0x00000150 + Alias for channel 5 CTRL register + 0x00000000 + + + CH5_AL1_CTRL + [31:0] + read-write + + + + + CH5_AL1_READ_ADDR + 0x00000154 + Alias for channel 5 READ_ADDR register + 0x00000000 + + + CH5_AL1_READ_ADDR + [31:0] + read-write + + + + + CH5_AL1_WRITE_ADDR + 0x00000158 + Alias for channel 5 WRITE_ADDR register + 0x00000000 + + + CH5_AL1_WRITE_ADDR + [31:0] + read-write + + + + + CH5_AL1_TRANS_COUNT_TRIG + 0x0000015c + Alias for channel 5 TRANS_COUNT register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH5_AL1_TRANS_COUNT_TRIG + [31:0] + read-write + + + + + CH5_AL2_CTRL + 0x00000160 + Alias for channel 5 CTRL register + 0x00000000 + + + CH5_AL2_CTRL + [31:0] + read-write + + + + + CH5_AL2_TRANS_COUNT + 0x00000164 + Alias for channel 5 TRANS_COUNT register + 0x00000000 + + + CH5_AL2_TRANS_COUNT + [31:0] + read-write + + + + + CH5_AL2_READ_ADDR + 0x00000168 + Alias for channel 5 READ_ADDR register + 0x00000000 + + + CH5_AL2_READ_ADDR + [31:0] + read-write + + + + + CH5_AL2_WRITE_ADDR_TRIG + 0x0000016c + Alias for channel 5 WRITE_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH5_AL2_WRITE_ADDR_TRIG + [31:0] + read-write + + + + + CH5_AL3_CTRL + 0x00000170 + Alias for channel 5 CTRL register + 0x00000000 + + + CH5_AL3_CTRL + [31:0] + read-write + + + + + CH5_AL3_WRITE_ADDR + 0x00000174 + Alias for channel 5 WRITE_ADDR register + 0x00000000 + + + CH5_AL3_WRITE_ADDR + [31:0] + read-write + + + + + CH5_AL3_TRANS_COUNT + 0x00000178 + Alias for channel 5 TRANS_COUNT register + 0x00000000 + + + CH5_AL3_TRANS_COUNT + [31:0] + read-write + + + + + CH5_AL3_READ_ADDR_TRIG + 0x0000017c + Alias for channel 5 READ_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH5_AL3_READ_ADDR_TRIG + [31:0] + read-write + + + + + CH6_READ_ADDR + 0x00000180 + DMA Channel 6 Read Address pointer + 0x00000000 + + + CH6_READ_ADDR + This register updates automatically each time a read completes. The current value is the next address to be read by this channel. + [31:0] + read-write + + + + + CH6_WRITE_ADDR + 0x00000184 + DMA Channel 6 Write Address pointer + 0x00000000 + + + CH6_WRITE_ADDR + This register updates automatically each time a write completes. The current value is the next address to be written by this channel. + [31:0] + read-write + + + + + CH6_TRANS_COUNT + 0x00000188 + DMA Channel 6 Transfer Count + 0x00000000 + + + MODE + When MODE is 0x0, the transfer count decrements with each transfer until 0, and then the channel triggers the next channel indicated by CTRL_CHAIN_TO. + + When MODE is 0x1, the transfer count decrements with each transfer until 0, and then the channel re-triggers itself, in addition to the trigger indicated by CTRL_CHAIN_TO. This is useful for e.g. an endless ring-buffer DMA with periodic interrupts. + + When MODE is 0xf, the transfer count does not decrement. The DMA channel performs an endless sequence of transfers, never triggering other channels or raising interrupts, until an ABORT is raised. + + All other values are reserved. + [31:28] + read-write + + + NORMAL + 0 + + + TRIGGER_SELF + 1 + + + ENDLESS + 15 + + + + + COUNT + 28-bit transfer count (256 million transfers maximum). + + Program the number of bus transfers a channel will perform before halting. Note that, if transfers are larger than one byte in size, this is not equal to the number of bytes transferred (see CTRL_DATA_SIZE). + + When the channel is active, reading this register shows the number of transfers remaining, updating automatically each time a write transfer completes. + + Writing this register sets the RELOAD value for the transfer counter. Each time this channel is triggered, the RELOAD value is copied into the live transfer counter. The channel can be started multiple times, and will perform the same number of transfers each time, as programmed by most recent write. + + The RELOAD value can be observed at CHx_DBG_TCR. If TRANS_COUNT is used as a trigger, the written value is used immediately as the length of the new transfer sequence, as well as being written to RELOAD. + [27:0] + read-write + + + + + CH6_CTRL_TRIG + 0x0000018c + DMA Channel 6 Control and Status + 0x00000000 + + + AHB_ERROR + Logical OR of the READ_ERROR and WRITE_ERROR flags. The channel halts when it encounters any bus error, and always raises its channel IRQ flag. + [31:31] + read-only + + + READ_ERROR + If 1, the channel received a read bus error. Write one to clear. + READ_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 3 transfers later) + [30:30] + read-write + oneToClear + + + WRITE_ERROR + If 1, the channel received a write bus error. Write one to clear. + WRITE_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 5 transfers later) + [29:29] + read-write + oneToClear + + + BUSY + This flag goes high when the channel starts a new transfer sequence, and low when the last transfer of that sequence completes. Clearing EN while BUSY is high pauses the channel, and BUSY will stay high while paused. + + To terminate a sequence early (and clear the BUSY flag), see CHAN_ABORT. + [26:26] + read-only + + + SNIFF_EN + If 1, this channel's data transfers are visible to the sniff hardware, and each transfer will advance the state of the checksum. This only applies if the sniff hardware is enabled, and has this channel selected. + + This allows checksum to be enabled or disabled on a per-control- block basis. + [25:25] + read-write + + + BSWAP + Apply byte-swap transformation to DMA data. + For byte data, this has no effect. For halfword data, the two bytes of each halfword are swapped. For word data, the four bytes of each word are swapped to reverse order. + [24:24] + read-write + + + IRQ_QUIET + In QUIET mode, the channel does not generate IRQs at the end of every transfer block. Instead, an IRQ is raised when NULL is written to a trigger register, indicating the end of a control block chain. + + This reduces the number of interrupts to be serviced by the CPU when transferring a DMA chain of many small control blocks. + [23:23] + read-write + + + TREQ_SEL + Select a Transfer Request signal. + The channel uses the transfer request signal to pace its data transfer rate. Sources for TREQ signals are internal (TIMERS) or external (DREQ, a Data Request from the system). + 0x0 to 0x3a -> select DREQ n as TREQ + [22:17] + read-write + + + PIO0_TX0 + 0 + Select PIO0's TX FIFO 0 as TREQ + + + PIO0_TX1 + 1 + Select PIO0's TX FIFO 1 as TREQ + + + PIO0_TX2 + 2 + Select PIO0's TX FIFO 2 as TREQ + + + PIO0_TX3 + 3 + Select PIO0's TX FIFO 3 as TREQ + + + PIO0_RX0 + 4 + Select PIO0's RX FIFO 0 as TREQ + + + PIO0_RX1 + 5 + Select PIO0's RX FIFO 1 as TREQ + + + PIO0_RX2 + 6 + Select PIO0's RX FIFO 2 as TREQ + + + PIO0_RX3 + 7 + Select PIO0's RX FIFO 3 as TREQ + + + PIO1_TX0 + 8 + Select PIO1's TX FIFO 0 as TREQ + + + PIO1_TX1 + 9 + Select PIO1's TX FIFO 1 as TREQ + + + PIO1_TX2 + 10 + Select PIO1's TX FIFO 2 as TREQ + + + PIO1_TX3 + 11 + Select PIO1's TX FIFO 3 as TREQ + + + PIO1_RX0 + 12 + Select PIO1's RX FIFO 0 as TREQ + + + PIO1_RX1 + 13 + Select PIO1's RX FIFO 1 as TREQ + + + PIO1_RX2 + 14 + Select PIO1's RX FIFO 2 as TREQ + + + PIO1_RX3 + 15 + Select PIO1's RX FIFO 3 as TREQ + + + PIO2_TX0 + 16 + Select PIO2's TX FIFO 0 as TREQ + + + PIO2_TX1 + 17 + Select PIO2's TX FIFO 1 as TREQ + + + PIO2_TX2 + 18 + Select PIO2's TX FIFO 2 as TREQ + + + PIO2_TX3 + 19 + Select PIO2's TX FIFO 3 as TREQ + + + PIO2_RX0 + 20 + Select PIO2's RX FIFO 0 as TREQ + + + PIO2_RX1 + 21 + Select PIO2's RX FIFO 1 as TREQ + + + PIO2_RX2 + 22 + Select PIO2's RX FIFO 2 as TREQ + + + PIO2_RX3 + 23 + Select PIO2's RX FIFO 3 as TREQ + + + SPI0_TX + 24 + Select SPI0's TX FIFO as TREQ + + + SPI0_RX + 25 + Select SPI0's RX FIFO as TREQ + + + SPI1_TX + 26 + Select SPI1's TX FIFO as TREQ + + + SPI1_RX + 27 + Select SPI1's RX FIFO as TREQ + + + UART0_TX + 28 + Select UART0's TX FIFO as TREQ + + + UART0_RX + 29 + Select UART0's RX FIFO as TREQ + + + UART1_TX + 30 + Select UART1's TX FIFO as TREQ + + + UART1_RX + 31 + Select UART1's RX FIFO as TREQ + + + PWM_WRAP0 + 32 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP1 + 33 + Select PWM Counter 1's Wrap Value as TREQ + + + PWM_WRAP2 + 34 + Select PWM Counter 2's Wrap Value as TREQ + + + PWM_WRAP3 + 35 + Select PWM Counter 3's Wrap Value as TREQ + + + PWM_WRAP4 + 36 + Select PWM Counter 4's Wrap Value as TREQ + + + PWM_WRAP5 + 37 + Select PWM Counter 5's Wrap Value as TREQ + + + PWM_WRAP6 + 38 + Select PWM Counter 6's Wrap Value as TREQ + + + PWM_WRAP7 + 39 + Select PWM Counter 7's Wrap Value as TREQ + + + PWM_WRAP8 + 40 + Select PWM Counter 8's Wrap Value as TREQ + + + PWM_WRAP9 + 41 + Select PWM Counter 9's Wrap Value as TREQ + + + PWM_WRAP10 + 42 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP11 + 43 + Select PWM Counter 1's Wrap Value as TREQ + + + I2C0_TX + 44 + Select I2C0's TX FIFO as TREQ + + + I2C0_RX + 45 + Select I2C0's RX FIFO as TREQ + + + I2C1_TX + 46 + Select I2C1's TX FIFO as TREQ + + + I2C1_RX + 47 + Select I2C1's RX FIFO as TREQ + + + ADC + 48 + Select the ADC as TREQ + + + XIP_STREAM + 49 + Select the XIP Streaming FIFO as TREQ + + + XIP_QMITX + 50 + Select XIP_QMITX as TREQ + + + XIP_QMIRX + 51 + Select XIP_QMIRX as TREQ + + + HSTX + 52 + Select HSTX as TREQ + + + CORESIGHT + 53 + Select CORESIGHT as TREQ + + + SHA256 + 54 + Select SHA256 as TREQ + + + TIMER0 + 59 + Select Timer 0 as TREQ + + + TIMER1 + 60 + Select Timer 1 as TREQ + + + TIMER2 + 61 + Select Timer 2 as TREQ (Optional) + + + TIMER3 + 62 + Select Timer 3 as TREQ (Optional) + + + PERMANENT + 63 + Permanent request, for unpaced transfers. + + + + + CHAIN_TO + When this channel completes, it will trigger the channel indicated by CHAIN_TO. Disable by setting CHAIN_TO = _(this channel)_. + + Note this field resets to 0, so channels 1 and above will chain to channel 0 by default. Set this field to avoid this behaviour. + [16:13] + read-write + + + RING_SEL + Select whether RING_SIZE applies to read or write addresses. + If 0, read addresses are wrapped on a (1 << RING_SIZE) boundary. If 1, write addresses are wrapped. + [12:12] + read-write + + + RING_SIZE + Size of address wrap region. If 0, don't wrap. For values n > 0, only the lower n bits of the address will change. This wraps the address on a (1 << n) byte boundary, facilitating access to naturally-aligned ring buffers. + + Ring sizes between 2 and 32768 bytes are possible. This can apply to either read or write addresses, based on value of RING_SEL. + [11:8] + read-write + + + RING_NONE + 0 + + + + + INCR_WRITE_REV + If 1, and INCR_WRITE is 1, the write address is decremented rather than incremented with each transfer. + + If 1, and INCR_WRITE is 0, this otherwise-unused combination causes the write address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [7:7] + read-write + + + INCR_WRITE + If 1, the write address increments with each transfer. If 0, each write is directed to the same, initial address. + + Generally this should be disabled for memory-to-peripheral transfers. + [6:6] + read-write + + + INCR_READ_REV + If 1, and INCR_READ is 1, the read address is decremented rather than incremented with each transfer. + + If 1, and INCR_READ is 0, this otherwise-unused combination causes the read address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [5:5] + read-write + + + INCR_READ + If 1, the read address increments with each transfer. If 0, each read is directed to the same, initial address. + + Generally this should be disabled for peripheral-to-memory transfers. + [4:4] + read-write + + + DATA_SIZE + Set the size of each bus transfer (byte/halfword/word). READ_ADDR and WRITE_ADDR advance by this amount (1/2/4 bytes) with each transfer. + [3:2] + read-write + + + SIZE_BYTE + 0 + + + SIZE_HALFWORD + 1 + + + SIZE_WORD + 2 + + + + + HIGH_PRIORITY + HIGH_PRIORITY gives a channel preferential treatment in issue scheduling: in each scheduling round, all high priority channels are considered first, and then only a single low priority channel, before returning to the high priority channels. + + This only affects the order in which the DMA schedules channels. The DMA's bus priority is not changed. If the DMA is not saturated then a low priority channel will see no loss of throughput. + [1:1] + read-write + + + EN + DMA Channel Enable. + When 1, the channel will respond to triggering events, which will cause it to become BUSY and start transferring data. When 0, the channel will ignore triggers, stop issuing transfers, and pause the current transfer sequence (i.e. BUSY will remain high if already high) + [0:0] + read-write + + + + + CH6_AL1_CTRL + 0x00000190 + Alias for channel 6 CTRL register + 0x00000000 + + + CH6_AL1_CTRL + [31:0] + read-write + + + + + CH6_AL1_READ_ADDR + 0x00000194 + Alias for channel 6 READ_ADDR register + 0x00000000 + + + CH6_AL1_READ_ADDR + [31:0] + read-write + + + + + CH6_AL1_WRITE_ADDR + 0x00000198 + Alias for channel 6 WRITE_ADDR register + 0x00000000 + + + CH6_AL1_WRITE_ADDR + [31:0] + read-write + + + + + CH6_AL1_TRANS_COUNT_TRIG + 0x0000019c + Alias for channel 6 TRANS_COUNT register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH6_AL1_TRANS_COUNT_TRIG + [31:0] + read-write + + + + + CH6_AL2_CTRL + 0x000001a0 + Alias for channel 6 CTRL register + 0x00000000 + + + CH6_AL2_CTRL + [31:0] + read-write + + + + + CH6_AL2_TRANS_COUNT + 0x000001a4 + Alias for channel 6 TRANS_COUNT register + 0x00000000 + + + CH6_AL2_TRANS_COUNT + [31:0] + read-write + + + + + CH6_AL2_READ_ADDR + 0x000001a8 + Alias for channel 6 READ_ADDR register + 0x00000000 + + + CH6_AL2_READ_ADDR + [31:0] + read-write + + + + + CH6_AL2_WRITE_ADDR_TRIG + 0x000001ac + Alias for channel 6 WRITE_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH6_AL2_WRITE_ADDR_TRIG + [31:0] + read-write + + + + + CH6_AL3_CTRL + 0x000001b0 + Alias for channel 6 CTRL register + 0x00000000 + + + CH6_AL3_CTRL + [31:0] + read-write + + + + + CH6_AL3_WRITE_ADDR + 0x000001b4 + Alias for channel 6 WRITE_ADDR register + 0x00000000 + + + CH6_AL3_WRITE_ADDR + [31:0] + read-write + + + + + CH6_AL3_TRANS_COUNT + 0x000001b8 + Alias for channel 6 TRANS_COUNT register + 0x00000000 + + + CH6_AL3_TRANS_COUNT + [31:0] + read-write + + + + + CH6_AL3_READ_ADDR_TRIG + 0x000001bc + Alias for channel 6 READ_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH6_AL3_READ_ADDR_TRIG + [31:0] + read-write + + + + + CH7_READ_ADDR + 0x000001c0 + DMA Channel 7 Read Address pointer + 0x00000000 + + + CH7_READ_ADDR + This register updates automatically each time a read completes. The current value is the next address to be read by this channel. + [31:0] + read-write + + + + + CH7_WRITE_ADDR + 0x000001c4 + DMA Channel 7 Write Address pointer + 0x00000000 + + + CH7_WRITE_ADDR + This register updates automatically each time a write completes. The current value is the next address to be written by this channel. + [31:0] + read-write + + + + + CH7_TRANS_COUNT + 0x000001c8 + DMA Channel 7 Transfer Count + 0x00000000 + + + MODE + When MODE is 0x0, the transfer count decrements with each transfer until 0, and then the channel triggers the next channel indicated by CTRL_CHAIN_TO. + + When MODE is 0x1, the transfer count decrements with each transfer until 0, and then the channel re-triggers itself, in addition to the trigger indicated by CTRL_CHAIN_TO. This is useful for e.g. an endless ring-buffer DMA with periodic interrupts. + + When MODE is 0xf, the transfer count does not decrement. The DMA channel performs an endless sequence of transfers, never triggering other channels or raising interrupts, until an ABORT is raised. + + All other values are reserved. + [31:28] + read-write + + + NORMAL + 0 + + + TRIGGER_SELF + 1 + + + ENDLESS + 15 + + + + + COUNT + 28-bit transfer count (256 million transfers maximum). + + Program the number of bus transfers a channel will perform before halting. Note that, if transfers are larger than one byte in size, this is not equal to the number of bytes transferred (see CTRL_DATA_SIZE). + + When the channel is active, reading this register shows the number of transfers remaining, updating automatically each time a write transfer completes. + + Writing this register sets the RELOAD value for the transfer counter. Each time this channel is triggered, the RELOAD value is copied into the live transfer counter. The channel can be started multiple times, and will perform the same number of transfers each time, as programmed by most recent write. + + The RELOAD value can be observed at CHx_DBG_TCR. If TRANS_COUNT is used as a trigger, the written value is used immediately as the length of the new transfer sequence, as well as being written to RELOAD. + [27:0] + read-write + + + + + CH7_CTRL_TRIG + 0x000001cc + DMA Channel 7 Control and Status + 0x00000000 + + + AHB_ERROR + Logical OR of the READ_ERROR and WRITE_ERROR flags. The channel halts when it encounters any bus error, and always raises its channel IRQ flag. + [31:31] + read-only + + + READ_ERROR + If 1, the channel received a read bus error. Write one to clear. + READ_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 3 transfers later) + [30:30] + read-write + oneToClear + + + WRITE_ERROR + If 1, the channel received a write bus error. Write one to clear. + WRITE_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 5 transfers later) + [29:29] + read-write + oneToClear + + + BUSY + This flag goes high when the channel starts a new transfer sequence, and low when the last transfer of that sequence completes. Clearing EN while BUSY is high pauses the channel, and BUSY will stay high while paused. + + To terminate a sequence early (and clear the BUSY flag), see CHAN_ABORT. + [26:26] + read-only + + + SNIFF_EN + If 1, this channel's data transfers are visible to the sniff hardware, and each transfer will advance the state of the checksum. This only applies if the sniff hardware is enabled, and has this channel selected. + + This allows checksum to be enabled or disabled on a per-control- block basis. + [25:25] + read-write + + + BSWAP + Apply byte-swap transformation to DMA data. + For byte data, this has no effect. For halfword data, the two bytes of each halfword are swapped. For word data, the four bytes of each word are swapped to reverse order. + [24:24] + read-write + + + IRQ_QUIET + In QUIET mode, the channel does not generate IRQs at the end of every transfer block. Instead, an IRQ is raised when NULL is written to a trigger register, indicating the end of a control block chain. + + This reduces the number of interrupts to be serviced by the CPU when transferring a DMA chain of many small control blocks. + [23:23] + read-write + + + TREQ_SEL + Select a Transfer Request signal. + The channel uses the transfer request signal to pace its data transfer rate. Sources for TREQ signals are internal (TIMERS) or external (DREQ, a Data Request from the system). + 0x0 to 0x3a -> select DREQ n as TREQ + [22:17] + read-write + + + PIO0_TX0 + 0 + Select PIO0's TX FIFO 0 as TREQ + + + PIO0_TX1 + 1 + Select PIO0's TX FIFO 1 as TREQ + + + PIO0_TX2 + 2 + Select PIO0's TX FIFO 2 as TREQ + + + PIO0_TX3 + 3 + Select PIO0's TX FIFO 3 as TREQ + + + PIO0_RX0 + 4 + Select PIO0's RX FIFO 0 as TREQ + + + PIO0_RX1 + 5 + Select PIO0's RX FIFO 1 as TREQ + + + PIO0_RX2 + 6 + Select PIO0's RX FIFO 2 as TREQ + + + PIO0_RX3 + 7 + Select PIO0's RX FIFO 3 as TREQ + + + PIO1_TX0 + 8 + Select PIO1's TX FIFO 0 as TREQ + + + PIO1_TX1 + 9 + Select PIO1's TX FIFO 1 as TREQ + + + PIO1_TX2 + 10 + Select PIO1's TX FIFO 2 as TREQ + + + PIO1_TX3 + 11 + Select PIO1's TX FIFO 3 as TREQ + + + PIO1_RX0 + 12 + Select PIO1's RX FIFO 0 as TREQ + + + PIO1_RX1 + 13 + Select PIO1's RX FIFO 1 as TREQ + + + PIO1_RX2 + 14 + Select PIO1's RX FIFO 2 as TREQ + + + PIO1_RX3 + 15 + Select PIO1's RX FIFO 3 as TREQ + + + PIO2_TX0 + 16 + Select PIO2's TX FIFO 0 as TREQ + + + PIO2_TX1 + 17 + Select PIO2's TX FIFO 1 as TREQ + + + PIO2_TX2 + 18 + Select PIO2's TX FIFO 2 as TREQ + + + PIO2_TX3 + 19 + Select PIO2's TX FIFO 3 as TREQ + + + PIO2_RX0 + 20 + Select PIO2's RX FIFO 0 as TREQ + + + PIO2_RX1 + 21 + Select PIO2's RX FIFO 1 as TREQ + + + PIO2_RX2 + 22 + Select PIO2's RX FIFO 2 as TREQ + + + PIO2_RX3 + 23 + Select PIO2's RX FIFO 3 as TREQ + + + SPI0_TX + 24 + Select SPI0's TX FIFO as TREQ + + + SPI0_RX + 25 + Select SPI0's RX FIFO as TREQ + + + SPI1_TX + 26 + Select SPI1's TX FIFO as TREQ + + + SPI1_RX + 27 + Select SPI1's RX FIFO as TREQ + + + UART0_TX + 28 + Select UART0's TX FIFO as TREQ + + + UART0_RX + 29 + Select UART0's RX FIFO as TREQ + + + UART1_TX + 30 + Select UART1's TX FIFO as TREQ + + + UART1_RX + 31 + Select UART1's RX FIFO as TREQ + + + PWM_WRAP0 + 32 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP1 + 33 + Select PWM Counter 1's Wrap Value as TREQ + + + PWM_WRAP2 + 34 + Select PWM Counter 2's Wrap Value as TREQ + + + PWM_WRAP3 + 35 + Select PWM Counter 3's Wrap Value as TREQ + + + PWM_WRAP4 + 36 + Select PWM Counter 4's Wrap Value as TREQ + + + PWM_WRAP5 + 37 + Select PWM Counter 5's Wrap Value as TREQ + + + PWM_WRAP6 + 38 + Select PWM Counter 6's Wrap Value as TREQ + + + PWM_WRAP7 + 39 + Select PWM Counter 7's Wrap Value as TREQ + + + PWM_WRAP8 + 40 + Select PWM Counter 8's Wrap Value as TREQ + + + PWM_WRAP9 + 41 + Select PWM Counter 9's Wrap Value as TREQ + + + PWM_WRAP10 + 42 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP11 + 43 + Select PWM Counter 1's Wrap Value as TREQ + + + I2C0_TX + 44 + Select I2C0's TX FIFO as TREQ + + + I2C0_RX + 45 + Select I2C0's RX FIFO as TREQ + + + I2C1_TX + 46 + Select I2C1's TX FIFO as TREQ + + + I2C1_RX + 47 + Select I2C1's RX FIFO as TREQ + + + ADC + 48 + Select the ADC as TREQ + + + XIP_STREAM + 49 + Select the XIP Streaming FIFO as TREQ + + + XIP_QMITX + 50 + Select XIP_QMITX as TREQ + + + XIP_QMIRX + 51 + Select XIP_QMIRX as TREQ + + + HSTX + 52 + Select HSTX as TREQ + + + CORESIGHT + 53 + Select CORESIGHT as TREQ + + + SHA256 + 54 + Select SHA256 as TREQ + + + TIMER0 + 59 + Select Timer 0 as TREQ + + + TIMER1 + 60 + Select Timer 1 as TREQ + + + TIMER2 + 61 + Select Timer 2 as TREQ (Optional) + + + TIMER3 + 62 + Select Timer 3 as TREQ (Optional) + + + PERMANENT + 63 + Permanent request, for unpaced transfers. + + + + + CHAIN_TO + When this channel completes, it will trigger the channel indicated by CHAIN_TO. Disable by setting CHAIN_TO = _(this channel)_. + + Note this field resets to 0, so channels 1 and above will chain to channel 0 by default. Set this field to avoid this behaviour. + [16:13] + read-write + + + RING_SEL + Select whether RING_SIZE applies to read or write addresses. + If 0, read addresses are wrapped on a (1 << RING_SIZE) boundary. If 1, write addresses are wrapped. + [12:12] + read-write + + + RING_SIZE + Size of address wrap region. If 0, don't wrap. For values n > 0, only the lower n bits of the address will change. This wraps the address on a (1 << n) byte boundary, facilitating access to naturally-aligned ring buffers. + + Ring sizes between 2 and 32768 bytes are possible. This can apply to either read or write addresses, based on value of RING_SEL. + [11:8] + read-write + + + RING_NONE + 0 + + + + + INCR_WRITE_REV + If 1, and INCR_WRITE is 1, the write address is decremented rather than incremented with each transfer. + + If 1, and INCR_WRITE is 0, this otherwise-unused combination causes the write address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [7:7] + read-write + + + INCR_WRITE + If 1, the write address increments with each transfer. If 0, each write is directed to the same, initial address. + + Generally this should be disabled for memory-to-peripheral transfers. + [6:6] + read-write + + + INCR_READ_REV + If 1, and INCR_READ is 1, the read address is decremented rather than incremented with each transfer. + + If 1, and INCR_READ is 0, this otherwise-unused combination causes the read address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [5:5] + read-write + + + INCR_READ + If 1, the read address increments with each transfer. If 0, each read is directed to the same, initial address. + + Generally this should be disabled for peripheral-to-memory transfers. + [4:4] + read-write + + + DATA_SIZE + Set the size of each bus transfer (byte/halfword/word). READ_ADDR and WRITE_ADDR advance by this amount (1/2/4 bytes) with each transfer. + [3:2] + read-write + + + SIZE_BYTE + 0 + + + SIZE_HALFWORD + 1 + + + SIZE_WORD + 2 + + + + + HIGH_PRIORITY + HIGH_PRIORITY gives a channel preferential treatment in issue scheduling: in each scheduling round, all high priority channels are considered first, and then only a single low priority channel, before returning to the high priority channels. + + This only affects the order in which the DMA schedules channels. The DMA's bus priority is not changed. If the DMA is not saturated then a low priority channel will see no loss of throughput. + [1:1] + read-write + + + EN + DMA Channel Enable. + When 1, the channel will respond to triggering events, which will cause it to become BUSY and start transferring data. When 0, the channel will ignore triggers, stop issuing transfers, and pause the current transfer sequence (i.e. BUSY will remain high if already high) + [0:0] + read-write + + + + + CH7_AL1_CTRL + 0x000001d0 + Alias for channel 7 CTRL register + 0x00000000 + + + CH7_AL1_CTRL + [31:0] + read-write + + + + + CH7_AL1_READ_ADDR + 0x000001d4 + Alias for channel 7 READ_ADDR register + 0x00000000 + + + CH7_AL1_READ_ADDR + [31:0] + read-write + + + + + CH7_AL1_WRITE_ADDR + 0x000001d8 + Alias for channel 7 WRITE_ADDR register + 0x00000000 + + + CH7_AL1_WRITE_ADDR + [31:0] + read-write + + + + + CH7_AL1_TRANS_COUNT_TRIG + 0x000001dc + Alias for channel 7 TRANS_COUNT register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH7_AL1_TRANS_COUNT_TRIG + [31:0] + read-write + + + + + CH7_AL2_CTRL + 0x000001e0 + Alias for channel 7 CTRL register + 0x00000000 + + + CH7_AL2_CTRL + [31:0] + read-write + + + + + CH7_AL2_TRANS_COUNT + 0x000001e4 + Alias for channel 7 TRANS_COUNT register + 0x00000000 + + + CH7_AL2_TRANS_COUNT + [31:0] + read-write + + + + + CH7_AL2_READ_ADDR + 0x000001e8 + Alias for channel 7 READ_ADDR register + 0x00000000 + + + CH7_AL2_READ_ADDR + [31:0] + read-write + + + + + CH7_AL2_WRITE_ADDR_TRIG + 0x000001ec + Alias for channel 7 WRITE_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH7_AL2_WRITE_ADDR_TRIG + [31:0] + read-write + + + + + CH7_AL3_CTRL + 0x000001f0 + Alias for channel 7 CTRL register + 0x00000000 + + + CH7_AL3_CTRL + [31:0] + read-write + + + + + CH7_AL3_WRITE_ADDR + 0x000001f4 + Alias for channel 7 WRITE_ADDR register + 0x00000000 + + + CH7_AL3_WRITE_ADDR + [31:0] + read-write + + + + + CH7_AL3_TRANS_COUNT + 0x000001f8 + Alias for channel 7 TRANS_COUNT register + 0x00000000 + + + CH7_AL3_TRANS_COUNT + [31:0] + read-write + + + + + CH7_AL3_READ_ADDR_TRIG + 0x000001fc + Alias for channel 7 READ_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH7_AL3_READ_ADDR_TRIG + [31:0] + read-write + + + + + CH8_READ_ADDR + 0x00000200 + DMA Channel 8 Read Address pointer + 0x00000000 + + + CH8_READ_ADDR + This register updates automatically each time a read completes. The current value is the next address to be read by this channel. + [31:0] + read-write + + + + + CH8_WRITE_ADDR + 0x00000204 + DMA Channel 8 Write Address pointer + 0x00000000 + + + CH8_WRITE_ADDR + This register updates automatically each time a write completes. The current value is the next address to be written by this channel. + [31:0] + read-write + + + + + CH8_TRANS_COUNT + 0x00000208 + DMA Channel 8 Transfer Count + 0x00000000 + + + MODE + When MODE is 0x0, the transfer count decrements with each transfer until 0, and then the channel triggers the next channel indicated by CTRL_CHAIN_TO. + + When MODE is 0x1, the transfer count decrements with each transfer until 0, and then the channel re-triggers itself, in addition to the trigger indicated by CTRL_CHAIN_TO. This is useful for e.g. an endless ring-buffer DMA with periodic interrupts. + + When MODE is 0xf, the transfer count does not decrement. The DMA channel performs an endless sequence of transfers, never triggering other channels or raising interrupts, until an ABORT is raised. + + All other values are reserved. + [31:28] + read-write + + + NORMAL + 0 + + + TRIGGER_SELF + 1 + + + ENDLESS + 15 + + + + + COUNT + 28-bit transfer count (256 million transfers maximum). + + Program the number of bus transfers a channel will perform before halting. Note that, if transfers are larger than one byte in size, this is not equal to the number of bytes transferred (see CTRL_DATA_SIZE). + + When the channel is active, reading this register shows the number of transfers remaining, updating automatically each time a write transfer completes. + + Writing this register sets the RELOAD value for the transfer counter. Each time this channel is triggered, the RELOAD value is copied into the live transfer counter. The channel can be started multiple times, and will perform the same number of transfers each time, as programmed by most recent write. + + The RELOAD value can be observed at CHx_DBG_TCR. If TRANS_COUNT is used as a trigger, the written value is used immediately as the length of the new transfer sequence, as well as being written to RELOAD. + [27:0] + read-write + + + + + CH8_CTRL_TRIG + 0x0000020c + DMA Channel 8 Control and Status + 0x00000000 + + + AHB_ERROR + Logical OR of the READ_ERROR and WRITE_ERROR flags. The channel halts when it encounters any bus error, and always raises its channel IRQ flag. + [31:31] + read-only + + + READ_ERROR + If 1, the channel received a read bus error. Write one to clear. + READ_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 3 transfers later) + [30:30] + read-write + oneToClear + + + WRITE_ERROR + If 1, the channel received a write bus error. Write one to clear. + WRITE_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 5 transfers later) + [29:29] + read-write + oneToClear + + + BUSY + This flag goes high when the channel starts a new transfer sequence, and low when the last transfer of that sequence completes. Clearing EN while BUSY is high pauses the channel, and BUSY will stay high while paused. + + To terminate a sequence early (and clear the BUSY flag), see CHAN_ABORT. + [26:26] + read-only + + + SNIFF_EN + If 1, this channel's data transfers are visible to the sniff hardware, and each transfer will advance the state of the checksum. This only applies if the sniff hardware is enabled, and has this channel selected. + + This allows checksum to be enabled or disabled on a per-control- block basis. + [25:25] + read-write + + + BSWAP + Apply byte-swap transformation to DMA data. + For byte data, this has no effect. For halfword data, the two bytes of each halfword are swapped. For word data, the four bytes of each word are swapped to reverse order. + [24:24] + read-write + + + IRQ_QUIET + In QUIET mode, the channel does not generate IRQs at the end of every transfer block. Instead, an IRQ is raised when NULL is written to a trigger register, indicating the end of a control block chain. + + This reduces the number of interrupts to be serviced by the CPU when transferring a DMA chain of many small control blocks. + [23:23] + read-write + + + TREQ_SEL + Select a Transfer Request signal. + The channel uses the transfer request signal to pace its data transfer rate. Sources for TREQ signals are internal (TIMERS) or external (DREQ, a Data Request from the system). + 0x0 to 0x3a -> select DREQ n as TREQ + [22:17] + read-write + + + PIO0_TX0 + 0 + Select PIO0's TX FIFO 0 as TREQ + + + PIO0_TX1 + 1 + Select PIO0's TX FIFO 1 as TREQ + + + PIO0_TX2 + 2 + Select PIO0's TX FIFO 2 as TREQ + + + PIO0_TX3 + 3 + Select PIO0's TX FIFO 3 as TREQ + + + PIO0_RX0 + 4 + Select PIO0's RX FIFO 0 as TREQ + + + PIO0_RX1 + 5 + Select PIO0's RX FIFO 1 as TREQ + + + PIO0_RX2 + 6 + Select PIO0's RX FIFO 2 as TREQ + + + PIO0_RX3 + 7 + Select PIO0's RX FIFO 3 as TREQ + + + PIO1_TX0 + 8 + Select PIO1's TX FIFO 0 as TREQ + + + PIO1_TX1 + 9 + Select PIO1's TX FIFO 1 as TREQ + + + PIO1_TX2 + 10 + Select PIO1's TX FIFO 2 as TREQ + + + PIO1_TX3 + 11 + Select PIO1's TX FIFO 3 as TREQ + + + PIO1_RX0 + 12 + Select PIO1's RX FIFO 0 as TREQ + + + PIO1_RX1 + 13 + Select PIO1's RX FIFO 1 as TREQ + + + PIO1_RX2 + 14 + Select PIO1's RX FIFO 2 as TREQ + + + PIO1_RX3 + 15 + Select PIO1's RX FIFO 3 as TREQ + + + PIO2_TX0 + 16 + Select PIO2's TX FIFO 0 as TREQ + + + PIO2_TX1 + 17 + Select PIO2's TX FIFO 1 as TREQ + + + PIO2_TX2 + 18 + Select PIO2's TX FIFO 2 as TREQ + + + PIO2_TX3 + 19 + Select PIO2's TX FIFO 3 as TREQ + + + PIO2_RX0 + 20 + Select PIO2's RX FIFO 0 as TREQ + + + PIO2_RX1 + 21 + Select PIO2's RX FIFO 1 as TREQ + + + PIO2_RX2 + 22 + Select PIO2's RX FIFO 2 as TREQ + + + PIO2_RX3 + 23 + Select PIO2's RX FIFO 3 as TREQ + + + SPI0_TX + 24 + Select SPI0's TX FIFO as TREQ + + + SPI0_RX + 25 + Select SPI0's RX FIFO as TREQ + + + SPI1_TX + 26 + Select SPI1's TX FIFO as TREQ + + + SPI1_RX + 27 + Select SPI1's RX FIFO as TREQ + + + UART0_TX + 28 + Select UART0's TX FIFO as TREQ + + + UART0_RX + 29 + Select UART0's RX FIFO as TREQ + + + UART1_TX + 30 + Select UART1's TX FIFO as TREQ + + + UART1_RX + 31 + Select UART1's RX FIFO as TREQ + + + PWM_WRAP0 + 32 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP1 + 33 + Select PWM Counter 1's Wrap Value as TREQ + + + PWM_WRAP2 + 34 + Select PWM Counter 2's Wrap Value as TREQ + + + PWM_WRAP3 + 35 + Select PWM Counter 3's Wrap Value as TREQ + + + PWM_WRAP4 + 36 + Select PWM Counter 4's Wrap Value as TREQ + + + PWM_WRAP5 + 37 + Select PWM Counter 5's Wrap Value as TREQ + + + PWM_WRAP6 + 38 + Select PWM Counter 6's Wrap Value as TREQ + + + PWM_WRAP7 + 39 + Select PWM Counter 7's Wrap Value as TREQ + + + PWM_WRAP8 + 40 + Select PWM Counter 8's Wrap Value as TREQ + + + PWM_WRAP9 + 41 + Select PWM Counter 9's Wrap Value as TREQ + + + PWM_WRAP10 + 42 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP11 + 43 + Select PWM Counter 1's Wrap Value as TREQ + + + I2C0_TX + 44 + Select I2C0's TX FIFO as TREQ + + + I2C0_RX + 45 + Select I2C0's RX FIFO as TREQ + + + I2C1_TX + 46 + Select I2C1's TX FIFO as TREQ + + + I2C1_RX + 47 + Select I2C1's RX FIFO as TREQ + + + ADC + 48 + Select the ADC as TREQ + + + XIP_STREAM + 49 + Select the XIP Streaming FIFO as TREQ + + + XIP_QMITX + 50 + Select XIP_QMITX as TREQ + + + XIP_QMIRX + 51 + Select XIP_QMIRX as TREQ + + + HSTX + 52 + Select HSTX as TREQ + + + CORESIGHT + 53 + Select CORESIGHT as TREQ + + + SHA256 + 54 + Select SHA256 as TREQ + + + TIMER0 + 59 + Select Timer 0 as TREQ + + + TIMER1 + 60 + Select Timer 1 as TREQ + + + TIMER2 + 61 + Select Timer 2 as TREQ (Optional) + + + TIMER3 + 62 + Select Timer 3 as TREQ (Optional) + + + PERMANENT + 63 + Permanent request, for unpaced transfers. + + + + + CHAIN_TO + When this channel completes, it will trigger the channel indicated by CHAIN_TO. Disable by setting CHAIN_TO = _(this channel)_. + + Note this field resets to 0, so channels 1 and above will chain to channel 0 by default. Set this field to avoid this behaviour. + [16:13] + read-write + + + RING_SEL + Select whether RING_SIZE applies to read or write addresses. + If 0, read addresses are wrapped on a (1 << RING_SIZE) boundary. If 1, write addresses are wrapped. + [12:12] + read-write + + + RING_SIZE + Size of address wrap region. If 0, don't wrap. For values n > 0, only the lower n bits of the address will change. This wraps the address on a (1 << n) byte boundary, facilitating access to naturally-aligned ring buffers. + + Ring sizes between 2 and 32768 bytes are possible. This can apply to either read or write addresses, based on value of RING_SEL. + [11:8] + read-write + + + RING_NONE + 0 + + + + + INCR_WRITE_REV + If 1, and INCR_WRITE is 1, the write address is decremented rather than incremented with each transfer. + + If 1, and INCR_WRITE is 0, this otherwise-unused combination causes the write address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [7:7] + read-write + + + INCR_WRITE + If 1, the write address increments with each transfer. If 0, each write is directed to the same, initial address. + + Generally this should be disabled for memory-to-peripheral transfers. + [6:6] + read-write + + + INCR_READ_REV + If 1, and INCR_READ is 1, the read address is decremented rather than incremented with each transfer. + + If 1, and INCR_READ is 0, this otherwise-unused combination causes the read address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [5:5] + read-write + + + INCR_READ + If 1, the read address increments with each transfer. If 0, each read is directed to the same, initial address. + + Generally this should be disabled for peripheral-to-memory transfers. + [4:4] + read-write + + + DATA_SIZE + Set the size of each bus transfer (byte/halfword/word). READ_ADDR and WRITE_ADDR advance by this amount (1/2/4 bytes) with each transfer. + [3:2] + read-write + + + SIZE_BYTE + 0 + + + SIZE_HALFWORD + 1 + + + SIZE_WORD + 2 + + + + + HIGH_PRIORITY + HIGH_PRIORITY gives a channel preferential treatment in issue scheduling: in each scheduling round, all high priority channels are considered first, and then only a single low priority channel, before returning to the high priority channels. + + This only affects the order in which the DMA schedules channels. The DMA's bus priority is not changed. If the DMA is not saturated then a low priority channel will see no loss of throughput. + [1:1] + read-write + + + EN + DMA Channel Enable. + When 1, the channel will respond to triggering events, which will cause it to become BUSY and start transferring data. When 0, the channel will ignore triggers, stop issuing transfers, and pause the current transfer sequence (i.e. BUSY will remain high if already high) + [0:0] + read-write + + + + + CH8_AL1_CTRL + 0x00000210 + Alias for channel 8 CTRL register + 0x00000000 + + + CH8_AL1_CTRL + [31:0] + read-write + + + + + CH8_AL1_READ_ADDR + 0x00000214 + Alias for channel 8 READ_ADDR register + 0x00000000 + + + CH8_AL1_READ_ADDR + [31:0] + read-write + + + + + CH8_AL1_WRITE_ADDR + 0x00000218 + Alias for channel 8 WRITE_ADDR register + 0x00000000 + + + CH8_AL1_WRITE_ADDR + [31:0] + read-write + + + + + CH8_AL1_TRANS_COUNT_TRIG + 0x0000021c + Alias for channel 8 TRANS_COUNT register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH8_AL1_TRANS_COUNT_TRIG + [31:0] + read-write + + + + + CH8_AL2_CTRL + 0x00000220 + Alias for channel 8 CTRL register + 0x00000000 + + + CH8_AL2_CTRL + [31:0] + read-write + + + + + CH8_AL2_TRANS_COUNT + 0x00000224 + Alias for channel 8 TRANS_COUNT register + 0x00000000 + + + CH8_AL2_TRANS_COUNT + [31:0] + read-write + + + + + CH8_AL2_READ_ADDR + 0x00000228 + Alias for channel 8 READ_ADDR register + 0x00000000 + + + CH8_AL2_READ_ADDR + [31:0] + read-write + + + + + CH8_AL2_WRITE_ADDR_TRIG + 0x0000022c + Alias for channel 8 WRITE_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH8_AL2_WRITE_ADDR_TRIG + [31:0] + read-write + + + + + CH8_AL3_CTRL + 0x00000230 + Alias for channel 8 CTRL register + 0x00000000 + + + CH8_AL3_CTRL + [31:0] + read-write + + + + + CH8_AL3_WRITE_ADDR + 0x00000234 + Alias for channel 8 WRITE_ADDR register + 0x00000000 + + + CH8_AL3_WRITE_ADDR + [31:0] + read-write + + + + + CH8_AL3_TRANS_COUNT + 0x00000238 + Alias for channel 8 TRANS_COUNT register + 0x00000000 + + + CH8_AL3_TRANS_COUNT + [31:0] + read-write + + + + + CH8_AL3_READ_ADDR_TRIG + 0x0000023c + Alias for channel 8 READ_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH8_AL3_READ_ADDR_TRIG + [31:0] + read-write + + + + + CH9_READ_ADDR + 0x00000240 + DMA Channel 9 Read Address pointer + 0x00000000 + + + CH9_READ_ADDR + This register updates automatically each time a read completes. The current value is the next address to be read by this channel. + [31:0] + read-write + + + + + CH9_WRITE_ADDR + 0x00000244 + DMA Channel 9 Write Address pointer + 0x00000000 + + + CH9_WRITE_ADDR + This register updates automatically each time a write completes. The current value is the next address to be written by this channel. + [31:0] + read-write + + + + + CH9_TRANS_COUNT + 0x00000248 + DMA Channel 9 Transfer Count + 0x00000000 + + + MODE + When MODE is 0x0, the transfer count decrements with each transfer until 0, and then the channel triggers the next channel indicated by CTRL_CHAIN_TO. + + When MODE is 0x1, the transfer count decrements with each transfer until 0, and then the channel re-triggers itself, in addition to the trigger indicated by CTRL_CHAIN_TO. This is useful for e.g. an endless ring-buffer DMA with periodic interrupts. + + When MODE is 0xf, the transfer count does not decrement. The DMA channel performs an endless sequence of transfers, never triggering other channels or raising interrupts, until an ABORT is raised. + + All other values are reserved. + [31:28] + read-write + + + NORMAL + 0 + + + TRIGGER_SELF + 1 + + + ENDLESS + 15 + + + + + COUNT + 28-bit transfer count (256 million transfers maximum). + + Program the number of bus transfers a channel will perform before halting. Note that, if transfers are larger than one byte in size, this is not equal to the number of bytes transferred (see CTRL_DATA_SIZE). + + When the channel is active, reading this register shows the number of transfers remaining, updating automatically each time a write transfer completes. + + Writing this register sets the RELOAD value for the transfer counter. Each time this channel is triggered, the RELOAD value is copied into the live transfer counter. The channel can be started multiple times, and will perform the same number of transfers each time, as programmed by most recent write. + + The RELOAD value can be observed at CHx_DBG_TCR. If TRANS_COUNT is used as a trigger, the written value is used immediately as the length of the new transfer sequence, as well as being written to RELOAD. + [27:0] + read-write + + + + + CH9_CTRL_TRIG + 0x0000024c + DMA Channel 9 Control and Status + 0x00000000 + + + AHB_ERROR + Logical OR of the READ_ERROR and WRITE_ERROR flags. The channel halts when it encounters any bus error, and always raises its channel IRQ flag. + [31:31] + read-only + + + READ_ERROR + If 1, the channel received a read bus error. Write one to clear. + READ_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 3 transfers later) + [30:30] + read-write + oneToClear + + + WRITE_ERROR + If 1, the channel received a write bus error. Write one to clear. + WRITE_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 5 transfers later) + [29:29] + read-write + oneToClear + + + BUSY + This flag goes high when the channel starts a new transfer sequence, and low when the last transfer of that sequence completes. Clearing EN while BUSY is high pauses the channel, and BUSY will stay high while paused. + + To terminate a sequence early (and clear the BUSY flag), see CHAN_ABORT. + [26:26] + read-only + + + SNIFF_EN + If 1, this channel's data transfers are visible to the sniff hardware, and each transfer will advance the state of the checksum. This only applies if the sniff hardware is enabled, and has this channel selected. + + This allows checksum to be enabled or disabled on a per-control- block basis. + [25:25] + read-write + + + BSWAP + Apply byte-swap transformation to DMA data. + For byte data, this has no effect. For halfword data, the two bytes of each halfword are swapped. For word data, the four bytes of each word are swapped to reverse order. + [24:24] + read-write + + + IRQ_QUIET + In QUIET mode, the channel does not generate IRQs at the end of every transfer block. Instead, an IRQ is raised when NULL is written to a trigger register, indicating the end of a control block chain. + + This reduces the number of interrupts to be serviced by the CPU when transferring a DMA chain of many small control blocks. + [23:23] + read-write + + + TREQ_SEL + Select a Transfer Request signal. + The channel uses the transfer request signal to pace its data transfer rate. Sources for TREQ signals are internal (TIMERS) or external (DREQ, a Data Request from the system). + 0x0 to 0x3a -> select DREQ n as TREQ + [22:17] + read-write + + + PIO0_TX0 + 0 + Select PIO0's TX FIFO 0 as TREQ + + + PIO0_TX1 + 1 + Select PIO0's TX FIFO 1 as TREQ + + + PIO0_TX2 + 2 + Select PIO0's TX FIFO 2 as TREQ + + + PIO0_TX3 + 3 + Select PIO0's TX FIFO 3 as TREQ + + + PIO0_RX0 + 4 + Select PIO0's RX FIFO 0 as TREQ + + + PIO0_RX1 + 5 + Select PIO0's RX FIFO 1 as TREQ + + + PIO0_RX2 + 6 + Select PIO0's RX FIFO 2 as TREQ + + + PIO0_RX3 + 7 + Select PIO0's RX FIFO 3 as TREQ + + + PIO1_TX0 + 8 + Select PIO1's TX FIFO 0 as TREQ + + + PIO1_TX1 + 9 + Select PIO1's TX FIFO 1 as TREQ + + + PIO1_TX2 + 10 + Select PIO1's TX FIFO 2 as TREQ + + + PIO1_TX3 + 11 + Select PIO1's TX FIFO 3 as TREQ + + + PIO1_RX0 + 12 + Select PIO1's RX FIFO 0 as TREQ + + + PIO1_RX1 + 13 + Select PIO1's RX FIFO 1 as TREQ + + + PIO1_RX2 + 14 + Select PIO1's RX FIFO 2 as TREQ + + + PIO1_RX3 + 15 + Select PIO1's RX FIFO 3 as TREQ + + + PIO2_TX0 + 16 + Select PIO2's TX FIFO 0 as TREQ + + + PIO2_TX1 + 17 + Select PIO2's TX FIFO 1 as TREQ + + + PIO2_TX2 + 18 + Select PIO2's TX FIFO 2 as TREQ + + + PIO2_TX3 + 19 + Select PIO2's TX FIFO 3 as TREQ + + + PIO2_RX0 + 20 + Select PIO2's RX FIFO 0 as TREQ + + + PIO2_RX1 + 21 + Select PIO2's RX FIFO 1 as TREQ + + + PIO2_RX2 + 22 + Select PIO2's RX FIFO 2 as TREQ + + + PIO2_RX3 + 23 + Select PIO2's RX FIFO 3 as TREQ + + + SPI0_TX + 24 + Select SPI0's TX FIFO as TREQ + + + SPI0_RX + 25 + Select SPI0's RX FIFO as TREQ + + + SPI1_TX + 26 + Select SPI1's TX FIFO as TREQ + + + SPI1_RX + 27 + Select SPI1's RX FIFO as TREQ + + + UART0_TX + 28 + Select UART0's TX FIFO as TREQ + + + UART0_RX + 29 + Select UART0's RX FIFO as TREQ + + + UART1_TX + 30 + Select UART1's TX FIFO as TREQ + + + UART1_RX + 31 + Select UART1's RX FIFO as TREQ + + + PWM_WRAP0 + 32 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP1 + 33 + Select PWM Counter 1's Wrap Value as TREQ + + + PWM_WRAP2 + 34 + Select PWM Counter 2's Wrap Value as TREQ + + + PWM_WRAP3 + 35 + Select PWM Counter 3's Wrap Value as TREQ + + + PWM_WRAP4 + 36 + Select PWM Counter 4's Wrap Value as TREQ + + + PWM_WRAP5 + 37 + Select PWM Counter 5's Wrap Value as TREQ + + + PWM_WRAP6 + 38 + Select PWM Counter 6's Wrap Value as TREQ + + + PWM_WRAP7 + 39 + Select PWM Counter 7's Wrap Value as TREQ + + + PWM_WRAP8 + 40 + Select PWM Counter 8's Wrap Value as TREQ + + + PWM_WRAP9 + 41 + Select PWM Counter 9's Wrap Value as TREQ + + + PWM_WRAP10 + 42 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP11 + 43 + Select PWM Counter 1's Wrap Value as TREQ + + + I2C0_TX + 44 + Select I2C0's TX FIFO as TREQ + + + I2C0_RX + 45 + Select I2C0's RX FIFO as TREQ + + + I2C1_TX + 46 + Select I2C1's TX FIFO as TREQ + + + I2C1_RX + 47 + Select I2C1's RX FIFO as TREQ + + + ADC + 48 + Select the ADC as TREQ + + + XIP_STREAM + 49 + Select the XIP Streaming FIFO as TREQ + + + XIP_QMITX + 50 + Select XIP_QMITX as TREQ + + + XIP_QMIRX + 51 + Select XIP_QMIRX as TREQ + + + HSTX + 52 + Select HSTX as TREQ + + + CORESIGHT + 53 + Select CORESIGHT as TREQ + + + SHA256 + 54 + Select SHA256 as TREQ + + + TIMER0 + 59 + Select Timer 0 as TREQ + + + TIMER1 + 60 + Select Timer 1 as TREQ + + + TIMER2 + 61 + Select Timer 2 as TREQ (Optional) + + + TIMER3 + 62 + Select Timer 3 as TREQ (Optional) + + + PERMANENT + 63 + Permanent request, for unpaced transfers. + + + + + CHAIN_TO + When this channel completes, it will trigger the channel indicated by CHAIN_TO. Disable by setting CHAIN_TO = _(this channel)_. + + Note this field resets to 0, so channels 1 and above will chain to channel 0 by default. Set this field to avoid this behaviour. + [16:13] + read-write + + + RING_SEL + Select whether RING_SIZE applies to read or write addresses. + If 0, read addresses are wrapped on a (1 << RING_SIZE) boundary. If 1, write addresses are wrapped. + [12:12] + read-write + + + RING_SIZE + Size of address wrap region. If 0, don't wrap. For values n > 0, only the lower n bits of the address will change. This wraps the address on a (1 << n) byte boundary, facilitating access to naturally-aligned ring buffers. + + Ring sizes between 2 and 32768 bytes are possible. This can apply to either read or write addresses, based on value of RING_SEL. + [11:8] + read-write + + + RING_NONE + 0 + + + + + INCR_WRITE_REV + If 1, and INCR_WRITE is 1, the write address is decremented rather than incremented with each transfer. + + If 1, and INCR_WRITE is 0, this otherwise-unused combination causes the write address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [7:7] + read-write + + + INCR_WRITE + If 1, the write address increments with each transfer. If 0, each write is directed to the same, initial address. + + Generally this should be disabled for memory-to-peripheral transfers. + [6:6] + read-write + + + INCR_READ_REV + If 1, and INCR_READ is 1, the read address is decremented rather than incremented with each transfer. + + If 1, and INCR_READ is 0, this otherwise-unused combination causes the read address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [5:5] + read-write + + + INCR_READ + If 1, the read address increments with each transfer. If 0, each read is directed to the same, initial address. + + Generally this should be disabled for peripheral-to-memory transfers. + [4:4] + read-write + + + DATA_SIZE + Set the size of each bus transfer (byte/halfword/word). READ_ADDR and WRITE_ADDR advance by this amount (1/2/4 bytes) with each transfer. + [3:2] + read-write + + + SIZE_BYTE + 0 + + + SIZE_HALFWORD + 1 + + + SIZE_WORD + 2 + + + + + HIGH_PRIORITY + HIGH_PRIORITY gives a channel preferential treatment in issue scheduling: in each scheduling round, all high priority channels are considered first, and then only a single low priority channel, before returning to the high priority channels. + + This only affects the order in which the DMA schedules channels. The DMA's bus priority is not changed. If the DMA is not saturated then a low priority channel will see no loss of throughput. + [1:1] + read-write + + + EN + DMA Channel Enable. + When 1, the channel will respond to triggering events, which will cause it to become BUSY and start transferring data. When 0, the channel will ignore triggers, stop issuing transfers, and pause the current transfer sequence (i.e. BUSY will remain high if already high) + [0:0] + read-write + + + + + CH9_AL1_CTRL + 0x00000250 + Alias for channel 9 CTRL register + 0x00000000 + + + CH9_AL1_CTRL + [31:0] + read-write + + + + + CH9_AL1_READ_ADDR + 0x00000254 + Alias for channel 9 READ_ADDR register + 0x00000000 + + + CH9_AL1_READ_ADDR + [31:0] + read-write + + + + + CH9_AL1_WRITE_ADDR + 0x00000258 + Alias for channel 9 WRITE_ADDR register + 0x00000000 + + + CH9_AL1_WRITE_ADDR + [31:0] + read-write + + + + + CH9_AL1_TRANS_COUNT_TRIG + 0x0000025c + Alias for channel 9 TRANS_COUNT register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH9_AL1_TRANS_COUNT_TRIG + [31:0] + read-write + + + + + CH9_AL2_CTRL + 0x00000260 + Alias for channel 9 CTRL register + 0x00000000 + + + CH9_AL2_CTRL + [31:0] + read-write + + + + + CH9_AL2_TRANS_COUNT + 0x00000264 + Alias for channel 9 TRANS_COUNT register + 0x00000000 + + + CH9_AL2_TRANS_COUNT + [31:0] + read-write + + + + + CH9_AL2_READ_ADDR + 0x00000268 + Alias for channel 9 READ_ADDR register + 0x00000000 + + + CH9_AL2_READ_ADDR + [31:0] + read-write + + + + + CH9_AL2_WRITE_ADDR_TRIG + 0x0000026c + Alias for channel 9 WRITE_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH9_AL2_WRITE_ADDR_TRIG + [31:0] + read-write + + + + + CH9_AL3_CTRL + 0x00000270 + Alias for channel 9 CTRL register + 0x00000000 + + + CH9_AL3_CTRL + [31:0] + read-write + + + + + CH9_AL3_WRITE_ADDR + 0x00000274 + Alias for channel 9 WRITE_ADDR register + 0x00000000 + + + CH9_AL3_WRITE_ADDR + [31:0] + read-write + + + + + CH9_AL3_TRANS_COUNT + 0x00000278 + Alias for channel 9 TRANS_COUNT register + 0x00000000 + + + CH9_AL3_TRANS_COUNT + [31:0] + read-write + + + + + CH9_AL3_READ_ADDR_TRIG + 0x0000027c + Alias for channel 9 READ_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH9_AL3_READ_ADDR_TRIG + [31:0] + read-write + + + + + CH10_READ_ADDR + 0x00000280 + DMA Channel 10 Read Address pointer + 0x00000000 + + + CH10_READ_ADDR + This register updates automatically each time a read completes. The current value is the next address to be read by this channel. + [31:0] + read-write + + + + + CH10_WRITE_ADDR + 0x00000284 + DMA Channel 10 Write Address pointer + 0x00000000 + + + CH10_WRITE_ADDR + This register updates automatically each time a write completes. The current value is the next address to be written by this channel. + [31:0] + read-write + + + + + CH10_TRANS_COUNT + 0x00000288 + DMA Channel 10 Transfer Count + 0x00000000 + + + MODE + When MODE is 0x0, the transfer count decrements with each transfer until 0, and then the channel triggers the next channel indicated by CTRL_CHAIN_TO. + + When MODE is 0x1, the transfer count decrements with each transfer until 0, and then the channel re-triggers itself, in addition to the trigger indicated by CTRL_CHAIN_TO. This is useful for e.g. an endless ring-buffer DMA with periodic interrupts. + + When MODE is 0xf, the transfer count does not decrement. The DMA channel performs an endless sequence of transfers, never triggering other channels or raising interrupts, until an ABORT is raised. + + All other values are reserved. + [31:28] + read-write + + + NORMAL + 0 + + + TRIGGER_SELF + 1 + + + ENDLESS + 15 + + + + + COUNT + 28-bit transfer count (256 million transfers maximum). + + Program the number of bus transfers a channel will perform before halting. Note that, if transfers are larger than one byte in size, this is not equal to the number of bytes transferred (see CTRL_DATA_SIZE). + + When the channel is active, reading this register shows the number of transfers remaining, updating automatically each time a write transfer completes. + + Writing this register sets the RELOAD value for the transfer counter. Each time this channel is triggered, the RELOAD value is copied into the live transfer counter. The channel can be started multiple times, and will perform the same number of transfers each time, as programmed by most recent write. + + The RELOAD value can be observed at CHx_DBG_TCR. If TRANS_COUNT is used as a trigger, the written value is used immediately as the length of the new transfer sequence, as well as being written to RELOAD. + [27:0] + read-write + + + + + CH10_CTRL_TRIG + 0x0000028c + DMA Channel 10 Control and Status + 0x00000000 + + + AHB_ERROR + Logical OR of the READ_ERROR and WRITE_ERROR flags. The channel halts when it encounters any bus error, and always raises its channel IRQ flag. + [31:31] + read-only + + + READ_ERROR + If 1, the channel received a read bus error. Write one to clear. + READ_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 3 transfers later) + [30:30] + read-write + oneToClear + + + WRITE_ERROR + If 1, the channel received a write bus error. Write one to clear. + WRITE_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 5 transfers later) + [29:29] + read-write + oneToClear + + + BUSY + This flag goes high when the channel starts a new transfer sequence, and low when the last transfer of that sequence completes. Clearing EN while BUSY is high pauses the channel, and BUSY will stay high while paused. + + To terminate a sequence early (and clear the BUSY flag), see CHAN_ABORT. + [26:26] + read-only + + + SNIFF_EN + If 1, this channel's data transfers are visible to the sniff hardware, and each transfer will advance the state of the checksum. This only applies if the sniff hardware is enabled, and has this channel selected. + + This allows checksum to be enabled or disabled on a per-control- block basis. + [25:25] + read-write + + + BSWAP + Apply byte-swap transformation to DMA data. + For byte data, this has no effect. For halfword data, the two bytes of each halfword are swapped. For word data, the four bytes of each word are swapped to reverse order. + [24:24] + read-write + + + IRQ_QUIET + In QUIET mode, the channel does not generate IRQs at the end of every transfer block. Instead, an IRQ is raised when NULL is written to a trigger register, indicating the end of a control block chain. + + This reduces the number of interrupts to be serviced by the CPU when transferring a DMA chain of many small control blocks. + [23:23] + read-write + + + TREQ_SEL + Select a Transfer Request signal. + The channel uses the transfer request signal to pace its data transfer rate. Sources for TREQ signals are internal (TIMERS) or external (DREQ, a Data Request from the system). + 0x0 to 0x3a -> select DREQ n as TREQ + [22:17] + read-write + + + PIO0_TX0 + 0 + Select PIO0's TX FIFO 0 as TREQ + + + PIO0_TX1 + 1 + Select PIO0's TX FIFO 1 as TREQ + + + PIO0_TX2 + 2 + Select PIO0's TX FIFO 2 as TREQ + + + PIO0_TX3 + 3 + Select PIO0's TX FIFO 3 as TREQ + + + PIO0_RX0 + 4 + Select PIO0's RX FIFO 0 as TREQ + + + PIO0_RX1 + 5 + Select PIO0's RX FIFO 1 as TREQ + + + PIO0_RX2 + 6 + Select PIO0's RX FIFO 2 as TREQ + + + PIO0_RX3 + 7 + Select PIO0's RX FIFO 3 as TREQ + + + PIO1_TX0 + 8 + Select PIO1's TX FIFO 0 as TREQ + + + PIO1_TX1 + 9 + Select PIO1's TX FIFO 1 as TREQ + + + PIO1_TX2 + 10 + Select PIO1's TX FIFO 2 as TREQ + + + PIO1_TX3 + 11 + Select PIO1's TX FIFO 3 as TREQ + + + PIO1_RX0 + 12 + Select PIO1's RX FIFO 0 as TREQ + + + PIO1_RX1 + 13 + Select PIO1's RX FIFO 1 as TREQ + + + PIO1_RX2 + 14 + Select PIO1's RX FIFO 2 as TREQ + + + PIO1_RX3 + 15 + Select PIO1's RX FIFO 3 as TREQ + + + PIO2_TX0 + 16 + Select PIO2's TX FIFO 0 as TREQ + + + PIO2_TX1 + 17 + Select PIO2's TX FIFO 1 as TREQ + + + PIO2_TX2 + 18 + Select PIO2's TX FIFO 2 as TREQ + + + PIO2_TX3 + 19 + Select PIO2's TX FIFO 3 as TREQ + + + PIO2_RX0 + 20 + Select PIO2's RX FIFO 0 as TREQ + + + PIO2_RX1 + 21 + Select PIO2's RX FIFO 1 as TREQ + + + PIO2_RX2 + 22 + Select PIO2's RX FIFO 2 as TREQ + + + PIO2_RX3 + 23 + Select PIO2's RX FIFO 3 as TREQ + + + SPI0_TX + 24 + Select SPI0's TX FIFO as TREQ + + + SPI0_RX + 25 + Select SPI0's RX FIFO as TREQ + + + SPI1_TX + 26 + Select SPI1's TX FIFO as TREQ + + + SPI1_RX + 27 + Select SPI1's RX FIFO as TREQ + + + UART0_TX + 28 + Select UART0's TX FIFO as TREQ + + + UART0_RX + 29 + Select UART0's RX FIFO as TREQ + + + UART1_TX + 30 + Select UART1's TX FIFO as TREQ + + + UART1_RX + 31 + Select UART1's RX FIFO as TREQ + + + PWM_WRAP0 + 32 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP1 + 33 + Select PWM Counter 1's Wrap Value as TREQ + + + PWM_WRAP2 + 34 + Select PWM Counter 2's Wrap Value as TREQ + + + PWM_WRAP3 + 35 + Select PWM Counter 3's Wrap Value as TREQ + + + PWM_WRAP4 + 36 + Select PWM Counter 4's Wrap Value as TREQ + + + PWM_WRAP5 + 37 + Select PWM Counter 5's Wrap Value as TREQ + + + PWM_WRAP6 + 38 + Select PWM Counter 6's Wrap Value as TREQ + + + PWM_WRAP7 + 39 + Select PWM Counter 7's Wrap Value as TREQ + + + PWM_WRAP8 + 40 + Select PWM Counter 8's Wrap Value as TREQ + + + PWM_WRAP9 + 41 + Select PWM Counter 9's Wrap Value as TREQ + + + PWM_WRAP10 + 42 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP11 + 43 + Select PWM Counter 1's Wrap Value as TREQ + + + I2C0_TX + 44 + Select I2C0's TX FIFO as TREQ + + + I2C0_RX + 45 + Select I2C0's RX FIFO as TREQ + + + I2C1_TX + 46 + Select I2C1's TX FIFO as TREQ + + + I2C1_RX + 47 + Select I2C1's RX FIFO as TREQ + + + ADC + 48 + Select the ADC as TREQ + + + XIP_STREAM + 49 + Select the XIP Streaming FIFO as TREQ + + + XIP_QMITX + 50 + Select XIP_QMITX as TREQ + + + XIP_QMIRX + 51 + Select XIP_QMIRX as TREQ + + + HSTX + 52 + Select HSTX as TREQ + + + CORESIGHT + 53 + Select CORESIGHT as TREQ + + + SHA256 + 54 + Select SHA256 as TREQ + + + TIMER0 + 59 + Select Timer 0 as TREQ + + + TIMER1 + 60 + Select Timer 1 as TREQ + + + TIMER2 + 61 + Select Timer 2 as TREQ (Optional) + + + TIMER3 + 62 + Select Timer 3 as TREQ (Optional) + + + PERMANENT + 63 + Permanent request, for unpaced transfers. + + + + + CHAIN_TO + When this channel completes, it will trigger the channel indicated by CHAIN_TO. Disable by setting CHAIN_TO = _(this channel)_. + + Note this field resets to 0, so channels 1 and above will chain to channel 0 by default. Set this field to avoid this behaviour. + [16:13] + read-write + + + RING_SEL + Select whether RING_SIZE applies to read or write addresses. + If 0, read addresses are wrapped on a (1 << RING_SIZE) boundary. If 1, write addresses are wrapped. + [12:12] + read-write + + + RING_SIZE + Size of address wrap region. If 0, don't wrap. For values n > 0, only the lower n bits of the address will change. This wraps the address on a (1 << n) byte boundary, facilitating access to naturally-aligned ring buffers. + + Ring sizes between 2 and 32768 bytes are possible. This can apply to either read or write addresses, based on value of RING_SEL. + [11:8] + read-write + + + RING_NONE + 0 + + + + + INCR_WRITE_REV + If 1, and INCR_WRITE is 1, the write address is decremented rather than incremented with each transfer. + + If 1, and INCR_WRITE is 0, this otherwise-unused combination causes the write address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [7:7] + read-write + + + INCR_WRITE + If 1, the write address increments with each transfer. If 0, each write is directed to the same, initial address. + + Generally this should be disabled for memory-to-peripheral transfers. + [6:6] + read-write + + + INCR_READ_REV + If 1, and INCR_READ is 1, the read address is decremented rather than incremented with each transfer. + + If 1, and INCR_READ is 0, this otherwise-unused combination causes the read address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [5:5] + read-write + + + INCR_READ + If 1, the read address increments with each transfer. If 0, each read is directed to the same, initial address. + + Generally this should be disabled for peripheral-to-memory transfers. + [4:4] + read-write + + + DATA_SIZE + Set the size of each bus transfer (byte/halfword/word). READ_ADDR and WRITE_ADDR advance by this amount (1/2/4 bytes) with each transfer. + [3:2] + read-write + + + SIZE_BYTE + 0 + + + SIZE_HALFWORD + 1 + + + SIZE_WORD + 2 + + + + + HIGH_PRIORITY + HIGH_PRIORITY gives a channel preferential treatment in issue scheduling: in each scheduling round, all high priority channels are considered first, and then only a single low priority channel, before returning to the high priority channels. + + This only affects the order in which the DMA schedules channels. The DMA's bus priority is not changed. If the DMA is not saturated then a low priority channel will see no loss of throughput. + [1:1] + read-write + + + EN + DMA Channel Enable. + When 1, the channel will respond to triggering events, which will cause it to become BUSY and start transferring data. When 0, the channel will ignore triggers, stop issuing transfers, and pause the current transfer sequence (i.e. BUSY will remain high if already high) + [0:0] + read-write + + + + + CH10_AL1_CTRL + 0x00000290 + Alias for channel 10 CTRL register + 0x00000000 + + + CH10_AL1_CTRL + [31:0] + read-write + + + + + CH10_AL1_READ_ADDR + 0x00000294 + Alias for channel 10 READ_ADDR register + 0x00000000 + + + CH10_AL1_READ_ADDR + [31:0] + read-write + + + + + CH10_AL1_WRITE_ADDR + 0x00000298 + Alias for channel 10 WRITE_ADDR register + 0x00000000 + + + CH10_AL1_WRITE_ADDR + [31:0] + read-write + + + + + CH10_AL1_TRANS_COUNT_TRIG + 0x0000029c + Alias for channel 10 TRANS_COUNT register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH10_AL1_TRANS_COUNT_TRIG + [31:0] + read-write + + + + + CH10_AL2_CTRL + 0x000002a0 + Alias for channel 10 CTRL register + 0x00000000 + + + CH10_AL2_CTRL + [31:0] + read-write + + + + + CH10_AL2_TRANS_COUNT + 0x000002a4 + Alias for channel 10 TRANS_COUNT register + 0x00000000 + + + CH10_AL2_TRANS_COUNT + [31:0] + read-write + + + + + CH10_AL2_READ_ADDR + 0x000002a8 + Alias for channel 10 READ_ADDR register + 0x00000000 + + + CH10_AL2_READ_ADDR + [31:0] + read-write + + + + + CH10_AL2_WRITE_ADDR_TRIG + 0x000002ac + Alias for channel 10 WRITE_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH10_AL2_WRITE_ADDR_TRIG + [31:0] + read-write + + + + + CH10_AL3_CTRL + 0x000002b0 + Alias for channel 10 CTRL register + 0x00000000 + + + CH10_AL3_CTRL + [31:0] + read-write + + + + + CH10_AL3_WRITE_ADDR + 0x000002b4 + Alias for channel 10 WRITE_ADDR register + 0x00000000 + + + CH10_AL3_WRITE_ADDR + [31:0] + read-write + + + + + CH10_AL3_TRANS_COUNT + 0x000002b8 + Alias for channel 10 TRANS_COUNT register + 0x00000000 + + + CH10_AL3_TRANS_COUNT + [31:0] + read-write + + + + + CH10_AL3_READ_ADDR_TRIG + 0x000002bc + Alias for channel 10 READ_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH10_AL3_READ_ADDR_TRIG + [31:0] + read-write + + + + + CH11_READ_ADDR + 0x000002c0 + DMA Channel 11 Read Address pointer + 0x00000000 + + + CH11_READ_ADDR + This register updates automatically each time a read completes. The current value is the next address to be read by this channel. + [31:0] + read-write + + + + + CH11_WRITE_ADDR + 0x000002c4 + DMA Channel 11 Write Address pointer + 0x00000000 + + + CH11_WRITE_ADDR + This register updates automatically each time a write completes. The current value is the next address to be written by this channel. + [31:0] + read-write + + + + + CH11_TRANS_COUNT + 0x000002c8 + DMA Channel 11 Transfer Count + 0x00000000 + + + MODE + When MODE is 0x0, the transfer count decrements with each transfer until 0, and then the channel triggers the next channel indicated by CTRL_CHAIN_TO. + + When MODE is 0x1, the transfer count decrements with each transfer until 0, and then the channel re-triggers itself, in addition to the trigger indicated by CTRL_CHAIN_TO. This is useful for e.g. an endless ring-buffer DMA with periodic interrupts. + + When MODE is 0xf, the transfer count does not decrement. The DMA channel performs an endless sequence of transfers, never triggering other channels or raising interrupts, until an ABORT is raised. + + All other values are reserved. + [31:28] + read-write + + + NORMAL + 0 + + + TRIGGER_SELF + 1 + + + ENDLESS + 15 + + + + + COUNT + 28-bit transfer count (256 million transfers maximum). + + Program the number of bus transfers a channel will perform before halting. Note that, if transfers are larger than one byte in size, this is not equal to the number of bytes transferred (see CTRL_DATA_SIZE). + + When the channel is active, reading this register shows the number of transfers remaining, updating automatically each time a write transfer completes. + + Writing this register sets the RELOAD value for the transfer counter. Each time this channel is triggered, the RELOAD value is copied into the live transfer counter. The channel can be started multiple times, and will perform the same number of transfers each time, as programmed by most recent write. + + The RELOAD value can be observed at CHx_DBG_TCR. If TRANS_COUNT is used as a trigger, the written value is used immediately as the length of the new transfer sequence, as well as being written to RELOAD. + [27:0] + read-write + + + + + CH11_CTRL_TRIG + 0x000002cc + DMA Channel 11 Control and Status + 0x00000000 + + + AHB_ERROR + Logical OR of the READ_ERROR and WRITE_ERROR flags. The channel halts when it encounters any bus error, and always raises its channel IRQ flag. + [31:31] + read-only + + + READ_ERROR + If 1, the channel received a read bus error. Write one to clear. + READ_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 3 transfers later) + [30:30] + read-write + oneToClear + + + WRITE_ERROR + If 1, the channel received a write bus error. Write one to clear. + WRITE_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 5 transfers later) + [29:29] + read-write + oneToClear + + + BUSY + This flag goes high when the channel starts a new transfer sequence, and low when the last transfer of that sequence completes. Clearing EN while BUSY is high pauses the channel, and BUSY will stay high while paused. + + To terminate a sequence early (and clear the BUSY flag), see CHAN_ABORT. + [26:26] + read-only + + + SNIFF_EN + If 1, this channel's data transfers are visible to the sniff hardware, and each transfer will advance the state of the checksum. This only applies if the sniff hardware is enabled, and has this channel selected. + + This allows checksum to be enabled or disabled on a per-control- block basis. + [25:25] + read-write + + + BSWAP + Apply byte-swap transformation to DMA data. + For byte data, this has no effect. For halfword data, the two bytes of each halfword are swapped. For word data, the four bytes of each word are swapped to reverse order. + [24:24] + read-write + + + IRQ_QUIET + In QUIET mode, the channel does not generate IRQs at the end of every transfer block. Instead, an IRQ is raised when NULL is written to a trigger register, indicating the end of a control block chain. + + This reduces the number of interrupts to be serviced by the CPU when transferring a DMA chain of many small control blocks. + [23:23] + read-write + + + TREQ_SEL + Select a Transfer Request signal. + The channel uses the transfer request signal to pace its data transfer rate. Sources for TREQ signals are internal (TIMERS) or external (DREQ, a Data Request from the system). + 0x0 to 0x3a -> select DREQ n as TREQ + [22:17] + read-write + + + PIO0_TX0 + 0 + Select PIO0's TX FIFO 0 as TREQ + + + PIO0_TX1 + 1 + Select PIO0's TX FIFO 1 as TREQ + + + PIO0_TX2 + 2 + Select PIO0's TX FIFO 2 as TREQ + + + PIO0_TX3 + 3 + Select PIO0's TX FIFO 3 as TREQ + + + PIO0_RX0 + 4 + Select PIO0's RX FIFO 0 as TREQ + + + PIO0_RX1 + 5 + Select PIO0's RX FIFO 1 as TREQ + + + PIO0_RX2 + 6 + Select PIO0's RX FIFO 2 as TREQ + + + PIO0_RX3 + 7 + Select PIO0's RX FIFO 3 as TREQ + + + PIO1_TX0 + 8 + Select PIO1's TX FIFO 0 as TREQ + + + PIO1_TX1 + 9 + Select PIO1's TX FIFO 1 as TREQ + + + PIO1_TX2 + 10 + Select PIO1's TX FIFO 2 as TREQ + + + PIO1_TX3 + 11 + Select PIO1's TX FIFO 3 as TREQ + + + PIO1_RX0 + 12 + Select PIO1's RX FIFO 0 as TREQ + + + PIO1_RX1 + 13 + Select PIO1's RX FIFO 1 as TREQ + + + PIO1_RX2 + 14 + Select PIO1's RX FIFO 2 as TREQ + + + PIO1_RX3 + 15 + Select PIO1's RX FIFO 3 as TREQ + + + PIO2_TX0 + 16 + Select PIO2's TX FIFO 0 as TREQ + + + PIO2_TX1 + 17 + Select PIO2's TX FIFO 1 as TREQ + + + PIO2_TX2 + 18 + Select PIO2's TX FIFO 2 as TREQ + + + PIO2_TX3 + 19 + Select PIO2's TX FIFO 3 as TREQ + + + PIO2_RX0 + 20 + Select PIO2's RX FIFO 0 as TREQ + + + PIO2_RX1 + 21 + Select PIO2's RX FIFO 1 as TREQ + + + PIO2_RX2 + 22 + Select PIO2's RX FIFO 2 as TREQ + + + PIO2_RX3 + 23 + Select PIO2's RX FIFO 3 as TREQ + + + SPI0_TX + 24 + Select SPI0's TX FIFO as TREQ + + + SPI0_RX + 25 + Select SPI0's RX FIFO as TREQ + + + SPI1_TX + 26 + Select SPI1's TX FIFO as TREQ + + + SPI1_RX + 27 + Select SPI1's RX FIFO as TREQ + + + UART0_TX + 28 + Select UART0's TX FIFO as TREQ + + + UART0_RX + 29 + Select UART0's RX FIFO as TREQ + + + UART1_TX + 30 + Select UART1's TX FIFO as TREQ + + + UART1_RX + 31 + Select UART1's RX FIFO as TREQ + + + PWM_WRAP0 + 32 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP1 + 33 + Select PWM Counter 1's Wrap Value as TREQ + + + PWM_WRAP2 + 34 + Select PWM Counter 2's Wrap Value as TREQ + + + PWM_WRAP3 + 35 + Select PWM Counter 3's Wrap Value as TREQ + + + PWM_WRAP4 + 36 + Select PWM Counter 4's Wrap Value as TREQ + + + PWM_WRAP5 + 37 + Select PWM Counter 5's Wrap Value as TREQ + + + PWM_WRAP6 + 38 + Select PWM Counter 6's Wrap Value as TREQ + + + PWM_WRAP7 + 39 + Select PWM Counter 7's Wrap Value as TREQ + + + PWM_WRAP8 + 40 + Select PWM Counter 8's Wrap Value as TREQ + + + PWM_WRAP9 + 41 + Select PWM Counter 9's Wrap Value as TREQ + + + PWM_WRAP10 + 42 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP11 + 43 + Select PWM Counter 1's Wrap Value as TREQ + + + I2C0_TX + 44 + Select I2C0's TX FIFO as TREQ + + + I2C0_RX + 45 + Select I2C0's RX FIFO as TREQ + + + I2C1_TX + 46 + Select I2C1's TX FIFO as TREQ + + + I2C1_RX + 47 + Select I2C1's RX FIFO as TREQ + + + ADC + 48 + Select the ADC as TREQ + + + XIP_STREAM + 49 + Select the XIP Streaming FIFO as TREQ + + + XIP_QMITX + 50 + Select XIP_QMITX as TREQ + + + XIP_QMIRX + 51 + Select XIP_QMIRX as TREQ + + + HSTX + 52 + Select HSTX as TREQ + + + CORESIGHT + 53 + Select CORESIGHT as TREQ + + + SHA256 + 54 + Select SHA256 as TREQ + + + TIMER0 + 59 + Select Timer 0 as TREQ + + + TIMER1 + 60 + Select Timer 1 as TREQ + + + TIMER2 + 61 + Select Timer 2 as TREQ (Optional) + + + TIMER3 + 62 + Select Timer 3 as TREQ (Optional) + + + PERMANENT + 63 + Permanent request, for unpaced transfers. + + + + + CHAIN_TO + When this channel completes, it will trigger the channel indicated by CHAIN_TO. Disable by setting CHAIN_TO = _(this channel)_. + + Note this field resets to 0, so channels 1 and above will chain to channel 0 by default. Set this field to avoid this behaviour. + [16:13] + read-write + + + RING_SEL + Select whether RING_SIZE applies to read or write addresses. + If 0, read addresses are wrapped on a (1 << RING_SIZE) boundary. If 1, write addresses are wrapped. + [12:12] + read-write + + + RING_SIZE + Size of address wrap region. If 0, don't wrap. For values n > 0, only the lower n bits of the address will change. This wraps the address on a (1 << n) byte boundary, facilitating access to naturally-aligned ring buffers. + + Ring sizes between 2 and 32768 bytes are possible. This can apply to either read or write addresses, based on value of RING_SEL. + [11:8] + read-write + + + RING_NONE + 0 + + + + + INCR_WRITE_REV + If 1, and INCR_WRITE is 1, the write address is decremented rather than incremented with each transfer. + + If 1, and INCR_WRITE is 0, this otherwise-unused combination causes the write address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [7:7] + read-write + + + INCR_WRITE + If 1, the write address increments with each transfer. If 0, each write is directed to the same, initial address. + + Generally this should be disabled for memory-to-peripheral transfers. + [6:6] + read-write + + + INCR_READ_REV + If 1, and INCR_READ is 1, the read address is decremented rather than incremented with each transfer. + + If 1, and INCR_READ is 0, this otherwise-unused combination causes the read address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [5:5] + read-write + + + INCR_READ + If 1, the read address increments with each transfer. If 0, each read is directed to the same, initial address. + + Generally this should be disabled for peripheral-to-memory transfers. + [4:4] + read-write + + + DATA_SIZE + Set the size of each bus transfer (byte/halfword/word). READ_ADDR and WRITE_ADDR advance by this amount (1/2/4 bytes) with each transfer. + [3:2] + read-write + + + SIZE_BYTE + 0 + + + SIZE_HALFWORD + 1 + + + SIZE_WORD + 2 + + + + + HIGH_PRIORITY + HIGH_PRIORITY gives a channel preferential treatment in issue scheduling: in each scheduling round, all high priority channels are considered first, and then only a single low priority channel, before returning to the high priority channels. + + This only affects the order in which the DMA schedules channels. The DMA's bus priority is not changed. If the DMA is not saturated then a low priority channel will see no loss of throughput. + [1:1] + read-write + + + EN + DMA Channel Enable. + When 1, the channel will respond to triggering events, which will cause it to become BUSY and start transferring data. When 0, the channel will ignore triggers, stop issuing transfers, and pause the current transfer sequence (i.e. BUSY will remain high if already high) + [0:0] + read-write + + + + + CH11_AL1_CTRL + 0x000002d0 + Alias for channel 11 CTRL register + 0x00000000 + + + CH11_AL1_CTRL + [31:0] + read-write + + + + + CH11_AL1_READ_ADDR + 0x000002d4 + Alias for channel 11 READ_ADDR register + 0x00000000 + + + CH11_AL1_READ_ADDR + [31:0] + read-write + + + + + CH11_AL1_WRITE_ADDR + 0x000002d8 + Alias for channel 11 WRITE_ADDR register + 0x00000000 + + + CH11_AL1_WRITE_ADDR + [31:0] + read-write + + + + + CH11_AL1_TRANS_COUNT_TRIG + 0x000002dc + Alias for channel 11 TRANS_COUNT register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH11_AL1_TRANS_COUNT_TRIG + [31:0] + read-write + + + + + CH11_AL2_CTRL + 0x000002e0 + Alias for channel 11 CTRL register + 0x00000000 + + + CH11_AL2_CTRL + [31:0] + read-write + + + + + CH11_AL2_TRANS_COUNT + 0x000002e4 + Alias for channel 11 TRANS_COUNT register + 0x00000000 + + + CH11_AL2_TRANS_COUNT + [31:0] + read-write + + + + + CH11_AL2_READ_ADDR + 0x000002e8 + Alias for channel 11 READ_ADDR register + 0x00000000 + + + CH11_AL2_READ_ADDR + [31:0] + read-write + + + + + CH11_AL2_WRITE_ADDR_TRIG + 0x000002ec + Alias for channel 11 WRITE_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH11_AL2_WRITE_ADDR_TRIG + [31:0] + read-write + + + + + CH11_AL3_CTRL + 0x000002f0 + Alias for channel 11 CTRL register + 0x00000000 + + + CH11_AL3_CTRL + [31:0] + read-write + + + + + CH11_AL3_WRITE_ADDR + 0x000002f4 + Alias for channel 11 WRITE_ADDR register + 0x00000000 + + + CH11_AL3_WRITE_ADDR + [31:0] + read-write + + + + + CH11_AL3_TRANS_COUNT + 0x000002f8 + Alias for channel 11 TRANS_COUNT register + 0x00000000 + + + CH11_AL3_TRANS_COUNT + [31:0] + read-write + + + + + CH11_AL3_READ_ADDR_TRIG + 0x000002fc + Alias for channel 11 READ_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH11_AL3_READ_ADDR_TRIG + [31:0] + read-write + + + + + CH12_READ_ADDR + 0x00000300 + DMA Channel 12 Read Address pointer + 0x00000000 + + + CH12_READ_ADDR + This register updates automatically each time a read completes. The current value is the next address to be read by this channel. + [31:0] + read-write + + + + + CH12_WRITE_ADDR + 0x00000304 + DMA Channel 12 Write Address pointer + 0x00000000 + + + CH12_WRITE_ADDR + This register updates automatically each time a write completes. The current value is the next address to be written by this channel. + [31:0] + read-write + + + + + CH12_TRANS_COUNT + 0x00000308 + DMA Channel 12 Transfer Count + 0x00000000 + + + MODE + When MODE is 0x0, the transfer count decrements with each transfer until 0, and then the channel triggers the next channel indicated by CTRL_CHAIN_TO. + + When MODE is 0x1, the transfer count decrements with each transfer until 0, and then the channel re-triggers itself, in addition to the trigger indicated by CTRL_CHAIN_TO. This is useful for e.g. an endless ring-buffer DMA with periodic interrupts. + + When MODE is 0xf, the transfer count does not decrement. The DMA channel performs an endless sequence of transfers, never triggering other channels or raising interrupts, until an ABORT is raised. + + All other values are reserved. + [31:28] + read-write + + + NORMAL + 0 + + + TRIGGER_SELF + 1 + + + ENDLESS + 15 + + + + + COUNT + 28-bit transfer count (256 million transfers maximum). + + Program the number of bus transfers a channel will perform before halting. Note that, if transfers are larger than one byte in size, this is not equal to the number of bytes transferred (see CTRL_DATA_SIZE). + + When the channel is active, reading this register shows the number of transfers remaining, updating automatically each time a write transfer completes. + + Writing this register sets the RELOAD value for the transfer counter. Each time this channel is triggered, the RELOAD value is copied into the live transfer counter. The channel can be started multiple times, and will perform the same number of transfers each time, as programmed by most recent write. + + The RELOAD value can be observed at CHx_DBG_TCR. If TRANS_COUNT is used as a trigger, the written value is used immediately as the length of the new transfer sequence, as well as being written to RELOAD. + [27:0] + read-write + + + + + CH12_CTRL_TRIG + 0x0000030c + DMA Channel 12 Control and Status + 0x00000000 + + + AHB_ERROR + Logical OR of the READ_ERROR and WRITE_ERROR flags. The channel halts when it encounters any bus error, and always raises its channel IRQ flag. + [31:31] + read-only + + + READ_ERROR + If 1, the channel received a read bus error. Write one to clear. + READ_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 3 transfers later) + [30:30] + read-write + oneToClear + + + WRITE_ERROR + If 1, the channel received a write bus error. Write one to clear. + WRITE_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 5 transfers later) + [29:29] + read-write + oneToClear + + + BUSY + This flag goes high when the channel starts a new transfer sequence, and low when the last transfer of that sequence completes. Clearing EN while BUSY is high pauses the channel, and BUSY will stay high while paused. + + To terminate a sequence early (and clear the BUSY flag), see CHAN_ABORT. + [26:26] + read-only + + + SNIFF_EN + If 1, this channel's data transfers are visible to the sniff hardware, and each transfer will advance the state of the checksum. This only applies if the sniff hardware is enabled, and has this channel selected. + + This allows checksum to be enabled or disabled on a per-control- block basis. + [25:25] + read-write + + + BSWAP + Apply byte-swap transformation to DMA data. + For byte data, this has no effect. For halfword data, the two bytes of each halfword are swapped. For word data, the four bytes of each word are swapped to reverse order. + [24:24] + read-write + + + IRQ_QUIET + In QUIET mode, the channel does not generate IRQs at the end of every transfer block. Instead, an IRQ is raised when NULL is written to a trigger register, indicating the end of a control block chain. + + This reduces the number of interrupts to be serviced by the CPU when transferring a DMA chain of many small control blocks. + [23:23] + read-write + + + TREQ_SEL + Select a Transfer Request signal. + The channel uses the transfer request signal to pace its data transfer rate. Sources for TREQ signals are internal (TIMERS) or external (DREQ, a Data Request from the system). + 0x0 to 0x3a -> select DREQ n as TREQ + [22:17] + read-write + + + PIO0_TX0 + 0 + Select PIO0's TX FIFO 0 as TREQ + + + PIO0_TX1 + 1 + Select PIO0's TX FIFO 1 as TREQ + + + PIO0_TX2 + 2 + Select PIO0's TX FIFO 2 as TREQ + + + PIO0_TX3 + 3 + Select PIO0's TX FIFO 3 as TREQ + + + PIO0_RX0 + 4 + Select PIO0's RX FIFO 0 as TREQ + + + PIO0_RX1 + 5 + Select PIO0's RX FIFO 1 as TREQ + + + PIO0_RX2 + 6 + Select PIO0's RX FIFO 2 as TREQ + + + PIO0_RX3 + 7 + Select PIO0's RX FIFO 3 as TREQ + + + PIO1_TX0 + 8 + Select PIO1's TX FIFO 0 as TREQ + + + PIO1_TX1 + 9 + Select PIO1's TX FIFO 1 as TREQ + + + PIO1_TX2 + 10 + Select PIO1's TX FIFO 2 as TREQ + + + PIO1_TX3 + 11 + Select PIO1's TX FIFO 3 as TREQ + + + PIO1_RX0 + 12 + Select PIO1's RX FIFO 0 as TREQ + + + PIO1_RX1 + 13 + Select PIO1's RX FIFO 1 as TREQ + + + PIO1_RX2 + 14 + Select PIO1's RX FIFO 2 as TREQ + + + PIO1_RX3 + 15 + Select PIO1's RX FIFO 3 as TREQ + + + PIO2_TX0 + 16 + Select PIO2's TX FIFO 0 as TREQ + + + PIO2_TX1 + 17 + Select PIO2's TX FIFO 1 as TREQ + + + PIO2_TX2 + 18 + Select PIO2's TX FIFO 2 as TREQ + + + PIO2_TX3 + 19 + Select PIO2's TX FIFO 3 as TREQ + + + PIO2_RX0 + 20 + Select PIO2's RX FIFO 0 as TREQ + + + PIO2_RX1 + 21 + Select PIO2's RX FIFO 1 as TREQ + + + PIO2_RX2 + 22 + Select PIO2's RX FIFO 2 as TREQ + + + PIO2_RX3 + 23 + Select PIO2's RX FIFO 3 as TREQ + + + SPI0_TX + 24 + Select SPI0's TX FIFO as TREQ + + + SPI0_RX + 25 + Select SPI0's RX FIFO as TREQ + + + SPI1_TX + 26 + Select SPI1's TX FIFO as TREQ + + + SPI1_RX + 27 + Select SPI1's RX FIFO as TREQ + + + UART0_TX + 28 + Select UART0's TX FIFO as TREQ + + + UART0_RX + 29 + Select UART0's RX FIFO as TREQ + + + UART1_TX + 30 + Select UART1's TX FIFO as TREQ + + + UART1_RX + 31 + Select UART1's RX FIFO as TREQ + + + PWM_WRAP0 + 32 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP1 + 33 + Select PWM Counter 1's Wrap Value as TREQ + + + PWM_WRAP2 + 34 + Select PWM Counter 2's Wrap Value as TREQ + + + PWM_WRAP3 + 35 + Select PWM Counter 3's Wrap Value as TREQ + + + PWM_WRAP4 + 36 + Select PWM Counter 4's Wrap Value as TREQ + + + PWM_WRAP5 + 37 + Select PWM Counter 5's Wrap Value as TREQ + + + PWM_WRAP6 + 38 + Select PWM Counter 6's Wrap Value as TREQ + + + PWM_WRAP7 + 39 + Select PWM Counter 7's Wrap Value as TREQ + + + PWM_WRAP8 + 40 + Select PWM Counter 8's Wrap Value as TREQ + + + PWM_WRAP9 + 41 + Select PWM Counter 9's Wrap Value as TREQ + + + PWM_WRAP10 + 42 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP11 + 43 + Select PWM Counter 1's Wrap Value as TREQ + + + I2C0_TX + 44 + Select I2C0's TX FIFO as TREQ + + + I2C0_RX + 45 + Select I2C0's RX FIFO as TREQ + + + I2C1_TX + 46 + Select I2C1's TX FIFO as TREQ + + + I2C1_RX + 47 + Select I2C1's RX FIFO as TREQ + + + ADC + 48 + Select the ADC as TREQ + + + XIP_STREAM + 49 + Select the XIP Streaming FIFO as TREQ + + + XIP_QMITX + 50 + Select XIP_QMITX as TREQ + + + XIP_QMIRX + 51 + Select XIP_QMIRX as TREQ + + + HSTX + 52 + Select HSTX as TREQ + + + CORESIGHT + 53 + Select CORESIGHT as TREQ + + + SHA256 + 54 + Select SHA256 as TREQ + + + TIMER0 + 59 + Select Timer 0 as TREQ + + + TIMER1 + 60 + Select Timer 1 as TREQ + + + TIMER2 + 61 + Select Timer 2 as TREQ (Optional) + + + TIMER3 + 62 + Select Timer 3 as TREQ (Optional) + + + PERMANENT + 63 + Permanent request, for unpaced transfers. + + + + + CHAIN_TO + When this channel completes, it will trigger the channel indicated by CHAIN_TO. Disable by setting CHAIN_TO = _(this channel)_. + + Note this field resets to 0, so channels 1 and above will chain to channel 0 by default. Set this field to avoid this behaviour. + [16:13] + read-write + + + RING_SEL + Select whether RING_SIZE applies to read or write addresses. + If 0, read addresses are wrapped on a (1 << RING_SIZE) boundary. If 1, write addresses are wrapped. + [12:12] + read-write + + + RING_SIZE + Size of address wrap region. If 0, don't wrap. For values n > 0, only the lower n bits of the address will change. This wraps the address on a (1 << n) byte boundary, facilitating access to naturally-aligned ring buffers. + + Ring sizes between 2 and 32768 bytes are possible. This can apply to either read or write addresses, based on value of RING_SEL. + [11:8] + read-write + + + RING_NONE + 0 + + + + + INCR_WRITE_REV + If 1, and INCR_WRITE is 1, the write address is decremented rather than incremented with each transfer. + + If 1, and INCR_WRITE is 0, this otherwise-unused combination causes the write address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [7:7] + read-write + + + INCR_WRITE + If 1, the write address increments with each transfer. If 0, each write is directed to the same, initial address. + + Generally this should be disabled for memory-to-peripheral transfers. + [6:6] + read-write + + + INCR_READ_REV + If 1, and INCR_READ is 1, the read address is decremented rather than incremented with each transfer. + + If 1, and INCR_READ is 0, this otherwise-unused combination causes the read address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [5:5] + read-write + + + INCR_READ + If 1, the read address increments with each transfer. If 0, each read is directed to the same, initial address. + + Generally this should be disabled for peripheral-to-memory transfers. + [4:4] + read-write + + + DATA_SIZE + Set the size of each bus transfer (byte/halfword/word). READ_ADDR and WRITE_ADDR advance by this amount (1/2/4 bytes) with each transfer. + [3:2] + read-write + + + SIZE_BYTE + 0 + + + SIZE_HALFWORD + 1 + + + SIZE_WORD + 2 + + + + + HIGH_PRIORITY + HIGH_PRIORITY gives a channel preferential treatment in issue scheduling: in each scheduling round, all high priority channels are considered first, and then only a single low priority channel, before returning to the high priority channels. + + This only affects the order in which the DMA schedules channels. The DMA's bus priority is not changed. If the DMA is not saturated then a low priority channel will see no loss of throughput. + [1:1] + read-write + + + EN + DMA Channel Enable. + When 1, the channel will respond to triggering events, which will cause it to become BUSY and start transferring data. When 0, the channel will ignore triggers, stop issuing transfers, and pause the current transfer sequence (i.e. BUSY will remain high if already high) + [0:0] + read-write + + + + + CH12_AL1_CTRL + 0x00000310 + Alias for channel 12 CTRL register + 0x00000000 + + + CH12_AL1_CTRL + [31:0] + read-write + + + + + CH12_AL1_READ_ADDR + 0x00000314 + Alias for channel 12 READ_ADDR register + 0x00000000 + + + CH12_AL1_READ_ADDR + [31:0] + read-write + + + + + CH12_AL1_WRITE_ADDR + 0x00000318 + Alias for channel 12 WRITE_ADDR register + 0x00000000 + + + CH12_AL1_WRITE_ADDR + [31:0] + read-write + + + + + CH12_AL1_TRANS_COUNT_TRIG + 0x0000031c + Alias for channel 12 TRANS_COUNT register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH12_AL1_TRANS_COUNT_TRIG + [31:0] + read-write + + + + + CH12_AL2_CTRL + 0x00000320 + Alias for channel 12 CTRL register + 0x00000000 + + + CH12_AL2_CTRL + [31:0] + read-write + + + + + CH12_AL2_TRANS_COUNT + 0x00000324 + Alias for channel 12 TRANS_COUNT register + 0x00000000 + + + CH12_AL2_TRANS_COUNT + [31:0] + read-write + + + + + CH12_AL2_READ_ADDR + 0x00000328 + Alias for channel 12 READ_ADDR register + 0x00000000 + + + CH12_AL2_READ_ADDR + [31:0] + read-write + + + + + CH12_AL2_WRITE_ADDR_TRIG + 0x0000032c + Alias for channel 12 WRITE_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH12_AL2_WRITE_ADDR_TRIG + [31:0] + read-write + + + + + CH12_AL3_CTRL + 0x00000330 + Alias for channel 12 CTRL register + 0x00000000 + + + CH12_AL3_CTRL + [31:0] + read-write + + + + + CH12_AL3_WRITE_ADDR + 0x00000334 + Alias for channel 12 WRITE_ADDR register + 0x00000000 + + + CH12_AL3_WRITE_ADDR + [31:0] + read-write + + + + + CH12_AL3_TRANS_COUNT + 0x00000338 + Alias for channel 12 TRANS_COUNT register + 0x00000000 + + + CH12_AL3_TRANS_COUNT + [31:0] + read-write + + + + + CH12_AL3_READ_ADDR_TRIG + 0x0000033c + Alias for channel 12 READ_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH12_AL3_READ_ADDR_TRIG + [31:0] + read-write + + + + + CH13_READ_ADDR + 0x00000340 + DMA Channel 13 Read Address pointer + 0x00000000 + + + CH13_READ_ADDR + This register updates automatically each time a read completes. The current value is the next address to be read by this channel. + [31:0] + read-write + + + + + CH13_WRITE_ADDR + 0x00000344 + DMA Channel 13 Write Address pointer + 0x00000000 + + + CH13_WRITE_ADDR + This register updates automatically each time a write completes. The current value is the next address to be written by this channel. + [31:0] + read-write + + + + + CH13_TRANS_COUNT + 0x00000348 + DMA Channel 13 Transfer Count + 0x00000000 + + + MODE + When MODE is 0x0, the transfer count decrements with each transfer until 0, and then the channel triggers the next channel indicated by CTRL_CHAIN_TO. + + When MODE is 0x1, the transfer count decrements with each transfer until 0, and then the channel re-triggers itself, in addition to the trigger indicated by CTRL_CHAIN_TO. This is useful for e.g. an endless ring-buffer DMA with periodic interrupts. + + When MODE is 0xf, the transfer count does not decrement. The DMA channel performs an endless sequence of transfers, never triggering other channels or raising interrupts, until an ABORT is raised. + + All other values are reserved. + [31:28] + read-write + + + NORMAL + 0 + + + TRIGGER_SELF + 1 + + + ENDLESS + 15 + + + + + COUNT + 28-bit transfer count (256 million transfers maximum). + + Program the number of bus transfers a channel will perform before halting. Note that, if transfers are larger than one byte in size, this is not equal to the number of bytes transferred (see CTRL_DATA_SIZE). + + When the channel is active, reading this register shows the number of transfers remaining, updating automatically each time a write transfer completes. + + Writing this register sets the RELOAD value for the transfer counter. Each time this channel is triggered, the RELOAD value is copied into the live transfer counter. The channel can be started multiple times, and will perform the same number of transfers each time, as programmed by most recent write. + + The RELOAD value can be observed at CHx_DBG_TCR. If TRANS_COUNT is used as a trigger, the written value is used immediately as the length of the new transfer sequence, as well as being written to RELOAD. + [27:0] + read-write + + + + + CH13_CTRL_TRIG + 0x0000034c + DMA Channel 13 Control and Status + 0x00000000 + + + AHB_ERROR + Logical OR of the READ_ERROR and WRITE_ERROR flags. The channel halts when it encounters any bus error, and always raises its channel IRQ flag. + [31:31] + read-only + + + READ_ERROR + If 1, the channel received a read bus error. Write one to clear. + READ_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 3 transfers later) + [30:30] + read-write + oneToClear + + + WRITE_ERROR + If 1, the channel received a write bus error. Write one to clear. + WRITE_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 5 transfers later) + [29:29] + read-write + oneToClear + + + BUSY + This flag goes high when the channel starts a new transfer sequence, and low when the last transfer of that sequence completes. Clearing EN while BUSY is high pauses the channel, and BUSY will stay high while paused. + + To terminate a sequence early (and clear the BUSY flag), see CHAN_ABORT. + [26:26] + read-only + + + SNIFF_EN + If 1, this channel's data transfers are visible to the sniff hardware, and each transfer will advance the state of the checksum. This only applies if the sniff hardware is enabled, and has this channel selected. + + This allows checksum to be enabled or disabled on a per-control- block basis. + [25:25] + read-write + + + BSWAP + Apply byte-swap transformation to DMA data. + For byte data, this has no effect. For halfword data, the two bytes of each halfword are swapped. For word data, the four bytes of each word are swapped to reverse order. + [24:24] + read-write + + + IRQ_QUIET + In QUIET mode, the channel does not generate IRQs at the end of every transfer block. Instead, an IRQ is raised when NULL is written to a trigger register, indicating the end of a control block chain. + + This reduces the number of interrupts to be serviced by the CPU when transferring a DMA chain of many small control blocks. + [23:23] + read-write + + + TREQ_SEL + Select a Transfer Request signal. + The channel uses the transfer request signal to pace its data transfer rate. Sources for TREQ signals are internal (TIMERS) or external (DREQ, a Data Request from the system). + 0x0 to 0x3a -> select DREQ n as TREQ + [22:17] + read-write + + + PIO0_TX0 + 0 + Select PIO0's TX FIFO 0 as TREQ + + + PIO0_TX1 + 1 + Select PIO0's TX FIFO 1 as TREQ + + + PIO0_TX2 + 2 + Select PIO0's TX FIFO 2 as TREQ + + + PIO0_TX3 + 3 + Select PIO0's TX FIFO 3 as TREQ + + + PIO0_RX0 + 4 + Select PIO0's RX FIFO 0 as TREQ + + + PIO0_RX1 + 5 + Select PIO0's RX FIFO 1 as TREQ + + + PIO0_RX2 + 6 + Select PIO0's RX FIFO 2 as TREQ + + + PIO0_RX3 + 7 + Select PIO0's RX FIFO 3 as TREQ + + + PIO1_TX0 + 8 + Select PIO1's TX FIFO 0 as TREQ + + + PIO1_TX1 + 9 + Select PIO1's TX FIFO 1 as TREQ + + + PIO1_TX2 + 10 + Select PIO1's TX FIFO 2 as TREQ + + + PIO1_TX3 + 11 + Select PIO1's TX FIFO 3 as TREQ + + + PIO1_RX0 + 12 + Select PIO1's RX FIFO 0 as TREQ + + + PIO1_RX1 + 13 + Select PIO1's RX FIFO 1 as TREQ + + + PIO1_RX2 + 14 + Select PIO1's RX FIFO 2 as TREQ + + + PIO1_RX3 + 15 + Select PIO1's RX FIFO 3 as TREQ + + + PIO2_TX0 + 16 + Select PIO2's TX FIFO 0 as TREQ + + + PIO2_TX1 + 17 + Select PIO2's TX FIFO 1 as TREQ + + + PIO2_TX2 + 18 + Select PIO2's TX FIFO 2 as TREQ + + + PIO2_TX3 + 19 + Select PIO2's TX FIFO 3 as TREQ + + + PIO2_RX0 + 20 + Select PIO2's RX FIFO 0 as TREQ + + + PIO2_RX1 + 21 + Select PIO2's RX FIFO 1 as TREQ + + + PIO2_RX2 + 22 + Select PIO2's RX FIFO 2 as TREQ + + + PIO2_RX3 + 23 + Select PIO2's RX FIFO 3 as TREQ + + + SPI0_TX + 24 + Select SPI0's TX FIFO as TREQ + + + SPI0_RX + 25 + Select SPI0's RX FIFO as TREQ + + + SPI1_TX + 26 + Select SPI1's TX FIFO as TREQ + + + SPI1_RX + 27 + Select SPI1's RX FIFO as TREQ + + + UART0_TX + 28 + Select UART0's TX FIFO as TREQ + + + UART0_RX + 29 + Select UART0's RX FIFO as TREQ + + + UART1_TX + 30 + Select UART1's TX FIFO as TREQ + + + UART1_RX + 31 + Select UART1's RX FIFO as TREQ + + + PWM_WRAP0 + 32 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP1 + 33 + Select PWM Counter 1's Wrap Value as TREQ + + + PWM_WRAP2 + 34 + Select PWM Counter 2's Wrap Value as TREQ + + + PWM_WRAP3 + 35 + Select PWM Counter 3's Wrap Value as TREQ + + + PWM_WRAP4 + 36 + Select PWM Counter 4's Wrap Value as TREQ + + + PWM_WRAP5 + 37 + Select PWM Counter 5's Wrap Value as TREQ + + + PWM_WRAP6 + 38 + Select PWM Counter 6's Wrap Value as TREQ + + + PWM_WRAP7 + 39 + Select PWM Counter 7's Wrap Value as TREQ + + + PWM_WRAP8 + 40 + Select PWM Counter 8's Wrap Value as TREQ + + + PWM_WRAP9 + 41 + Select PWM Counter 9's Wrap Value as TREQ + + + PWM_WRAP10 + 42 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP11 + 43 + Select PWM Counter 1's Wrap Value as TREQ + + + I2C0_TX + 44 + Select I2C0's TX FIFO as TREQ + + + I2C0_RX + 45 + Select I2C0's RX FIFO as TREQ + + + I2C1_TX + 46 + Select I2C1's TX FIFO as TREQ + + + I2C1_RX + 47 + Select I2C1's RX FIFO as TREQ + + + ADC + 48 + Select the ADC as TREQ + + + XIP_STREAM + 49 + Select the XIP Streaming FIFO as TREQ + + + XIP_QMITX + 50 + Select XIP_QMITX as TREQ + + + XIP_QMIRX + 51 + Select XIP_QMIRX as TREQ + + + HSTX + 52 + Select HSTX as TREQ + + + CORESIGHT + 53 + Select CORESIGHT as TREQ + + + SHA256 + 54 + Select SHA256 as TREQ + + + TIMER0 + 59 + Select Timer 0 as TREQ + + + TIMER1 + 60 + Select Timer 1 as TREQ + + + TIMER2 + 61 + Select Timer 2 as TREQ (Optional) + + + TIMER3 + 62 + Select Timer 3 as TREQ (Optional) + + + PERMANENT + 63 + Permanent request, for unpaced transfers. + + + + + CHAIN_TO + When this channel completes, it will trigger the channel indicated by CHAIN_TO. Disable by setting CHAIN_TO = _(this channel)_. + + Note this field resets to 0, so channels 1 and above will chain to channel 0 by default. Set this field to avoid this behaviour. + [16:13] + read-write + + + RING_SEL + Select whether RING_SIZE applies to read or write addresses. + If 0, read addresses are wrapped on a (1 << RING_SIZE) boundary. If 1, write addresses are wrapped. + [12:12] + read-write + + + RING_SIZE + Size of address wrap region. If 0, don't wrap. For values n > 0, only the lower n bits of the address will change. This wraps the address on a (1 << n) byte boundary, facilitating access to naturally-aligned ring buffers. + + Ring sizes between 2 and 32768 bytes are possible. This can apply to either read or write addresses, based on value of RING_SEL. + [11:8] + read-write + + + RING_NONE + 0 + + + + + INCR_WRITE_REV + If 1, and INCR_WRITE is 1, the write address is decremented rather than incremented with each transfer. + + If 1, and INCR_WRITE is 0, this otherwise-unused combination causes the write address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [7:7] + read-write + + + INCR_WRITE + If 1, the write address increments with each transfer. If 0, each write is directed to the same, initial address. + + Generally this should be disabled for memory-to-peripheral transfers. + [6:6] + read-write + + + INCR_READ_REV + If 1, and INCR_READ is 1, the read address is decremented rather than incremented with each transfer. + + If 1, and INCR_READ is 0, this otherwise-unused combination causes the read address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [5:5] + read-write + + + INCR_READ + If 1, the read address increments with each transfer. If 0, each read is directed to the same, initial address. + + Generally this should be disabled for peripheral-to-memory transfers. + [4:4] + read-write + + + DATA_SIZE + Set the size of each bus transfer (byte/halfword/word). READ_ADDR and WRITE_ADDR advance by this amount (1/2/4 bytes) with each transfer. + [3:2] + read-write + + + SIZE_BYTE + 0 + + + SIZE_HALFWORD + 1 + + + SIZE_WORD + 2 + + + + + HIGH_PRIORITY + HIGH_PRIORITY gives a channel preferential treatment in issue scheduling: in each scheduling round, all high priority channels are considered first, and then only a single low priority channel, before returning to the high priority channels. + + This only affects the order in which the DMA schedules channels. The DMA's bus priority is not changed. If the DMA is not saturated then a low priority channel will see no loss of throughput. + [1:1] + read-write + + + EN + DMA Channel Enable. + When 1, the channel will respond to triggering events, which will cause it to become BUSY and start transferring data. When 0, the channel will ignore triggers, stop issuing transfers, and pause the current transfer sequence (i.e. BUSY will remain high if already high) + [0:0] + read-write + + + + + CH13_AL1_CTRL + 0x00000350 + Alias for channel 13 CTRL register + 0x00000000 + + + CH13_AL1_CTRL + [31:0] + read-write + + + + + CH13_AL1_READ_ADDR + 0x00000354 + Alias for channel 13 READ_ADDR register + 0x00000000 + + + CH13_AL1_READ_ADDR + [31:0] + read-write + + + + + CH13_AL1_WRITE_ADDR + 0x00000358 + Alias for channel 13 WRITE_ADDR register + 0x00000000 + + + CH13_AL1_WRITE_ADDR + [31:0] + read-write + + + + + CH13_AL1_TRANS_COUNT_TRIG + 0x0000035c + Alias for channel 13 TRANS_COUNT register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH13_AL1_TRANS_COUNT_TRIG + [31:0] + read-write + + + + + CH13_AL2_CTRL + 0x00000360 + Alias for channel 13 CTRL register + 0x00000000 + + + CH13_AL2_CTRL + [31:0] + read-write + + + + + CH13_AL2_TRANS_COUNT + 0x00000364 + Alias for channel 13 TRANS_COUNT register + 0x00000000 + + + CH13_AL2_TRANS_COUNT + [31:0] + read-write + + + + + CH13_AL2_READ_ADDR + 0x00000368 + Alias for channel 13 READ_ADDR register + 0x00000000 + + + CH13_AL2_READ_ADDR + [31:0] + read-write + + + + + CH13_AL2_WRITE_ADDR_TRIG + 0x0000036c + Alias for channel 13 WRITE_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH13_AL2_WRITE_ADDR_TRIG + [31:0] + read-write + + + + + CH13_AL3_CTRL + 0x00000370 + Alias for channel 13 CTRL register + 0x00000000 + + + CH13_AL3_CTRL + [31:0] + read-write + + + + + CH13_AL3_WRITE_ADDR + 0x00000374 + Alias for channel 13 WRITE_ADDR register + 0x00000000 + + + CH13_AL3_WRITE_ADDR + [31:0] + read-write + + + + + CH13_AL3_TRANS_COUNT + 0x00000378 + Alias for channel 13 TRANS_COUNT register + 0x00000000 + + + CH13_AL3_TRANS_COUNT + [31:0] + read-write + + + + + CH13_AL3_READ_ADDR_TRIG + 0x0000037c + Alias for channel 13 READ_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH13_AL3_READ_ADDR_TRIG + [31:0] + read-write + + + + + CH14_READ_ADDR + 0x00000380 + DMA Channel 14 Read Address pointer + 0x00000000 + + + CH14_READ_ADDR + This register updates automatically each time a read completes. The current value is the next address to be read by this channel. + [31:0] + read-write + + + + + CH14_WRITE_ADDR + 0x00000384 + DMA Channel 14 Write Address pointer + 0x00000000 + + + CH14_WRITE_ADDR + This register updates automatically each time a write completes. The current value is the next address to be written by this channel. + [31:0] + read-write + + + + + CH14_TRANS_COUNT + 0x00000388 + DMA Channel 14 Transfer Count + 0x00000000 + + + MODE + When MODE is 0x0, the transfer count decrements with each transfer until 0, and then the channel triggers the next channel indicated by CTRL_CHAIN_TO. + + When MODE is 0x1, the transfer count decrements with each transfer until 0, and then the channel re-triggers itself, in addition to the trigger indicated by CTRL_CHAIN_TO. This is useful for e.g. an endless ring-buffer DMA with periodic interrupts. + + When MODE is 0xf, the transfer count does not decrement. The DMA channel performs an endless sequence of transfers, never triggering other channels or raising interrupts, until an ABORT is raised. + + All other values are reserved. + [31:28] + read-write + + + NORMAL + 0 + + + TRIGGER_SELF + 1 + + + ENDLESS + 15 + + + + + COUNT + 28-bit transfer count (256 million transfers maximum). + + Program the number of bus transfers a channel will perform before halting. Note that, if transfers are larger than one byte in size, this is not equal to the number of bytes transferred (see CTRL_DATA_SIZE). + + When the channel is active, reading this register shows the number of transfers remaining, updating automatically each time a write transfer completes. + + Writing this register sets the RELOAD value for the transfer counter. Each time this channel is triggered, the RELOAD value is copied into the live transfer counter. The channel can be started multiple times, and will perform the same number of transfers each time, as programmed by most recent write. + + The RELOAD value can be observed at CHx_DBG_TCR. If TRANS_COUNT is used as a trigger, the written value is used immediately as the length of the new transfer sequence, as well as being written to RELOAD. + [27:0] + read-write + + + + + CH14_CTRL_TRIG + 0x0000038c + DMA Channel 14 Control and Status + 0x00000000 + + + AHB_ERROR + Logical OR of the READ_ERROR and WRITE_ERROR flags. The channel halts when it encounters any bus error, and always raises its channel IRQ flag. + [31:31] + read-only + + + READ_ERROR + If 1, the channel received a read bus error. Write one to clear. + READ_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 3 transfers later) + [30:30] + read-write + oneToClear + + + WRITE_ERROR + If 1, the channel received a write bus error. Write one to clear. + WRITE_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 5 transfers later) + [29:29] + read-write + oneToClear + + + BUSY + This flag goes high when the channel starts a new transfer sequence, and low when the last transfer of that sequence completes. Clearing EN while BUSY is high pauses the channel, and BUSY will stay high while paused. + + To terminate a sequence early (and clear the BUSY flag), see CHAN_ABORT. + [26:26] + read-only + + + SNIFF_EN + If 1, this channel's data transfers are visible to the sniff hardware, and each transfer will advance the state of the checksum. This only applies if the sniff hardware is enabled, and has this channel selected. + + This allows checksum to be enabled or disabled on a per-control- block basis. + [25:25] + read-write + + + BSWAP + Apply byte-swap transformation to DMA data. + For byte data, this has no effect. For halfword data, the two bytes of each halfword are swapped. For word data, the four bytes of each word are swapped to reverse order. + [24:24] + read-write + + + IRQ_QUIET + In QUIET mode, the channel does not generate IRQs at the end of every transfer block. Instead, an IRQ is raised when NULL is written to a trigger register, indicating the end of a control block chain. + + This reduces the number of interrupts to be serviced by the CPU when transferring a DMA chain of many small control blocks. + [23:23] + read-write + + + TREQ_SEL + Select a Transfer Request signal. + The channel uses the transfer request signal to pace its data transfer rate. Sources for TREQ signals are internal (TIMERS) or external (DREQ, a Data Request from the system). + 0x0 to 0x3a -> select DREQ n as TREQ + [22:17] + read-write + + + PIO0_TX0 + 0 + Select PIO0's TX FIFO 0 as TREQ + + + PIO0_TX1 + 1 + Select PIO0's TX FIFO 1 as TREQ + + + PIO0_TX2 + 2 + Select PIO0's TX FIFO 2 as TREQ + + + PIO0_TX3 + 3 + Select PIO0's TX FIFO 3 as TREQ + + + PIO0_RX0 + 4 + Select PIO0's RX FIFO 0 as TREQ + + + PIO0_RX1 + 5 + Select PIO0's RX FIFO 1 as TREQ + + + PIO0_RX2 + 6 + Select PIO0's RX FIFO 2 as TREQ + + + PIO0_RX3 + 7 + Select PIO0's RX FIFO 3 as TREQ + + + PIO1_TX0 + 8 + Select PIO1's TX FIFO 0 as TREQ + + + PIO1_TX1 + 9 + Select PIO1's TX FIFO 1 as TREQ + + + PIO1_TX2 + 10 + Select PIO1's TX FIFO 2 as TREQ + + + PIO1_TX3 + 11 + Select PIO1's TX FIFO 3 as TREQ + + + PIO1_RX0 + 12 + Select PIO1's RX FIFO 0 as TREQ + + + PIO1_RX1 + 13 + Select PIO1's RX FIFO 1 as TREQ + + + PIO1_RX2 + 14 + Select PIO1's RX FIFO 2 as TREQ + + + PIO1_RX3 + 15 + Select PIO1's RX FIFO 3 as TREQ + + + PIO2_TX0 + 16 + Select PIO2's TX FIFO 0 as TREQ + + + PIO2_TX1 + 17 + Select PIO2's TX FIFO 1 as TREQ + + + PIO2_TX2 + 18 + Select PIO2's TX FIFO 2 as TREQ + + + PIO2_TX3 + 19 + Select PIO2's TX FIFO 3 as TREQ + + + PIO2_RX0 + 20 + Select PIO2's RX FIFO 0 as TREQ + + + PIO2_RX1 + 21 + Select PIO2's RX FIFO 1 as TREQ + + + PIO2_RX2 + 22 + Select PIO2's RX FIFO 2 as TREQ + + + PIO2_RX3 + 23 + Select PIO2's RX FIFO 3 as TREQ + + + SPI0_TX + 24 + Select SPI0's TX FIFO as TREQ + + + SPI0_RX + 25 + Select SPI0's RX FIFO as TREQ + + + SPI1_TX + 26 + Select SPI1's TX FIFO as TREQ + + + SPI1_RX + 27 + Select SPI1's RX FIFO as TREQ + + + UART0_TX + 28 + Select UART0's TX FIFO as TREQ + + + UART0_RX + 29 + Select UART0's RX FIFO as TREQ + + + UART1_TX + 30 + Select UART1's TX FIFO as TREQ + + + UART1_RX + 31 + Select UART1's RX FIFO as TREQ + + + PWM_WRAP0 + 32 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP1 + 33 + Select PWM Counter 1's Wrap Value as TREQ + + + PWM_WRAP2 + 34 + Select PWM Counter 2's Wrap Value as TREQ + + + PWM_WRAP3 + 35 + Select PWM Counter 3's Wrap Value as TREQ + + + PWM_WRAP4 + 36 + Select PWM Counter 4's Wrap Value as TREQ + + + PWM_WRAP5 + 37 + Select PWM Counter 5's Wrap Value as TREQ + + + PWM_WRAP6 + 38 + Select PWM Counter 6's Wrap Value as TREQ + + + PWM_WRAP7 + 39 + Select PWM Counter 7's Wrap Value as TREQ + + + PWM_WRAP8 + 40 + Select PWM Counter 8's Wrap Value as TREQ + + + PWM_WRAP9 + 41 + Select PWM Counter 9's Wrap Value as TREQ + + + PWM_WRAP10 + 42 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP11 + 43 + Select PWM Counter 1's Wrap Value as TREQ + + + I2C0_TX + 44 + Select I2C0's TX FIFO as TREQ + + + I2C0_RX + 45 + Select I2C0's RX FIFO as TREQ + + + I2C1_TX + 46 + Select I2C1's TX FIFO as TREQ + + + I2C1_RX + 47 + Select I2C1's RX FIFO as TREQ + + + ADC + 48 + Select the ADC as TREQ + + + XIP_STREAM + 49 + Select the XIP Streaming FIFO as TREQ + + + XIP_QMITX + 50 + Select XIP_QMITX as TREQ + + + XIP_QMIRX + 51 + Select XIP_QMIRX as TREQ + + + HSTX + 52 + Select HSTX as TREQ + + + CORESIGHT + 53 + Select CORESIGHT as TREQ + + + SHA256 + 54 + Select SHA256 as TREQ + + + TIMER0 + 59 + Select Timer 0 as TREQ + + + TIMER1 + 60 + Select Timer 1 as TREQ + + + TIMER2 + 61 + Select Timer 2 as TREQ (Optional) + + + TIMER3 + 62 + Select Timer 3 as TREQ (Optional) + + + PERMANENT + 63 + Permanent request, for unpaced transfers. + + + + + CHAIN_TO + When this channel completes, it will trigger the channel indicated by CHAIN_TO. Disable by setting CHAIN_TO = _(this channel)_. + + Note this field resets to 0, so channels 1 and above will chain to channel 0 by default. Set this field to avoid this behaviour. + [16:13] + read-write + + + RING_SEL + Select whether RING_SIZE applies to read or write addresses. + If 0, read addresses are wrapped on a (1 << RING_SIZE) boundary. If 1, write addresses are wrapped. + [12:12] + read-write + + + RING_SIZE + Size of address wrap region. If 0, don't wrap. For values n > 0, only the lower n bits of the address will change. This wraps the address on a (1 << n) byte boundary, facilitating access to naturally-aligned ring buffers. + + Ring sizes between 2 and 32768 bytes are possible. This can apply to either read or write addresses, based on value of RING_SEL. + [11:8] + read-write + + + RING_NONE + 0 + + + + + INCR_WRITE_REV + If 1, and INCR_WRITE is 1, the write address is decremented rather than incremented with each transfer. + + If 1, and INCR_WRITE is 0, this otherwise-unused combination causes the write address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [7:7] + read-write + + + INCR_WRITE + If 1, the write address increments with each transfer. If 0, each write is directed to the same, initial address. + + Generally this should be disabled for memory-to-peripheral transfers. + [6:6] + read-write + + + INCR_READ_REV + If 1, and INCR_READ is 1, the read address is decremented rather than incremented with each transfer. + + If 1, and INCR_READ is 0, this otherwise-unused combination causes the read address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [5:5] + read-write + + + INCR_READ + If 1, the read address increments with each transfer. If 0, each read is directed to the same, initial address. + + Generally this should be disabled for peripheral-to-memory transfers. + [4:4] + read-write + + + DATA_SIZE + Set the size of each bus transfer (byte/halfword/word). READ_ADDR and WRITE_ADDR advance by this amount (1/2/4 bytes) with each transfer. + [3:2] + read-write + + + SIZE_BYTE + 0 + + + SIZE_HALFWORD + 1 + + + SIZE_WORD + 2 + + + + + HIGH_PRIORITY + HIGH_PRIORITY gives a channel preferential treatment in issue scheduling: in each scheduling round, all high priority channels are considered first, and then only a single low priority channel, before returning to the high priority channels. + + This only affects the order in which the DMA schedules channels. The DMA's bus priority is not changed. If the DMA is not saturated then a low priority channel will see no loss of throughput. + [1:1] + read-write + + + EN + DMA Channel Enable. + When 1, the channel will respond to triggering events, which will cause it to become BUSY and start transferring data. When 0, the channel will ignore triggers, stop issuing transfers, and pause the current transfer sequence (i.e. BUSY will remain high if already high) + [0:0] + read-write + + + + + CH14_AL1_CTRL + 0x00000390 + Alias for channel 14 CTRL register + 0x00000000 + + + CH14_AL1_CTRL + [31:0] + read-write + + + + + CH14_AL1_READ_ADDR + 0x00000394 + Alias for channel 14 READ_ADDR register + 0x00000000 + + + CH14_AL1_READ_ADDR + [31:0] + read-write + + + + + CH14_AL1_WRITE_ADDR + 0x00000398 + Alias for channel 14 WRITE_ADDR register + 0x00000000 + + + CH14_AL1_WRITE_ADDR + [31:0] + read-write + + + + + CH14_AL1_TRANS_COUNT_TRIG + 0x0000039c + Alias for channel 14 TRANS_COUNT register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH14_AL1_TRANS_COUNT_TRIG + [31:0] + read-write + + + + + CH14_AL2_CTRL + 0x000003a0 + Alias for channel 14 CTRL register + 0x00000000 + + + CH14_AL2_CTRL + [31:0] + read-write + + + + + CH14_AL2_TRANS_COUNT + 0x000003a4 + Alias for channel 14 TRANS_COUNT register + 0x00000000 + + + CH14_AL2_TRANS_COUNT + [31:0] + read-write + + + + + CH14_AL2_READ_ADDR + 0x000003a8 + Alias for channel 14 READ_ADDR register + 0x00000000 + + + CH14_AL2_READ_ADDR + [31:0] + read-write + + + + + CH14_AL2_WRITE_ADDR_TRIG + 0x000003ac + Alias for channel 14 WRITE_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH14_AL2_WRITE_ADDR_TRIG + [31:0] + read-write + + + + + CH14_AL3_CTRL + 0x000003b0 + Alias for channel 14 CTRL register + 0x00000000 + + + CH14_AL3_CTRL + [31:0] + read-write + + + + + CH14_AL3_WRITE_ADDR + 0x000003b4 + Alias for channel 14 WRITE_ADDR register + 0x00000000 + + + CH14_AL3_WRITE_ADDR + [31:0] + read-write + + + + + CH14_AL3_TRANS_COUNT + 0x000003b8 + Alias for channel 14 TRANS_COUNT register + 0x00000000 + + + CH14_AL3_TRANS_COUNT + [31:0] + read-write + + + + + CH14_AL3_READ_ADDR_TRIG + 0x000003bc + Alias for channel 14 READ_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH14_AL3_READ_ADDR_TRIG + [31:0] + read-write + + + + + CH15_READ_ADDR + 0x000003c0 + DMA Channel 15 Read Address pointer + 0x00000000 + + + CH15_READ_ADDR + This register updates automatically each time a read completes. The current value is the next address to be read by this channel. + [31:0] + read-write + + + + + CH15_WRITE_ADDR + 0x000003c4 + DMA Channel 15 Write Address pointer + 0x00000000 + + + CH15_WRITE_ADDR + This register updates automatically each time a write completes. The current value is the next address to be written by this channel. + [31:0] + read-write + + + + + CH15_TRANS_COUNT + 0x000003c8 + DMA Channel 15 Transfer Count + 0x00000000 + + + MODE + When MODE is 0x0, the transfer count decrements with each transfer until 0, and then the channel triggers the next channel indicated by CTRL_CHAIN_TO. + + When MODE is 0x1, the transfer count decrements with each transfer until 0, and then the channel re-triggers itself, in addition to the trigger indicated by CTRL_CHAIN_TO. This is useful for e.g. an endless ring-buffer DMA with periodic interrupts. + + When MODE is 0xf, the transfer count does not decrement. The DMA channel performs an endless sequence of transfers, never triggering other channels or raising interrupts, until an ABORT is raised. + + All other values are reserved. + [31:28] + read-write + + + NORMAL + 0 + + + TRIGGER_SELF + 1 + + + ENDLESS + 15 + + + + + COUNT + 28-bit transfer count (256 million transfers maximum). + + Program the number of bus transfers a channel will perform before halting. Note that, if transfers are larger than one byte in size, this is not equal to the number of bytes transferred (see CTRL_DATA_SIZE). + + When the channel is active, reading this register shows the number of transfers remaining, updating automatically each time a write transfer completes. + + Writing this register sets the RELOAD value for the transfer counter. Each time this channel is triggered, the RELOAD value is copied into the live transfer counter. The channel can be started multiple times, and will perform the same number of transfers each time, as programmed by most recent write. + + The RELOAD value can be observed at CHx_DBG_TCR. If TRANS_COUNT is used as a trigger, the written value is used immediately as the length of the new transfer sequence, as well as being written to RELOAD. + [27:0] + read-write + + + + + CH15_CTRL_TRIG + 0x000003cc + DMA Channel 15 Control and Status + 0x00000000 + + + AHB_ERROR + Logical OR of the READ_ERROR and WRITE_ERROR flags. The channel halts when it encounters any bus error, and always raises its channel IRQ flag. + [31:31] + read-only + + + READ_ERROR + If 1, the channel received a read bus error. Write one to clear. + READ_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 3 transfers later) + [30:30] + read-write + oneToClear + + + WRITE_ERROR + If 1, the channel received a write bus error. Write one to clear. + WRITE_ADDR shows the approximate address where the bus error was encountered (will not be earlier, or more than 5 transfers later) + [29:29] + read-write + oneToClear + + + BUSY + This flag goes high when the channel starts a new transfer sequence, and low when the last transfer of that sequence completes. Clearing EN while BUSY is high pauses the channel, and BUSY will stay high while paused. + + To terminate a sequence early (and clear the BUSY flag), see CHAN_ABORT. + [26:26] + read-only + + + SNIFF_EN + If 1, this channel's data transfers are visible to the sniff hardware, and each transfer will advance the state of the checksum. This only applies if the sniff hardware is enabled, and has this channel selected. + + This allows checksum to be enabled or disabled on a per-control- block basis. + [25:25] + read-write + + + BSWAP + Apply byte-swap transformation to DMA data. + For byte data, this has no effect. For halfword data, the two bytes of each halfword are swapped. For word data, the four bytes of each word are swapped to reverse order. + [24:24] + read-write + + + IRQ_QUIET + In QUIET mode, the channel does not generate IRQs at the end of every transfer block. Instead, an IRQ is raised when NULL is written to a trigger register, indicating the end of a control block chain. + + This reduces the number of interrupts to be serviced by the CPU when transferring a DMA chain of many small control blocks. + [23:23] + read-write + + + TREQ_SEL + Select a Transfer Request signal. + The channel uses the transfer request signal to pace its data transfer rate. Sources for TREQ signals are internal (TIMERS) or external (DREQ, a Data Request from the system). + 0x0 to 0x3a -> select DREQ n as TREQ + [22:17] + read-write + + + PIO0_TX0 + 0 + Select PIO0's TX FIFO 0 as TREQ + + + PIO0_TX1 + 1 + Select PIO0's TX FIFO 1 as TREQ + + + PIO0_TX2 + 2 + Select PIO0's TX FIFO 2 as TREQ + + + PIO0_TX3 + 3 + Select PIO0's TX FIFO 3 as TREQ + + + PIO0_RX0 + 4 + Select PIO0's RX FIFO 0 as TREQ + + + PIO0_RX1 + 5 + Select PIO0's RX FIFO 1 as TREQ + + + PIO0_RX2 + 6 + Select PIO0's RX FIFO 2 as TREQ + + + PIO0_RX3 + 7 + Select PIO0's RX FIFO 3 as TREQ + + + PIO1_TX0 + 8 + Select PIO1's TX FIFO 0 as TREQ + + + PIO1_TX1 + 9 + Select PIO1's TX FIFO 1 as TREQ + + + PIO1_TX2 + 10 + Select PIO1's TX FIFO 2 as TREQ + + + PIO1_TX3 + 11 + Select PIO1's TX FIFO 3 as TREQ + + + PIO1_RX0 + 12 + Select PIO1's RX FIFO 0 as TREQ + + + PIO1_RX1 + 13 + Select PIO1's RX FIFO 1 as TREQ + + + PIO1_RX2 + 14 + Select PIO1's RX FIFO 2 as TREQ + + + PIO1_RX3 + 15 + Select PIO1's RX FIFO 3 as TREQ + + + PIO2_TX0 + 16 + Select PIO2's TX FIFO 0 as TREQ + + + PIO2_TX1 + 17 + Select PIO2's TX FIFO 1 as TREQ + + + PIO2_TX2 + 18 + Select PIO2's TX FIFO 2 as TREQ + + + PIO2_TX3 + 19 + Select PIO2's TX FIFO 3 as TREQ + + + PIO2_RX0 + 20 + Select PIO2's RX FIFO 0 as TREQ + + + PIO2_RX1 + 21 + Select PIO2's RX FIFO 1 as TREQ + + + PIO2_RX2 + 22 + Select PIO2's RX FIFO 2 as TREQ + + + PIO2_RX3 + 23 + Select PIO2's RX FIFO 3 as TREQ + + + SPI0_TX + 24 + Select SPI0's TX FIFO as TREQ + + + SPI0_RX + 25 + Select SPI0's RX FIFO as TREQ + + + SPI1_TX + 26 + Select SPI1's TX FIFO as TREQ + + + SPI1_RX + 27 + Select SPI1's RX FIFO as TREQ + + + UART0_TX + 28 + Select UART0's TX FIFO as TREQ + + + UART0_RX + 29 + Select UART0's RX FIFO as TREQ + + + UART1_TX + 30 + Select UART1's TX FIFO as TREQ + + + UART1_RX + 31 + Select UART1's RX FIFO as TREQ + + + PWM_WRAP0 + 32 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP1 + 33 + Select PWM Counter 1's Wrap Value as TREQ + + + PWM_WRAP2 + 34 + Select PWM Counter 2's Wrap Value as TREQ + + + PWM_WRAP3 + 35 + Select PWM Counter 3's Wrap Value as TREQ + + + PWM_WRAP4 + 36 + Select PWM Counter 4's Wrap Value as TREQ + + + PWM_WRAP5 + 37 + Select PWM Counter 5's Wrap Value as TREQ + + + PWM_WRAP6 + 38 + Select PWM Counter 6's Wrap Value as TREQ + + + PWM_WRAP7 + 39 + Select PWM Counter 7's Wrap Value as TREQ + + + PWM_WRAP8 + 40 + Select PWM Counter 8's Wrap Value as TREQ + + + PWM_WRAP9 + 41 + Select PWM Counter 9's Wrap Value as TREQ + + + PWM_WRAP10 + 42 + Select PWM Counter 0's Wrap Value as TREQ + + + PWM_WRAP11 + 43 + Select PWM Counter 1's Wrap Value as TREQ + + + I2C0_TX + 44 + Select I2C0's TX FIFO as TREQ + + + I2C0_RX + 45 + Select I2C0's RX FIFO as TREQ + + + I2C1_TX + 46 + Select I2C1's TX FIFO as TREQ + + + I2C1_RX + 47 + Select I2C1's RX FIFO as TREQ + + + ADC + 48 + Select the ADC as TREQ + + + XIP_STREAM + 49 + Select the XIP Streaming FIFO as TREQ + + + XIP_QMITX + 50 + Select XIP_QMITX as TREQ + + + XIP_QMIRX + 51 + Select XIP_QMIRX as TREQ + + + HSTX + 52 + Select HSTX as TREQ + + + CORESIGHT + 53 + Select CORESIGHT as TREQ + + + SHA256 + 54 + Select SHA256 as TREQ + + + TIMER0 + 59 + Select Timer 0 as TREQ + + + TIMER1 + 60 + Select Timer 1 as TREQ + + + TIMER2 + 61 + Select Timer 2 as TREQ (Optional) + + + TIMER3 + 62 + Select Timer 3 as TREQ (Optional) + + + PERMANENT + 63 + Permanent request, for unpaced transfers. + + + + + CHAIN_TO + When this channel completes, it will trigger the channel indicated by CHAIN_TO. Disable by setting CHAIN_TO = _(this channel)_. + + Note this field resets to 0, so channels 1 and above will chain to channel 0 by default. Set this field to avoid this behaviour. + [16:13] + read-write + + + RING_SEL + Select whether RING_SIZE applies to read or write addresses. + If 0, read addresses are wrapped on a (1 << RING_SIZE) boundary. If 1, write addresses are wrapped. + [12:12] + read-write + + + RING_SIZE + Size of address wrap region. If 0, don't wrap. For values n > 0, only the lower n bits of the address will change. This wraps the address on a (1 << n) byte boundary, facilitating access to naturally-aligned ring buffers. + + Ring sizes between 2 and 32768 bytes are possible. This can apply to either read or write addresses, based on value of RING_SEL. + [11:8] + read-write + + + RING_NONE + 0 + + + + + INCR_WRITE_REV + If 1, and INCR_WRITE is 1, the write address is decremented rather than incremented with each transfer. + + If 1, and INCR_WRITE is 0, this otherwise-unused combination causes the write address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [7:7] + read-write + + + INCR_WRITE + If 1, the write address increments with each transfer. If 0, each write is directed to the same, initial address. + + Generally this should be disabled for memory-to-peripheral transfers. + [6:6] + read-write + + + INCR_READ_REV + If 1, and INCR_READ is 1, the read address is decremented rather than incremented with each transfer. + + If 1, and INCR_READ is 0, this otherwise-unused combination causes the read address to be incremented by twice the transfer size, i.e. skipping over alternate addresses. + [5:5] + read-write + + + INCR_READ + If 1, the read address increments with each transfer. If 0, each read is directed to the same, initial address. + + Generally this should be disabled for peripheral-to-memory transfers. + [4:4] + read-write + + + DATA_SIZE + Set the size of each bus transfer (byte/halfword/word). READ_ADDR and WRITE_ADDR advance by this amount (1/2/4 bytes) with each transfer. + [3:2] + read-write + + + SIZE_BYTE + 0 + + + SIZE_HALFWORD + 1 + + + SIZE_WORD + 2 + + + + + HIGH_PRIORITY + HIGH_PRIORITY gives a channel preferential treatment in issue scheduling: in each scheduling round, all high priority channels are considered first, and then only a single low priority channel, before returning to the high priority channels. + + This only affects the order in which the DMA schedules channels. The DMA's bus priority is not changed. If the DMA is not saturated then a low priority channel will see no loss of throughput. + [1:1] + read-write + + + EN + DMA Channel Enable. + When 1, the channel will respond to triggering events, which will cause it to become BUSY and start transferring data. When 0, the channel will ignore triggers, stop issuing transfers, and pause the current transfer sequence (i.e. BUSY will remain high if already high) + [0:0] + read-write + + + + + CH15_AL1_CTRL + 0x000003d0 + Alias for channel 15 CTRL register + 0x00000000 + + + CH15_AL1_CTRL + [31:0] + read-write + + + + + CH15_AL1_READ_ADDR + 0x000003d4 + Alias for channel 15 READ_ADDR register + 0x00000000 + + + CH15_AL1_READ_ADDR + [31:0] + read-write + + + + + CH15_AL1_WRITE_ADDR + 0x000003d8 + Alias for channel 15 WRITE_ADDR register + 0x00000000 + + + CH15_AL1_WRITE_ADDR + [31:0] + read-write + + + + + CH15_AL1_TRANS_COUNT_TRIG + 0x000003dc + Alias for channel 15 TRANS_COUNT register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH15_AL1_TRANS_COUNT_TRIG + [31:0] + read-write + + + + + CH15_AL2_CTRL + 0x000003e0 + Alias for channel 15 CTRL register + 0x00000000 + + + CH15_AL2_CTRL + [31:0] + read-write + + + + + CH15_AL2_TRANS_COUNT + 0x000003e4 + Alias for channel 15 TRANS_COUNT register + 0x00000000 + + + CH15_AL2_TRANS_COUNT + [31:0] + read-write + + + + + CH15_AL2_READ_ADDR + 0x000003e8 + Alias for channel 15 READ_ADDR register + 0x00000000 + + + CH15_AL2_READ_ADDR + [31:0] + read-write + + + + + CH15_AL2_WRITE_ADDR_TRIG + 0x000003ec + Alias for channel 15 WRITE_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH15_AL2_WRITE_ADDR_TRIG + [31:0] + read-write + + + + + CH15_AL3_CTRL + 0x000003f0 + Alias for channel 15 CTRL register + 0x00000000 + + + CH15_AL3_CTRL + [31:0] + read-write + + + + + CH15_AL3_WRITE_ADDR + 0x000003f4 + Alias for channel 15 WRITE_ADDR register + 0x00000000 + + + CH15_AL3_WRITE_ADDR + [31:0] + read-write + + + + + CH15_AL3_TRANS_COUNT + 0x000003f8 + Alias for channel 15 TRANS_COUNT register + 0x00000000 + + + CH15_AL3_TRANS_COUNT + [31:0] + read-write + + + + + CH15_AL3_READ_ADDR_TRIG + 0x000003fc + Alias for channel 15 READ_ADDR register + This is a trigger register (0xc). Writing a nonzero value will + reload the channel counter and start the channel. + 0x00000000 + + + CH15_AL3_READ_ADDR_TRIG + [31:0] + read-write + + + + + INTR + 0x00000400 + Interrupt Status (raw) + 0x00000000 + + + INTR + Raw interrupt status for DMA Channels 0..15. Bit n corresponds to channel n. Ignores any masking or forcing. Channel interrupts can be cleared by writing a bit mask to INTR or INTS0/1/2/3. + + Channel interrupts can be routed to either of four system-level IRQs based on INTE0, INTE1, INTE2 and INTE3. + + The multiple system-level interrupts might be used to allow NVIC IRQ preemption for more time-critical channels, to spread IRQ load across different cores, or to target IRQs to different security domains. + + It is also valid to ignore the multiple IRQs, and just use INTE0/INTS0/IRQ 0. + + If this register is accessed at a security/privilege level less than that of a given channel (as defined by that channel's SECCFG_CHx register), then that channel's interrupt status will read as 0, ignore writes. + [15:0] + read-write + oneToClear + + + + + INTE0 + 0x00000404 + Interrupt Enables for IRQ 0 + 0x00000000 + + + INTE0 + Set bit n to pass interrupts from channel n to DMA IRQ 0. + + Note this bit has no effect if the channel security/privilege level, defined by SECCFG_CHx, is greater than the IRQ security/privilege defined by SECCFG_IRQ0. + [15:0] + read-write + + + + + INTF0 + 0x00000408 + Force Interrupts + 0x00000000 + + + INTF0 + Write 1s to force the corresponding bits in INTS0. The interrupt remains asserted until INTF0 is cleared. + [15:0] + read-write + + + + + INTS0 + 0x0000040c + Interrupt Status for IRQ 0 + 0x00000000 + + + INTS0 + Indicates active channel interrupt requests which are currently causing IRQ 0 to be asserted. + Channel interrupts can be cleared by writing a bit mask here. + + Channels with a security/privilege (SECCFG_CHx) greater SECCFG_IRQ0) read as 0 in this register, and ignore writes. + [15:0] + read-write + oneToClear + + + + + INTR1 + 0x00000410 + Interrupt Status (raw) + 0x00000000 + + + INTR1 + Raw interrupt status for DMA Channels 0..15. Bit n corresponds to channel n. Ignores any masking or forcing. Channel interrupts can be cleared by writing a bit mask to INTR or INTS0/1/2/3. + + Channel interrupts can be routed to either of four system-level IRQs based on INTE0, INTE1, INTE2 and INTE3. + + The multiple system-level interrupts might be used to allow NVIC IRQ preemption for more time-critical channels, to spread IRQ load across different cores, or to target IRQs to different security domains. + + It is also valid to ignore the multiple IRQs, and just use INTE0/INTS0/IRQ 0. + + If this register is accessed at a security/privilege level less than that of a given channel (as defined by that channel's SECCFG_CHx register), then that channel's interrupt status will read as 0, ignore writes. + [15:0] + read-write + oneToClear + + + + + INTE1 + 0x00000414 + Interrupt Enables for IRQ 1 + 0x00000000 + + + INTE1 + Set bit n to pass interrupts from channel n to DMA IRQ 1. + + Note this bit has no effect if the channel security/privilege level, defined by SECCFG_CHx, is greater than the IRQ security/privilege defined by SECCFG_IRQ1. + [15:0] + read-write + + + + + INTF1 + 0x00000418 + Force Interrupts + 0x00000000 + + + INTF1 + Write 1s to force the corresponding bits in INTS1. The interrupt remains asserted until INTF1 is cleared. + [15:0] + read-write + + + + + INTS1 + 0x0000041c + Interrupt Status for IRQ 1 + 0x00000000 + + + INTS1 + Indicates active channel interrupt requests which are currently causing IRQ 1 to be asserted. + Channel interrupts can be cleared by writing a bit mask here. + + Channels with a security/privilege (SECCFG_CHx) greater SECCFG_IRQ1) read as 0 in this register, and ignore writes. + [15:0] + read-write + oneToClear + + + + + INTR2 + 0x00000420 + Interrupt Status (raw) + 0x00000000 + + + INTR2 + Raw interrupt status for DMA Channels 0..15. Bit n corresponds to channel n. Ignores any masking or forcing. Channel interrupts can be cleared by writing a bit mask to INTR or INTS0/1/2/3. + + Channel interrupts can be routed to either of four system-level IRQs based on INTE0, INTE1, INTE2 and INTE3. + + The multiple system-level interrupts might be used to allow NVIC IRQ preemption for more time-critical channels, to spread IRQ load across different cores, or to target IRQs to different security domains. + + It is also valid to ignore the multiple IRQs, and just use INTE0/INTS0/IRQ 0. + + If this register is accessed at a security/privilege level less than that of a given channel (as defined by that channel's SECCFG_CHx register), then that channel's interrupt status will read as 0, ignore writes. + [15:0] + read-write + oneToClear + + + + + INTE2 + 0x00000424 + Interrupt Enables for IRQ 2 + 0x00000000 + + + INTE2 + Set bit n to pass interrupts from channel n to DMA IRQ 2. + + Note this bit has no effect if the channel security/privilege level, defined by SECCFG_CHx, is greater than the IRQ security/privilege defined by SECCFG_IRQ2. + [15:0] + read-write + + + + + INTF2 + 0x00000428 + Force Interrupts + 0x00000000 + + + INTF2 + Write 1s to force the corresponding bits in INTS2. The interrupt remains asserted until INTF2 is cleared. + [15:0] + read-write + + + + + INTS2 + 0x0000042c + Interrupt Status for IRQ 2 + 0x00000000 + + + INTS2 + Indicates active channel interrupt requests which are currently causing IRQ 2 to be asserted. + Channel interrupts can be cleared by writing a bit mask here. + + Channels with a security/privilege (SECCFG_CHx) greater SECCFG_IRQ2) read as 0 in this register, and ignore writes. + [15:0] + read-write + oneToClear + + + + + INTR3 + 0x00000430 + Interrupt Status (raw) + 0x00000000 + + + INTR3 + Raw interrupt status for DMA Channels 0..15. Bit n corresponds to channel n. Ignores any masking or forcing. Channel interrupts can be cleared by writing a bit mask to INTR or INTS0/1/2/3. + + Channel interrupts can be routed to either of four system-level IRQs based on INTE0, INTE1, INTE2 and INTE3. + + The multiple system-level interrupts might be used to allow NVIC IRQ preemption for more time-critical channels, to spread IRQ load across different cores, or to target IRQs to different security domains. + + It is also valid to ignore the multiple IRQs, and just use INTE0/INTS0/IRQ 0. + + If this register is accessed at a security/privilege level less than that of a given channel (as defined by that channel's SECCFG_CHx register), then that channel's interrupt status will read as 0, ignore writes. + [15:0] + read-write + oneToClear + + + + + INTE3 + 0x00000434 + Interrupt Enables for IRQ 3 + 0x00000000 + + + INTE3 + Set bit n to pass interrupts from channel n to DMA IRQ 3. + + Note this bit has no effect if the channel security/privilege level, defined by SECCFG_CHx, is greater than the IRQ security/privilege defined by SECCFG_IRQ3. + [15:0] + read-write + + + + + INTF3 + 0x00000438 + Force Interrupts + 0x00000000 + + + INTF3 + Write 1s to force the corresponding bits in INTS3. The interrupt remains asserted until INTF3 is cleared. + [15:0] + read-write + + + + + INTS3 + 0x0000043c + Interrupt Status for IRQ 3 + 0x00000000 + + + INTS3 + Indicates active channel interrupt requests which are currently causing IRQ 3 to be asserted. + Channel interrupts can be cleared by writing a bit mask here. + + Channels with a security/privilege (SECCFG_CHx) greater SECCFG_IRQ3) read as 0 in this register, and ignore writes. + [15:0] + read-write + oneToClear + + + + + TIMER0 + 0x00000440 + Pacing (X/Y) fractional timer + The pacing timer produces TREQ assertions at a rate set by ((X/Y) * sys_clk). This equation is evaluated every sys_clk cycles and therefore can only generate TREQs at a rate of 1 per sys_clk (i.e. permanent TREQ) or less. + 0x00000000 + + + X + Pacing Timer Dividend. Specifies the X value for the (X/Y) fractional timer. + [31:16] + read-write + + + Y + Pacing Timer Divisor. Specifies the Y value for the (X/Y) fractional timer. + [15:0] + read-write + + + + + TIMER1 + 0x00000444 + Pacing (X/Y) fractional timer + The pacing timer produces TREQ assertions at a rate set by ((X/Y) * sys_clk). This equation is evaluated every sys_clk cycles and therefore can only generate TREQs at a rate of 1 per sys_clk (i.e. permanent TREQ) or less. + 0x00000000 + + + X + Pacing Timer Dividend. Specifies the X value for the (X/Y) fractional timer. + [31:16] + read-write + + + Y + Pacing Timer Divisor. Specifies the Y value for the (X/Y) fractional timer. + [15:0] + read-write + + + + + TIMER2 + 0x00000448 + Pacing (X/Y) fractional timer + The pacing timer produces TREQ assertions at a rate set by ((X/Y) * sys_clk). This equation is evaluated every sys_clk cycles and therefore can only generate TREQs at a rate of 1 per sys_clk (i.e. permanent TREQ) or less. + 0x00000000 + + + X + Pacing Timer Dividend. Specifies the X value for the (X/Y) fractional timer. + [31:16] + read-write + + + Y + Pacing Timer Divisor. Specifies the Y value for the (X/Y) fractional timer. + [15:0] + read-write + + + + + TIMER3 + 0x0000044c + Pacing (X/Y) fractional timer + The pacing timer produces TREQ assertions at a rate set by ((X/Y) * sys_clk). This equation is evaluated every sys_clk cycles and therefore can only generate TREQs at a rate of 1 per sys_clk (i.e. permanent TREQ) or less. + 0x00000000 + + + X + Pacing Timer Dividend. Specifies the X value for the (X/Y) fractional timer. + [31:16] + read-write + + + Y + Pacing Timer Divisor. Specifies the Y value for the (X/Y) fractional timer. + [15:0] + read-write + + + + + MULTI_CHAN_TRIGGER + 0x00000450 + Trigger one or more channels simultaneously + 0x00000000 + + + MULTI_CHAN_TRIGGER + Each bit in this register corresponds to a DMA channel. Writing a 1 to the relevant bit is the same as writing to that channel's trigger register; the channel will start if it is currently enabled and not already busy. + [15:0] + write-only + + + + + SNIFF_CTRL + 0x00000454 + Sniffer Control + 0x00000000 + + + OUT_INV + If set, the result appears inverted (bitwise complement) when read. This does not affect the way the checksum is calculated; the result is transformed on-the-fly between the result register and the bus. + [11:11] + read-write + + + OUT_REV + If set, the result appears bit-reversed when read. This does not affect the way the checksum is calculated; the result is transformed on-the-fly between the result register and the bus. + [10:10] + read-write + + + BSWAP + Locally perform a byte reverse on the sniffed data, before feeding into checksum. + + Note that the sniff hardware is downstream of the DMA channel byteswap performed in the read master: if channel CTRL_BSWAP and SNIFF_CTRL_BSWAP are both enabled, their effects cancel from the sniffer's point of view. + [9:9] + read-write + + + CALC + [8:5] + read-write + + + CRC32 + 0 + Calculate a CRC-32 (IEEE802.3 polynomial) + + + CRC32R + 1 + Calculate a CRC-32 (IEEE802.3 polynomial) with bit reversed data + + + CRC16 + 2 + Calculate a CRC-16-CCITT + + + CRC16R + 3 + Calculate a CRC-16-CCITT with bit reversed data + + + EVEN + 14 + XOR reduction over all data. == 1 if the total 1 population count is odd. + + + SUM + 15 + Calculate a simple 32-bit checksum (addition with a 32 bit accumulator) + + + + + DMACH + DMA channel for Sniffer to observe + [4:1] + read-write + + + EN + Enable sniffer + [0:0] + read-write + + + + + SNIFF_DATA + 0x00000458 + Data accumulator for sniff hardware + 0x00000000 + + + SNIFF_DATA + Write an initial seed value here before starting a DMA transfer on the channel indicated by SNIFF_CTRL_DMACH. The hardware will update this register each time it observes a read from the indicated channel. Once the channel completes, the final result can be read from this register. + [31:0] + read-write + + + + + FIFO_LEVELS + 0x00000460 + Debug RAF, WAF, TDF levels + 0x00000000 + + + RAF_LVL + Current Read-Address-FIFO fill level + [23:16] + read-only + + + WAF_LVL + Current Write-Address-FIFO fill level + [15:8] + read-only + + + TDF_LVL + Current Transfer-Data-FIFO fill level + [7:0] + read-only + + + + + CHAN_ABORT + 0x00000464 + Abort an in-progress transfer sequence on one or more channels + 0x00000000 + + + CHAN_ABORT + Each bit corresponds to a channel. Writing a 1 aborts whatever transfer sequence is in progress on that channel. The bit will remain high until any in-flight transfers have been flushed through the address and data FIFOs. + + After writing, this register must be polled until it returns all-zero. Until this point, it is unsafe to restart the channel. + [15:0] + write-only + + + + + N_CHANNELS + 0x00000468 + The number of channels this DMA instance is equipped with. This DMA supports up to 16 hardware channels, but can be configured with as few as one, to minimise silicon area. + 0x00000000 + + + N_CHANNELS + [4:0] + read-only + + + + + SECCFG_CH0 + 0x00000480 + Security configuration for channel 0. Control whether this channel performs Secure/Non-secure and Privileged/Unprivileged bus accesses. + + If this channel generates bus accesses of some security level, an access of at least that level (in the order S+P > S+U > NS+P > NS+U) is required to program, trigger, abort, check the status of, interrupt on or acknowledge the interrupt of this channel. + + This register automatically locks down (becomes read-only) once software starts to configure the channel. + + This register is world-readable, but is writable only from a Secure, Privileged context. + 0x00000003 + + + LOCK + LOCK is 0 at reset, and is set to 1 automatically upon a successful write to this channel's control registers. That is, a write to CTRL, READ_ADDR, WRITE_ADDR, TRANS_COUNT and their aliases. + + Once its LOCK bit is set, this register becomes read-only. + + A failed write, for example due to the write's privilege being lower than that specified in the channel's SECCFG register, will not set the LOCK bit. + [2:2] + read-write + + + S + Secure channel. If 1, this channel performs Secure bus accesses. If 0, it performs Non-secure bus accesses. + + If 1, this channel is controllable only from a Secure context. + [1:1] + read-write + + + P + Privileged channel. If 1, this channel performs Privileged bus accesses. If 0, it performs Unprivileged bus accesses. + + If 1, this channel is controllable only from a Privileged context of the same Secure/Non-secure level, or any context of a higher Secure/Non-secure level. + [0:0] + read-write + + + + + SECCFG_CH1 + 0x00000484 + Security configuration for channel 1. Control whether this channel performs Secure/Non-secure and Privileged/Unprivileged bus accesses. + + If this channel generates bus accesses of some security level, an access of at least that level (in the order S+P > S+U > NS+P > NS+U) is required to program, trigger, abort, check the status of, interrupt on or acknowledge the interrupt of this channel. + + This register automatically locks down (becomes read-only) once software starts to configure the channel. + + This register is world-readable, but is writable only from a Secure, Privileged context. + 0x00000003 + + + LOCK + LOCK is 0 at reset, and is set to 1 automatically upon a successful write to this channel's control registers. That is, a write to CTRL, READ_ADDR, WRITE_ADDR, TRANS_COUNT and their aliases. + + Once its LOCK bit is set, this register becomes read-only. + + A failed write, for example due to the write's privilege being lower than that specified in the channel's SECCFG register, will not set the LOCK bit. + [2:2] + read-write + + + S + Secure channel. If 1, this channel performs Secure bus accesses. If 0, it performs Non-secure bus accesses. + + If 1, this channel is controllable only from a Secure context. + [1:1] + read-write + + + P + Privileged channel. If 1, this channel performs Privileged bus accesses. If 0, it performs Unprivileged bus accesses. + + If 1, this channel is controllable only from a Privileged context of the same Secure/Non-secure level, or any context of a higher Secure/Non-secure level. + [0:0] + read-write + + + + + SECCFG_CH2 + 0x00000488 + Security configuration for channel 2. Control whether this channel performs Secure/Non-secure and Privileged/Unprivileged bus accesses. + + If this channel generates bus accesses of some security level, an access of at least that level (in the order S+P > S+U > NS+P > NS+U) is required to program, trigger, abort, check the status of, interrupt on or acknowledge the interrupt of this channel. + + This register automatically locks down (becomes read-only) once software starts to configure the channel. + + This register is world-readable, but is writable only from a Secure, Privileged context. + 0x00000003 + + + LOCK + LOCK is 0 at reset, and is set to 1 automatically upon a successful write to this channel's control registers. That is, a write to CTRL, READ_ADDR, WRITE_ADDR, TRANS_COUNT and their aliases. + + Once its LOCK bit is set, this register becomes read-only. + + A failed write, for example due to the write's privilege being lower than that specified in the channel's SECCFG register, will not set the LOCK bit. + [2:2] + read-write + + + S + Secure channel. If 1, this channel performs Secure bus accesses. If 0, it performs Non-secure bus accesses. + + If 1, this channel is controllable only from a Secure context. + [1:1] + read-write + + + P + Privileged channel. If 1, this channel performs Privileged bus accesses. If 0, it performs Unprivileged bus accesses. + + If 1, this channel is controllable only from a Privileged context of the same Secure/Non-secure level, or any context of a higher Secure/Non-secure level. + [0:0] + read-write + + + + + SECCFG_CH3 + 0x0000048c + Security configuration for channel 3. Control whether this channel performs Secure/Non-secure and Privileged/Unprivileged bus accesses. + + If this channel generates bus accesses of some security level, an access of at least that level (in the order S+P > S+U > NS+P > NS+U) is required to program, trigger, abort, check the status of, interrupt on or acknowledge the interrupt of this channel. + + This register automatically locks down (becomes read-only) once software starts to configure the channel. + + This register is world-readable, but is writable only from a Secure, Privileged context. + 0x00000003 + + + LOCK + LOCK is 0 at reset, and is set to 1 automatically upon a successful write to this channel's control registers. That is, a write to CTRL, READ_ADDR, WRITE_ADDR, TRANS_COUNT and their aliases. + + Once its LOCK bit is set, this register becomes read-only. + + A failed write, for example due to the write's privilege being lower than that specified in the channel's SECCFG register, will not set the LOCK bit. + [2:2] + read-write + + + S + Secure channel. If 1, this channel performs Secure bus accesses. If 0, it performs Non-secure bus accesses. + + If 1, this channel is controllable only from a Secure context. + [1:1] + read-write + + + P + Privileged channel. If 1, this channel performs Privileged bus accesses. If 0, it performs Unprivileged bus accesses. + + If 1, this channel is controllable only from a Privileged context of the same Secure/Non-secure level, or any context of a higher Secure/Non-secure level. + [0:0] + read-write + + + + + SECCFG_CH4 + 0x00000490 + Security configuration for channel 4. Control whether this channel performs Secure/Non-secure and Privileged/Unprivileged bus accesses. + + If this channel generates bus accesses of some security level, an access of at least that level (in the order S+P > S+U > NS+P > NS+U) is required to program, trigger, abort, check the status of, interrupt on or acknowledge the interrupt of this channel. + + This register automatically locks down (becomes read-only) once software starts to configure the channel. + + This register is world-readable, but is writable only from a Secure, Privileged context. + 0x00000003 + + + LOCK + LOCK is 0 at reset, and is set to 1 automatically upon a successful write to this channel's control registers. That is, a write to CTRL, READ_ADDR, WRITE_ADDR, TRANS_COUNT and their aliases. + + Once its LOCK bit is set, this register becomes read-only. + + A failed write, for example due to the write's privilege being lower than that specified in the channel's SECCFG register, will not set the LOCK bit. + [2:2] + read-write + + + S + Secure channel. If 1, this channel performs Secure bus accesses. If 0, it performs Non-secure bus accesses. + + If 1, this channel is controllable only from a Secure context. + [1:1] + read-write + + + P + Privileged channel. If 1, this channel performs Privileged bus accesses. If 0, it performs Unprivileged bus accesses. + + If 1, this channel is controllable only from a Privileged context of the same Secure/Non-secure level, or any context of a higher Secure/Non-secure level. + [0:0] + read-write + + + + + SECCFG_CH5 + 0x00000494 + Security configuration for channel 5. Control whether this channel performs Secure/Non-secure and Privileged/Unprivileged bus accesses. + + If this channel generates bus accesses of some security level, an access of at least that level (in the order S+P > S+U > NS+P > NS+U) is required to program, trigger, abort, check the status of, interrupt on or acknowledge the interrupt of this channel. + + This register automatically locks down (becomes read-only) once software starts to configure the channel. + + This register is world-readable, but is writable only from a Secure, Privileged context. + 0x00000003 + + + LOCK + LOCK is 0 at reset, and is set to 1 automatically upon a successful write to this channel's control registers. That is, a write to CTRL, READ_ADDR, WRITE_ADDR, TRANS_COUNT and their aliases. + + Once its LOCK bit is set, this register becomes read-only. + + A failed write, for example due to the write's privilege being lower than that specified in the channel's SECCFG register, will not set the LOCK bit. + [2:2] + read-write + + + S + Secure channel. If 1, this channel performs Secure bus accesses. If 0, it performs Non-secure bus accesses. + + If 1, this channel is controllable only from a Secure context. + [1:1] + read-write + + + P + Privileged channel. If 1, this channel performs Privileged bus accesses. If 0, it performs Unprivileged bus accesses. + + If 1, this channel is controllable only from a Privileged context of the same Secure/Non-secure level, or any context of a higher Secure/Non-secure level. + [0:0] + read-write + + + + + SECCFG_CH6 + 0x00000498 + Security configuration for channel 6. Control whether this channel performs Secure/Non-secure and Privileged/Unprivileged bus accesses. + + If this channel generates bus accesses of some security level, an access of at least that level (in the order S+P > S+U > NS+P > NS+U) is required to program, trigger, abort, check the status of, interrupt on or acknowledge the interrupt of this channel. + + This register automatically locks down (becomes read-only) once software starts to configure the channel. + + This register is world-readable, but is writable only from a Secure, Privileged context. + 0x00000003 + + + LOCK + LOCK is 0 at reset, and is set to 1 automatically upon a successful write to this channel's control registers. That is, a write to CTRL, READ_ADDR, WRITE_ADDR, TRANS_COUNT and their aliases. + + Once its LOCK bit is set, this register becomes read-only. + + A failed write, for example due to the write's privilege being lower than that specified in the channel's SECCFG register, will not set the LOCK bit. + [2:2] + read-write + + + S + Secure channel. If 1, this channel performs Secure bus accesses. If 0, it performs Non-secure bus accesses. + + If 1, this channel is controllable only from a Secure context. + [1:1] + read-write + + + P + Privileged channel. If 1, this channel performs Privileged bus accesses. If 0, it performs Unprivileged bus accesses. + + If 1, this channel is controllable only from a Privileged context of the same Secure/Non-secure level, or any context of a higher Secure/Non-secure level. + [0:0] + read-write + + + + + SECCFG_CH7 + 0x0000049c + Security configuration for channel 7. Control whether this channel performs Secure/Non-secure and Privileged/Unprivileged bus accesses. + + If this channel generates bus accesses of some security level, an access of at least that level (in the order S+P > S+U > NS+P > NS+U) is required to program, trigger, abort, check the status of, interrupt on or acknowledge the interrupt of this channel. + + This register automatically locks down (becomes read-only) once software starts to configure the channel. + + This register is world-readable, but is writable only from a Secure, Privileged context. + 0x00000003 + + + LOCK + LOCK is 0 at reset, and is set to 1 automatically upon a successful write to this channel's control registers. That is, a write to CTRL, READ_ADDR, WRITE_ADDR, TRANS_COUNT and their aliases. + + Once its LOCK bit is set, this register becomes read-only. + + A failed write, for example due to the write's privilege being lower than that specified in the channel's SECCFG register, will not set the LOCK bit. + [2:2] + read-write + + + S + Secure channel. If 1, this channel performs Secure bus accesses. If 0, it performs Non-secure bus accesses. + + If 1, this channel is controllable only from a Secure context. + [1:1] + read-write + + + P + Privileged channel. If 1, this channel performs Privileged bus accesses. If 0, it performs Unprivileged bus accesses. + + If 1, this channel is controllable only from a Privileged context of the same Secure/Non-secure level, or any context of a higher Secure/Non-secure level. + [0:0] + read-write + + + + + SECCFG_CH8 + 0x000004a0 + Security configuration for channel 8. Control whether this channel performs Secure/Non-secure and Privileged/Unprivileged bus accesses. + + If this channel generates bus accesses of some security level, an access of at least that level (in the order S+P > S+U > NS+P > NS+U) is required to program, trigger, abort, check the status of, interrupt on or acknowledge the interrupt of this channel. + + This register automatically locks down (becomes read-only) once software starts to configure the channel. + + This register is world-readable, but is writable only from a Secure, Privileged context. + 0x00000003 + + + LOCK + LOCK is 0 at reset, and is set to 1 automatically upon a successful write to this channel's control registers. That is, a write to CTRL, READ_ADDR, WRITE_ADDR, TRANS_COUNT and their aliases. + + Once its LOCK bit is set, this register becomes read-only. + + A failed write, for example due to the write's privilege being lower than that specified in the channel's SECCFG register, will not set the LOCK bit. + [2:2] + read-write + + + S + Secure channel. If 1, this channel performs Secure bus accesses. If 0, it performs Non-secure bus accesses. + + If 1, this channel is controllable only from a Secure context. + [1:1] + read-write + + + P + Privileged channel. If 1, this channel performs Privileged bus accesses. If 0, it performs Unprivileged bus accesses. + + If 1, this channel is controllable only from a Privileged context of the same Secure/Non-secure level, or any context of a higher Secure/Non-secure level. + [0:0] + read-write + + + + + SECCFG_CH9 + 0x000004a4 + Security configuration for channel 9. Control whether this channel performs Secure/Non-secure and Privileged/Unprivileged bus accesses. + + If this channel generates bus accesses of some security level, an access of at least that level (in the order S+P > S+U > NS+P > NS+U) is required to program, trigger, abort, check the status of, interrupt on or acknowledge the interrupt of this channel. + + This register automatically locks down (becomes read-only) once software starts to configure the channel. + + This register is world-readable, but is writable only from a Secure, Privileged context. + 0x00000003 + + + LOCK + LOCK is 0 at reset, and is set to 1 automatically upon a successful write to this channel's control registers. That is, a write to CTRL, READ_ADDR, WRITE_ADDR, TRANS_COUNT and their aliases. + + Once its LOCK bit is set, this register becomes read-only. + + A failed write, for example due to the write's privilege being lower than that specified in the channel's SECCFG register, will not set the LOCK bit. + [2:2] + read-write + + + S + Secure channel. If 1, this channel performs Secure bus accesses. If 0, it performs Non-secure bus accesses. + + If 1, this channel is controllable only from a Secure context. + [1:1] + read-write + + + P + Privileged channel. If 1, this channel performs Privileged bus accesses. If 0, it performs Unprivileged bus accesses. + + If 1, this channel is controllable only from a Privileged context of the same Secure/Non-secure level, or any context of a higher Secure/Non-secure level. + [0:0] + read-write + + + + + SECCFG_CH10 + 0x000004a8 + Security configuration for channel 10. Control whether this channel performs Secure/Non-secure and Privileged/Unprivileged bus accesses. + + If this channel generates bus accesses of some security level, an access of at least that level (in the order S+P > S+U > NS+P > NS+U) is required to program, trigger, abort, check the status of, interrupt on or acknowledge the interrupt of this channel. + + This register automatically locks down (becomes read-only) once software starts to configure the channel. + + This register is world-readable, but is writable only from a Secure, Privileged context. + 0x00000003 + + + LOCK + LOCK is 0 at reset, and is set to 1 automatically upon a successful write to this channel's control registers. That is, a write to CTRL, READ_ADDR, WRITE_ADDR, TRANS_COUNT and their aliases. + + Once its LOCK bit is set, this register becomes read-only. + + A failed write, for example due to the write's privilege being lower than that specified in the channel's SECCFG register, will not set the LOCK bit. + [2:2] + read-write + + + S + Secure channel. If 1, this channel performs Secure bus accesses. If 0, it performs Non-secure bus accesses. + + If 1, this channel is controllable only from a Secure context. + [1:1] + read-write + + + P + Privileged channel. If 1, this channel performs Privileged bus accesses. If 0, it performs Unprivileged bus accesses. + + If 1, this channel is controllable only from a Privileged context of the same Secure/Non-secure level, or any context of a higher Secure/Non-secure level. + [0:0] + read-write + + + + + SECCFG_CH11 + 0x000004ac + Security configuration for channel 11. Control whether this channel performs Secure/Non-secure and Privileged/Unprivileged bus accesses. + + If this channel generates bus accesses of some security level, an access of at least that level (in the order S+P > S+U > NS+P > NS+U) is required to program, trigger, abort, check the status of, interrupt on or acknowledge the interrupt of this channel. + + This register automatically locks down (becomes read-only) once software starts to configure the channel. + + This register is world-readable, but is writable only from a Secure, Privileged context. + 0x00000003 + + + LOCK + LOCK is 0 at reset, and is set to 1 automatically upon a successful write to this channel's control registers. That is, a write to CTRL, READ_ADDR, WRITE_ADDR, TRANS_COUNT and their aliases. + + Once its LOCK bit is set, this register becomes read-only. + + A failed write, for example due to the write's privilege being lower than that specified in the channel's SECCFG register, will not set the LOCK bit. + [2:2] + read-write + + + S + Secure channel. If 1, this channel performs Secure bus accesses. If 0, it performs Non-secure bus accesses. + + If 1, this channel is controllable only from a Secure context. + [1:1] + read-write + + + P + Privileged channel. If 1, this channel performs Privileged bus accesses. If 0, it performs Unprivileged bus accesses. + + If 1, this channel is controllable only from a Privileged context of the same Secure/Non-secure level, or any context of a higher Secure/Non-secure level. + [0:0] + read-write + + + + + SECCFG_CH12 + 0x000004b0 + Security configuration for channel 12. Control whether this channel performs Secure/Non-secure and Privileged/Unprivileged bus accesses. + + If this channel generates bus accesses of some security level, an access of at least that level (in the order S+P > S+U > NS+P > NS+U) is required to program, trigger, abort, check the status of, interrupt on or acknowledge the interrupt of this channel. + + This register automatically locks down (becomes read-only) once software starts to configure the channel. + + This register is world-readable, but is writable only from a Secure, Privileged context. + 0x00000003 + + + LOCK + LOCK is 0 at reset, and is set to 1 automatically upon a successful write to this channel's control registers. That is, a write to CTRL, READ_ADDR, WRITE_ADDR, TRANS_COUNT and their aliases. + + Once its LOCK bit is set, this register becomes read-only. + + A failed write, for example due to the write's privilege being lower than that specified in the channel's SECCFG register, will not set the LOCK bit. + [2:2] + read-write + + + S + Secure channel. If 1, this channel performs Secure bus accesses. If 0, it performs Non-secure bus accesses. + + If 1, this channel is controllable only from a Secure context. + [1:1] + read-write + + + P + Privileged channel. If 1, this channel performs Privileged bus accesses. If 0, it performs Unprivileged bus accesses. + + If 1, this channel is controllable only from a Privileged context of the same Secure/Non-secure level, or any context of a higher Secure/Non-secure level. + [0:0] + read-write + + + + + SECCFG_CH13 + 0x000004b4 + Security configuration for channel 13. Control whether this channel performs Secure/Non-secure and Privileged/Unprivileged bus accesses. + + If this channel generates bus accesses of some security level, an access of at least that level (in the order S+P > S+U > NS+P > NS+U) is required to program, trigger, abort, check the status of, interrupt on or acknowledge the interrupt of this channel. + + This register automatically locks down (becomes read-only) once software starts to configure the channel. + + This register is world-readable, but is writable only from a Secure, Privileged context. + 0x00000003 + + + LOCK + LOCK is 0 at reset, and is set to 1 automatically upon a successful write to this channel's control registers. That is, a write to CTRL, READ_ADDR, WRITE_ADDR, TRANS_COUNT and their aliases. + + Once its LOCK bit is set, this register becomes read-only. + + A failed write, for example due to the write's privilege being lower than that specified in the channel's SECCFG register, will not set the LOCK bit. + [2:2] + read-write + + + S + Secure channel. If 1, this channel performs Secure bus accesses. If 0, it performs Non-secure bus accesses. + + If 1, this channel is controllable only from a Secure context. + [1:1] + read-write + + + P + Privileged channel. If 1, this channel performs Privileged bus accesses. If 0, it performs Unprivileged bus accesses. + + If 1, this channel is controllable only from a Privileged context of the same Secure/Non-secure level, or any context of a higher Secure/Non-secure level. + [0:0] + read-write + + + + + SECCFG_CH14 + 0x000004b8 + Security configuration for channel 14. Control whether this channel performs Secure/Non-secure and Privileged/Unprivileged bus accesses. + + If this channel generates bus accesses of some security level, an access of at least that level (in the order S+P > S+U > NS+P > NS+U) is required to program, trigger, abort, check the status of, interrupt on or acknowledge the interrupt of this channel. + + This register automatically locks down (becomes read-only) once software starts to configure the channel. + + This register is world-readable, but is writable only from a Secure, Privileged context. + 0x00000003 + + + LOCK + LOCK is 0 at reset, and is set to 1 automatically upon a successful write to this channel's control registers. That is, a write to CTRL, READ_ADDR, WRITE_ADDR, TRANS_COUNT and their aliases. + + Once its LOCK bit is set, this register becomes read-only. + + A failed write, for example due to the write's privilege being lower than that specified in the channel's SECCFG register, will not set the LOCK bit. + [2:2] + read-write + + + S + Secure channel. If 1, this channel performs Secure bus accesses. If 0, it performs Non-secure bus accesses. + + If 1, this channel is controllable only from a Secure context. + [1:1] + read-write + + + P + Privileged channel. If 1, this channel performs Privileged bus accesses. If 0, it performs Unprivileged bus accesses. + + If 1, this channel is controllable only from a Privileged context of the same Secure/Non-secure level, or any context of a higher Secure/Non-secure level. + [0:0] + read-write + + + + + SECCFG_CH15 + 0x000004bc + Security configuration for channel 15. Control whether this channel performs Secure/Non-secure and Privileged/Unprivileged bus accesses. + + If this channel generates bus accesses of some security level, an access of at least that level (in the order S+P > S+U > NS+P > NS+U) is required to program, trigger, abort, check the status of, interrupt on or acknowledge the interrupt of this channel. + + This register automatically locks down (becomes read-only) once software starts to configure the channel. + + This register is world-readable, but is writable only from a Secure, Privileged context. + 0x00000003 + + + LOCK + LOCK is 0 at reset, and is set to 1 automatically upon a successful write to this channel's control registers. That is, a write to CTRL, READ_ADDR, WRITE_ADDR, TRANS_COUNT and their aliases. + + Once its LOCK bit is set, this register becomes read-only. + + A failed write, for example due to the write's privilege being lower than that specified in the channel's SECCFG register, will not set the LOCK bit. + [2:2] + read-write + + + S + Secure channel. If 1, this channel performs Secure bus accesses. If 0, it performs Non-secure bus accesses. + + If 1, this channel is controllable only from a Secure context. + [1:1] + read-write + + + P + Privileged channel. If 1, this channel performs Privileged bus accesses. If 0, it performs Unprivileged bus accesses. + + If 1, this channel is controllable only from a Privileged context of the same Secure/Non-secure level, or any context of a higher Secure/Non-secure level. + [0:0] + read-write + + + + + SECCFG_IRQ0 + 0x000004c0 + Security configuration for IRQ 0. Control whether the IRQ permits configuration by Non-secure/Unprivileged contexts, and whether it can observe Secure/Privileged channel interrupt flags. + 0x00000003 + + + S + Secure IRQ. If 1, this IRQ's control registers can only be accessed from a Secure context. + + If 0, this IRQ's control registers can be accessed from a Non-secure context, but Secure channels (as per SECCFG_CHx) are masked from the IRQ status, and this IRQ's registers can not be used to acknowledge the channel interrupts of Secure channels. + [1:1] + read-write + + + P + Privileged IRQ. If 1, this IRQ's control registers can only be accessed from a Privileged context. + + If 0, this IRQ's control registers can be accessed from an Unprivileged context, but Privileged channels (as per SECCFG_CHx) are masked from the IRQ status, and this IRQ's registers can not be used to acknowledge the channel interrupts of Privileged channels. + [0:0] + read-write + + + + + SECCFG_IRQ1 + 0x000004c4 + Security configuration for IRQ 1. Control whether the IRQ permits configuration by Non-secure/Unprivileged contexts, and whether it can observe Secure/Privileged channel interrupt flags. + 0x00000003 + + + S + Secure IRQ. If 1, this IRQ's control registers can only be accessed from a Secure context. + + If 0, this IRQ's control registers can be accessed from a Non-secure context, but Secure channels (as per SECCFG_CHx) are masked from the IRQ status, and this IRQ's registers can not be used to acknowledge the channel interrupts of Secure channels. + [1:1] + read-write + + + P + Privileged IRQ. If 1, this IRQ's control registers can only be accessed from a Privileged context. + + If 0, this IRQ's control registers can be accessed from an Unprivileged context, but Privileged channels (as per SECCFG_CHx) are masked from the IRQ status, and this IRQ's registers can not be used to acknowledge the channel interrupts of Privileged channels. + [0:0] + read-write + + + + + SECCFG_IRQ2 + 0x000004c8 + Security configuration for IRQ 2. Control whether the IRQ permits configuration by Non-secure/Unprivileged contexts, and whether it can observe Secure/Privileged channel interrupt flags. + 0x00000003 + + + S + Secure IRQ. If 1, this IRQ's control registers can only be accessed from a Secure context. + + If 0, this IRQ's control registers can be accessed from a Non-secure context, but Secure channels (as per SECCFG_CHx) are masked from the IRQ status, and this IRQ's registers can not be used to acknowledge the channel interrupts of Secure channels. + [1:1] + read-write + + + P + Privileged IRQ. If 1, this IRQ's control registers can only be accessed from a Privileged context. + + If 0, this IRQ's control registers can be accessed from an Unprivileged context, but Privileged channels (as per SECCFG_CHx) are masked from the IRQ status, and this IRQ's registers can not be used to acknowledge the channel interrupts of Privileged channels. + [0:0] + read-write + + + + + SECCFG_IRQ3 + 0x000004cc + Security configuration for IRQ 3. Control whether the IRQ permits configuration by Non-secure/Unprivileged contexts, and whether it can observe Secure/Privileged channel interrupt flags. + 0x00000003 + + + S + Secure IRQ. If 1, this IRQ's control registers can only be accessed from a Secure context. + + If 0, this IRQ's control registers can be accessed from a Non-secure context, but Secure channels (as per SECCFG_CHx) are masked from the IRQ status, and this IRQ's registers can not be used to acknowledge the channel interrupts of Secure channels. + [1:1] + read-write + + + P + Privileged IRQ. If 1, this IRQ's control registers can only be accessed from a Privileged context. + + If 0, this IRQ's control registers can be accessed from an Unprivileged context, but Privileged channels (as per SECCFG_CHx) are masked from the IRQ status, and this IRQ's registers can not be used to acknowledge the channel interrupts of Privileged channels. + [0:0] + read-write + + + + + SECCFG_MISC + 0x000004d0 + Miscellaneous security configuration + 0x000003ff + + + TIMER3_S + If 1, the TIMER3 register is only accessible from a Secure context, and timer DREQ 3 is only visible to Secure channels. + [9:9] + read-write + + + TIMER3_P + If 1, the TIMER3 register is only accessible from a Privileged (or more Secure) context, and timer DREQ 3 is only visible to Privileged (or more Secure) channels. + [8:8] + read-write + + + TIMER2_S + If 1, the TIMER2 register is only accessible from a Secure context, and timer DREQ 2 is only visible to Secure channels. + [7:7] + read-write + + + TIMER2_P + If 1, the TIMER2 register is only accessible from a Privileged (or more Secure) context, and timer DREQ 2 is only visible to Privileged (or more Secure) channels. + [6:6] + read-write + + + TIMER1_S + If 1, the TIMER1 register is only accessible from a Secure context, and timer DREQ 1 is only visible to Secure channels. + [5:5] + read-write + + + TIMER1_P + If 1, the TIMER1 register is only accessible from a Privileged (or more Secure) context, and timer DREQ 1 is only visible to Privileged (or more Secure) channels. + [4:4] + read-write + + + TIMER0_S + If 1, the TIMER0 register is only accessible from a Secure context, and timer DREQ 0 is only visible to Secure channels. + [3:3] + read-write + + + TIMER0_P + If 1, the TIMER0 register is only accessible from a Privileged (or more Secure) context, and timer DREQ 0 is only visible to Privileged (or more Secure) channels. + [2:2] + read-write + + + SNIFF_S + If 1, the sniffer can see data transfers from Secure channels, and can itself only be accessed from a Secure context. + + If 0, the sniffer can be accessed from either a Secure or Non-secure context, but can not see data transfers of Secure channels. + [1:1] + read-write + + + SNIFF_P + If 1, the sniffer can see data transfers from Privileged channels, and can itself only be accessed from a privileged context, or from a Secure context when SNIFF_S is 0. + + If 0, the sniffer can be accessed from either a Privileged or Unprivileged context (with sufficient security level) but can not see transfers from Privileged channels. + [0:0] + read-write + + + + + MPU_CTRL + 0x00000500 + Control register for DMA MPU. Accessible only from a Privileged context. + 0x00000000 + + + NS_HIDE_ADDR + By default, when a region's S bit is clear, Non-secure-Privileged reads can see the region's base address and limit address. Set this bit to make the addresses appear as 0 to Non-secure reads, even when the region is Non-secure, to avoid leaking information about the processor SAU map. + [3:3] + read-write + + + S + Determine whether an address not covered by an active MPU region is Secure (1) or Non-secure (0) + [2:2] + read-write + + + P + Determine whether an address not covered by an active MPU region is Privileged (1) or Unprivileged (0) + [1:1] + read-write + + + + + MPU_BAR0 + 0x00000504 + Base address register for MPU region 0. Writable only from a Secure, Privileged context. + 0x00000000 + + + ADDR + This MPU region matches addresses where addr[31:5] (the 27 most significant bits) are greater than or equal to BAR_ADDR, and less than or equal to LAR_ADDR. + + Readable from any Privileged context, if and only if this region's S bit is clear, and MPU_CTRL_NS_HIDE_ADDR is clear. Otherwise readable only from a Secure, Privileged context. + [31:5] + read-write + + + + + MPU_LAR0 + 0x00000508 + Limit address register for MPU region 0. Writable only from a Secure, Privileged context, with the exception of the P bit. + 0x00000000 + + + ADDR + Limit address bits 31:5. Readable from any Privileged context, if and only if this region's S bit is clear, and MPU_CTRL_NS_HIDE_ADDR is clear. Otherwise readable only from a Secure, Privileged context. + [31:5] + read-write + + + S + Determines the Secure/Non-secure (=1/0) status of addresses matching this region, if this region is enabled. + [2:2] + read-write + + + P + Determines the Privileged/Unprivileged (=1/0) status of addresses matching this region, if this region is enabled. Writable from any Privileged context, if and only if the S bit is clear. Otherwise, writable only from a Secure, Privileged context. + [1:1] + read-write + + + EN + Region enable. If 1, any address within range specified by the base address (BAR_ADDR) and limit address (LAR_ADDR) has the attributes specified by S and P. + [0:0] + read-write + + + + + MPU_BAR1 + 0x0000050c + Base address register for MPU region 1. Writable only from a Secure, Privileged context. + 0x00000000 + + + ADDR + This MPU region matches addresses where addr[31:5] (the 27 most significant bits) are greater than or equal to BAR_ADDR, and less than or equal to LAR_ADDR. + + Readable from any Privileged context, if and only if this region's S bit is clear, and MPU_CTRL_NS_HIDE_ADDR is clear. Otherwise readable only from a Secure, Privileged context. + [31:5] + read-write + + + + + MPU_LAR1 + 0x00000510 + Limit address register for MPU region 1. Writable only from a Secure, Privileged context, with the exception of the P bit. + 0x00000000 + + + ADDR + Limit address bits 31:5. Readable from any Privileged context, if and only if this region's S bit is clear, and MPU_CTRL_NS_HIDE_ADDR is clear. Otherwise readable only from a Secure, Privileged context. + [31:5] + read-write + + + S + Determines the Secure/Non-secure (=1/0) status of addresses matching this region, if this region is enabled. + [2:2] + read-write + + + P + Determines the Privileged/Unprivileged (=1/0) status of addresses matching this region, if this region is enabled. Writable from any Privileged context, if and only if the S bit is clear. Otherwise, writable only from a Secure, Privileged context. + [1:1] + read-write + + + EN + Region enable. If 1, any address within range specified by the base address (BAR_ADDR) and limit address (LAR_ADDR) has the attributes specified by S and P. + [0:0] + read-write + + + + + MPU_BAR2 + 0x00000514 + Base address register for MPU region 2. Writable only from a Secure, Privileged context. + 0x00000000 + + + ADDR + This MPU region matches addresses where addr[31:5] (the 27 most significant bits) are greater than or equal to BAR_ADDR, and less than or equal to LAR_ADDR. + + Readable from any Privileged context, if and only if this region's S bit is clear, and MPU_CTRL_NS_HIDE_ADDR is clear. Otherwise readable only from a Secure, Privileged context. + [31:5] + read-write + + + + + MPU_LAR2 + 0x00000518 + Limit address register for MPU region 2. Writable only from a Secure, Privileged context, with the exception of the P bit. + 0x00000000 + + + ADDR + Limit address bits 31:5. Readable from any Privileged context, if and only if this region's S bit is clear, and MPU_CTRL_NS_HIDE_ADDR is clear. Otherwise readable only from a Secure, Privileged context. + [31:5] + read-write + + + S + Determines the Secure/Non-secure (=1/0) status of addresses matching this region, if this region is enabled. + [2:2] + read-write + + + P + Determines the Privileged/Unprivileged (=1/0) status of addresses matching this region, if this region is enabled. Writable from any Privileged context, if and only if the S bit is clear. Otherwise, writable only from a Secure, Privileged context. + [1:1] + read-write + + + EN + Region enable. If 1, any address within range specified by the base address (BAR_ADDR) and limit address (LAR_ADDR) has the attributes specified by S and P. + [0:0] + read-write + + + + + MPU_BAR3 + 0x0000051c + Base address register for MPU region 3. Writable only from a Secure, Privileged context. + 0x00000000 + + + ADDR + This MPU region matches addresses where addr[31:5] (the 27 most significant bits) are greater than or equal to BAR_ADDR, and less than or equal to LAR_ADDR. + + Readable from any Privileged context, if and only if this region's S bit is clear, and MPU_CTRL_NS_HIDE_ADDR is clear. Otherwise readable only from a Secure, Privileged context. + [31:5] + read-write + + + + + MPU_LAR3 + 0x00000520 + Limit address register for MPU region 3. Writable only from a Secure, Privileged context, with the exception of the P bit. + 0x00000000 + + + ADDR + Limit address bits 31:5. Readable from any Privileged context, if and only if this region's S bit is clear, and MPU_CTRL_NS_HIDE_ADDR is clear. Otherwise readable only from a Secure, Privileged context. + [31:5] + read-write + + + S + Determines the Secure/Non-secure (=1/0) status of addresses matching this region, if this region is enabled. + [2:2] + read-write + + + P + Determines the Privileged/Unprivileged (=1/0) status of addresses matching this region, if this region is enabled. Writable from any Privileged context, if and only if the S bit is clear. Otherwise, writable only from a Secure, Privileged context. + [1:1] + read-write + + + EN + Region enable. If 1, any address within range specified by the base address (BAR_ADDR) and limit address (LAR_ADDR) has the attributes specified by S and P. + [0:0] + read-write + + + + + MPU_BAR4 + 0x00000524 + Base address register for MPU region 4. Writable only from a Secure, Privileged context. + 0x00000000 + + + ADDR + This MPU region matches addresses where addr[31:5] (the 27 most significant bits) are greater than or equal to BAR_ADDR, and less than or equal to LAR_ADDR. + + Readable from any Privileged context, if and only if this region's S bit is clear, and MPU_CTRL_NS_HIDE_ADDR is clear. Otherwise readable only from a Secure, Privileged context. + [31:5] + read-write + + + + + MPU_LAR4 + 0x00000528 + Limit address register for MPU region 4. Writable only from a Secure, Privileged context, with the exception of the P bit. + 0x00000000 + + + ADDR + Limit address bits 31:5. Readable from any Privileged context, if and only if this region's S bit is clear, and MPU_CTRL_NS_HIDE_ADDR is clear. Otherwise readable only from a Secure, Privileged context. + [31:5] + read-write + + + S + Determines the Secure/Non-secure (=1/0) status of addresses matching this region, if this region is enabled. + [2:2] + read-write + + + P + Determines the Privileged/Unprivileged (=1/0) status of addresses matching this region, if this region is enabled. Writable from any Privileged context, if and only if the S bit is clear. Otherwise, writable only from a Secure, Privileged context. + [1:1] + read-write + + + EN + Region enable. If 1, any address within range specified by the base address (BAR_ADDR) and limit address (LAR_ADDR) has the attributes specified by S and P. + [0:0] + read-write + + + + + MPU_BAR5 + 0x0000052c + Base address register for MPU region 5. Writable only from a Secure, Privileged context. + 0x00000000 + + + ADDR + This MPU region matches addresses where addr[31:5] (the 27 most significant bits) are greater than or equal to BAR_ADDR, and less than or equal to LAR_ADDR. + + Readable from any Privileged context, if and only if this region's S bit is clear, and MPU_CTRL_NS_HIDE_ADDR is clear. Otherwise readable only from a Secure, Privileged context. + [31:5] + read-write + + + + + MPU_LAR5 + 0x00000530 + Limit address register for MPU region 5. Writable only from a Secure, Privileged context, with the exception of the P bit. + 0x00000000 + + + ADDR + Limit address bits 31:5. Readable from any Privileged context, if and only if this region's S bit is clear, and MPU_CTRL_NS_HIDE_ADDR is clear. Otherwise readable only from a Secure, Privileged context. + [31:5] + read-write + + + S + Determines the Secure/Non-secure (=1/0) status of addresses matching this region, if this region is enabled. + [2:2] + read-write + + + P + Determines the Privileged/Unprivileged (=1/0) status of addresses matching this region, if this region is enabled. Writable from any Privileged context, if and only if the S bit is clear. Otherwise, writable only from a Secure, Privileged context. + [1:1] + read-write + + + EN + Region enable. If 1, any address within range specified by the base address (BAR_ADDR) and limit address (LAR_ADDR) has the attributes specified by S and P. + [0:0] + read-write + + + + + MPU_BAR6 + 0x00000534 + Base address register for MPU region 6. Writable only from a Secure, Privileged context. + 0x00000000 + + + ADDR + This MPU region matches addresses where addr[31:5] (the 27 most significant bits) are greater than or equal to BAR_ADDR, and less than or equal to LAR_ADDR. + + Readable from any Privileged context, if and only if this region's S bit is clear, and MPU_CTRL_NS_HIDE_ADDR is clear. Otherwise readable only from a Secure, Privileged context. + [31:5] + read-write + + + + + MPU_LAR6 + 0x00000538 + Limit address register for MPU region 6. Writable only from a Secure, Privileged context, with the exception of the P bit. + 0x00000000 + + + ADDR + Limit address bits 31:5. Readable from any Privileged context, if and only if this region's S bit is clear, and MPU_CTRL_NS_HIDE_ADDR is clear. Otherwise readable only from a Secure, Privileged context. + [31:5] + read-write + + + S + Determines the Secure/Non-secure (=1/0) status of addresses matching this region, if this region is enabled. + [2:2] + read-write + + + P + Determines the Privileged/Unprivileged (=1/0) status of addresses matching this region, if this region is enabled. Writable from any Privileged context, if and only if the S bit is clear. Otherwise, writable only from a Secure, Privileged context. + [1:1] + read-write + + + EN + Region enable. If 1, any address within range specified by the base address (BAR_ADDR) and limit address (LAR_ADDR) has the attributes specified by S and P. + [0:0] + read-write + + + + + MPU_BAR7 + 0x0000053c + Base address register for MPU region 7. Writable only from a Secure, Privileged context. + 0x00000000 + + + ADDR + This MPU region matches addresses where addr[31:5] (the 27 most significant bits) are greater than or equal to BAR_ADDR, and less than or equal to LAR_ADDR. + + Readable from any Privileged context, if and only if this region's S bit is clear, and MPU_CTRL_NS_HIDE_ADDR is clear. Otherwise readable only from a Secure, Privileged context. + [31:5] + read-write + + + + + MPU_LAR7 + 0x00000540 + Limit address register for MPU region 7. Writable only from a Secure, Privileged context, with the exception of the P bit. + 0x00000000 + + + ADDR + Limit address bits 31:5. Readable from any Privileged context, if and only if this region's S bit is clear, and MPU_CTRL_NS_HIDE_ADDR is clear. Otherwise readable only from a Secure, Privileged context. + [31:5] + read-write + + + S + Determines the Secure/Non-secure (=1/0) status of addresses matching this region, if this region is enabled. + [2:2] + read-write + + + P + Determines the Privileged/Unprivileged (=1/0) status of addresses matching this region, if this region is enabled. Writable from any Privileged context, if and only if the S bit is clear. Otherwise, writable only from a Secure, Privileged context. + [1:1] + read-write + + + EN + Region enable. If 1, any address within range specified by the base address (BAR_ADDR) and limit address (LAR_ADDR) has the attributes specified by S and P. + [0:0] + read-write + + + + + CH0_DBG_CTDREQ + 0x00000800 + Read: get channel DREQ counter (i.e. how many accesses the DMA expects it can perform on the peripheral without overflow/underflow. Write any value: clears the counter, and cause channel to re-initiate DREQ handshake. + 0x00000000 + + + CH0_DBG_CTDREQ + [5:0] + read-write + oneToClear + + + + + CH0_DBG_TCR + 0x00000804 + Read to get channel TRANS_COUNT reload value, i.e. the length of the next transfer + 0x00000000 + + + CH0_DBG_TCR + [31:0] + read-only + + + + + CH1_DBG_CTDREQ + 0x00000840 + Read: get channel DREQ counter (i.e. how many accesses the DMA expects it can perform on the peripheral without overflow/underflow. Write any value: clears the counter, and cause channel to re-initiate DREQ handshake. + 0x00000000 + + + CH1_DBG_CTDREQ + [5:0] + read-write + oneToClear + + + + + CH1_DBG_TCR + 0x00000844 + Read to get channel TRANS_COUNT reload value, i.e. the length of the next transfer + 0x00000000 + + + CH1_DBG_TCR + [31:0] + read-only + + + + + CH2_DBG_CTDREQ + 0x00000880 + Read: get channel DREQ counter (i.e. how many accesses the DMA expects it can perform on the peripheral without overflow/underflow. Write any value: clears the counter, and cause channel to re-initiate DREQ handshake. + 0x00000000 + + + CH2_DBG_CTDREQ + [5:0] + read-write + oneToClear + + + + + CH2_DBG_TCR + 0x00000884 + Read to get channel TRANS_COUNT reload value, i.e. the length of the next transfer + 0x00000000 + + + CH2_DBG_TCR + [31:0] + read-only + + + + + CH3_DBG_CTDREQ + 0x000008c0 + Read: get channel DREQ counter (i.e. how many accesses the DMA expects it can perform on the peripheral without overflow/underflow. Write any value: clears the counter, and cause channel to re-initiate DREQ handshake. + 0x00000000 + + + CH3_DBG_CTDREQ + [5:0] + read-write + oneToClear + + + + + CH3_DBG_TCR + 0x000008c4 + Read to get channel TRANS_COUNT reload value, i.e. the length of the next transfer + 0x00000000 + + + CH3_DBG_TCR + [31:0] + read-only + + + + + CH4_DBG_CTDREQ + 0x00000900 + Read: get channel DREQ counter (i.e. how many accesses the DMA expects it can perform on the peripheral without overflow/underflow. Write any value: clears the counter, and cause channel to re-initiate DREQ handshake. + 0x00000000 + + + CH4_DBG_CTDREQ + [5:0] + read-write + oneToClear + + + + + CH4_DBG_TCR + 0x00000904 + Read to get channel TRANS_COUNT reload value, i.e. the length of the next transfer + 0x00000000 + + + CH4_DBG_TCR + [31:0] + read-only + + + + + CH5_DBG_CTDREQ + 0x00000940 + Read: get channel DREQ counter (i.e. how many accesses the DMA expects it can perform on the peripheral without overflow/underflow. Write any value: clears the counter, and cause channel to re-initiate DREQ handshake. + 0x00000000 + + + CH5_DBG_CTDREQ + [5:0] + read-write + oneToClear + + + + + CH5_DBG_TCR + 0x00000944 + Read to get channel TRANS_COUNT reload value, i.e. the length of the next transfer + 0x00000000 + + + CH5_DBG_TCR + [31:0] + read-only + + + + + CH6_DBG_CTDREQ + 0x00000980 + Read: get channel DREQ counter (i.e. how many accesses the DMA expects it can perform on the peripheral without overflow/underflow. Write any value: clears the counter, and cause channel to re-initiate DREQ handshake. + 0x00000000 + + + CH6_DBG_CTDREQ + [5:0] + read-write + oneToClear + + + + + CH6_DBG_TCR + 0x00000984 + Read to get channel TRANS_COUNT reload value, i.e. the length of the next transfer + 0x00000000 + + + CH6_DBG_TCR + [31:0] + read-only + + + + + CH7_DBG_CTDREQ + 0x000009c0 + Read: get channel DREQ counter (i.e. how many accesses the DMA expects it can perform on the peripheral without overflow/underflow. Write any value: clears the counter, and cause channel to re-initiate DREQ handshake. + 0x00000000 + + + CH7_DBG_CTDREQ + [5:0] + read-write + oneToClear + + + + + CH7_DBG_TCR + 0x000009c4 + Read to get channel TRANS_COUNT reload value, i.e. the length of the next transfer + 0x00000000 + + + CH7_DBG_TCR + [31:0] + read-only + + + + + CH8_DBG_CTDREQ + 0x00000a00 + Read: get channel DREQ counter (i.e. how many accesses the DMA expects it can perform on the peripheral without overflow/underflow. Write any value: clears the counter, and cause channel to re-initiate DREQ handshake. + 0x00000000 + + + CH8_DBG_CTDREQ + [5:0] + read-write + oneToClear + + + + + CH8_DBG_TCR + 0x00000a04 + Read to get channel TRANS_COUNT reload value, i.e. the length of the next transfer + 0x00000000 + + + CH8_DBG_TCR + [31:0] + read-only + + + + + CH9_DBG_CTDREQ + 0x00000a40 + Read: get channel DREQ counter (i.e. how many accesses the DMA expects it can perform on the peripheral without overflow/underflow. Write any value: clears the counter, and cause channel to re-initiate DREQ handshake. + 0x00000000 + + + CH9_DBG_CTDREQ + [5:0] + read-write + oneToClear + + + + + CH9_DBG_TCR + 0x00000a44 + Read to get channel TRANS_COUNT reload value, i.e. the length of the next transfer + 0x00000000 + + + CH9_DBG_TCR + [31:0] + read-only + + + + + CH10_DBG_CTDREQ + 0x00000a80 + Read: get channel DREQ counter (i.e. how many accesses the DMA expects it can perform on the peripheral without overflow/underflow. Write any value: clears the counter, and cause channel to re-initiate DREQ handshake. + 0x00000000 + + + CH10_DBG_CTDREQ + [5:0] + read-write + oneToClear + + + + + CH10_DBG_TCR + 0x00000a84 + Read to get channel TRANS_COUNT reload value, i.e. the length of the next transfer + 0x00000000 + + + CH10_DBG_TCR + [31:0] + read-only + + + + + CH11_DBG_CTDREQ + 0x00000ac0 + Read: get channel DREQ counter (i.e. how many accesses the DMA expects it can perform on the peripheral without overflow/underflow. Write any value: clears the counter, and cause channel to re-initiate DREQ handshake. + 0x00000000 + + + CH11_DBG_CTDREQ + [5:0] + read-write + oneToClear + + + + + CH11_DBG_TCR + 0x00000ac4 + Read to get channel TRANS_COUNT reload value, i.e. the length of the next transfer + 0x00000000 + + + CH11_DBG_TCR + [31:0] + read-only + + + + + CH12_DBG_CTDREQ + 0x00000b00 + Read: get channel DREQ counter (i.e. how many accesses the DMA expects it can perform on the peripheral without overflow/underflow. Write any value: clears the counter, and cause channel to re-initiate DREQ handshake. + 0x00000000 + + + CH12_DBG_CTDREQ + [5:0] + read-write + oneToClear + + + + + CH12_DBG_TCR + 0x00000b04 + Read to get channel TRANS_COUNT reload value, i.e. the length of the next transfer + 0x00000000 + + + CH12_DBG_TCR + [31:0] + read-only + + + + + CH13_DBG_CTDREQ + 0x00000b40 + Read: get channel DREQ counter (i.e. how many accesses the DMA expects it can perform on the peripheral without overflow/underflow. Write any value: clears the counter, and cause channel to re-initiate DREQ handshake. + 0x00000000 + + + CH13_DBG_CTDREQ + [5:0] + read-write + oneToClear + + + + + CH13_DBG_TCR + 0x00000b44 + Read to get channel TRANS_COUNT reload value, i.e. the length of the next transfer + 0x00000000 + + + CH13_DBG_TCR + [31:0] + read-only + + + + + CH14_DBG_CTDREQ + 0x00000b80 + Read: get channel DREQ counter (i.e. how many accesses the DMA expects it can perform on the peripheral without overflow/underflow. Write any value: clears the counter, and cause channel to re-initiate DREQ handshake. + 0x00000000 + + + CH14_DBG_CTDREQ + [5:0] + read-write + oneToClear + + + + + CH14_DBG_TCR + 0x00000b84 + Read to get channel TRANS_COUNT reload value, i.e. the length of the next transfer + 0x00000000 + + + CH14_DBG_TCR + [31:0] + read-only + + + + + CH15_DBG_CTDREQ + 0x00000bc0 + Read: get channel DREQ counter (i.e. how many accesses the DMA expects it can perform on the peripheral without overflow/underflow. Write any value: clears the counter, and cause channel to re-initiate DREQ handshake. + 0x00000000 + + + CH15_DBG_CTDREQ + [5:0] + read-write + oneToClear + + + + + CH15_DBG_TCR + 0x00000bc4 + Read to get channel TRANS_COUNT reload value, i.e. the length of the next transfer + 0x00000000 + + + CH15_DBG_TCR + [31:0] + read-only + + + + + + + TIMER0 + Controls time and alarms + + time is a 64 bit value indicating the time since power-on + + timeh is the top 32 bits of time & timel is the bottom 32 bits to change time write to timelw before timehw to read time read from timelr before timehr + + An alarm is set by setting alarm_enable and writing to the corresponding alarm register When an alarm is pending, the corresponding alarm_running signal will be high An alarm can be cancelled before it has finished by clearing the alarm_enable When an alarm fires, the corresponding alarm_irq is set and alarm_running is cleared To clear the interrupt write a 1 to the corresponding alarm_irq The timer can be locked to prevent writing + 0x400b0000 + + 0 + 76 + registers + + + TIMER0_IRQ_0 + 0 + + + TIMER0_IRQ_1 + 1 + + + TIMER0_IRQ_2 + 2 + + + TIMER0_IRQ_3 + 3 + + + + TIMEHW + 0x00000000 + Write to bits 63:32 of time always write timelw before timehw + 0x00000000 + + + TIMEHW + [31:0] + write-only + + + + + TIMELW + 0x00000004 + Write to bits 31:0 of time writes do not get copied to time until timehw is written + 0x00000000 + + + TIMELW + [31:0] + write-only + + + + + TIMEHR + 0x00000008 + Read from bits 63:32 of time always read timelr before timehr + 0x00000000 + + + TIMEHR + [31:0] + read-only + + + + + TIMELR + 0x0000000c + Read from bits 31:0 of time + 0x00000000 + + + TIMELR + [31:0] + read-only + modify + + + + + ALARM0 + 0x00000010 + Arm alarm 0, and configure the time it will fire. Once armed, the alarm fires when TIMER_ALARM0 == TIMELR. The alarm will disarm itself once it fires, and can be disarmed early using the ARMED status register. + 0x00000000 + + + ALARM0 + [31:0] + read-write + + + + + ALARM1 + 0x00000014 + Arm alarm 1, and configure the time it will fire. Once armed, the alarm fires when TIMER_ALARM1 == TIMELR. The alarm will disarm itself once it fires, and can be disarmed early using the ARMED status register. + 0x00000000 + + + ALARM1 + [31:0] + read-write + + + + + ALARM2 + 0x00000018 + Arm alarm 2, and configure the time it will fire. Once armed, the alarm fires when TIMER_ALARM2 == TIMELR. The alarm will disarm itself once it fires, and can be disarmed early using the ARMED status register. + 0x00000000 + + + ALARM2 + [31:0] + read-write + + + + + ALARM3 + 0x0000001c + Arm alarm 3, and configure the time it will fire. Once armed, the alarm fires when TIMER_ALARM3 == TIMELR. The alarm will disarm itself once it fires, and can be disarmed early using the ARMED status register. + 0x00000000 + + + ALARM3 + [31:0] + read-write + + + + + ARMED + 0x00000020 + Indicates the armed/disarmed status of each alarm. A write to the corresponding ALARMx register arms the alarm. Alarms automatically disarm upon firing, but writing ones here will disarm immediately without waiting to fire. + 0x00000000 + + + ARMED + [3:0] + read-write + oneToClear + + + + + TIMERAWH + 0x00000024 + Raw read from bits 63:32 of time (no side effects) + 0x00000000 + + + TIMERAWH + [31:0] + read-only + + + + + TIMERAWL + 0x00000028 + Raw read from bits 31:0 of time (no side effects) + 0x00000000 + + + TIMERAWL + [31:0] + read-only + + + + + DBGPAUSE + 0x0000002c + Set bits high to enable pause when the corresponding debug ports are active + 0x00000007 + + + DBG1 + Pause when processor 1 is in debug mode + [2:2] + read-write + + + DBG0 + Pause when processor 0 is in debug mode + [1:1] + read-write + + + + + PAUSE + 0x00000030 + Set high to pause the timer + 0x00000000 + + + PAUSE + [0:0] + read-write + + + + + LOCKED + 0x00000034 + Set locked bit to disable write access to timer Once set, cannot be cleared (without a reset) + 0x00000000 + + + LOCKED + [0:0] + read-write + + + + + SOURCE + 0x00000038 + Selects the source for the timer. Defaults to the normal tick configured in the ticks block (typically configured to 1 microsecond). Writing to 1 will ignore the tick and count clk_sys cycles instead. + 0x00000000 + + + CLK_SYS + [0:0] + read-write + + + TICK + 0 + + + CLK_SYS + 1 + + + + + + + INTR + 0x0000003c + Raw Interrupts + 0x00000000 + + + ALARM_3 + [3:3] + read-write + oneToClear + + + ALARM_2 + [2:2] + read-write + oneToClear + + + ALARM_1 + [1:1] + read-write + oneToClear + + + ALARM_0 + [0:0] + read-write + oneToClear + + + + + INTE + 0x00000040 + Interrupt Enable + 0x00000000 + + + ALARM_3 + [3:3] + read-write + + + ALARM_2 + [2:2] + read-write + + + ALARM_1 + [1:1] + read-write + + + ALARM_0 + [0:0] + read-write + + + + + INTF + 0x00000044 + Interrupt Force + 0x00000000 + + + ALARM_3 + [3:3] + read-write + + + ALARM_2 + [2:2] + read-write + + + ALARM_1 + [1:1] + read-write + + + ALARM_0 + [0:0] + read-write + + + + + INTS + 0x00000048 + Interrupt status after masking & forcing + 0x00000000 + + + ALARM_3 + [3:3] + read-only + + + ALARM_2 + [2:2] + read-only + + + ALARM_1 + [1:1] + read-only + + + ALARM_0 + [0:0] + read-only + + + + + + + TIMER1 + 0x400b8000 + + TIMER1_IRQ_0 + 4 + + + TIMER1_IRQ_1 + 5 + + + TIMER1_IRQ_2 + 6 + + + TIMER1_IRQ_3 + 7 + + + + PWM + Simple PWM + 0x400a8000 + + 0 + 272 + registers + + + PWM_IRQ_WRAP_0 + 8 + + + PWM_IRQ_WRAP_1 + 9 + + + + CH0_CSR + 0x00000000 + Control and status register + 0x00000000 + + + PH_ADV + Advance the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running + at less than full speed (div_int + div_frac / 16 > 1) + [7:7] + write-only + + + PH_RET + Retard the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running. + [6:6] + write-only + + + DIVMODE + [5:4] + read-write + + + div + 0 + Free-running counting at rate dictated by fractional divider + + + level + 1 + Fractional divider operation is gated by the PWM B pin. + + + rise + 2 + Counter advances with each rising edge of the PWM B pin. + + + fall + 3 + Counter advances with each falling edge of the PWM B pin. + + + + + B_INV + Invert output B + [3:3] + read-write + + + A_INV + Invert output A + [2:2] + read-write + + + PH_CORRECT + 1: Enable phase-correct modulation. 0: Trailing-edge + [1:1] + read-write + + + EN + Enable the PWM channel. + [0:0] + read-write + + + + + CH0_DIV + 0x00000004 + INT and FRAC form a fixed-point fractional number. + Counting rate is system clock frequency divided by this number. + Fractional division uses simple 1st-order sigma-delta. + 0x00000010 + + + INT + [11:4] + read-write + + + FRAC + [3:0] + read-write + + + + + CH0_CTR + 0x00000008 + Direct access to the PWM counter + 0x00000000 + + + CH0_CTR + [15:0] + read-write + + + + + CH0_CC + 0x0000000c + Counter compare values + 0x00000000 + + + B + [31:16] + read-write + + + A + [15:0] + read-write + + + + + CH0_TOP + 0x00000010 + Counter wrap value + 0x0000ffff + + + CH0_TOP + [15:0] + read-write + + + + + CH1_CSR + 0x00000014 + Control and status register + 0x00000000 + + + PH_ADV + Advance the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running + at less than full speed (div_int + div_frac / 16 > 1) + [7:7] + write-only + + + PH_RET + Retard the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running. + [6:6] + write-only + + + DIVMODE + [5:4] + read-write + + + div + 0 + Free-running counting at rate dictated by fractional divider + + + level + 1 + Fractional divider operation is gated by the PWM B pin. + + + rise + 2 + Counter advances with each rising edge of the PWM B pin. + + + fall + 3 + Counter advances with each falling edge of the PWM B pin. + + + + + B_INV + Invert output B + [3:3] + read-write + + + A_INV + Invert output A + [2:2] + read-write + + + PH_CORRECT + 1: Enable phase-correct modulation. 0: Trailing-edge + [1:1] + read-write + + + EN + Enable the PWM channel. + [0:0] + read-write + + + + + CH1_DIV + 0x00000018 + INT and FRAC form a fixed-point fractional number. + Counting rate is system clock frequency divided by this number. + Fractional division uses simple 1st-order sigma-delta. + 0x00000010 + + + INT + [11:4] + read-write + + + FRAC + [3:0] + read-write + + + + + CH1_CTR + 0x0000001c + Direct access to the PWM counter + 0x00000000 + + + CH1_CTR + [15:0] + read-write + + + + + CH1_CC + 0x00000020 + Counter compare values + 0x00000000 + + + B + [31:16] + read-write + + + A + [15:0] + read-write + + + + + CH1_TOP + 0x00000024 + Counter wrap value + 0x0000ffff + + + CH1_TOP + [15:0] + read-write + + + + + CH2_CSR + 0x00000028 + Control and status register + 0x00000000 + + + PH_ADV + Advance the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running + at less than full speed (div_int + div_frac / 16 > 1) + [7:7] + write-only + + + PH_RET + Retard the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running. + [6:6] + write-only + + + DIVMODE + [5:4] + read-write + + + div + 0 + Free-running counting at rate dictated by fractional divider + + + level + 1 + Fractional divider operation is gated by the PWM B pin. + + + rise + 2 + Counter advances with each rising edge of the PWM B pin. + + + fall + 3 + Counter advances with each falling edge of the PWM B pin. + + + + + B_INV + Invert output B + [3:3] + read-write + + + A_INV + Invert output A + [2:2] + read-write + + + PH_CORRECT + 1: Enable phase-correct modulation. 0: Trailing-edge + [1:1] + read-write + + + EN + Enable the PWM channel. + [0:0] + read-write + + + + + CH2_DIV + 0x0000002c + INT and FRAC form a fixed-point fractional number. + Counting rate is system clock frequency divided by this number. + Fractional division uses simple 1st-order sigma-delta. + 0x00000010 + + + INT + [11:4] + read-write + + + FRAC + [3:0] + read-write + + + + + CH2_CTR + 0x00000030 + Direct access to the PWM counter + 0x00000000 + + + CH2_CTR + [15:0] + read-write + + + + + CH2_CC + 0x00000034 + Counter compare values + 0x00000000 + + + B + [31:16] + read-write + + + A + [15:0] + read-write + + + + + CH2_TOP + 0x00000038 + Counter wrap value + 0x0000ffff + + + CH2_TOP + [15:0] + read-write + + + + + CH3_CSR + 0x0000003c + Control and status register + 0x00000000 + + + PH_ADV + Advance the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running + at less than full speed (div_int + div_frac / 16 > 1) + [7:7] + write-only + + + PH_RET + Retard the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running. + [6:6] + write-only + + + DIVMODE + [5:4] + read-write + + + div + 0 + Free-running counting at rate dictated by fractional divider + + + level + 1 + Fractional divider operation is gated by the PWM B pin. + + + rise + 2 + Counter advances with each rising edge of the PWM B pin. + + + fall + 3 + Counter advances with each falling edge of the PWM B pin. + + + + + B_INV + Invert output B + [3:3] + read-write + + + A_INV + Invert output A + [2:2] + read-write + + + PH_CORRECT + 1: Enable phase-correct modulation. 0: Trailing-edge + [1:1] + read-write + + + EN + Enable the PWM channel. + [0:0] + read-write + + + + + CH3_DIV + 0x00000040 + INT and FRAC form a fixed-point fractional number. + Counting rate is system clock frequency divided by this number. + Fractional division uses simple 1st-order sigma-delta. + 0x00000010 + + + INT + [11:4] + read-write + + + FRAC + [3:0] + read-write + + + + + CH3_CTR + 0x00000044 + Direct access to the PWM counter + 0x00000000 + + + CH3_CTR + [15:0] + read-write + + + + + CH3_CC + 0x00000048 + Counter compare values + 0x00000000 + + + B + [31:16] + read-write + + + A + [15:0] + read-write + + + + + CH3_TOP + 0x0000004c + Counter wrap value + 0x0000ffff + + + CH3_TOP + [15:0] + read-write + + + + + CH4_CSR + 0x00000050 + Control and status register + 0x00000000 + + + PH_ADV + Advance the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running + at less than full speed (div_int + div_frac / 16 > 1) + [7:7] + write-only + + + PH_RET + Retard the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running. + [6:6] + write-only + + + DIVMODE + [5:4] + read-write + + + div + 0 + Free-running counting at rate dictated by fractional divider + + + level + 1 + Fractional divider operation is gated by the PWM B pin. + + + rise + 2 + Counter advances with each rising edge of the PWM B pin. + + + fall + 3 + Counter advances with each falling edge of the PWM B pin. + + + + + B_INV + Invert output B + [3:3] + read-write + + + A_INV + Invert output A + [2:2] + read-write + + + PH_CORRECT + 1: Enable phase-correct modulation. 0: Trailing-edge + [1:1] + read-write + + + EN + Enable the PWM channel. + [0:0] + read-write + + + + + CH4_DIV + 0x00000054 + INT and FRAC form a fixed-point fractional number. + Counting rate is system clock frequency divided by this number. + Fractional division uses simple 1st-order sigma-delta. + 0x00000010 + + + INT + [11:4] + read-write + + + FRAC + [3:0] + read-write + + + + + CH4_CTR + 0x00000058 + Direct access to the PWM counter + 0x00000000 + + + CH4_CTR + [15:0] + read-write + + + + + CH4_CC + 0x0000005c + Counter compare values + 0x00000000 + + + B + [31:16] + read-write + + + A + [15:0] + read-write + + + + + CH4_TOP + 0x00000060 + Counter wrap value + 0x0000ffff + + + CH4_TOP + [15:0] + read-write + + + + + CH5_CSR + 0x00000064 + Control and status register + 0x00000000 + + + PH_ADV + Advance the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running + at less than full speed (div_int + div_frac / 16 > 1) + [7:7] + write-only + + + PH_RET + Retard the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running. + [6:6] + write-only + + + DIVMODE + [5:4] + read-write + + + div + 0 + Free-running counting at rate dictated by fractional divider + + + level + 1 + Fractional divider operation is gated by the PWM B pin. + + + rise + 2 + Counter advances with each rising edge of the PWM B pin. + + + fall + 3 + Counter advances with each falling edge of the PWM B pin. + + + + + B_INV + Invert output B + [3:3] + read-write + + + A_INV + Invert output A + [2:2] + read-write + + + PH_CORRECT + 1: Enable phase-correct modulation. 0: Trailing-edge + [1:1] + read-write + + + EN + Enable the PWM channel. + [0:0] + read-write + + + + + CH5_DIV + 0x00000068 + INT and FRAC form a fixed-point fractional number. + Counting rate is system clock frequency divided by this number. + Fractional division uses simple 1st-order sigma-delta. + 0x00000010 + + + INT + [11:4] + read-write + + + FRAC + [3:0] + read-write + + + + + CH5_CTR + 0x0000006c + Direct access to the PWM counter + 0x00000000 + + + CH5_CTR + [15:0] + read-write + + + + + CH5_CC + 0x00000070 + Counter compare values + 0x00000000 + + + B + [31:16] + read-write + + + A + [15:0] + read-write + + + + + CH5_TOP + 0x00000074 + Counter wrap value + 0x0000ffff + + + CH5_TOP + [15:0] + read-write + + + + + CH6_CSR + 0x00000078 + Control and status register + 0x00000000 + + + PH_ADV + Advance the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running + at less than full speed (div_int + div_frac / 16 > 1) + [7:7] + write-only + + + PH_RET + Retard the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running. + [6:6] + write-only + + + DIVMODE + [5:4] + read-write + + + div + 0 + Free-running counting at rate dictated by fractional divider + + + level + 1 + Fractional divider operation is gated by the PWM B pin. + + + rise + 2 + Counter advances with each rising edge of the PWM B pin. + + + fall + 3 + Counter advances with each falling edge of the PWM B pin. + + + + + B_INV + Invert output B + [3:3] + read-write + + + A_INV + Invert output A + [2:2] + read-write + + + PH_CORRECT + 1: Enable phase-correct modulation. 0: Trailing-edge + [1:1] + read-write + + + EN + Enable the PWM channel. + [0:0] + read-write + + + + + CH6_DIV + 0x0000007c + INT and FRAC form a fixed-point fractional number. + Counting rate is system clock frequency divided by this number. + Fractional division uses simple 1st-order sigma-delta. + 0x00000010 + + + INT + [11:4] + read-write + + + FRAC + [3:0] + read-write + + + + + CH6_CTR + 0x00000080 + Direct access to the PWM counter + 0x00000000 + + + CH6_CTR + [15:0] + read-write + + + + + CH6_CC + 0x00000084 + Counter compare values + 0x00000000 + + + B + [31:16] + read-write + + + A + [15:0] + read-write + + + + + CH6_TOP + 0x00000088 + Counter wrap value + 0x0000ffff + + + CH6_TOP + [15:0] + read-write + + + + + CH7_CSR + 0x0000008c + Control and status register + 0x00000000 + + + PH_ADV + Advance the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running + at less than full speed (div_int + div_frac / 16 > 1) + [7:7] + write-only + + + PH_RET + Retard the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running. + [6:6] + write-only + + + DIVMODE + [5:4] + read-write + + + div + 0 + Free-running counting at rate dictated by fractional divider + + + level + 1 + Fractional divider operation is gated by the PWM B pin. + + + rise + 2 + Counter advances with each rising edge of the PWM B pin. + + + fall + 3 + Counter advances with each falling edge of the PWM B pin. + + + + + B_INV + Invert output B + [3:3] + read-write + + + A_INV + Invert output A + [2:2] + read-write + + + PH_CORRECT + 1: Enable phase-correct modulation. 0: Trailing-edge + [1:1] + read-write + + + EN + Enable the PWM channel. + [0:0] + read-write + + + + + CH7_DIV + 0x00000090 + INT and FRAC form a fixed-point fractional number. + Counting rate is system clock frequency divided by this number. + Fractional division uses simple 1st-order sigma-delta. + 0x00000010 + + + INT + [11:4] + read-write + + + FRAC + [3:0] + read-write + + + + + CH7_CTR + 0x00000094 + Direct access to the PWM counter + 0x00000000 + + + CH7_CTR + [15:0] + read-write + + + + + CH7_CC + 0x00000098 + Counter compare values + 0x00000000 + + + B + [31:16] + read-write + + + A + [15:0] + read-write + + + + + CH7_TOP + 0x0000009c + Counter wrap value + 0x0000ffff + + + CH7_TOP + [15:0] + read-write + + + + + CH8_CSR + 0x000000a0 + Control and status register + 0x00000000 + + + PH_ADV + Advance the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running + at less than full speed (div_int + div_frac / 16 > 1) + [7:7] + write-only + + + PH_RET + Retard the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running. + [6:6] + write-only + + + DIVMODE + [5:4] + read-write + + + div + 0 + Free-running counting at rate dictated by fractional divider + + + level + 1 + Fractional divider operation is gated by the PWM B pin. + + + rise + 2 + Counter advances with each rising edge of the PWM B pin. + + + fall + 3 + Counter advances with each falling edge of the PWM B pin. + + + + + B_INV + Invert output B + [3:3] + read-write + + + A_INV + Invert output A + [2:2] + read-write + + + PH_CORRECT + 1: Enable phase-correct modulation. 0: Trailing-edge + [1:1] + read-write + + + EN + Enable the PWM channel. + [0:0] + read-write + + + + + CH8_DIV + 0x000000a4 + INT and FRAC form a fixed-point fractional number. + Counting rate is system clock frequency divided by this number. + Fractional division uses simple 1st-order sigma-delta. + 0x00000010 + + + INT + [11:4] + read-write + + + FRAC + [3:0] + read-write + + + + + CH8_CTR + 0x000000a8 + Direct access to the PWM counter + 0x00000000 + + + CH8_CTR + [15:0] + read-write + + + + + CH8_CC + 0x000000ac + Counter compare values + 0x00000000 + + + B + [31:16] + read-write + + + A + [15:0] + read-write + + + + + CH8_TOP + 0x000000b0 + Counter wrap value + 0x0000ffff + + + CH8_TOP + [15:0] + read-write + + + + + CH9_CSR + 0x000000b4 + Control and status register + 0x00000000 + + + PH_ADV + Advance the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running + at less than full speed (div_int + div_frac / 16 > 1) + [7:7] + write-only + + + PH_RET + Retard the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running. + [6:6] + write-only + + + DIVMODE + [5:4] + read-write + + + div + 0 + Free-running counting at rate dictated by fractional divider + + + level + 1 + Fractional divider operation is gated by the PWM B pin. + + + rise + 2 + Counter advances with each rising edge of the PWM B pin. + + + fall + 3 + Counter advances with each falling edge of the PWM B pin. + + + + + B_INV + Invert output B + [3:3] + read-write + + + A_INV + Invert output A + [2:2] + read-write + + + PH_CORRECT + 1: Enable phase-correct modulation. 0: Trailing-edge + [1:1] + read-write + + + EN + Enable the PWM channel. + [0:0] + read-write + + + + + CH9_DIV + 0x000000b8 + INT and FRAC form a fixed-point fractional number. + Counting rate is system clock frequency divided by this number. + Fractional division uses simple 1st-order sigma-delta. + 0x00000010 + + + INT + [11:4] + read-write + + + FRAC + [3:0] + read-write + + + + + CH9_CTR + 0x000000bc + Direct access to the PWM counter + 0x00000000 + + + CH9_CTR + [15:0] + read-write + + + + + CH9_CC + 0x000000c0 + Counter compare values + 0x00000000 + + + B + [31:16] + read-write + + + A + [15:0] + read-write + + + + + CH9_TOP + 0x000000c4 + Counter wrap value + 0x0000ffff + + + CH9_TOP + [15:0] + read-write + + + + + CH10_CSR + 0x000000c8 + Control and status register + 0x00000000 + + + PH_ADV + Advance the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running + at less than full speed (div_int + div_frac / 16 > 1) + [7:7] + write-only + + + PH_RET + Retard the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running. + [6:6] + write-only + + + DIVMODE + [5:4] + read-write + + + div + 0 + Free-running counting at rate dictated by fractional divider + + + level + 1 + Fractional divider operation is gated by the PWM B pin. + + + rise + 2 + Counter advances with each rising edge of the PWM B pin. + + + fall + 3 + Counter advances with each falling edge of the PWM B pin. + + + + + B_INV + Invert output B + [3:3] + read-write + + + A_INV + Invert output A + [2:2] + read-write + + + PH_CORRECT + 1: Enable phase-correct modulation. 0: Trailing-edge + [1:1] + read-write + + + EN + Enable the PWM channel. + [0:0] + read-write + + + + + CH10_DIV + 0x000000cc + INT and FRAC form a fixed-point fractional number. + Counting rate is system clock frequency divided by this number. + Fractional division uses simple 1st-order sigma-delta. + 0x00000010 + + + INT + [11:4] + read-write + + + FRAC + [3:0] + read-write + + + + + CH10_CTR + 0x000000d0 + Direct access to the PWM counter + 0x00000000 + + + CH10_CTR + [15:0] + read-write + + + + + CH10_CC + 0x000000d4 + Counter compare values + 0x00000000 + + + B + [31:16] + read-write + + + A + [15:0] + read-write + + + + + CH10_TOP + 0x000000d8 + Counter wrap value + 0x0000ffff + + + CH10_TOP + [15:0] + read-write + + + + + CH11_CSR + 0x000000dc + Control and status register + 0x00000000 + + + PH_ADV + Advance the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running + at less than full speed (div_int + div_frac / 16 > 1) + [7:7] + write-only + + + PH_RET + Retard the phase of the counter by 1 count, while it is running. + Self-clearing. Write a 1, and poll until low. Counter must be running. + [6:6] + write-only + + + DIVMODE + [5:4] + read-write + + + div + 0 + Free-running counting at rate dictated by fractional divider + + + level + 1 + Fractional divider operation is gated by the PWM B pin. + + + rise + 2 + Counter advances with each rising edge of the PWM B pin. + + + fall + 3 + Counter advances with each falling edge of the PWM B pin. + + + + + B_INV + Invert output B + [3:3] + read-write + + + A_INV + Invert output A + [2:2] + read-write + + + PH_CORRECT + 1: Enable phase-correct modulation. 0: Trailing-edge + [1:1] + read-write + + + EN + Enable the PWM channel. + [0:0] + read-write + + + + + CH11_DIV + 0x000000e0 + INT and FRAC form a fixed-point fractional number. + Counting rate is system clock frequency divided by this number. + Fractional division uses simple 1st-order sigma-delta. + 0x00000010 + + + INT + [11:4] + read-write + + + FRAC + [3:0] + read-write + + + + + CH11_CTR + 0x000000e4 + Direct access to the PWM counter + 0x00000000 + + + CH11_CTR + [15:0] + read-write + + + + + CH11_CC + 0x000000e8 + Counter compare values + 0x00000000 + + + B + [31:16] + read-write + + + A + [15:0] + read-write + + + + + CH11_TOP + 0x000000ec + Counter wrap value + 0x0000ffff + + + CH11_TOP + [15:0] + read-write + + + + + EN + 0x000000f0 + This register aliases the CSR_EN bits for all channels. + Writing to this register allows multiple channels to be enabled + or disabled simultaneously, so they can run in perfect sync. + For each channel, there is only one physical EN register bit, + which can be accessed through here or CHx_CSR. + 0x00000000 + + + CH11 + [11:11] + read-write + + + CH10 + [10:10] + read-write + + + CH9 + [9:9] + read-write + + + CH8 + [8:8] + read-write + + + CH7 + [7:7] + read-write + + + CH6 + [6:6] + read-write + + + CH5 + [5:5] + read-write + + + CH4 + [4:4] + read-write + + + CH3 + [3:3] + read-write + + + CH2 + [2:2] + read-write + + + CH1 + [1:1] + read-write + + + CH0 + [0:0] + read-write + + + + + INTR + 0x000000f4 + Raw Interrupts + 0x00000000 + + + CH11 + [11:11] + read-write + oneToClear + + + CH10 + [10:10] + read-write + oneToClear + + + CH9 + [9:9] + read-write + oneToClear + + + CH8 + [8:8] + read-write + oneToClear + + + CH7 + [7:7] + read-write + oneToClear + + + CH6 + [6:6] + read-write + oneToClear + + + CH5 + [5:5] + read-write + oneToClear + + + CH4 + [4:4] + read-write + oneToClear + + + CH3 + [3:3] + read-write + oneToClear + + + CH2 + [2:2] + read-write + oneToClear + + + CH1 + [1:1] + read-write + oneToClear + + + CH0 + [0:0] + read-write + oneToClear + + + + + IRQ0_INTE + 0x000000f8 + Interrupt Enable for irq0 + 0x00000000 + + + CH11 + [11:11] + read-write + + + CH10 + [10:10] + read-write + + + CH9 + [9:9] + read-write + + + CH8 + [8:8] + read-write + + + CH7 + [7:7] + read-write + + + CH6 + [6:6] + read-write + + + CH5 + [5:5] + read-write + + + CH4 + [4:4] + read-write + + + CH3 + [3:3] + read-write + + + CH2 + [2:2] + read-write + + + CH1 + [1:1] + read-write + + + CH0 + [0:0] + read-write + + + + + IRQ0_INTF + 0x000000fc + Interrupt Force for irq0 + 0x00000000 + + + CH11 + [11:11] + read-write + + + CH10 + [10:10] + read-write + + + CH9 + [9:9] + read-write + + + CH8 + [8:8] + read-write + + + CH7 + [7:7] + read-write + + + CH6 + [6:6] + read-write + + + CH5 + [5:5] + read-write + + + CH4 + [4:4] + read-write + + + CH3 + [3:3] + read-write + + + CH2 + [2:2] + read-write + + + CH1 + [1:1] + read-write + + + CH0 + [0:0] + read-write + + + + + IRQ0_INTS + 0x00000100 + Interrupt status after masking & forcing for irq0 + 0x00000000 + + + CH11 + [11:11] + read-only + + + CH10 + [10:10] + read-only + + + CH9 + [9:9] + read-only + + + CH8 + [8:8] + read-only + + + CH7 + [7:7] + read-only + + + CH6 + [6:6] + read-only + + + CH5 + [5:5] + read-only + + + CH4 + [4:4] + read-only + + + CH3 + [3:3] + read-only + + + CH2 + [2:2] + read-only + + + CH1 + [1:1] + read-only + + + CH0 + [0:0] + read-only + + + + + IRQ1_INTE + 0x00000104 + Interrupt Enable for irq1 + 0x00000000 + + + CH11 + [11:11] + read-write + + + CH10 + [10:10] + read-write + + + CH9 + [9:9] + read-write + + + CH8 + [8:8] + read-write + + + CH7 + [7:7] + read-write + + + CH6 + [6:6] + read-write + + + CH5 + [5:5] + read-write + + + CH4 + [4:4] + read-write + + + CH3 + [3:3] + read-write + + + CH2 + [2:2] + read-write + + + CH1 + [1:1] + read-write + + + CH0 + [0:0] + read-write + + + + + IRQ1_INTF + 0x00000108 + Interrupt Force for irq1 + 0x00000000 + + + CH11 + [11:11] + read-write + + + CH10 + [10:10] + read-write + + + CH9 + [9:9] + read-write + + + CH8 + [8:8] + read-write + + + CH7 + [7:7] + read-write + + + CH6 + [6:6] + read-write + + + CH5 + [5:5] + read-write + + + CH4 + [4:4] + read-write + + + CH3 + [3:3] + read-write + + + CH2 + [2:2] + read-write + + + CH1 + [1:1] + read-write + + + CH0 + [0:0] + read-write + + + + + IRQ1_INTS + 0x0000010c + Interrupt status after masking & forcing for irq1 + 0x00000000 + + + CH11 + [11:11] + read-only + + + CH10 + [10:10] + read-only + + + CH9 + [9:9] + read-only + + + CH8 + [8:8] + read-only + + + CH7 + [7:7] + read-only + + + CH6 + [6:6] + read-only + + + CH5 + [5:5] + read-only + + + CH4 + [4:4] + read-only + + + CH3 + [3:3] + read-only + + + CH2 + [2:2] + read-only + + + CH1 + [1:1] + read-only + + + CH0 + [0:0] + read-only + + + + + + + ADC + Control and data interface to SAR ADC + 0x400a0000 + + 0 + 36 + registers + + + ADC_IRQ_FIFO + 35 + + + + CS + 0x00000000 + ADC Control and Status + 0x00000000 + + + RROBIN + Round-robin sampling. 1 bit per channel. Set all bits to 0 to disable. + Otherwise, the ADC will cycle through each enabled channel in a round-robin fashion. + The first channel to be sampled will be the one currently indicated by AINSEL. + AINSEL will be updated after each conversion with the newly-selected channel. + [24:16] + read-write + + + AINSEL + Select analog mux input. Updated automatically in round-robin mode. + This is corrected for the package option so only ADC channels which are bonded are available, and in the correct order + [15:12] + read-write + + + ERR_STICKY + Some past ADC conversion encountered an error. Write 1 to clear. + [10:10] + read-write + oneToClear + + + ERR + The most recent ADC conversion encountered an error; result is undefined or noisy. + [9:9] + read-only + + + READY + 1 if the ADC is ready to start a new conversion. Implies any previous conversion has completed. + 0 whilst conversion in progress. + [8:8] + read-only + + + START_MANY + Continuously perform conversions whilst this bit is 1. A new conversion will start immediately after the previous finishes. + [3:3] + read-write + + + START_ONCE + Start a single conversion. Self-clearing. Ignored if start_many is asserted. + [2:2] + write-only + + + TS_EN + Power on temperature sensor. 1 - enabled. 0 - disabled. + [1:1] + read-write + + + EN + Power on ADC and enable its clock. + 1 - enabled. 0 - disabled. + [0:0] + read-write + + + + + RESULT + 0x00000004 + Result of most recent ADC conversion + 0x00000000 + + + RESULT + [11:0] + read-only + + + + + FCS + 0x00000008 + FIFO control and status + 0x00000000 + + + THRESH + DREQ/IRQ asserted when level >= threshold + [27:24] + read-write + + + LEVEL + The number of conversion results currently waiting in the FIFO + [19:16] + read-only + + + OVER + 1 if the FIFO has been overflowed. Write 1 to clear. + [11:11] + read-write + oneToClear + + + UNDER + 1 if the FIFO has been underflowed. Write 1 to clear. + [10:10] + read-write + oneToClear + + + FULL + [9:9] + read-only + + + EMPTY + [8:8] + read-only + + + DREQ_EN + If 1: assert DMA requests when FIFO contains data + [3:3] + read-write + + + ERR + If 1: conversion error bit appears in the FIFO alongside the result + [2:2] + read-write + + + SHIFT + If 1: FIFO results are right-shifted to be one byte in size. Enables DMA to byte buffers. + [1:1] + read-write + + + EN + If 1: write result to the FIFO after each conversion. + [0:0] + read-write + + + + + FIFO + 0x0000000c + Conversion result FIFO + 0x00000000 + + + ERR + 1 if this particular sample experienced a conversion error. Remains in the same location if the sample is shifted. + [15:15] + read-only + modify + + + VAL + [11:0] + read-only + modify + + + + + DIV + 0x00000010 + Clock divider. If non-zero, CS_START_MANY will start conversions + at regular intervals rather than back-to-back. + The divider is reset when either of these fields are written. + Total period is 1 + INT + FRAC / 256 + 0x00000000 + + + INT + Integer part of clock divisor. + [23:8] + read-write + + + FRAC + Fractional part of clock divisor. First-order delta-sigma. + [7:0] + read-write + + + + + INTR + 0x00000014 + Raw Interrupts + 0x00000000 + + + FIFO + Triggered when the sample FIFO reaches a certain level. + This level can be programmed via the FCS_THRESH field. + [0:0] + read-only + + + + + INTE + 0x00000018 + Interrupt Enable + 0x00000000 + + + FIFO + Triggered when the sample FIFO reaches a certain level. + This level can be programmed via the FCS_THRESH field. + [0:0] + read-write + + + + + INTF + 0x0000001c + Interrupt Force + 0x00000000 + + + FIFO + Triggered when the sample FIFO reaches a certain level. + This level can be programmed via the FCS_THRESH field. + [0:0] + read-write + + + + + INTS + 0x00000020 + Interrupt status after masking & forcing + 0x00000000 + + + FIFO + Triggered when the sample FIFO reaches a certain level. + This level can be programmed via the FCS_THRESH field. + [0:0] + read-only + + + + + + + I2C0 + DW_apb_i2c address block + + List of configuration constants for the Synopsys I2C hardware (you may see references to these in I2C register header; these are *fixed* values, set at hardware design time): + + IC_ULTRA_FAST_MODE ................ 0x0 + IC_UFM_TBUF_CNT_DEFAULT ........... 0x8 + IC_UFM_SCL_LOW_COUNT .............. 0x0008 + IC_UFM_SCL_HIGH_COUNT ............. 0x0006 + IC_TX_TL .......................... 0x0 + IC_TX_CMD_BLOCK ................... 0x1 + IC_HAS_DMA ........................ 0x1 + IC_HAS_ASYNC_FIFO ................. 0x0 + IC_SMBUS_ARP ...................... 0x0 + IC_FIRST_DATA_BYTE_STATUS ......... 0x1 + IC_INTR_IO ........................ 0x1 + IC_MASTER_MODE .................... 0x1 + IC_DEFAULT_ACK_GENERAL_CALL ....... 0x1 + IC_INTR_POL ....................... 0x1 + IC_OPTIONAL_SAR ................... 0x0 + IC_DEFAULT_TAR_SLAVE_ADDR ......... 0x055 + IC_DEFAULT_SLAVE_ADDR ............. 0x055 + IC_DEFAULT_HS_SPKLEN .............. 0x1 + IC_FS_SCL_HIGH_COUNT .............. 0x0006 + IC_HS_SCL_LOW_COUNT ............... 0x0008 + IC_DEVICE_ID_VALUE ................ 0x0 + IC_10BITADDR_MASTER ............... 0x0 + IC_CLK_FREQ_OPTIMIZATION .......... 0x0 + IC_DEFAULT_FS_SPKLEN .............. 0x7 + IC_ADD_ENCODED_PARAMS ............. 0x0 + IC_DEFAULT_SDA_HOLD ............... 0x000001 + IC_DEFAULT_SDA_SETUP .............. 0x64 + IC_AVOID_RX_FIFO_FLUSH_ON_TX_ABRT . 0x0 + IC_CLOCK_PERIOD ................... 100 + IC_EMPTYFIFO_HOLD_MASTER_EN ....... 1 + IC_RESTART_EN ..................... 0x1 + IC_TX_CMD_BLOCK_DEFAULT ........... 0x0 + IC_BUS_CLEAR_FEATURE .............. 0x0 + IC_CAP_LOADING .................... 100 + IC_FS_SCL_LOW_COUNT ............... 0x000d + APB_DATA_WIDTH .................... 32 + IC_SDA_STUCK_TIMEOUT_DEFAULT ...... 0xffffffff + IC_SLV_DATA_NACK_ONLY ............. 0x1 + IC_10BITADDR_SLAVE ................ 0x0 + IC_CLK_TYPE ....................... 0x0 + IC_SMBUS_UDID_MSB ................. 0x0 + IC_SMBUS_SUSPEND_ALERT ............ 0x0 + IC_HS_SCL_HIGH_COUNT .............. 0x0006 + IC_SLV_RESTART_DET_EN ............. 0x1 + IC_SMBUS .......................... 0x0 + IC_OPTIONAL_SAR_DEFAULT ........... 0x0 + IC_PERSISTANT_SLV_ADDR_DEFAULT .... 0x0 + IC_USE_COUNTS ..................... 0x0 + IC_RX_BUFFER_DEPTH ................ 16 + IC_SCL_STUCK_TIMEOUT_DEFAULT ...... 0xffffffff + IC_RX_FULL_HLD_BUS_EN ............. 0x1 + IC_SLAVE_DISABLE .................. 0x1 + IC_RX_TL .......................... 0x0 + IC_DEVICE_ID ...................... 0x0 + IC_HC_COUNT_VALUES ................ 0x0 + I2C_DYNAMIC_TAR_UPDATE ............ 0 + IC_SMBUS_CLK_LOW_MEXT_DEFAULT ..... 0xffffffff + IC_SMBUS_CLK_LOW_SEXT_DEFAULT ..... 0xffffffff + IC_HS_MASTER_CODE ................. 0x1 + IC_SMBUS_RST_IDLE_CNT_DEFAULT ..... 0xffff + IC_SMBUS_UDID_LSB_DEFAULT ......... 0xffffffff + IC_SS_SCL_HIGH_COUNT .............. 0x0028 + IC_SS_SCL_LOW_COUNT ............... 0x002f + IC_MAX_SPEED_MODE ................. 0x2 + IC_STAT_FOR_CLK_STRETCH ........... 0x0 + IC_STOP_DET_IF_MASTER_ACTIVE ...... 0x0 + IC_DEFAULT_UFM_SPKLEN ............. 0x1 + IC_TX_BUFFER_DEPTH ................ 16 + 0x40090000 + + 0 + 256 + registers + + + I2C0_IRQ + 36 + + + + IC_CON + 0x00000000 + I2C Control Register. This register can be written only when the DW_apb_i2c is disabled, which corresponds to the IC_ENABLE[0] register being set to 0. Writes at other times have no effect. + + Read/Write Access: - bit 10 is read only. - bit 11 is read only - bit 16 is read only - bit 17 is read only - bits 18 and 19 are read only. + 0x00000065 + + + STOP_DET_IF_MASTER_ACTIVE + Master issues the STOP_DET interrupt irrespective of whether master is active or not + [10:10] + read-only + + + RX_FIFO_FULL_HLD_CTRL + This bit controls whether DW_apb_i2c should hold the bus when the Rx FIFO is physically full to its RX_BUFFER_DEPTH, as described in the IC_RX_FULL_HLD_BUS_EN parameter. + + Reset value: 0x0. + [9:9] + read-write + + + DISABLED + 0 + Overflow when RX_FIFO is full + + + ENABLED + 1 + Hold bus when RX_FIFO is full + + + + + TX_EMPTY_CTRL + This bit controls the generation of the TX_EMPTY interrupt, as described in the IC_RAW_INTR_STAT register. + + Reset value: 0x0. + [8:8] + read-write + + + DISABLED + 0 + Default behaviour of TX_EMPTY interrupt + + + ENABLED + 1 + Controlled generation of TX_EMPTY interrupt + + + + + STOP_DET_IFADDRESSED + In slave mode: - 1'b1: issues the STOP_DET interrupt only when it is addressed. - 1'b0: issues the STOP_DET irrespective of whether it's addressed or not. Reset value: 0x0 + + NOTE: During a general call address, this slave does not issue the STOP_DET interrupt if STOP_DET_IF_ADDRESSED = 1'b1, even if the slave responds to the general call address by generating ACK. The STOP_DET interrupt is generated only when the transmitted address matches the slave address (SAR). + [7:7] + read-write + + + DISABLED + 0 + slave issues STOP_DET intr always + + + ENABLED + 1 + slave issues STOP_DET intr only if addressed + + + + + IC_SLAVE_DISABLE + This bit controls whether I2C has its slave disabled, which means once the presetn signal is applied, then this bit is set and the slave is disabled. + + If this bit is set (slave is disabled), DW_apb_i2c functions only as a master and does not perform any action that requires a slave. + + NOTE: Software should ensure that if this bit is written with 0, then bit 0 should also be written with a 0. + [6:6] + read-write + + + SLAVE_ENABLED + 0 + Slave mode is enabled + + + SLAVE_DISABLED + 1 + Slave mode is disabled + + + + + IC_RESTART_EN + Determines whether RESTART conditions may be sent when acting as a master. Some older slaves do not support handling RESTART conditions; however, RESTART conditions are used in several DW_apb_i2c operations. When RESTART is disabled, the master is prohibited from performing the following functions: - Sending a START BYTE - Performing any high-speed mode operation - High-speed mode operation - Performing direction changes in combined format mode - Performing a read operation with a 10-bit address By replacing RESTART condition followed by a STOP and a subsequent START condition, split operations are broken down into multiple DW_apb_i2c transfers. If the above operations are performed, it will result in setting bit 6 (TX_ABRT) of the IC_RAW_INTR_STAT register. + + Reset value: ENABLED + [5:5] + read-write + + + DISABLED + 0 + Master restart disabled + + + ENABLED + 1 + Master restart enabled + + + + + IC_10BITADDR_MASTER + Controls whether the DW_apb_i2c starts its transfers in 7- or 10-bit addressing mode when acting as a master. - 0: 7-bit addressing - 1: 10-bit addressing + [4:4] + read-write + + + ADDR_7BITS + 0 + Master 7Bit addressing mode + + + ADDR_10BITS + 1 + Master 10Bit addressing mode + + + + + IC_10BITADDR_SLAVE + When acting as a slave, this bit controls whether the DW_apb_i2c responds to 7- or 10-bit addresses. - 0: 7-bit addressing. The DW_apb_i2c ignores transactions that involve 10-bit addressing; for 7-bit addressing, only the lower 7 bits of the IC_SAR register are compared. - 1: 10-bit addressing. The DW_apb_i2c responds to only 10-bit addressing transfers that match the full 10 bits of the IC_SAR register. + [3:3] + read-write + + + ADDR_7BITS + 0 + Slave 7Bit addressing + + + ADDR_10BITS + 1 + Slave 10Bit addressing + + + + + SPEED + These bits control at which speed the DW_apb_i2c operates; its setting is relevant only if one is operating the DW_apb_i2c in master mode. Hardware protects against illegal values being programmed by software. These bits must be programmed appropriately for slave mode also, as it is used to capture correct value of spike filter as per the speed mode. + + This register should be programmed only with a value in the range of 1 to IC_MAX_SPEED_MODE; otherwise, hardware updates this register with the value of IC_MAX_SPEED_MODE. + + 1: standard mode (100 kbit/s) + + 2: fast mode (<=400 kbit/s) or fast mode plus (<=1000Kbit/s) + + 3: high speed mode (3.4 Mbit/s) + + Note: This field is not applicable when IC_ULTRA_FAST_MODE=1 + [2:1] + read-write + + + STANDARD + 1 + Standard Speed mode of operation + + + FAST + 2 + Fast or Fast Plus mode of operation + + + HIGH + 3 + High Speed mode of operation + + + + + MASTER_MODE + This bit controls whether the DW_apb_i2c master is enabled. + + NOTE: Software should ensure that if this bit is written with '1' then bit 6 should also be written with a '1'. + [0:0] + read-write + + + DISABLED + 0 + Master mode is disabled + + + ENABLED + 1 + Master mode is enabled + + + + + + + IC_TAR + 0x00000004 + I2C Target Address Register + + This register is 12 bits wide, and bits 31:12 are reserved. This register can be written to only when IC_ENABLE[0] is set to 0. + + Note: If the software or application is aware that the DW_apb_i2c is not using the TAR address for the pending commands in the Tx FIFO, then it is possible to update the TAR address even while the Tx FIFO has entries (IC_STATUS[2]= 0). - It is not necessary to perform any write to this register if DW_apb_i2c is enabled as an I2C slave only. + 0x00000055 + + + SPECIAL + This bit indicates whether software performs a Device-ID or General Call or START BYTE command. - 0: ignore bit 10 GC_OR_START and use IC_TAR normally - 1: perform special I2C command as specified in Device_ID or GC_OR_START bit Reset value: 0x0 + [11:11] + read-write + + + DISABLED + 0 + Disables programming of GENERAL_CALL or START_BYTE transmission + + + ENABLED + 1 + Enables programming of GENERAL_CALL or START_BYTE transmission + + + + + GC_OR_START + If bit 11 (SPECIAL) is set to 1 and bit 13(Device-ID) is set to 0, then this bit indicates whether a General Call or START byte command is to be performed by the DW_apb_i2c. - 0: General Call Address - after issuing a General Call, only writes may be performed. Attempting to issue a read command results in setting bit 6 (TX_ABRT) of the IC_RAW_INTR_STAT register. The DW_apb_i2c remains in General Call mode until the SPECIAL bit value (bit 11) is cleared. - 1: START BYTE Reset value: 0x0 + [10:10] + read-write + + + GENERAL_CALL + 0 + GENERAL_CALL byte transmission + + + START_BYTE + 1 + START byte transmission + + + + + IC_TAR + This is the target address for any master transaction. When transmitting a General Call, these bits are ignored. To generate a START BYTE, the CPU needs to write only once into these bits. + + If the IC_TAR and IC_SAR are the same, loopback exists but the FIFOs are shared between master and slave, so full loopback is not feasible. Only one direction loopback mode is supported (simplex), not duplex. A master cannot transmit to itself; it can transmit to only a slave. + [9:0] + read-write + + + + + IC_SAR + 0x00000008 + I2C Slave Address Register + 0x00000055 + + + IC_SAR + The IC_SAR holds the slave address when the I2C is operating as a slave. For 7-bit addressing, only IC_SAR[6:0] is used. + + This register can be written only when the I2C interface is disabled, which corresponds to the IC_ENABLE[0] register being set to 0. Writes at other times have no effect. + + Note: The default values cannot be any of the reserved address locations: that is, 0x00 to 0x07, or 0x78 to 0x7f. The correct operation of the device is not guaranteed if you program the IC_SAR or IC_TAR to a reserved value. Refer to <<table_I2C_firstbyte_bit_defs>> for a complete list of these reserved values. + [9:0] + read-write + + + + + IC_DATA_CMD + 0x00000010 + I2C Rx/Tx Data Buffer and Command Register; this is the register the CPU writes to when filling the TX FIFO and the CPU reads from when retrieving bytes from RX FIFO. + + The size of the register changes as follows: + + Write: - 11 bits when IC_EMPTYFIFO_HOLD_MASTER_EN=1 - 9 bits when IC_EMPTYFIFO_HOLD_MASTER_EN=0 Read: - 12 bits when IC_FIRST_DATA_BYTE_STATUS = 1 - 8 bits when IC_FIRST_DATA_BYTE_STATUS = 0 Note: In order for the DW_apb_i2c to continue acknowledging reads, a read command should be written for every byte that is to be received; otherwise the DW_apb_i2c will stop acknowledging. + 0x00000000 + + + FIRST_DATA_BYTE + Indicates the first data byte received after the address phase for receive transfer in Master receiver or Slave receiver mode. + + Reset value : 0x0 + + NOTE: In case of APB_DATA_WIDTH=8, + + 1. The user has to perform two APB Reads to IC_DATA_CMD in order to get status on 11 bit. + + 2. In order to read the 11 bit, the user has to perform the first data byte read [7:0] (offset 0x10) and then perform the second read [15:8] (offset 0x11) in order to know the status of 11 bit (whether the data received in previous read is a first data byte or not). + + 3. The 11th bit is an optional read field, user can ignore 2nd byte read [15:8] (offset 0x11) if not interested in FIRST_DATA_BYTE status. + [11:11] + read-only + + + INACTIVE + 0 + Sequential data byte received + + + ACTIVE + 1 + Non sequential data byte received + + + + + RESTART + This bit controls whether a RESTART is issued before the byte is sent or received. + + 1 - If IC_RESTART_EN is 1, a RESTART is issued before the data is sent/received (according to the value of CMD), regardless of whether or not the transfer direction is changing from the previous command; if IC_RESTART_EN is 0, a STOP followed by a START is issued instead. + + 0 - If IC_RESTART_EN is 1, a RESTART is issued only if the transfer direction is changing from the previous command; if IC_RESTART_EN is 0, a STOP followed by a START is issued instead. + + Reset value: 0x0 + [10:10] + write-only + + + DISABLE + 0 + Don't Issue RESTART before this command + + + ENABLE + 1 + Issue RESTART before this command + + + + + STOP + This bit controls whether a STOP is issued after the byte is sent or received. + + - 1 - STOP is issued after this byte, regardless of whether or not the Tx FIFO is empty. If the Tx FIFO is not empty, the master immediately tries to start a new transfer by issuing a START and arbitrating for the bus. - 0 - STOP is not issued after this byte, regardless of whether or not the Tx FIFO is empty. If the Tx FIFO is not empty, the master continues the current transfer by sending/receiving data bytes according to the value of the CMD bit. If the Tx FIFO is empty, the master holds the SCL line low and stalls the bus until a new command is available in the Tx FIFO. Reset value: 0x0 + [9:9] + write-only + + + DISABLE + 0 + Don't Issue STOP after this command + + + ENABLE + 1 + Issue STOP after this command + + + + + CMD + This bit controls whether a read or a write is performed. This bit does not control the direction when the DW_apb_i2con acts as a slave. It controls only the direction when it acts as a master. + + When a command is entered in the TX FIFO, this bit distinguishes the write and read commands. In slave-receiver mode, this bit is a 'don't care' because writes to this register are not required. In slave-transmitter mode, a '0' indicates that the data in IC_DATA_CMD is to be transmitted. + + When programming this bit, you should remember the following: attempting to perform a read operation after a General Call command has been sent results in a TX_ABRT interrupt (bit 6 of the IC_RAW_INTR_STAT register), unless bit 11 (SPECIAL) in the IC_TAR register has been cleared. If a '1' is written to this bit after receiving a RD_REQ interrupt, then a TX_ABRT interrupt occurs. + + Reset value: 0x0 + [8:8] + write-only + + + WRITE + 0 + Master Write Command + + + READ + 1 + Master Read Command + + + + + DAT + This register contains the data to be transmitted or received on the I2C bus. If you are writing to this register and want to perform a read, bits 7:0 (DAT) are ignored by the DW_apb_i2c. However, when you read this register, these bits return the value of data received on the DW_apb_i2c interface. + + Reset value: 0x0 + [7:0] + read-write + + + + + IC_SS_SCL_HCNT + 0x00000014 + Standard Speed I2C Clock SCL High Count Register + 0x00000028 + + + IC_SS_SCL_HCNT + This register must be set before any I2C bus transaction can take place to ensure proper I/O timing. This register sets the SCL clock high-period count for standard speed. For more information, refer to 'IC_CLK Frequency Configuration'. + + This register can be written only when the I2C interface is disabled which corresponds to the IC_ENABLE[0] register being set to 0. Writes at other times have no effect. + + The minimum valid value is 6; hardware prevents values less than this being written, and if attempted results in 6 being set. For designs with APB_DATA_WIDTH = 8, the order of programming is important to ensure the correct operation of the DW_apb_i2c. The lower byte must be programmed first. Then the upper byte is programmed. + + NOTE: This register must not be programmed to a value higher than 65525, because DW_apb_i2c uses a 16-bit counter to flag an I2C bus idle condition when this counter reaches a value of IC_SS_SCL_HCNT + 10. + [15:0] + read-write + + + + + IC_SS_SCL_LCNT + 0x00000018 + Standard Speed I2C Clock SCL Low Count Register + 0x0000002f + + + IC_SS_SCL_LCNT + This register must be set before any I2C bus transaction can take place to ensure proper I/O timing. This register sets the SCL clock low period count for standard speed. For more information, refer to 'IC_CLK Frequency Configuration' + + This register can be written only when the I2C interface is disabled which corresponds to the IC_ENABLE[0] register being set to 0. Writes at other times have no effect. + + The minimum valid value is 8; hardware prevents values less than this being written, and if attempted, results in 8 being set. For designs with APB_DATA_WIDTH = 8, the order of programming is important to ensure the correct operation of DW_apb_i2c. The lower byte must be programmed first, and then the upper byte is programmed. + [15:0] + read-write + + + + + IC_FS_SCL_HCNT + 0x0000001c + Fast Mode or Fast Mode Plus I2C Clock SCL High Count Register + 0x00000006 + + + IC_FS_SCL_HCNT + This register must be set before any I2C bus transaction can take place to ensure proper I/O timing. This register sets the SCL clock high-period count for fast mode or fast mode plus. It is used in high-speed mode to send the Master Code and START BYTE or General CALL. For more information, refer to 'IC_CLK Frequency Configuration'. + + This register goes away and becomes read-only returning 0s if IC_MAX_SPEED_MODE = standard. This register can be written only when the I2C interface is disabled, which corresponds to the IC_ENABLE[0] register being set to 0. Writes at other times have no effect. + + The minimum valid value is 6; hardware prevents values less than this being written, and if attempted results in 6 being set. For designs with APB_DATA_WIDTH == 8 the order of programming is important to ensure the correct operation of the DW_apb_i2c. The lower byte must be programmed first. Then the upper byte is programmed. + [15:0] + read-write + + + + + IC_FS_SCL_LCNT + 0x00000020 + Fast Mode or Fast Mode Plus I2C Clock SCL Low Count Register + 0x0000000d + + + IC_FS_SCL_LCNT + This register must be set before any I2C bus transaction can take place to ensure proper I/O timing. This register sets the SCL clock low period count for fast speed. It is used in high-speed mode to send the Master Code and START BYTE or General CALL. For more information, refer to 'IC_CLK Frequency Configuration'. + + This register goes away and becomes read-only returning 0s if IC_MAX_SPEED_MODE = standard. + + This register can be written only when the I2C interface is disabled, which corresponds to the IC_ENABLE[0] register being set to 0. Writes at other times have no effect. + + The minimum valid value is 8; hardware prevents values less than this being written, and if attempted results in 8 being set. For designs with APB_DATA_WIDTH = 8 the order of programming is important to ensure the correct operation of the DW_apb_i2c. The lower byte must be programmed first. Then the upper byte is programmed. If the value is less than 8 then the count value gets changed to 8. + [15:0] + read-write + + + + + IC_INTR_STAT + 0x0000002c + I2C Interrupt Status Register + + Each bit in this register has a corresponding mask bit in the IC_INTR_MASK register. These bits are cleared by reading the matching interrupt clear register. The unmasked raw versions of these bits are available in the IC_RAW_INTR_STAT register. + 0x00000000 + + + R_RESTART_DET + See IC_RAW_INTR_STAT for a detailed description of R_RESTART_DET bit. + + Reset value: 0x0 + [12:12] + read-only + + + INACTIVE + 0 + R_RESTART_DET interrupt is inactive + + + ACTIVE + 1 + R_RESTART_DET interrupt is active + + + + + R_GEN_CALL + See IC_RAW_INTR_STAT for a detailed description of R_GEN_CALL bit. + + Reset value: 0x0 + [11:11] + read-only + + + INACTIVE + 0 + R_GEN_CALL interrupt is inactive + + + ACTIVE + 1 + R_GEN_CALL interrupt is active + + + + + R_START_DET + See IC_RAW_INTR_STAT for a detailed description of R_START_DET bit. + + Reset value: 0x0 + [10:10] + read-only + + + INACTIVE + 0 + R_START_DET interrupt is inactive + + + ACTIVE + 1 + R_START_DET interrupt is active + + + + + R_STOP_DET + See IC_RAW_INTR_STAT for a detailed description of R_STOP_DET bit. + + Reset value: 0x0 + [9:9] + read-only + + + INACTIVE + 0 + R_STOP_DET interrupt is inactive + + + ACTIVE + 1 + R_STOP_DET interrupt is active + + + + + R_ACTIVITY + See IC_RAW_INTR_STAT for a detailed description of R_ACTIVITY bit. + + Reset value: 0x0 + [8:8] + read-only + + + INACTIVE + 0 + R_ACTIVITY interrupt is inactive + + + ACTIVE + 1 + R_ACTIVITY interrupt is active + + + + + R_RX_DONE + See IC_RAW_INTR_STAT for a detailed description of R_RX_DONE bit. + + Reset value: 0x0 + [7:7] + read-only + + + INACTIVE + 0 + R_RX_DONE interrupt is inactive + + + ACTIVE + 1 + R_RX_DONE interrupt is active + + + + + R_TX_ABRT + See IC_RAW_INTR_STAT for a detailed description of R_TX_ABRT bit. + + Reset value: 0x0 + [6:6] + read-only + + + INACTIVE + 0 + R_TX_ABRT interrupt is inactive + + + ACTIVE + 1 + R_TX_ABRT interrupt is active + + + + + R_RD_REQ + See IC_RAW_INTR_STAT for a detailed description of R_RD_REQ bit. + + Reset value: 0x0 + [5:5] + read-only + + + INACTIVE + 0 + R_RD_REQ interrupt is inactive + + + ACTIVE + 1 + R_RD_REQ interrupt is active + + + + + R_TX_EMPTY + See IC_RAW_INTR_STAT for a detailed description of R_TX_EMPTY bit. + + Reset value: 0x0 + [4:4] + read-only + + + INACTIVE + 0 + R_TX_EMPTY interrupt is inactive + + + ACTIVE + 1 + R_TX_EMPTY interrupt is active + + + + + R_TX_OVER + See IC_RAW_INTR_STAT for a detailed description of R_TX_OVER bit. + + Reset value: 0x0 + [3:3] + read-only + + + INACTIVE + 0 + R_TX_OVER interrupt is inactive + + + ACTIVE + 1 + R_TX_OVER interrupt is active + + + + + R_RX_FULL + See IC_RAW_INTR_STAT for a detailed description of R_RX_FULL bit. + + Reset value: 0x0 + [2:2] + read-only + + + INACTIVE + 0 + R_RX_FULL interrupt is inactive + + + ACTIVE + 1 + R_RX_FULL interrupt is active + + + + + R_RX_OVER + See IC_RAW_INTR_STAT for a detailed description of R_RX_OVER bit. + + Reset value: 0x0 + [1:1] + read-only + + + INACTIVE + 0 + R_RX_OVER interrupt is inactive + + + ACTIVE + 1 + R_RX_OVER interrupt is active + + + + + R_RX_UNDER + See IC_RAW_INTR_STAT for a detailed description of R_RX_UNDER bit. + + Reset value: 0x0 + [0:0] + read-only + + + INACTIVE + 0 + RX_UNDER interrupt is inactive + + + ACTIVE + 1 + RX_UNDER interrupt is active + + + + + + + IC_INTR_MASK + 0x00000030 + I2C Interrupt Mask Register. + + These bits mask their corresponding interrupt status bits. This register is active low; a value of 0 masks the interrupt, whereas a value of 1 unmasks the interrupt. + 0x000008ff + + + M_RESTART_DET + This bit masks the R_RESTART_DET interrupt in IC_INTR_STAT register. + + Reset value: 0x0 + [12:12] + read-write + + + ENABLED + 0 + RESTART_DET interrupt is masked + + + DISABLED + 1 + RESTART_DET interrupt is unmasked + + + + + M_GEN_CALL + This bit masks the R_GEN_CALL interrupt in IC_INTR_STAT register. + + Reset value: 0x1 + [11:11] + read-write + + + ENABLED + 0 + GEN_CALL interrupt is masked + + + DISABLED + 1 + GEN_CALL interrupt is unmasked + + + + + M_START_DET + This bit masks the R_START_DET interrupt in IC_INTR_STAT register. + + Reset value: 0x0 + [10:10] + read-write + + + ENABLED + 0 + START_DET interrupt is masked + + + DISABLED + 1 + START_DET interrupt is unmasked + + + + + M_STOP_DET + This bit masks the R_STOP_DET interrupt in IC_INTR_STAT register. + + Reset value: 0x0 + [9:9] + read-write + + + ENABLED + 0 + STOP_DET interrupt is masked + + + DISABLED + 1 + STOP_DET interrupt is unmasked + + + + + M_ACTIVITY + This bit masks the R_ACTIVITY interrupt in IC_INTR_STAT register. + + Reset value: 0x0 + [8:8] + read-write + + + ENABLED + 0 + ACTIVITY interrupt is masked + + + DISABLED + 1 + ACTIVITY interrupt is unmasked + + + + + M_RX_DONE + This bit masks the R_RX_DONE interrupt in IC_INTR_STAT register. + + Reset value: 0x1 + [7:7] + read-write + + + ENABLED + 0 + RX_DONE interrupt is masked + + + DISABLED + 1 + RX_DONE interrupt is unmasked + + + + + M_TX_ABRT + This bit masks the R_TX_ABRT interrupt in IC_INTR_STAT register. + + Reset value: 0x1 + [6:6] + read-write + + + ENABLED + 0 + TX_ABORT interrupt is masked + + + DISABLED + 1 + TX_ABORT interrupt is unmasked + + + + + M_RD_REQ + This bit masks the R_RD_REQ interrupt in IC_INTR_STAT register. + + Reset value: 0x1 + [5:5] + read-write + + + ENABLED + 0 + RD_REQ interrupt is masked + + + DISABLED + 1 + RD_REQ interrupt is unmasked + + + + + M_TX_EMPTY + This bit masks the R_TX_EMPTY interrupt in IC_INTR_STAT register. + + Reset value: 0x1 + [4:4] + read-write + + + ENABLED + 0 + TX_EMPTY interrupt is masked + + + DISABLED + 1 + TX_EMPTY interrupt is unmasked + + + + + M_TX_OVER + This bit masks the R_TX_OVER interrupt in IC_INTR_STAT register. + + Reset value: 0x1 + [3:3] + read-write + + + ENABLED + 0 + TX_OVER interrupt is masked + + + DISABLED + 1 + TX_OVER interrupt is unmasked + + + + + M_RX_FULL + This bit masks the R_RX_FULL interrupt in IC_INTR_STAT register. + + Reset value: 0x1 + [2:2] + read-write + + + ENABLED + 0 + RX_FULL interrupt is masked + + + DISABLED + 1 + RX_FULL interrupt is unmasked + + + + + M_RX_OVER + This bit masks the R_RX_OVER interrupt in IC_INTR_STAT register. + + Reset value: 0x1 + [1:1] + read-write + + + ENABLED + 0 + RX_OVER interrupt is masked + + + DISABLED + 1 + RX_OVER interrupt is unmasked + + + + + M_RX_UNDER + This bit masks the R_RX_UNDER interrupt in IC_INTR_STAT register. + + Reset value: 0x1 + [0:0] + read-write + + + ENABLED + 0 + RX_UNDER interrupt is masked + + + DISABLED + 1 + RX_UNDER interrupt is unmasked + + + + + + + IC_RAW_INTR_STAT + 0x00000034 + I2C Raw Interrupt Status Register + + Unlike the IC_INTR_STAT register, these bits are not masked so they always show the true status of the DW_apb_i2c. + 0x00000000 + + + RESTART_DET + Indicates whether a RESTART condition has occurred on the I2C interface when DW_apb_i2c is operating in Slave mode and the slave is being addressed. Enabled only when IC_SLV_RESTART_DET_EN=1. + + Note: However, in high-speed mode or during a START BYTE transfer, the RESTART comes before the address field as per the I2C protocol. In this case, the slave is not the addressed slave when the RESTART is issued, therefore DW_apb_i2c does not generate the RESTART_DET interrupt. + + Reset value: 0x0 + [12:12] + read-only + + + INACTIVE + 0 + RESTART_DET interrupt is inactive + + + ACTIVE + 1 + RESTART_DET interrupt is active + + + + + GEN_CALL + Set only when a General Call address is received and it is acknowledged. It stays set until it is cleared either by disabling DW_apb_i2c or when the CPU reads bit 0 of the IC_CLR_GEN_CALL register. DW_apb_i2c stores the received data in the Rx buffer. + + Reset value: 0x0 + [11:11] + read-only + + + INACTIVE + 0 + GEN_CALL interrupt is inactive + + + ACTIVE + 1 + GEN_CALL interrupt is active + + + + + START_DET + Indicates whether a START or RESTART condition has occurred on the I2C interface regardless of whether DW_apb_i2c is operating in slave or master mode. + + Reset value: 0x0 + [10:10] + read-only + + + INACTIVE + 0 + START_DET interrupt is inactive + + + ACTIVE + 1 + START_DET interrupt is active + + + + + STOP_DET + Indicates whether a STOP condition has occurred on the I2C interface regardless of whether DW_apb_i2c is operating in slave or master mode. + + In Slave Mode: - If IC_CON[7]=1'b1 (STOP_DET_IFADDRESSED), the STOP_DET interrupt will be issued only if slave is addressed. Note: During a general call address, this slave does not issue a STOP_DET interrupt if STOP_DET_IF_ADDRESSED=1'b1, even if the slave responds to the general call address by generating ACK. The STOP_DET interrupt is generated only when the transmitted address matches the slave address (SAR). - If IC_CON[7]=1'b0 (STOP_DET_IFADDRESSED), the STOP_DET interrupt is issued irrespective of whether it is being addressed. In Master Mode: - If IC_CON[10]=1'b1 (STOP_DET_IF_MASTER_ACTIVE),the STOP_DET interrupt will be issued only if Master is active. - If IC_CON[10]=1'b0 (STOP_DET_IFADDRESSED),the STOP_DET interrupt will be issued irrespective of whether master is active or not. Reset value: 0x0 + [9:9] + read-only + + + INACTIVE + 0 + STOP_DET interrupt is inactive + + + ACTIVE + 1 + STOP_DET interrupt is active + + + + + ACTIVITY + This bit captures DW_apb_i2c activity and stays set until it is cleared. There are four ways to clear it: - Disabling the DW_apb_i2c - Reading the IC_CLR_ACTIVITY register - Reading the IC_CLR_INTR register - System reset Once this bit is set, it stays set unless one of the four methods is used to clear it. Even if the DW_apb_i2c module is idle, this bit remains set until cleared, indicating that there was activity on the bus. + + Reset value: 0x0 + [8:8] + read-only + + + INACTIVE + 0 + RAW_INTR_ACTIVITY interrupt is inactive + + + ACTIVE + 1 + RAW_INTR_ACTIVITY interrupt is active + + + + + RX_DONE + When the DW_apb_i2c is acting as a slave-transmitter, this bit is set to 1 if the master does not acknowledge a transmitted byte. This occurs on the last byte of the transmission, indicating that the transmission is done. + + Reset value: 0x0 + [7:7] + read-only + + + INACTIVE + 0 + RX_DONE interrupt is inactive + + + ACTIVE + 1 + RX_DONE interrupt is active + + + + + TX_ABRT + This bit indicates if DW_apb_i2c, as an I2C transmitter, is unable to complete the intended actions on the contents of the transmit FIFO. This situation can occur both as an I2C master or an I2C slave, and is referred to as a 'transmit abort'. When this bit is set to 1, the IC_TX_ABRT_SOURCE register indicates the reason why the transmit abort takes places. + + Note: The DW_apb_i2c flushes/resets/empties the TX_FIFO and RX_FIFO whenever there is a transmit abort caused by any of the events tracked by the IC_TX_ABRT_SOURCE register. The FIFOs remains in this flushed state until the register IC_CLR_TX_ABRT is read. Once this read is performed, the Tx FIFO is then ready to accept more data bytes from the APB interface. + + Reset value: 0x0 + [6:6] + read-only + + + INACTIVE + 0 + TX_ABRT interrupt is inactive + + + ACTIVE + 1 + TX_ABRT interrupt is active + + + + + RD_REQ + This bit is set to 1 when DW_apb_i2c is acting as a slave and another I2C master is attempting to read data from DW_apb_i2c. The DW_apb_i2c holds the I2C bus in a wait state (SCL=0) until this interrupt is serviced, which means that the slave has been addressed by a remote master that is asking for data to be transferred. The processor must respond to this interrupt and then write the requested data to the IC_DATA_CMD register. This bit is set to 0 just after the processor reads the IC_CLR_RD_REQ register. + + Reset value: 0x0 + [5:5] + read-only + + + INACTIVE + 0 + RD_REQ interrupt is inactive + + + ACTIVE + 1 + RD_REQ interrupt is active + + + + + TX_EMPTY + The behavior of the TX_EMPTY interrupt status differs based on the TX_EMPTY_CTRL selection in the IC_CON register. - When TX_EMPTY_CTRL = 0: This bit is set to 1 when the transmit buffer is at or below the threshold value set in the IC_TX_TL register. - When TX_EMPTY_CTRL = 1: This bit is set to 1 when the transmit buffer is at or below the threshold value set in the IC_TX_TL register and the transmission of the address/data from the internal shift register for the most recently popped command is completed. It is automatically cleared by hardware when the buffer level goes above the threshold. When IC_ENABLE[0] is set to 0, the TX FIFO is flushed and held in reset. There the TX FIFO looks like it has no data within it, so this bit is set to 1, provided there is activity in the master or slave state machines. When there is no longer any activity, then with ic_en=0, this bit is set to 0. + + Reset value: 0x0. + [4:4] + read-only + + + INACTIVE + 0 + TX_EMPTY interrupt is inactive + + + ACTIVE + 1 + TX_EMPTY interrupt is active + + + + + TX_OVER + Set during transmit if the transmit buffer is filled to IC_TX_BUFFER_DEPTH and the processor attempts to issue another I2C command by writing to the IC_DATA_CMD register. When the module is disabled, this bit keeps its level until the master or slave state machines go into idle, and when ic_en goes to 0, this interrupt is cleared. + + Reset value: 0x0 + [3:3] + read-only + + + INACTIVE + 0 + TX_OVER interrupt is inactive + + + ACTIVE + 1 + TX_OVER interrupt is active + + + + + RX_FULL + Set when the receive buffer reaches or goes above the RX_TL threshold in the IC_RX_TL register. It is automatically cleared by hardware when buffer level goes below the threshold. If the module is disabled (IC_ENABLE[0]=0), the RX FIFO is flushed and held in reset; therefore the RX FIFO is not full. So this bit is cleared once the IC_ENABLE bit 0 is programmed with a 0, regardless of the activity that continues. + + Reset value: 0x0 + [2:2] + read-only + + + INACTIVE + 0 + RX_FULL interrupt is inactive + + + ACTIVE + 1 + RX_FULL interrupt is active + + + + + RX_OVER + Set if the receive buffer is completely filled to IC_RX_BUFFER_DEPTH and an additional byte is received from an external I2C device. The DW_apb_i2c acknowledges this, but any data bytes received after the FIFO is full are lost. If the module is disabled (IC_ENABLE[0]=0), this bit keeps its level until the master or slave state machines go into idle, and when ic_en goes to 0, this interrupt is cleared. + + Note: If bit 9 of the IC_CON register (RX_FIFO_FULL_HLD_CTRL) is programmed to HIGH, then the RX_OVER interrupt never occurs, because the Rx FIFO never overflows. + + Reset value: 0x0 + [1:1] + read-only + + + INACTIVE + 0 + RX_OVER interrupt is inactive + + + ACTIVE + 1 + RX_OVER interrupt is active + + + + + RX_UNDER + Set if the processor attempts to read the receive buffer when it is empty by reading from the IC_DATA_CMD register. If the module is disabled (IC_ENABLE[0]=0), this bit keeps its level until the master or slave state machines go into idle, and when ic_en goes to 0, this interrupt is cleared. + + Reset value: 0x0 + [0:0] + read-only + + + INACTIVE + 0 + RX_UNDER interrupt is inactive + + + ACTIVE + 1 + RX_UNDER interrupt is active + + + + + + + IC_RX_TL + 0x00000038 + I2C Receive FIFO Threshold Register + 0x00000000 + + + RX_TL + Receive FIFO Threshold Level. + + Controls the level of entries (or above) that triggers the RX_FULL interrupt (bit 2 in IC_RAW_INTR_STAT register). The valid range is 0-255, with the additional restriction that hardware does not allow this value to be set to a value larger than the depth of the buffer. If an attempt is made to do that, the actual value set will be the maximum depth of the buffer. A value of 0 sets the threshold for 1 entry, and a value of 255 sets the threshold for 256 entries. + [7:0] + read-write + + + + + IC_TX_TL + 0x0000003c + I2C Transmit FIFO Threshold Register + 0x00000000 + + + TX_TL + Transmit FIFO Threshold Level. + + Controls the level of entries (or below) that trigger the TX_EMPTY interrupt (bit 4 in IC_RAW_INTR_STAT register). The valid range is 0-255, with the additional restriction that it may not be set to value larger than the depth of the buffer. If an attempt is made to do that, the actual value set will be the maximum depth of the buffer. A value of 0 sets the threshold for 0 entries, and a value of 255 sets the threshold for 255 entries. + [7:0] + read-write + + + + + IC_CLR_INTR + 0x00000040 + Clear Combined and Individual Interrupt Register + 0x00000000 + + + CLR_INTR + Read this register to clear the combined interrupt, all individual interrupts, and the IC_TX_ABRT_SOURCE register. This bit does not clear hardware clearable interrupts but software clearable interrupts. Refer to Bit 9 of the IC_TX_ABRT_SOURCE register for an exception to clearing IC_TX_ABRT_SOURCE. + + Reset value: 0x0 + [0:0] + read-only + + + + + IC_CLR_RX_UNDER + 0x00000044 + Clear RX_UNDER Interrupt Register + 0x00000000 + + + CLR_RX_UNDER + Read this register to clear the RX_UNDER interrupt (bit 0) of the IC_RAW_INTR_STAT register. + + Reset value: 0x0 + [0:0] + read-only + + + + + IC_CLR_RX_OVER + 0x00000048 + Clear RX_OVER Interrupt Register + 0x00000000 + + + CLR_RX_OVER + Read this register to clear the RX_OVER interrupt (bit 1) of the IC_RAW_INTR_STAT register. + + Reset value: 0x0 + [0:0] + read-only + + + + + IC_CLR_TX_OVER + 0x0000004c + Clear TX_OVER Interrupt Register + 0x00000000 + + + CLR_TX_OVER + Read this register to clear the TX_OVER interrupt (bit 3) of the IC_RAW_INTR_STAT register. + + Reset value: 0x0 + [0:0] + read-only + + + + + IC_CLR_RD_REQ + 0x00000050 + Clear RD_REQ Interrupt Register + 0x00000000 + + + CLR_RD_REQ + Read this register to clear the RD_REQ interrupt (bit 5) of the IC_RAW_INTR_STAT register. + + Reset value: 0x0 + [0:0] + read-only + + + + + IC_CLR_TX_ABRT + 0x00000054 + Clear TX_ABRT Interrupt Register + 0x00000000 + + + CLR_TX_ABRT + Read this register to clear the TX_ABRT interrupt (bit 6) of the IC_RAW_INTR_STAT register, and the IC_TX_ABRT_SOURCE register. This also releases the TX FIFO from the flushed/reset state, allowing more writes to the TX FIFO. Refer to Bit 9 of the IC_TX_ABRT_SOURCE register for an exception to clearing IC_TX_ABRT_SOURCE. + + Reset value: 0x0 + [0:0] + read-only + + + + + IC_CLR_RX_DONE + 0x00000058 + Clear RX_DONE Interrupt Register + 0x00000000 + + + CLR_RX_DONE + Read this register to clear the RX_DONE interrupt (bit 7) of the IC_RAW_INTR_STAT register. + + Reset value: 0x0 + [0:0] + read-only + + + + + IC_CLR_ACTIVITY + 0x0000005c + Clear ACTIVITY Interrupt Register + 0x00000000 + + + CLR_ACTIVITY + Reading this register clears the ACTIVITY interrupt if the I2C is not active anymore. If the I2C module is still active on the bus, the ACTIVITY interrupt bit continues to be set. It is automatically cleared by hardware if the module is disabled and if there is no further activity on the bus. The value read from this register to get status of the ACTIVITY interrupt (bit 8) of the IC_RAW_INTR_STAT register. + + Reset value: 0x0 + [0:0] + read-only + + + + + IC_CLR_STOP_DET + 0x00000060 + Clear STOP_DET Interrupt Register + 0x00000000 + + + CLR_STOP_DET + Read this register to clear the STOP_DET interrupt (bit 9) of the IC_RAW_INTR_STAT register. + + Reset value: 0x0 + [0:0] + read-only + + + + + IC_CLR_START_DET + 0x00000064 + Clear START_DET Interrupt Register + 0x00000000 + + + CLR_START_DET + Read this register to clear the START_DET interrupt (bit 10) of the IC_RAW_INTR_STAT register. + + Reset value: 0x0 + [0:0] + read-only + + + + + IC_CLR_GEN_CALL + 0x00000068 + Clear GEN_CALL Interrupt Register + 0x00000000 + + + CLR_GEN_CALL + Read this register to clear the GEN_CALL interrupt (bit 11) of IC_RAW_INTR_STAT register. + + Reset value: 0x0 + [0:0] + read-only + + + + + IC_ENABLE + 0x0000006c + I2C Enable Register + 0x00000000 + + + TX_CMD_BLOCK + In Master mode: - 1'b1: Blocks the transmission of data on I2C bus even if Tx FIFO has data to transmit. - 1'b0: The transmission of data starts on I2C bus automatically, as soon as the first data is available in the Tx FIFO. Note: To block the execution of Master commands, set the TX_CMD_BLOCK bit only when Tx FIFO is empty (IC_STATUS[2]==1) and Master is in Idle state (IC_STATUS[5] == 0). Any further commands put in the Tx FIFO are not executed until TX_CMD_BLOCK bit is unset. Reset value: IC_TX_CMD_BLOCK_DEFAULT + [2:2] + read-write + + + NOT_BLOCKED + 0 + Tx Command execution not blocked + + + BLOCKED + 1 + Tx Command execution blocked + + + + + ABORT + When set, the controller initiates the transfer abort. - 0: ABORT not initiated or ABORT done - 1: ABORT operation in progress The software can abort the I2C transfer in master mode by setting this bit. The software can set this bit only when ENABLE is already set; otherwise, the controller ignores any write to ABORT bit. The software cannot clear the ABORT bit once set. In response to an ABORT, the controller issues a STOP and flushes the Tx FIFO after completing the current transfer, then sets the TX_ABORT interrupt after the abort operation. The ABORT bit is cleared automatically after the abort operation. + + For a detailed description on how to abort I2C transfers, refer to 'Aborting I2C Transfers'. + + Reset value: 0x0 + [1:1] + read-write + + + DISABLE + 0 + ABORT operation not in progress + + + ENABLED + 1 + ABORT operation in progress + + + + + ENABLE + Controls whether the DW_apb_i2c is enabled. - 0: Disables DW_apb_i2c (TX and RX FIFOs are held in an erased state) - 1: Enables DW_apb_i2c Software can disable DW_apb_i2c while it is active. However, it is important that care be taken to ensure that DW_apb_i2c is disabled properly. A recommended procedure is described in 'Disabling DW_apb_i2c'. + + When DW_apb_i2c is disabled, the following occurs: - The TX FIFO and RX FIFO get flushed. - Status bits in the IC_INTR_STAT register are still active until DW_apb_i2c goes into IDLE state. If the module is transmitting, it stops as well as deletes the contents of the transmit buffer after the current transfer is complete. If the module is receiving, the DW_apb_i2c stops the current transfer at the end of the current byte and does not acknowledge the transfer. + + In systems with asynchronous pclk and ic_clk when IC_CLK_TYPE parameter set to asynchronous (1), there is a two ic_clk delay when enabling or disabling the DW_apb_i2c. For a detailed description on how to disable DW_apb_i2c, refer to 'Disabling DW_apb_i2c' + + Reset value: 0x0 + [0:0] + read-write + + + DISABLED + 0 + I2C is disabled + + + ENABLED + 1 + I2C is enabled + + + + + + + IC_STATUS + 0x00000070 + I2C Status Register + + This is a read-only register used to indicate the current transfer status and FIFO status. The status register may be read at any time. None of the bits in this register request an interrupt. + + When the I2C is disabled by writing 0 in bit 0 of the IC_ENABLE register: - Bits 1 and 2 are set to 1 - Bits 3 and 10 are set to 0 When the master or slave state machines goes to idle and ic_en=0: - Bits 5 and 6 are set to 0 + 0x00000006 + + + SLV_ACTIVITY + Slave FSM Activity Status. When the Slave Finite State Machine (FSM) is not in the IDLE state, this bit is set. - 0: Slave FSM is in IDLE state so the Slave part of DW_apb_i2c is not Active - 1: Slave FSM is not in IDLE state so the Slave part of DW_apb_i2c is Active Reset value: 0x0 + [6:6] + read-only + + + IDLE + 0 + Slave is idle + + + ACTIVE + 1 + Slave not idle + + + + + MST_ACTIVITY + Master FSM Activity Status. When the Master Finite State Machine (FSM) is not in the IDLE state, this bit is set. - 0: Master FSM is in IDLE state so the Master part of DW_apb_i2c is not Active - 1: Master FSM is not in IDLE state so the Master part of DW_apb_i2c is Active Note: IC_STATUS[0]-that is, ACTIVITY bit-is the OR of SLV_ACTIVITY and MST_ACTIVITY bits. + + Reset value: 0x0 + [5:5] + read-only + + + IDLE + 0 + Master is idle + + + ACTIVE + 1 + Master not idle + + + + + RFF + Receive FIFO Completely Full. When the receive FIFO is completely full, this bit is set. When the receive FIFO contains one or more empty location, this bit is cleared. - 0: Receive FIFO is not full - 1: Receive FIFO is full Reset value: 0x0 + [4:4] + read-only + + + NOT_FULL + 0 + Rx FIFO not full + + + FULL + 1 + Rx FIFO is full + + + + + RFNE + Receive FIFO Not Empty. This bit is set when the receive FIFO contains one or more entries; it is cleared when the receive FIFO is empty. - 0: Receive FIFO is empty - 1: Receive FIFO is not empty Reset value: 0x0 + [3:3] + read-only + + + EMPTY + 0 + Rx FIFO is empty + + + NOT_EMPTY + 1 + Rx FIFO not empty + + + + + TFE + Transmit FIFO Completely Empty. When the transmit FIFO is completely empty, this bit is set. When it contains one or more valid entries, this bit is cleared. This bit field does not request an interrupt. - 0: Transmit FIFO is not empty - 1: Transmit FIFO is empty Reset value: 0x1 + [2:2] + read-only + + + NON_EMPTY + 0 + Tx FIFO not empty + + + EMPTY + 1 + Tx FIFO is empty + + + + + TFNF + Transmit FIFO Not Full. Set when the transmit FIFO contains one or more empty locations, and is cleared when the FIFO is full. - 0: Transmit FIFO is full - 1: Transmit FIFO is not full Reset value: 0x1 + [1:1] + read-only + + + FULL + 0 + Tx FIFO is full + + + NOT_FULL + 1 + Tx FIFO not full + + + + + ACTIVITY + I2C Activity Status. Reset value: 0x0 + [0:0] + read-only + + + INACTIVE + 0 + I2C is idle + + + ACTIVE + 1 + I2C is active + + + + + + + IC_TXFLR + 0x00000074 + I2C Transmit FIFO Level Register This register contains the number of valid data entries in the transmit FIFO buffer. It is cleared whenever: - The I2C is disabled - There is a transmit abort - that is, TX_ABRT bit is set in the IC_RAW_INTR_STAT register - The slave bulk transmit mode is aborted The register increments whenever data is placed into the transmit FIFO and decrements when data is taken from the transmit FIFO. + 0x00000000 + + + TXFLR + Transmit FIFO Level. Contains the number of valid data entries in the transmit FIFO. + + Reset value: 0x0 + [4:0] + read-only + + + + + IC_RXFLR + 0x00000078 + I2C Receive FIFO Level Register This register contains the number of valid data entries in the receive FIFO buffer. It is cleared whenever: - The I2C is disabled - Whenever there is a transmit abort caused by any of the events tracked in IC_TX_ABRT_SOURCE The register increments whenever data is placed into the receive FIFO and decrements when data is taken from the receive FIFO. + 0x00000000 + + + RXFLR + Receive FIFO Level. Contains the number of valid data entries in the receive FIFO. + + Reset value: 0x0 + [4:0] + read-only + + + + + IC_SDA_HOLD + 0x0000007c + I2C SDA Hold Time Length Register + + The bits [15:0] of this register are used to control the hold time of SDA during transmit in both slave and master mode (after SCL goes from HIGH to LOW). + + The bits [23:16] of this register are used to extend the SDA transition (if any) whenever SCL is HIGH in the receiver in either master or slave mode. + + Writes to this register succeed only when IC_ENABLE[0]=0. + + The values in this register are in units of ic_clk period. The value programmed in IC_SDA_TX_HOLD must be greater than the minimum hold time in each mode (one cycle in master mode, seven cycles in slave mode) for the value to be implemented. + + The programmed SDA hold time during transmit (IC_SDA_TX_HOLD) cannot exceed at any time the duration of the low part of scl. Therefore the programmed value cannot be larger than N_SCL_LOW-2, where N_SCL_LOW is the duration of the low part of the scl period measured in ic_clk cycles. + 0x00000001 + + + IC_SDA_RX_HOLD + Sets the required SDA hold time in units of ic_clk period, when DW_apb_i2c acts as a receiver. + + Reset value: IC_DEFAULT_SDA_HOLD[23:16]. + [23:16] + read-write + + + IC_SDA_TX_HOLD + Sets the required SDA hold time in units of ic_clk period, when DW_apb_i2c acts as a transmitter. + + Reset value: IC_DEFAULT_SDA_HOLD[15:0]. + [15:0] + read-write + + + + + IC_TX_ABRT_SOURCE + 0x00000080 + I2C Transmit Abort Source Register + + This register has 32 bits that indicate the source of the TX_ABRT bit. Except for Bit 9, this register is cleared whenever the IC_CLR_TX_ABRT register or the IC_CLR_INTR register is read. To clear Bit 9, the source of the ABRT_SBYTE_NORSTRT must be fixed first; RESTART must be enabled (IC_CON[5]=1), the SPECIAL bit must be cleared (IC_TAR[11]), or the GC_OR_START bit must be cleared (IC_TAR[10]). + + Once the source of the ABRT_SBYTE_NORSTRT is fixed, then this bit can be cleared in the same manner as other bits in this register. If the source of the ABRT_SBYTE_NORSTRT is not fixed before attempting to clear this bit, Bit 9 clears for one cycle and is then re-asserted. + 0x00000000 + + + TX_FLUSH_CNT + This field indicates the number of Tx FIFO Data Commands which are flushed due to TX_ABRT interrupt. It is cleared whenever I2C is disabled. + + Reset value: 0x0 + + Role of DW_apb_i2c: Master-Transmitter or Slave-Transmitter + [31:23] + read-only + + + ABRT_USER_ABRT + This is a master-mode-only bit. Master has detected the transfer abort (IC_ENABLE[1]) + + Reset value: 0x0 + + Role of DW_apb_i2c: Master-Transmitter + [16:16] + read-only + + + ABRT_USER_ABRT_VOID + 0 + Transfer abort detected by master- scenario not present + + + ABRT_USER_ABRT_GENERATED + 1 + Transfer abort detected by master + + + + + ABRT_SLVRD_INTX + 1: When the processor side responds to a slave mode request for data to be transmitted to a remote master and user writes a 1 in CMD (bit 8) of IC_DATA_CMD register. + + Reset value: 0x0 + + Role of DW_apb_i2c: Slave-Transmitter + [15:15] + read-only + + + ABRT_SLVRD_INTX_VOID + 0 + Slave trying to transmit to remote master in read mode- scenario not present + + + ABRT_SLVRD_INTX_GENERATED + 1 + Slave trying to transmit to remote master in read mode + + + + + ABRT_SLV_ARBLOST + This field indicates that a Slave has lost the bus while transmitting data to a remote master. IC_TX_ABRT_SOURCE[12] is set at the same time. Note: Even though the slave never 'owns' the bus, something could go wrong on the bus. This is a fail safe check. For instance, during a data transmission at the low-to-high transition of SCL, if what is on the data bus is not what is supposed to be transmitted, then DW_apb_i2c no longer own the bus. + + Reset value: 0x0 + + Role of DW_apb_i2c: Slave-Transmitter + [14:14] + read-only + + + ABRT_SLV_ARBLOST_VOID + 0 + Slave lost arbitration to remote master- scenario not present + + + ABRT_SLV_ARBLOST_GENERATED + 1 + Slave lost arbitration to remote master + + + + + ABRT_SLVFLUSH_TXFIFO + This field specifies that the Slave has received a read command and some data exists in the TX FIFO, so the slave issues a TX_ABRT interrupt to flush old data in TX FIFO. + + Reset value: 0x0 + + Role of DW_apb_i2c: Slave-Transmitter + [13:13] + read-only + + + ABRT_SLVFLUSH_TXFIFO_VOID + 0 + Slave flushes existing data in TX-FIFO upon getting read command- scenario not present + + + ABRT_SLVFLUSH_TXFIFO_GENERATED + 1 + Slave flushes existing data in TX-FIFO upon getting read command + + + + + ARB_LOST + This field specifies that the Master has lost arbitration, or if IC_TX_ABRT_SOURCE[14] is also set, then the slave transmitter has lost arbitration. + + Reset value: 0x0 + + Role of DW_apb_i2c: Master-Transmitter or Slave-Transmitter + [12:12] + read-only + + + ABRT_LOST_VOID + 0 + Master or Slave-Transmitter lost arbitration- scenario not present + + + ABRT_LOST_GENERATED + 1 + Master or Slave-Transmitter lost arbitration + + + + + ABRT_MASTER_DIS + This field indicates that the User tries to initiate a Master operation with the Master mode disabled. + + Reset value: 0x0 + + Role of DW_apb_i2c: Master-Transmitter or Master-Receiver + [11:11] + read-only + + + ABRT_MASTER_DIS_VOID + 0 + User initiating master operation when MASTER disabled- scenario not present + + + ABRT_MASTER_DIS_GENERATED + 1 + User initiating master operation when MASTER disabled + + + + + ABRT_10B_RD_NORSTRT + This field indicates that the restart is disabled (IC_RESTART_EN bit (IC_CON[5]) =0) and the master sends a read command in 10-bit addressing mode. + + Reset value: 0x0 + + Role of DW_apb_i2c: Master-Receiver + [10:10] + read-only + + + ABRT_10B_RD_VOID + 0 + Master not trying to read in 10Bit addressing mode when RESTART disabled + + + ABRT_10B_RD_GENERATED + 1 + Master trying to read in 10Bit addressing mode when RESTART disabled + + + + + ABRT_SBYTE_NORSTRT + To clear Bit 9, the source of the ABRT_SBYTE_NORSTRT must be fixed first; restart must be enabled (IC_CON[5]=1), the SPECIAL bit must be cleared (IC_TAR[11]), or the GC_OR_START bit must be cleared (IC_TAR[10]). Once the source of the ABRT_SBYTE_NORSTRT is fixed, then this bit can be cleared in the same manner as other bits in this register. If the source of the ABRT_SBYTE_NORSTRT is not fixed before attempting to clear this bit, bit 9 clears for one cycle and then gets reasserted. When this field is set to 1, the restart is disabled (IC_RESTART_EN bit (IC_CON[5]) =0) and the user is trying to send a START Byte. + + Reset value: 0x0 + + Role of DW_apb_i2c: Master + [9:9] + read-only + + + ABRT_SBYTE_NORSTRT_VOID + 0 + User trying to send START byte when RESTART disabled- scenario not present + + + ABRT_SBYTE_NORSTRT_GENERATED + 1 + User trying to send START byte when RESTART disabled + + + + + ABRT_HS_NORSTRT + This field indicates that the restart is disabled (IC_RESTART_EN bit (IC_CON[5]) =0) and the user is trying to use the master to transfer data in High Speed mode. + + Reset value: 0x0 + + Role of DW_apb_i2c: Master-Transmitter or Master-Receiver + [8:8] + read-only + + + ABRT_HS_NORSTRT_VOID + 0 + User trying to switch Master to HS mode when RESTART disabled- scenario not present + + + ABRT_HS_NORSTRT_GENERATED + 1 + User trying to switch Master to HS mode when RESTART disabled + + + + + ABRT_SBYTE_ACKDET + This field indicates that the Master has sent a START Byte and the START Byte was acknowledged (wrong behavior). + + Reset value: 0x0 + + Role of DW_apb_i2c: Master + [7:7] + read-only + + + ABRT_SBYTE_ACKDET_VOID + 0 + ACK detected for START byte- scenario not present + + + ABRT_SBYTE_ACKDET_GENERATED + 1 + ACK detected for START byte + + + + + ABRT_HS_ACKDET + This field indicates that the Master is in High Speed mode and the High Speed Master code was acknowledged (wrong behavior). + + Reset value: 0x0 + + Role of DW_apb_i2c: Master + [6:6] + read-only + + + ABRT_HS_ACK_VOID + 0 + HS Master code ACKed in HS Mode- scenario not present + + + ABRT_HS_ACK_GENERATED + 1 + HS Master code ACKed in HS Mode + + + + + ABRT_GCALL_READ + This field indicates that DW_apb_i2c in the master mode has sent a General Call but the user programmed the byte following the General Call to be a read from the bus (IC_DATA_CMD[9] is set to 1). + + Reset value: 0x0 + + Role of DW_apb_i2c: Master-Transmitter + [5:5] + read-only + + + ABRT_GCALL_READ_VOID + 0 + GCALL is followed by read from bus-scenario not present + + + ABRT_GCALL_READ_GENERATED + 1 + GCALL is followed by read from bus + + + + + ABRT_GCALL_NOACK + This field indicates that DW_apb_i2c in master mode has sent a General Call and no slave on the bus acknowledged the General Call. + + Reset value: 0x0 + + Role of DW_apb_i2c: Master-Transmitter + [4:4] + read-only + + + ABRT_GCALL_NOACK_VOID + 0 + GCALL not ACKed by any slave-scenario not present + + + ABRT_GCALL_NOACK_GENERATED + 1 + GCALL not ACKed by any slave + + + + + ABRT_TXDATA_NOACK + This field indicates the master-mode only bit. When the master receives an acknowledgement for the address, but when it sends data byte(s) following the address, it did not receive an acknowledge from the remote slave(s). + + Reset value: 0x0 + + Role of DW_apb_i2c: Master-Transmitter + [3:3] + read-only + + + ABRT_TXDATA_NOACK_VOID + 0 + Transmitted data non-ACKed by addressed slave-scenario not present + + + ABRT_TXDATA_NOACK_GENERATED + 1 + Transmitted data not ACKed by addressed slave + + + + + ABRT_10ADDR2_NOACK + This field indicates that the Master is in 10-bit address mode and that the second address byte of the 10-bit address was not acknowledged by any slave. + + Reset value: 0x0 + + Role of DW_apb_i2c: Master-Transmitter or Master-Receiver + [2:2] + read-only + + + INACTIVE + 0 + This abort is not generated + + + ACTIVE + 1 + Byte 2 of 10Bit Address not ACKed by any slave + + + + + ABRT_10ADDR1_NOACK + This field indicates that the Master is in 10-bit address mode and the first 10-bit address byte was not acknowledged by any slave. + + Reset value: 0x0 + + Role of DW_apb_i2c: Master-Transmitter or Master-Receiver + [1:1] + read-only + + + INACTIVE + 0 + This abort is not generated + + + ACTIVE + 1 + Byte 1 of 10Bit Address not ACKed by any slave + + + + + ABRT_7B_ADDR_NOACK + This field indicates that the Master is in 7-bit addressing mode and the address sent was not acknowledged by any slave. + + Reset value: 0x0 + + Role of DW_apb_i2c: Master-Transmitter or Master-Receiver + [0:0] + read-only + + + INACTIVE + 0 + This abort is not generated + + + ACTIVE + 1 + This abort is generated because of NOACK for 7-bit address + + + + + + + IC_SLV_DATA_NACK_ONLY + 0x00000084 + Generate Slave Data NACK Register + + The register is used to generate a NACK for the data part of a transfer when DW_apb_i2c is acting as a slave-receiver. This register only exists when the IC_SLV_DATA_NACK_ONLY parameter is set to 1. When this parameter disabled, this register does not exist and writing to the register's address has no effect. + + A write can occur on this register if both of the following conditions are met: - DW_apb_i2c is disabled (IC_ENABLE[0] = 0) - Slave part is inactive (IC_STATUS[6] = 0) Note: The IC_STATUS[6] is a register read-back location for the internal slv_activity signal; the user should poll this before writing the ic_slv_data_nack_only bit. + 0x00000000 + + + NACK + Generate NACK. This NACK generation only occurs when DW_apb_i2c is a slave-receiver. If this register is set to a value of 1, it can only generate a NACK after a data byte is received; hence, the data transfer is aborted and the data received is not pushed to the receive buffer. + + When the register is set to a value of 0, it generates NACK/ACK, depending on normal criteria. - 1: generate NACK after data byte received - 0: generate NACK/ACK normally Reset value: 0x0 + [0:0] + read-write + + + DISABLED + 0 + Slave receiver generates NACK normally + + + ENABLED + 1 + Slave receiver generates NACK upon data reception only + + + + + + + IC_DMA_CR + 0x00000088 + DMA Control Register + + The register is used to enable the DMA Controller interface operation. There is a separate bit for transmit and receive. This can be programmed regardless of the state of IC_ENABLE. + 0x00000000 + + + TDMAE + Transmit DMA Enable. This bit enables/disables the transmit FIFO DMA channel. Reset value: 0x0 + [1:1] + read-write + + + DISABLED + 0 + transmit FIFO DMA channel disabled + + + ENABLED + 1 + Transmit FIFO DMA channel enabled + + + + + RDMAE + Receive DMA Enable. This bit enables/disables the receive FIFO DMA channel. Reset value: 0x0 + [0:0] + read-write + + + DISABLED + 0 + Receive FIFO DMA channel disabled + + + ENABLED + 1 + Receive FIFO DMA channel enabled + + + + + + + IC_DMA_TDLR + 0x0000008c + DMA Transmit Data Level Register + 0x00000000 + + + DMATDL + Transmit Data Level. This bit field controls the level at which a DMA request is made by the transmit logic. It is equal to the watermark level; that is, the dma_tx_req signal is generated when the number of valid data entries in the transmit FIFO is equal to or below this field value, and TDMAE = 1. + + Reset value: 0x0 + [3:0] + read-write + + + + + IC_DMA_RDLR + 0x00000090 + I2C Receive Data Level Register + 0x00000000 + + + DMARDL + Receive Data Level. This bit field controls the level at which a DMA request is made by the receive logic. The watermark level = DMARDL+1; that is, dma_rx_req is generated when the number of valid data entries in the receive FIFO is equal to or more than this field value + 1, and RDMAE =1. For instance, when DMARDL is 0, then dma_rx_req is asserted when 1 or more data entries are present in the receive FIFO. + + Reset value: 0x0 + [3:0] + read-write + + + + + IC_SDA_SETUP + 0x00000094 + I2C SDA Setup Register + + This register controls the amount of time delay (in terms of number of ic_clk clock periods) introduced in the rising edge of SCL - relative to SDA changing - when DW_apb_i2c services a read request in a slave-transmitter operation. The relevant I2C requirement is tSU:DAT (note 4) as detailed in the I2C Bus Specification. This register must be programmed with a value equal to or greater than 2. + + Writes to this register succeed only when IC_ENABLE[0] = 0. + + Note: The length of setup time is calculated using [(IC_SDA_SETUP - 1) * (ic_clk_period)], so if the user requires 10 ic_clk periods of setup time, they should program a value of 11. The IC_SDA_SETUP register is only used by the DW_apb_i2c when operating as a slave transmitter. + 0x00000064 + + + SDA_SETUP + SDA Setup. It is recommended that if the required delay is 1000ns, then for an ic_clk frequency of 10 MHz, IC_SDA_SETUP should be programmed to a value of 11. IC_SDA_SETUP must be programmed with a minimum value of 2. + [7:0] + read-write + + + + + IC_ACK_GENERAL_CALL + 0x00000098 + I2C ACK General Call Register + + The register controls whether DW_apb_i2c responds with a ACK or NACK when it receives an I2C General Call address. + + This register is applicable only when the DW_apb_i2c is in slave mode. + 0x00000001 + + + ACK_GEN_CALL + ACK General Call. When set to 1, DW_apb_i2c responds with a ACK (by asserting ic_data_oe) when it receives a General Call. Otherwise, DW_apb_i2c responds with a NACK (by negating ic_data_oe). + [0:0] + read-write + + + DISABLED + 0 + Generate NACK for a General Call + + + ENABLED + 1 + Generate ACK for a General Call + + + + + + + IC_ENABLE_STATUS + 0x0000009c + I2C Enable Status Register + + The register is used to report the DW_apb_i2c hardware status when the IC_ENABLE[0] register is set from 1 to 0; that is, when DW_apb_i2c is disabled. + + If IC_ENABLE[0] has been set to 1, bits 2:1 are forced to 0, and bit 0 is forced to 1. + + If IC_ENABLE[0] has been set to 0, bits 2:1 is only be valid as soon as bit 0 is read as '0'. + + Note: When IC_ENABLE[0] has been set to 0, a delay occurs for bit 0 to be read as 0 because disabling the DW_apb_i2c depends on I2C bus activities. + 0x00000000 + + + SLV_RX_DATA_LOST + Slave Received Data Lost. This bit indicates if a Slave-Receiver operation has been aborted with at least one data byte received from an I2C transfer due to the setting bit 0 of IC_ENABLE from 1 to 0. When read as 1, DW_apb_i2c is deemed to have been actively engaged in an aborted I2C transfer (with matching address) and the data phase of the I2C transfer has been entered, even though a data byte has been responded with a NACK. + + Note: If the remote I2C master terminates the transfer with a STOP condition before the DW_apb_i2c has a chance to NACK a transfer, and IC_ENABLE[0] has been set to 0, then this bit is also set to 1. + + When read as 0, DW_apb_i2c is deemed to have been disabled without being actively involved in the data phase of a Slave-Receiver transfer. + + Note: The CPU can safely read this bit when IC_EN (bit 0) is read as 0. + + Reset value: 0x0 + [2:2] + read-only + + + INACTIVE + 0 + Slave RX Data is not lost + + + ACTIVE + 1 + Slave RX Data is lost + + + + + SLV_DISABLED_WHILE_BUSY + Slave Disabled While Busy (Transmit, Receive). This bit indicates if a potential or active Slave operation has been aborted due to the setting bit 0 of the IC_ENABLE register from 1 to 0. This bit is set when the CPU writes a 0 to the IC_ENABLE register while: + + (a) DW_apb_i2c is receiving the address byte of the Slave-Transmitter operation from a remote master; + + OR, + + (b) address and data bytes of the Slave-Receiver operation from a remote master. + + When read as 1, DW_apb_i2c is deemed to have forced a NACK during any part of an I2C transfer, irrespective of whether the I2C address matches the slave address set in DW_apb_i2c (IC_SAR register) OR if the transfer is completed before IC_ENABLE is set to 0 but has not taken effect. + + Note: If the remote I2C master terminates the transfer with a STOP condition before the DW_apb_i2c has a chance to NACK a transfer, and IC_ENABLE[0] has been set to 0, then this bit will also be set to 1. + + When read as 0, DW_apb_i2c is deemed to have been disabled when there is master activity, or when the I2C bus is idle. + + Note: The CPU can safely read this bit when IC_EN (bit 0) is read as 0. + + Reset value: 0x0 + [1:1] + read-only + + + INACTIVE + 0 + Slave is disabled when it is idle + + + ACTIVE + 1 + Slave is disabled when it is active + + + + + IC_EN + ic_en Status. This bit always reflects the value driven on the output port ic_en. - When read as 1, DW_apb_i2c is deemed to be in an enabled state. - When read as 0, DW_apb_i2c is deemed completely inactive. Note: The CPU can safely read this bit anytime. When this bit is read as 0, the CPU can safely read SLV_RX_DATA_LOST (bit 2) and SLV_DISABLED_WHILE_BUSY (bit 1). + + Reset value: 0x0 + [0:0] + read-only + + + DISABLED + 0 + I2C disabled + + + ENABLED + 1 + I2C enabled + + + + + + + IC_FS_SPKLEN + 0x000000a0 + I2C SS, FS or FM+ spike suppression limit + + This register is used to store the duration, measured in ic_clk cycles, of the longest spike that is filtered out by the spike suppression logic when the component is operating in SS, FS or FM+ modes. The relevant I2C requirement is tSP (table 4) as detailed in the I2C Bus Specification. This register must be programmed with a minimum value of 1. + 0x00000007 + + + IC_FS_SPKLEN + This register must be set before any I2C bus transaction can take place to ensure stable operation. This register sets the duration, measured in ic_clk cycles, of the longest spike in the SCL or SDA lines that will be filtered out by the spike suppression logic. This register can be written only when the I2C interface is disabled which corresponds to the IC_ENABLE[0] register being set to 0. Writes at other times have no effect. The minimum valid value is 1; hardware prevents values less than this being written, and if attempted results in 1 being set. or more information, refer to 'Spike Suppression'. + [7:0] + read-write + + + + + IC_CLR_RESTART_DET + 0x000000a8 + Clear RESTART_DET Interrupt Register + 0x00000000 + + + CLR_RESTART_DET + Read this register to clear the RESTART_DET interrupt (bit 12) of IC_RAW_INTR_STAT register. + + Reset value: 0x0 + [0:0] + read-only + + + + + IC_COMP_PARAM_1 + 0x000000f4 + Component Parameter Register 1 + + Note This register is not implemented and therefore reads as 0. If it was implemented it would be a constant read-only register that contains encoded information about the component's parameter settings. Fields shown below are the settings for those parameters + 0x00000000 + + + TX_BUFFER_DEPTH + TX Buffer Depth = 16 + [23:16] + read-only + + + RX_BUFFER_DEPTH + RX Buffer Depth = 16 + [15:8] + read-only + + + ADD_ENCODED_PARAMS + Encoded parameters not visible + [7:7] + read-only + + + HAS_DMA + DMA handshaking signals are enabled + [6:6] + read-only + + + INTR_IO + COMBINED Interrupt outputs + [5:5] + read-only + + + HC_COUNT_VALUES + Programmable count values for each mode. + [4:4] + read-only + + + MAX_SPEED_MODE + MAX SPEED MODE = FAST MODE + [3:2] + read-only + + + APB_DATA_WIDTH + APB data bus width is 32 bits + [1:0] + read-only + + + + + IC_COMP_VERSION + 0x000000f8 + I2C Component Version Register + 0x3230312a + + + IC_COMP_VERSION + [31:0] + read-only + + + + + IC_COMP_TYPE + 0x000000fc + I2C Component Type Register + 0x44570140 + + + IC_COMP_TYPE + Designware Component Type number = 0x44_57_01_40. This assigned unique hex value is constant and is derived from the two ASCII letters 'DW' followed by a 16-bit unsigned number. + [31:0] + read-only + + + + + + + I2C1 + 0x40098000 + + I2C1_IRQ + 37 + + + + SPI0 + 0x40080000 + + 0 + 4096 + registers + + + SPI0_IRQ + 31 + + + + SSPCR0 + 0x00000000 + Control register 0, SSPCR0 on page 3-4 + 0x00000000 + + + SCR + Serial clock rate. The value SCR is used to generate the transmit and receive bit rate of the PrimeCell SSP. The bit rate is: F SSPCLK CPSDVSR x (1+SCR) where CPSDVSR is an even value from 2-254, programmed through the SSPCPSR register and SCR is a value from 0-255. + [15:8] + read-write + + + SPH + SSPCLKOUT phase, applicable to Motorola SPI frame format only. See Motorola SPI frame format on page 2-10. + [7:7] + read-write + + + SPO + SSPCLKOUT polarity, applicable to Motorola SPI frame format only. See Motorola SPI frame format on page 2-10. + [6:6] + read-write + + + FRF + Frame format: 00 Motorola SPI frame format. 01 TI synchronous serial frame format. 10 National Microwire frame format. 11 Reserved, undefined operation. + [5:4] + read-write + + + DSS + Data Size Select: 0000 Reserved, undefined operation. 0001 Reserved, undefined operation. 0010 Reserved, undefined operation. 0011 4-bit data. 0100 5-bit data. 0101 6-bit data. 0110 7-bit data. 0111 8-bit data. 1000 9-bit data. 1001 10-bit data. 1010 11-bit data. 1011 12-bit data. 1100 13-bit data. 1101 14-bit data. 1110 15-bit data. 1111 16-bit data. + [3:0] + read-write + + + + + SSPCR1 + 0x00000004 + Control register 1, SSPCR1 on page 3-5 + 0x00000000 + + + SOD + Slave-mode output disable. This bit is relevant only in the slave mode, MS=1. In multiple-slave systems, it is possible for an PrimeCell SSP master to broadcast a message to all slaves in the system while ensuring that only one slave drives data onto its serial output line. In such systems the RXD lines from multiple slaves could be tied together. To operate in such systems, the SOD bit can be set if the PrimeCell SSP slave is not supposed to drive the SSPTXD line: 0 SSP can drive the SSPTXD output in slave mode. 1 SSP must not drive the SSPTXD output in slave mode. + [3:3] + read-write + + + MS + Master or slave mode select. This bit can be modified only when the PrimeCell SSP is disabled, SSE=0: 0 Device configured as master, default. 1 Device configured as slave. + [2:2] + read-write + + + SSE + Synchronous serial port enable: 0 SSP operation disabled. 1 SSP operation enabled. + [1:1] + read-write + + + LBM + Loop back mode: 0 Normal serial port operation enabled. 1 Output of transmit serial shifter is connected to input of receive serial shifter internally. + [0:0] + read-write + + + + + SSPDR + 0x00000008 + Data register, SSPDR on page 3-6 + 0x00000000 + + + DATA + Transmit/Receive FIFO: Read Receive FIFO. Write Transmit FIFO. You must right-justify data when the PrimeCell SSP is programmed for a data size that is less than 16 bits. Unused bits at the top are ignored by transmit logic. The receive logic automatically right-justifies. + [15:0] + read-write + modify + + + + + SSPSR + 0x0000000c + Status register, SSPSR on page 3-7 + 0x00000003 + + + BSY + PrimeCell SSP busy flag, RO: 0 SSP is idle. 1 SSP is currently transmitting and/or receiving a frame or the transmit FIFO is not empty. + [4:4] + read-only + + + RFF + Receive FIFO full, RO: 0 Receive FIFO is not full. 1 Receive FIFO is full. + [3:3] + read-only + + + RNE + Receive FIFO not empty, RO: 0 Receive FIFO is empty. 1 Receive FIFO is not empty. + [2:2] + read-only + + + TNF + Transmit FIFO not full, RO: 0 Transmit FIFO is full. 1 Transmit FIFO is not full. + [1:1] + read-only + + + TFE + Transmit FIFO empty, RO: 0 Transmit FIFO is not empty. 1 Transmit FIFO is empty. + [0:0] + read-only + + + + + SSPCPSR + 0x00000010 + Clock prescale register, SSPCPSR on page 3-8 + 0x00000000 + + + CPSDVSR + Clock prescale divisor. Must be an even number from 2-254, depending on the frequency of SSPCLK. The least significant bit always returns zero on reads. + [7:0] + read-write + + + + + SSPIMSC + 0x00000014 + Interrupt mask set or clear register, SSPIMSC on page 3-9 + 0x00000000 + + + TXIM + Transmit FIFO interrupt mask: 0 Transmit FIFO half empty or less condition interrupt is masked. 1 Transmit FIFO half empty or less condition interrupt is not masked. + [3:3] + read-write + + + RXIM + Receive FIFO interrupt mask: 0 Receive FIFO half full or less condition interrupt is masked. 1 Receive FIFO half full or less condition interrupt is not masked. + [2:2] + read-write + + + RTIM + Receive timeout interrupt mask: 0 Receive FIFO not empty and no read prior to timeout period interrupt is masked. 1 Receive FIFO not empty and no read prior to timeout period interrupt is not masked. + [1:1] + read-write + + + RORIM + Receive overrun interrupt mask: 0 Receive FIFO written to while full condition interrupt is masked. 1 Receive FIFO written to while full condition interrupt is not masked. + [0:0] + read-write + + + + + SSPRIS + 0x00000018 + Raw interrupt status register, SSPRIS on page 3-10 + 0x00000008 + + + TXRIS + Gives the raw interrupt state, prior to masking, of the SSPTXINTR interrupt + [3:3] + read-only + + + RXRIS + Gives the raw interrupt state, prior to masking, of the SSPRXINTR interrupt + [2:2] + read-only + + + RTRIS + Gives the raw interrupt state, prior to masking, of the SSPRTINTR interrupt + [1:1] + read-only + + + RORRIS + Gives the raw interrupt state, prior to masking, of the SSPRORINTR interrupt + [0:0] + read-only + + + + + SSPMIS + 0x0000001c + Masked interrupt status register, SSPMIS on page 3-11 + 0x00000000 + + + TXMIS + Gives the transmit FIFO masked interrupt state, after masking, of the SSPTXINTR interrupt + [3:3] + read-only + + + RXMIS + Gives the receive FIFO masked interrupt state, after masking, of the SSPRXINTR interrupt + [2:2] + read-only + + + RTMIS + Gives the receive timeout masked interrupt state, after masking, of the SSPRTINTR interrupt + [1:1] + read-only + + + RORMIS + Gives the receive over run masked interrupt status, after masking, of the SSPRORINTR interrupt + [0:0] + read-only + + + + + SSPICR + 0x00000020 + Interrupt clear register, SSPICR on page 3-11 + 0x00000000 + + + RTIC + Clears the SSPRTINTR interrupt + [1:1] + read-write + oneToClear + + + RORIC + Clears the SSPRORINTR interrupt + [0:0] + read-write + oneToClear + + + + + SSPDMACR + 0x00000024 + DMA control register, SSPDMACR on page 3-12 + 0x00000000 + + + TXDMAE + Transmit DMA Enable. If this bit is set to 1, DMA for the transmit FIFO is enabled. + [1:1] + read-write + + + RXDMAE + Receive DMA Enable. If this bit is set to 1, DMA for the receive FIFO is enabled. + [0:0] + read-write + + + + + SSPPERIPHID0 + 0x00000fe0 + Peripheral identification registers, SSPPeriphID0-3 on page 3-13 + 0x00000022 + + + PARTNUMBER0 + These bits read back as 0x22 + [7:0] + read-only + + + + + SSPPERIPHID1 + 0x00000fe4 + Peripheral identification registers, SSPPeriphID0-3 on page 3-13 + 0x00000010 + + + DESIGNER0 + These bits read back as 0x1 + [7:4] + read-only + + + PARTNUMBER1 + These bits read back as 0x0 + [3:0] + read-only + + + + + SSPPERIPHID2 + 0x00000fe8 + Peripheral identification registers, SSPPeriphID0-3 on page 3-13 + 0x00000034 + + + REVISION + These bits return the peripheral revision + [7:4] + read-only + + + DESIGNER1 + These bits read back as 0x4 + [3:0] + read-only + + + + + SSPPERIPHID3 + 0x00000fec + Peripheral identification registers, SSPPeriphID0-3 on page 3-13 + 0x00000000 + + + CONFIGURATION + These bits read back as 0x00 + [7:0] + read-only + + + + + SSPPCELLID0 + 0x00000ff0 + PrimeCell identification registers, SSPPCellID0-3 on page 3-16 + 0x0000000d + + + SSPPCELLID0 + These bits read back as 0x0D + [7:0] + read-only + + + + + SSPPCELLID1 + 0x00000ff4 + PrimeCell identification registers, SSPPCellID0-3 on page 3-16 + 0x000000f0 + + + SSPPCELLID1 + These bits read back as 0xF0 + [7:0] + read-only + + + + + SSPPCELLID2 + 0x00000ff8 + PrimeCell identification registers, SSPPCellID0-3 on page 3-16 + 0x00000005 + + + SSPPCELLID2 + These bits read back as 0x05 + [7:0] + read-only + + + + + SSPPCELLID3 + 0x00000ffc + PrimeCell identification registers, SSPPCellID0-3 on page 3-16 + 0x000000b1 + + + SSPPCELLID3 + These bits read back as 0xB1 + [7:0] + read-only + + + + + + + SPI1 + 0x40088000 + + SPI1_IRQ + 32 + + + + PIO0 + Programmable IO block + 0x50200000 + + 0 + 392 + registers + + + PIO0_IRQ_0 + 15 + + + PIO0_IRQ_1 + 16 + + + + CTRL + 0x00000000 + PIO control register + 0x00000000 + + + NEXTPREV_CLKDIV_RESTART + Write 1 to restart the clock dividers of state machines in neighbouring PIO blocks, as specified by NEXT_PIO_MASK and PREV_PIO_MASK in the same write. + + This is equivalent to writing 1 to the corresponding CLKDIV_RESTART bits in those PIOs' CTRL registers. + [26:26] + write-only + + + NEXTPREV_SM_DISABLE + Write 1 to disable state machines in neighbouring PIO blocks, as specified by NEXT_PIO_MASK and PREV_PIO_MASK in the same write. + + This is equivalent to clearing the corresponding SM_ENABLE bits in those PIOs' CTRL registers. + [25:25] + write-only + + + NEXTPREV_SM_ENABLE + Write 1 to enable state machines in neighbouring PIO blocks, as specified by NEXT_PIO_MASK and PREV_PIO_MASK in the same write. + + This is equivalent to setting the corresponding SM_ENABLE bits in those PIOs' CTRL registers. + + If both OTHERS_SM_ENABLE and OTHERS_SM_DISABLE are set, the disable takes precedence. + [24:24] + write-only + + + NEXT_PIO_MASK + A mask of state machines in the neighbouring higher-numbered PIO block in the system (or PIO block 0 if this is the highest-numbered PIO block) to which to apply the operations specified by NEXTPREV_CLKDIV_RESTART, NEXTPREV_SM_ENABLE, and NEXTPREV_SM_DISABLE in the same write. + + This allows state machines in a neighbouring PIO block to be started/stopped/clock-synced exactly simultaneously with a write to this PIO block's CTRL register. + + Note that in a system with two PIOs, NEXT_PIO_MASK and PREV_PIO_MASK actually indicate the same PIO block. In this case the effects are applied cumulatively (as though the masks were OR'd together). + + Neighbouring PIO blocks are disconnected (status signals tied to 0 and control signals ignored) if one block is accessible to NonSecure code, and one is not. + [23:20] + write-only + + + PREV_PIO_MASK + A mask of state machines in the neighbouring lower-numbered PIO block in the system (or the highest-numbered PIO block if this is PIO block 0) to which to apply the operations specified by OP_CLKDIV_RESTART, OP_ENABLE, OP_DISABLE in the same write. + + This allows state machines in a neighbouring PIO block to be started/stopped/clock-synced exactly simultaneously with a write to this PIO block's CTRL register. + + Neighbouring PIO blocks are disconnected (status signals tied to 0 and control signals ignored) if one block is accessible to NonSecure code, and one is not. + [19:16] + write-only + + + CLKDIV_RESTART + Restart a state machine's clock divider from an initial phase of 0. Clock dividers are free-running, so once started, their output (including fractional jitter) is completely determined by the integer/fractional divisor configured in SMx_CLKDIV. This means that, if multiple clock dividers with the same divisor are restarted simultaneously, by writing multiple 1 bits to this field, the execution clocks of those state machines will run in precise lockstep. + + Note that setting/clearing SM_ENABLE does not stop the clock divider from running, so once multiple state machines' clocks are synchronised, it is safe to disable/reenable a state machine, whilst keeping the clock dividers in sync. + + Note also that CLKDIV_RESTART can be written to whilst the state machine is running, and this is useful to resynchronise clock dividers after the divisors (SMx_CLKDIV) have been changed on-the-fly. + [11:8] + write-only + + + SM_RESTART + Write 1 to instantly clear internal SM state which may be otherwise difficult to access and will affect future execution. + + Specifically, the following are cleared: input and output shift counters; the contents of the input shift register; the delay counter; the waiting-on-IRQ state; any stalled instruction written to SMx_INSTR or run by OUT/MOV EXEC; any pin write left asserted due to OUT_STICKY. + + The contents of the output shift register and the X/Y scratch registers are not affected. + [7:4] + write-only + + + SM_ENABLE + Enable/disable each of the four state machines by writing 1/0 to each of these four bits. When disabled, a state machine will cease executing instructions, except those written directly to SMx_INSTR by the system. Multiple bits can be set/cleared at once to run/halt multiple state machines simultaneously. + [3:0] + read-write + + + + + FSTAT + 0x00000004 + FIFO status register + 0x0f000f00 + + + TXEMPTY + State machine TX FIFO is empty + [27:24] + read-only + + + TXFULL + State machine TX FIFO is full + [19:16] + read-only + + + RXEMPTY + State machine RX FIFO is empty + [11:8] + read-only + + + RXFULL + State machine RX FIFO is full + [3:0] + read-only + + + + + FDEBUG + 0x00000008 + FIFO debug register + 0x00000000 + + + TXSTALL + State machine has stalled on empty TX FIFO during a blocking PULL, or an OUT with autopull enabled. Write 1 to clear. + [27:24] + read-write + oneToClear + + + TXOVER + TX FIFO overflow (i.e. write-on-full by the system) has occurred. Write 1 to clear. Note that write-on-full does not alter the state or contents of the FIFO in any way, but the data that the system attempted to write is dropped, so if this flag is set, your software has quite likely dropped some data on the floor. + [19:16] + read-write + oneToClear + + + RXUNDER + RX FIFO underflow (i.e. read-on-empty by the system) has occurred. Write 1 to clear. Note that read-on-empty does not perturb the state of the FIFO in any way, but the data returned by reading from an empty FIFO is undefined, so this flag generally only becomes set due to some kind of software error. + [11:8] + read-write + oneToClear + + + RXSTALL + State machine has stalled on full RX FIFO during a blocking PUSH, or an IN with autopush enabled. This flag is also set when a nonblocking PUSH to a full FIFO took place, in which case the state machine has dropped data. Write 1 to clear. + [3:0] + read-write + oneToClear + + + + + FLEVEL + 0x0000000c + FIFO levels + 0x00000000 + + + RX3 + [31:28] + read-only + + + TX3 + [27:24] + read-only + + + RX2 + [23:20] + read-only + + + TX2 + [19:16] + read-only + + + RX1 + [15:12] + read-only + + + TX1 + [11:8] + read-only + + + RX0 + [7:4] + read-only + + + TX0 + [3:0] + read-only + + + + + TXF0 + 0x00000010 + Direct write access to the TX FIFO for this state machine. Each write pushes one word to the FIFO. Attempting to write to a full FIFO has no effect on the FIFO state or contents, and sets the sticky FDEBUG_TXOVER error flag for this FIFO. + 0x00000000 + + + TXF0 + [31:0] + write-only + + + + + TXF1 + 0x00000014 + Direct write access to the TX FIFO for this state machine. Each write pushes one word to the FIFO. Attempting to write to a full FIFO has no effect on the FIFO state or contents, and sets the sticky FDEBUG_TXOVER error flag for this FIFO. + 0x00000000 + + + TXF1 + [31:0] + write-only + + + + + TXF2 + 0x00000018 + Direct write access to the TX FIFO for this state machine. Each write pushes one word to the FIFO. Attempting to write to a full FIFO has no effect on the FIFO state or contents, and sets the sticky FDEBUG_TXOVER error flag for this FIFO. + 0x00000000 + + + TXF2 + [31:0] + write-only + + + + + TXF3 + 0x0000001c + Direct write access to the TX FIFO for this state machine. Each write pushes one word to the FIFO. Attempting to write to a full FIFO has no effect on the FIFO state or contents, and sets the sticky FDEBUG_TXOVER error flag for this FIFO. + 0x00000000 + + + TXF3 + [31:0] + write-only + + + + + RXF0 + 0x00000020 + Direct read access to the RX FIFO for this state machine. Each read pops one word from the FIFO. Attempting to read from an empty FIFO has no effect on the FIFO state, and sets the sticky FDEBUG_RXUNDER error flag for this FIFO. The data returned to the system on a read from an empty FIFO is undefined. + 0x00000000 + + + RXF0 + [31:0] + read-only + modify + + + + + RXF1 + 0x00000024 + Direct read access to the RX FIFO for this state machine. Each read pops one word from the FIFO. Attempting to read from an empty FIFO has no effect on the FIFO state, and sets the sticky FDEBUG_RXUNDER error flag for this FIFO. The data returned to the system on a read from an empty FIFO is undefined. + 0x00000000 + + + RXF1 + [31:0] + read-only + modify + + + + + RXF2 + 0x00000028 + Direct read access to the RX FIFO for this state machine. Each read pops one word from the FIFO. Attempting to read from an empty FIFO has no effect on the FIFO state, and sets the sticky FDEBUG_RXUNDER error flag for this FIFO. The data returned to the system on a read from an empty FIFO is undefined. + 0x00000000 + + + RXF2 + [31:0] + read-only + modify + + + + + RXF3 + 0x0000002c + Direct read access to the RX FIFO for this state machine. Each read pops one word from the FIFO. Attempting to read from an empty FIFO has no effect on the FIFO state, and sets the sticky FDEBUG_RXUNDER error flag for this FIFO. The data returned to the system on a read from an empty FIFO is undefined. + 0x00000000 + + + RXF3 + [31:0] + read-only + modify + + + + + IRQ + 0x00000030 + State machine IRQ flags register. Write 1 to clear. There are eight state machine IRQ flags, which can be set, cleared, and waited on by the state machines. There's no fixed association between flags and state machines -- any state machine can use any flag. + + Any of the eight flags can be used for timing synchronisation between state machines, using IRQ and WAIT instructions. Any combination of the eight flags can also routed out to either of the two system-level interrupt requests, alongside FIFO status interrupts -- see e.g. IRQ0_INTE. + 0x00000000 + + + IRQ + [7:0] + read-write + oneToClear + + + + + IRQ_FORCE + 0x00000034 + Writing a 1 to each of these bits will forcibly assert the corresponding IRQ. Note this is different to the INTF register: writing here affects PIO internal state. INTF just asserts the processor-facing IRQ signal for testing ISRs, and is not visible to the state machines. + 0x00000000 + + + IRQ_FORCE + [7:0] + write-only + + + + + INPUT_SYNC_BYPASS + 0x00000038 + There is a 2-flipflop synchronizer on each GPIO input, which protects PIO logic from metastabilities. This increases input delay, and for fast synchronous IO (e.g. SPI) these synchronizers may need to be bypassed. Each bit in this register corresponds to one GPIO. + 0 -> input is synchronized (default) + 1 -> synchronizer is bypassed + If in doubt, leave this register as all zeroes. + 0x00000000 + + + INPUT_SYNC_BYPASS + [31:0] + read-write + + + + + DBG_PADOUT + 0x0000003c + Read to sample the pad output values PIO is currently driving to the GPIOs. On RP2040 there are 30 GPIOs, so the two most significant bits are hardwired to 0. + 0x00000000 + + + DBG_PADOUT + [31:0] + read-only + + + + + DBG_PADOE + 0x00000040 + Read to sample the pad output enables (direction) PIO is currently driving to the GPIOs. On RP2040 there are 30 GPIOs, so the two most significant bits are hardwired to 0. + 0x00000000 + + + DBG_PADOE + [31:0] + read-only + + + + + DBG_CFGINFO + 0x00000044 + The PIO hardware has some free parameters that may vary between chip products. + These should be provided in the chip datasheet, but are also exposed here. + 0x10000000 + + + VERSION + Version of the core PIO hardware. + [31:28] + read-only + + + v0 + 0 + Version 0 (RP2040) + + + v1 + 1 + Version 1 (RP2350) + + + + + IMEM_SIZE + The size of the instruction memory, measured in units of one instruction + [21:16] + read-only + + + SM_COUNT + The number of state machines this PIO instance is equipped with. + [11:8] + read-only + + + FIFO_DEPTH + The depth of the state machine TX/RX FIFOs, measured in words. + Joining fifos via SHIFTCTRL_FJOIN gives one FIFO with double + this depth. + [5:0] + read-only + + + + + INSTR_MEM0 + 0x00000048 + Write-only access to instruction memory location 0 + 0x00000000 + + + INSTR_MEM0 + [15:0] + write-only + + + + + INSTR_MEM1 + 0x0000004c + Write-only access to instruction memory location 1 + 0x00000000 + + + INSTR_MEM1 + [15:0] + write-only + + + + + INSTR_MEM2 + 0x00000050 + Write-only access to instruction memory location 2 + 0x00000000 + + + INSTR_MEM2 + [15:0] + write-only + + + + + INSTR_MEM3 + 0x00000054 + Write-only access to instruction memory location 3 + 0x00000000 + + + INSTR_MEM3 + [15:0] + write-only + + + + + INSTR_MEM4 + 0x00000058 + Write-only access to instruction memory location 4 + 0x00000000 + + + INSTR_MEM4 + [15:0] + write-only + + + + + INSTR_MEM5 + 0x0000005c + Write-only access to instruction memory location 5 + 0x00000000 + + + INSTR_MEM5 + [15:0] + write-only + + + + + INSTR_MEM6 + 0x00000060 + Write-only access to instruction memory location 6 + 0x00000000 + + + INSTR_MEM6 + [15:0] + write-only + + + + + INSTR_MEM7 + 0x00000064 + Write-only access to instruction memory location 7 + 0x00000000 + + + INSTR_MEM7 + [15:0] + write-only + + + + + INSTR_MEM8 + 0x00000068 + Write-only access to instruction memory location 8 + 0x00000000 + + + INSTR_MEM8 + [15:0] + write-only + + + + + INSTR_MEM9 + 0x0000006c + Write-only access to instruction memory location 9 + 0x00000000 + + + INSTR_MEM9 + [15:0] + write-only + + + + + INSTR_MEM10 + 0x00000070 + Write-only access to instruction memory location 10 + 0x00000000 + + + INSTR_MEM10 + [15:0] + write-only + + + + + INSTR_MEM11 + 0x00000074 + Write-only access to instruction memory location 11 + 0x00000000 + + + INSTR_MEM11 + [15:0] + write-only + + + + + INSTR_MEM12 + 0x00000078 + Write-only access to instruction memory location 12 + 0x00000000 + + + INSTR_MEM12 + [15:0] + write-only + + + + + INSTR_MEM13 + 0x0000007c + Write-only access to instruction memory location 13 + 0x00000000 + + + INSTR_MEM13 + [15:0] + write-only + + + + + INSTR_MEM14 + 0x00000080 + Write-only access to instruction memory location 14 + 0x00000000 + + + INSTR_MEM14 + [15:0] + write-only + + + + + INSTR_MEM15 + 0x00000084 + Write-only access to instruction memory location 15 + 0x00000000 + + + INSTR_MEM15 + [15:0] + write-only + + + + + INSTR_MEM16 + 0x00000088 + Write-only access to instruction memory location 16 + 0x00000000 + + + INSTR_MEM16 + [15:0] + write-only + + + + + INSTR_MEM17 + 0x0000008c + Write-only access to instruction memory location 17 + 0x00000000 + + + INSTR_MEM17 + [15:0] + write-only + + + + + INSTR_MEM18 + 0x00000090 + Write-only access to instruction memory location 18 + 0x00000000 + + + INSTR_MEM18 + [15:0] + write-only + + + + + INSTR_MEM19 + 0x00000094 + Write-only access to instruction memory location 19 + 0x00000000 + + + INSTR_MEM19 + [15:0] + write-only + + + + + INSTR_MEM20 + 0x00000098 + Write-only access to instruction memory location 20 + 0x00000000 + + + INSTR_MEM20 + [15:0] + write-only + + + + + INSTR_MEM21 + 0x0000009c + Write-only access to instruction memory location 21 + 0x00000000 + + + INSTR_MEM21 + [15:0] + write-only + + + + + INSTR_MEM22 + 0x000000a0 + Write-only access to instruction memory location 22 + 0x00000000 + + + INSTR_MEM22 + [15:0] + write-only + + + + + INSTR_MEM23 + 0x000000a4 + Write-only access to instruction memory location 23 + 0x00000000 + + + INSTR_MEM23 + [15:0] + write-only + + + + + INSTR_MEM24 + 0x000000a8 + Write-only access to instruction memory location 24 + 0x00000000 + + + INSTR_MEM24 + [15:0] + write-only + + + + + INSTR_MEM25 + 0x000000ac + Write-only access to instruction memory location 25 + 0x00000000 + + + INSTR_MEM25 + [15:0] + write-only + + + + + INSTR_MEM26 + 0x000000b0 + Write-only access to instruction memory location 26 + 0x00000000 + + + INSTR_MEM26 + [15:0] + write-only + + + + + INSTR_MEM27 + 0x000000b4 + Write-only access to instruction memory location 27 + 0x00000000 + + + INSTR_MEM27 + [15:0] + write-only + + + + + INSTR_MEM28 + 0x000000b8 + Write-only access to instruction memory location 28 + 0x00000000 + + + INSTR_MEM28 + [15:0] + write-only + + + + + INSTR_MEM29 + 0x000000bc + Write-only access to instruction memory location 29 + 0x00000000 + + + INSTR_MEM29 + [15:0] + write-only + + + + + INSTR_MEM30 + 0x000000c0 + Write-only access to instruction memory location 30 + 0x00000000 + + + INSTR_MEM30 + [15:0] + write-only + + + + + INSTR_MEM31 + 0x000000c4 + Write-only access to instruction memory location 31 + 0x00000000 + + + INSTR_MEM31 + [15:0] + write-only + + + + + SM0_CLKDIV + 0x000000c8 + Clock divisor register for state machine 0 + Frequency = clock freq / (CLKDIV_INT + CLKDIV_FRAC / 256) + 0x00010000 + + + INT + Effective frequency is sysclk/(int + frac/256). + Value of 0 is interpreted as 65536. If INT is 0, FRAC must also be 0. + [31:16] + read-write + + + FRAC + Fractional part of clock divisor + [15:8] + read-write + + + + + SM0_EXECCTRL + 0x000000cc + Execution/behavioural settings for state machine 0 + 0x0001f000 + + + EXEC_STALLED + If 1, an instruction written to SMx_INSTR is stalled, and latched by the state machine. Will clear to 0 once this instruction completes. + [31:31] + read-only + + + SIDE_EN + If 1, the MSB of the Delay/Side-set instruction field is used as side-set enable, rather than a side-set data bit. This allows instructions to perform side-set optionally, rather than on every instruction, but the maximum possible side-set width is reduced from 5 to 4. Note that the value of PINCTRL_SIDESET_COUNT is inclusive of this enable bit. + [30:30] + read-write + + + SIDE_PINDIR + If 1, side-set data is asserted to pin directions, instead of pin values + [29:29] + read-write + + + JMP_PIN + The GPIO number to use as condition for JMP PIN. Unaffected by input mapping. + [28:24] + read-write + + + OUT_EN_SEL + Which data bit to use for inline OUT enable + [23:19] + read-write + + + INLINE_OUT_EN + If 1, use a bit of OUT data as an auxiliary write enable + When used in conjunction with OUT_STICKY, writes with an enable of 0 will + deassert the latest pin write. This can create useful masking/override behaviour + due to the priority ordering of state machine pin writes (SM0 < SM1 < ...) + [18:18] + read-write + + + OUT_STICKY + Continuously assert the most recent OUT/SET to the pins + [17:17] + read-write + + + WRAP_TOP + After reaching this address, execution is wrapped to wrap_bottom. + If the instruction is a jump, and the jump condition is true, the jump takes priority. + [16:12] + read-write + + + WRAP_BOTTOM + After reaching wrap_top, execution is wrapped to this address. + [11:7] + read-write + + + STATUS_SEL + Comparison used for the MOV x, STATUS instruction. + [6:5] + read-write + + + TXLEVEL + 0 + All-ones if TX FIFO level < N, otherwise all-zeroes + + + RXLEVEL + 1 + All-ones if RX FIFO level < N, otherwise all-zeroes + + + IRQ + 2 + All-ones if the indexed IRQ flag is raised, otherwise all-zeroes + + + + + STATUS_N + Comparison level or IRQ index for the MOV x, STATUS instruction. + + If STATUS_SEL is TXLEVEL or RXLEVEL, then values of STATUS_N greater than the current FIFO depth are reserved, and have undefined behaviour. + [4:0] + read-write + + + IRQ + 0 + Index 0-7 of an IRQ flag in this PIO block + + + IRQ_PREVPIO + 8 + Index 0-7 of an IRQ flag in the next lower-numbered PIO block + + + IRQ_NEXTPIO + 16 + Index 0-7 of an IRQ flag in the next higher-numbered PIO block + + + + + + + SM0_SHIFTCTRL + 0x000000d0 + Control behaviour of the input/output shift registers for state machine 0 + 0x000c0000 + + + FJOIN_RX + When 1, RX FIFO steals the TX FIFO's storage, and becomes twice as deep. + TX FIFO is disabled as a result (always reads as both full and empty). + FIFOs are flushed when this bit is changed. + [31:31] + read-write + + + FJOIN_TX + When 1, TX FIFO steals the RX FIFO's storage, and becomes twice as deep. + RX FIFO is disabled as a result (always reads as both full and empty). + FIFOs are flushed when this bit is changed. + [30:30] + read-write + + + PULL_THRESH + Number of bits shifted out of OSR before autopull, or conditional pull (PULL IFEMPTY), will take place. + Write 0 for value of 32. + [29:25] + read-write + + + PUSH_THRESH + Number of bits shifted into ISR before autopush, or conditional push (PUSH IFFULL), will take place. + Write 0 for value of 32. + [24:20] + read-write + + + OUT_SHIFTDIR + 1 = shift out of output shift register to right. 0 = to left. + [19:19] + read-write + + + IN_SHIFTDIR + 1 = shift input shift register to right (data enters from left). 0 = to left. + [18:18] + read-write + + + AUTOPULL + Pull automatically when the output shift register is emptied, i.e. on or following an OUT instruction which causes the output shift counter to reach or exceed PULL_THRESH. + [17:17] + read-write + + + AUTOPUSH + Push automatically when the input shift register is filled, i.e. on an IN instruction which causes the input shift counter to reach or exceed PUSH_THRESH. + [16:16] + read-write + + + FJOIN_RX_PUT + If 1, disable this state machine's RX FIFO, make its storage available for random write access by the state machine (using the `put` instruction) and, unless FJOIN_RX_GET is also set, random read access by the processor (through the RXFx_PUTGETy registers). + + If FJOIN_RX_PUT and FJOIN_RX_GET are both set, then the RX FIFO's registers can be randomly read/written by the state machine, but are completely inaccessible to the processor. + + Setting this bit will clear the FJOIN_TX and FJOIN_RX bits. + [15:15] + read-write + + + FJOIN_RX_GET + If 1, disable this state machine's RX FIFO, make its storage available for random read access by the state machine (using the `get` instruction) and, unless FJOIN_RX_PUT is also set, random write access by the processor (through the RXFx_PUTGETy registers). + + If FJOIN_RX_PUT and FJOIN_RX_GET are both set, then the RX FIFO's registers can be randomly read/written by the state machine, but are completely inaccessible to the processor. + + Setting this bit will clear the FJOIN_TX and FJOIN_RX bits. + [14:14] + read-write + + + IN_COUNT + Set the number of pins which are not masked to 0 when read by an IN PINS, WAIT PIN or MOV x, PINS instruction. + + For example, an IN_COUNT of 5 means that the 5 LSBs of the IN pin group are visible (bits 4:0), but the remaining 27 MSBs are masked to 0. A count of 32 is encoded with a field value of 0, so the default behaviour is to not perform any masking. + + Note this masking is applied in addition to the masking usually performed by the IN instruction. This is mainly useful for the MOV x, PINS instruction, which otherwise has no way of masking pins. + [4:0] + read-write + + + + + SM0_ADDR + 0x000000d4 + Current instruction address of state machine 0 + 0x00000000 + + + SM0_ADDR + [4:0] + read-only + + + + + SM0_INSTR + 0x000000d8 + Read to see the instruction currently addressed by state machine 0's program counter + Write to execute an instruction immediately (including jumps) and then resume execution. + 0x00000000 + + + SM0_INSTR + [15:0] + read-write + + + + + SM0_PINCTRL + 0x000000dc + State machine pin control + 0x14000000 + + + SIDESET_COUNT + The number of MSBs of the Delay/Side-set instruction field which are used for side-set. Inclusive of the enable bit, if present. Minimum of 0 (all delay bits, no side-set) and maximum of 5 (all side-set, no delay). + [31:29] + read-write + + + SET_COUNT + The number of pins asserted by a SET. In the range 0 to 5 inclusive. + [28:26] + read-write + + + OUT_COUNT + The number of pins asserted by an OUT PINS, OUT PINDIRS or MOV PINS instruction. In the range 0 to 32 inclusive. + [25:20] + read-write + + + IN_BASE + The pin which is mapped to the least-significant bit of a state machine's IN data bus. Higher-numbered pins are mapped to consecutively more-significant data bits, with a modulo of 32 applied to pin number. + [19:15] + read-write + + + SIDESET_BASE + The lowest-numbered pin that will be affected by a side-set operation. The MSBs of an instruction's side-set/delay field (up to 5, determined by SIDESET_COUNT) are used for side-set data, with the remaining LSBs used for delay. The least-significant bit of the side-set portion is the bit written to this pin, with more-significant bits written to higher-numbered pins. + [14:10] + read-write + + + SET_BASE + The lowest-numbered pin that will be affected by a SET PINS or SET PINDIRS instruction. The data written to this pin is the least-significant bit of the SET data. + [9:5] + read-write + + + OUT_BASE + The lowest-numbered pin that will be affected by an OUT PINS, OUT PINDIRS or MOV PINS instruction. The data written to this pin will always be the least-significant bit of the OUT or MOV data. + [4:0] + read-write + + + + + SM1_CLKDIV + 0x000000e0 + Clock divisor register for state machine 1 + Frequency = clock freq / (CLKDIV_INT + CLKDIV_FRAC / 256) + 0x00010000 + + + INT + Effective frequency is sysclk/(int + frac/256). + Value of 0 is interpreted as 65536. If INT is 0, FRAC must also be 0. + [31:16] + read-write + + + FRAC + Fractional part of clock divisor + [15:8] + read-write + + + + + SM1_EXECCTRL + 0x000000e4 + Execution/behavioural settings for state machine 1 + 0x0001f000 + + + EXEC_STALLED + If 1, an instruction written to SMx_INSTR is stalled, and latched by the state machine. Will clear to 0 once this instruction completes. + [31:31] + read-only + + + SIDE_EN + If 1, the MSB of the Delay/Side-set instruction field is used as side-set enable, rather than a side-set data bit. This allows instructions to perform side-set optionally, rather than on every instruction, but the maximum possible side-set width is reduced from 5 to 4. Note that the value of PINCTRL_SIDESET_COUNT is inclusive of this enable bit. + [30:30] + read-write + + + SIDE_PINDIR + If 1, side-set data is asserted to pin directions, instead of pin values + [29:29] + read-write + + + JMP_PIN + The GPIO number to use as condition for JMP PIN. Unaffected by input mapping. + [28:24] + read-write + + + OUT_EN_SEL + Which data bit to use for inline OUT enable + [23:19] + read-write + + + INLINE_OUT_EN + If 1, use a bit of OUT data as an auxiliary write enable + When used in conjunction with OUT_STICKY, writes with an enable of 0 will + deassert the latest pin write. This can create useful masking/override behaviour + due to the priority ordering of state machine pin writes (SM0 < SM1 < ...) + [18:18] + read-write + + + OUT_STICKY + Continuously assert the most recent OUT/SET to the pins + [17:17] + read-write + + + WRAP_TOP + After reaching this address, execution is wrapped to wrap_bottom. + If the instruction is a jump, and the jump condition is true, the jump takes priority. + [16:12] + read-write + + + WRAP_BOTTOM + After reaching wrap_top, execution is wrapped to this address. + [11:7] + read-write + + + STATUS_SEL + Comparison used for the MOV x, STATUS instruction. + [6:5] + read-write + + + TXLEVEL + 0 + All-ones if TX FIFO level < N, otherwise all-zeroes + + + RXLEVEL + 1 + All-ones if RX FIFO level < N, otherwise all-zeroes + + + IRQ + 2 + All-ones if the indexed IRQ flag is raised, otherwise all-zeroes + + + + + STATUS_N + Comparison level or IRQ index for the MOV x, STATUS instruction. + + If STATUS_SEL is TXLEVEL or RXLEVEL, then values of STATUS_N greater than the current FIFO depth are reserved, and have undefined behaviour. + [4:0] + read-write + + + IRQ + 0 + Index 0-7 of an IRQ flag in this PIO block + + + IRQ_PREVPIO + 8 + Index 0-7 of an IRQ flag in the next lower-numbered PIO block + + + IRQ_NEXTPIO + 16 + Index 0-7 of an IRQ flag in the next higher-numbered PIO block + + + + + + + SM1_SHIFTCTRL + 0x000000e8 + Control behaviour of the input/output shift registers for state machine 1 + 0x000c0000 + + + FJOIN_RX + When 1, RX FIFO steals the TX FIFO's storage, and becomes twice as deep. + TX FIFO is disabled as a result (always reads as both full and empty). + FIFOs are flushed when this bit is changed. + [31:31] + read-write + + + FJOIN_TX + When 1, TX FIFO steals the RX FIFO's storage, and becomes twice as deep. + RX FIFO is disabled as a result (always reads as both full and empty). + FIFOs are flushed when this bit is changed. + [30:30] + read-write + + + PULL_THRESH + Number of bits shifted out of OSR before autopull, or conditional pull (PULL IFEMPTY), will take place. + Write 0 for value of 32. + [29:25] + read-write + + + PUSH_THRESH + Number of bits shifted into ISR before autopush, or conditional push (PUSH IFFULL), will take place. + Write 0 for value of 32. + [24:20] + read-write + + + OUT_SHIFTDIR + 1 = shift out of output shift register to right. 0 = to left. + [19:19] + read-write + + + IN_SHIFTDIR + 1 = shift input shift register to right (data enters from left). 0 = to left. + [18:18] + read-write + + + AUTOPULL + Pull automatically when the output shift register is emptied, i.e. on or following an OUT instruction which causes the output shift counter to reach or exceed PULL_THRESH. + [17:17] + read-write + + + AUTOPUSH + Push automatically when the input shift register is filled, i.e. on an IN instruction which causes the input shift counter to reach or exceed PUSH_THRESH. + [16:16] + read-write + + + FJOIN_RX_PUT + If 1, disable this state machine's RX FIFO, make its storage available for random write access by the state machine (using the `put` instruction) and, unless FJOIN_RX_GET is also set, random read access by the processor (through the RXFx_PUTGETy registers). + + If FJOIN_RX_PUT and FJOIN_RX_GET are both set, then the RX FIFO's registers can be randomly read/written by the state machine, but are completely inaccessible to the processor. + + Setting this bit will clear the FJOIN_TX and FJOIN_RX bits. + [15:15] + read-write + + + FJOIN_RX_GET + If 1, disable this state machine's RX FIFO, make its storage available for random read access by the state machine (using the `get` instruction) and, unless FJOIN_RX_PUT is also set, random write access by the processor (through the RXFx_PUTGETy registers). + + If FJOIN_RX_PUT and FJOIN_RX_GET are both set, then the RX FIFO's registers can be randomly read/written by the state machine, but are completely inaccessible to the processor. + + Setting this bit will clear the FJOIN_TX and FJOIN_RX bits. + [14:14] + read-write + + + IN_COUNT + Set the number of pins which are not masked to 0 when read by an IN PINS, WAIT PIN or MOV x, PINS instruction. + + For example, an IN_COUNT of 5 means that the 5 LSBs of the IN pin group are visible (bits 4:0), but the remaining 27 MSBs are masked to 0. A count of 32 is encoded with a field value of 0, so the default behaviour is to not perform any masking. + + Note this masking is applied in addition to the masking usually performed by the IN instruction. This is mainly useful for the MOV x, PINS instruction, which otherwise has no way of masking pins. + [4:0] + read-write + + + + + SM1_ADDR + 0x000000ec + Current instruction address of state machine 1 + 0x00000000 + + + SM1_ADDR + [4:0] + read-only + + + + + SM1_INSTR + 0x000000f0 + Read to see the instruction currently addressed by state machine 1's program counter + Write to execute an instruction immediately (including jumps) and then resume execution. + 0x00000000 + + + SM1_INSTR + [15:0] + read-write + + + + + SM1_PINCTRL + 0x000000f4 + State machine pin control + 0x14000000 + + + SIDESET_COUNT + The number of MSBs of the Delay/Side-set instruction field which are used for side-set. Inclusive of the enable bit, if present. Minimum of 0 (all delay bits, no side-set) and maximum of 5 (all side-set, no delay). + [31:29] + read-write + + + SET_COUNT + The number of pins asserted by a SET. In the range 0 to 5 inclusive. + [28:26] + read-write + + + OUT_COUNT + The number of pins asserted by an OUT PINS, OUT PINDIRS or MOV PINS instruction. In the range 0 to 32 inclusive. + [25:20] + read-write + + + IN_BASE + The pin which is mapped to the least-significant bit of a state machine's IN data bus. Higher-numbered pins are mapped to consecutively more-significant data bits, with a modulo of 32 applied to pin number. + [19:15] + read-write + + + SIDESET_BASE + The lowest-numbered pin that will be affected by a side-set operation. The MSBs of an instruction's side-set/delay field (up to 5, determined by SIDESET_COUNT) are used for side-set data, with the remaining LSBs used for delay. The least-significant bit of the side-set portion is the bit written to this pin, with more-significant bits written to higher-numbered pins. + [14:10] + read-write + + + SET_BASE + The lowest-numbered pin that will be affected by a SET PINS or SET PINDIRS instruction. The data written to this pin is the least-significant bit of the SET data. + [9:5] + read-write + + + OUT_BASE + The lowest-numbered pin that will be affected by an OUT PINS, OUT PINDIRS or MOV PINS instruction. The data written to this pin will always be the least-significant bit of the OUT or MOV data. + [4:0] + read-write + + + + + SM2_CLKDIV + 0x000000f8 + Clock divisor register for state machine 2 + Frequency = clock freq / (CLKDIV_INT + CLKDIV_FRAC / 256) + 0x00010000 + + + INT + Effective frequency is sysclk/(int + frac/256). + Value of 0 is interpreted as 65536. If INT is 0, FRAC must also be 0. + [31:16] + read-write + + + FRAC + Fractional part of clock divisor + [15:8] + read-write + + + + + SM2_EXECCTRL + 0x000000fc + Execution/behavioural settings for state machine 2 + 0x0001f000 + + + EXEC_STALLED + If 1, an instruction written to SMx_INSTR is stalled, and latched by the state machine. Will clear to 0 once this instruction completes. + [31:31] + read-only + + + SIDE_EN + If 1, the MSB of the Delay/Side-set instruction field is used as side-set enable, rather than a side-set data bit. This allows instructions to perform side-set optionally, rather than on every instruction, but the maximum possible side-set width is reduced from 5 to 4. Note that the value of PINCTRL_SIDESET_COUNT is inclusive of this enable bit. + [30:30] + read-write + + + SIDE_PINDIR + If 1, side-set data is asserted to pin directions, instead of pin values + [29:29] + read-write + + + JMP_PIN + The GPIO number to use as condition for JMP PIN. Unaffected by input mapping. + [28:24] + read-write + + + OUT_EN_SEL + Which data bit to use for inline OUT enable + [23:19] + read-write + + + INLINE_OUT_EN + If 1, use a bit of OUT data as an auxiliary write enable + When used in conjunction with OUT_STICKY, writes with an enable of 0 will + deassert the latest pin write. This can create useful masking/override behaviour + due to the priority ordering of state machine pin writes (SM0 < SM1 < ...) + [18:18] + read-write + + + OUT_STICKY + Continuously assert the most recent OUT/SET to the pins + [17:17] + read-write + + + WRAP_TOP + After reaching this address, execution is wrapped to wrap_bottom. + If the instruction is a jump, and the jump condition is true, the jump takes priority. + [16:12] + read-write + + + WRAP_BOTTOM + After reaching wrap_top, execution is wrapped to this address. + [11:7] + read-write + + + STATUS_SEL + Comparison used for the MOV x, STATUS instruction. + [6:5] + read-write + + + TXLEVEL + 0 + All-ones if TX FIFO level < N, otherwise all-zeroes + + + RXLEVEL + 1 + All-ones if RX FIFO level < N, otherwise all-zeroes + + + IRQ + 2 + All-ones if the indexed IRQ flag is raised, otherwise all-zeroes + + + + + STATUS_N + Comparison level or IRQ index for the MOV x, STATUS instruction. + + If STATUS_SEL is TXLEVEL or RXLEVEL, then values of STATUS_N greater than the current FIFO depth are reserved, and have undefined behaviour. + [4:0] + read-write + + + IRQ + 0 + Index 0-7 of an IRQ flag in this PIO block + + + IRQ_PREVPIO + 8 + Index 0-7 of an IRQ flag in the next lower-numbered PIO block + + + IRQ_NEXTPIO + 16 + Index 0-7 of an IRQ flag in the next higher-numbered PIO block + + + + + + + SM2_SHIFTCTRL + 0x00000100 + Control behaviour of the input/output shift registers for state machine 2 + 0x000c0000 + + + FJOIN_RX + When 1, RX FIFO steals the TX FIFO's storage, and becomes twice as deep. + TX FIFO is disabled as a result (always reads as both full and empty). + FIFOs are flushed when this bit is changed. + [31:31] + read-write + + + FJOIN_TX + When 1, TX FIFO steals the RX FIFO's storage, and becomes twice as deep. + RX FIFO is disabled as a result (always reads as both full and empty). + FIFOs are flushed when this bit is changed. + [30:30] + read-write + + + PULL_THRESH + Number of bits shifted out of OSR before autopull, or conditional pull (PULL IFEMPTY), will take place. + Write 0 for value of 32. + [29:25] + read-write + + + PUSH_THRESH + Number of bits shifted into ISR before autopush, or conditional push (PUSH IFFULL), will take place. + Write 0 for value of 32. + [24:20] + read-write + + + OUT_SHIFTDIR + 1 = shift out of output shift register to right. 0 = to left. + [19:19] + read-write + + + IN_SHIFTDIR + 1 = shift input shift register to right (data enters from left). 0 = to left. + [18:18] + read-write + + + AUTOPULL + Pull automatically when the output shift register is emptied, i.e. on or following an OUT instruction which causes the output shift counter to reach or exceed PULL_THRESH. + [17:17] + read-write + + + AUTOPUSH + Push automatically when the input shift register is filled, i.e. on an IN instruction which causes the input shift counter to reach or exceed PUSH_THRESH. + [16:16] + read-write + + + FJOIN_RX_PUT + If 1, disable this state machine's RX FIFO, make its storage available for random write access by the state machine (using the `put` instruction) and, unless FJOIN_RX_GET is also set, random read access by the processor (through the RXFx_PUTGETy registers). + + If FJOIN_RX_PUT and FJOIN_RX_GET are both set, then the RX FIFO's registers can be randomly read/written by the state machine, but are completely inaccessible to the processor. + + Setting this bit will clear the FJOIN_TX and FJOIN_RX bits. + [15:15] + read-write + + + FJOIN_RX_GET + If 1, disable this state machine's RX FIFO, make its storage available for random read access by the state machine (using the `get` instruction) and, unless FJOIN_RX_PUT is also set, random write access by the processor (through the RXFx_PUTGETy registers). + + If FJOIN_RX_PUT and FJOIN_RX_GET are both set, then the RX FIFO's registers can be randomly read/written by the state machine, but are completely inaccessible to the processor. + + Setting this bit will clear the FJOIN_TX and FJOIN_RX bits. + [14:14] + read-write + + + IN_COUNT + Set the number of pins which are not masked to 0 when read by an IN PINS, WAIT PIN or MOV x, PINS instruction. + + For example, an IN_COUNT of 5 means that the 5 LSBs of the IN pin group are visible (bits 4:0), but the remaining 27 MSBs are masked to 0. A count of 32 is encoded with a field value of 0, so the default behaviour is to not perform any masking. + + Note this masking is applied in addition to the masking usually performed by the IN instruction. This is mainly useful for the MOV x, PINS instruction, which otherwise has no way of masking pins. + [4:0] + read-write + + + + + SM2_ADDR + 0x00000104 + Current instruction address of state machine 2 + 0x00000000 + + + SM2_ADDR + [4:0] + read-only + + + + + SM2_INSTR + 0x00000108 + Read to see the instruction currently addressed by state machine 2's program counter + Write to execute an instruction immediately (including jumps) and then resume execution. + 0x00000000 + + + SM2_INSTR + [15:0] + read-write + + + + + SM2_PINCTRL + 0x0000010c + State machine pin control + 0x14000000 + + + SIDESET_COUNT + The number of MSBs of the Delay/Side-set instruction field which are used for side-set. Inclusive of the enable bit, if present. Minimum of 0 (all delay bits, no side-set) and maximum of 5 (all side-set, no delay). + [31:29] + read-write + + + SET_COUNT + The number of pins asserted by a SET. In the range 0 to 5 inclusive. + [28:26] + read-write + + + OUT_COUNT + The number of pins asserted by an OUT PINS, OUT PINDIRS or MOV PINS instruction. In the range 0 to 32 inclusive. + [25:20] + read-write + + + IN_BASE + The pin which is mapped to the least-significant bit of a state machine's IN data bus. Higher-numbered pins are mapped to consecutively more-significant data bits, with a modulo of 32 applied to pin number. + [19:15] + read-write + + + SIDESET_BASE + The lowest-numbered pin that will be affected by a side-set operation. The MSBs of an instruction's side-set/delay field (up to 5, determined by SIDESET_COUNT) are used for side-set data, with the remaining LSBs used for delay. The least-significant bit of the side-set portion is the bit written to this pin, with more-significant bits written to higher-numbered pins. + [14:10] + read-write + + + SET_BASE + The lowest-numbered pin that will be affected by a SET PINS or SET PINDIRS instruction. The data written to this pin is the least-significant bit of the SET data. + [9:5] + read-write + + + OUT_BASE + The lowest-numbered pin that will be affected by an OUT PINS, OUT PINDIRS or MOV PINS instruction. The data written to this pin will always be the least-significant bit of the OUT or MOV data. + [4:0] + read-write + + + + + SM3_CLKDIV + 0x00000110 + Clock divisor register for state machine 3 + Frequency = clock freq / (CLKDIV_INT + CLKDIV_FRAC / 256) + 0x00010000 + + + INT + Effective frequency is sysclk/(int + frac/256). + Value of 0 is interpreted as 65536. If INT is 0, FRAC must also be 0. + [31:16] + read-write + + + FRAC + Fractional part of clock divisor + [15:8] + read-write + + + + + SM3_EXECCTRL + 0x00000114 + Execution/behavioural settings for state machine 3 + 0x0001f000 + + + EXEC_STALLED + If 1, an instruction written to SMx_INSTR is stalled, and latched by the state machine. Will clear to 0 once this instruction completes. + [31:31] + read-only + + + SIDE_EN + If 1, the MSB of the Delay/Side-set instruction field is used as side-set enable, rather than a side-set data bit. This allows instructions to perform side-set optionally, rather than on every instruction, but the maximum possible side-set width is reduced from 5 to 4. Note that the value of PINCTRL_SIDESET_COUNT is inclusive of this enable bit. + [30:30] + read-write + + + SIDE_PINDIR + If 1, side-set data is asserted to pin directions, instead of pin values + [29:29] + read-write + + + JMP_PIN + The GPIO number to use as condition for JMP PIN. Unaffected by input mapping. + [28:24] + read-write + + + OUT_EN_SEL + Which data bit to use for inline OUT enable + [23:19] + read-write + + + INLINE_OUT_EN + If 1, use a bit of OUT data as an auxiliary write enable + When used in conjunction with OUT_STICKY, writes with an enable of 0 will + deassert the latest pin write. This can create useful masking/override behaviour + due to the priority ordering of state machine pin writes (SM0 < SM1 < ...) + [18:18] + read-write + + + OUT_STICKY + Continuously assert the most recent OUT/SET to the pins + [17:17] + read-write + + + WRAP_TOP + After reaching this address, execution is wrapped to wrap_bottom. + If the instruction is a jump, and the jump condition is true, the jump takes priority. + [16:12] + read-write + + + WRAP_BOTTOM + After reaching wrap_top, execution is wrapped to this address. + [11:7] + read-write + + + STATUS_SEL + Comparison used for the MOV x, STATUS instruction. + [6:5] + read-write + + + TXLEVEL + 0 + All-ones if TX FIFO level < N, otherwise all-zeroes + + + RXLEVEL + 1 + All-ones if RX FIFO level < N, otherwise all-zeroes + + + IRQ + 2 + All-ones if the indexed IRQ flag is raised, otherwise all-zeroes + + + + + STATUS_N + Comparison level or IRQ index for the MOV x, STATUS instruction. + + If STATUS_SEL is TXLEVEL or RXLEVEL, then values of STATUS_N greater than the current FIFO depth are reserved, and have undefined behaviour. + [4:0] + read-write + + + IRQ + 0 + Index 0-7 of an IRQ flag in this PIO block + + + IRQ_PREVPIO + 8 + Index 0-7 of an IRQ flag in the next lower-numbered PIO block + + + IRQ_NEXTPIO + 16 + Index 0-7 of an IRQ flag in the next higher-numbered PIO block + + + + + + + SM3_SHIFTCTRL + 0x00000118 + Control behaviour of the input/output shift registers for state machine 3 + 0x000c0000 + + + FJOIN_RX + When 1, RX FIFO steals the TX FIFO's storage, and becomes twice as deep. + TX FIFO is disabled as a result (always reads as both full and empty). + FIFOs are flushed when this bit is changed. + [31:31] + read-write + + + FJOIN_TX + When 1, TX FIFO steals the RX FIFO's storage, and becomes twice as deep. + RX FIFO is disabled as a result (always reads as both full and empty). + FIFOs are flushed when this bit is changed. + [30:30] + read-write + + + PULL_THRESH + Number of bits shifted out of OSR before autopull, or conditional pull (PULL IFEMPTY), will take place. + Write 0 for value of 32. + [29:25] + read-write + + + PUSH_THRESH + Number of bits shifted into ISR before autopush, or conditional push (PUSH IFFULL), will take place. + Write 0 for value of 32. + [24:20] + read-write + + + OUT_SHIFTDIR + 1 = shift out of output shift register to right. 0 = to left. + [19:19] + read-write + + + IN_SHIFTDIR + 1 = shift input shift register to right (data enters from left). 0 = to left. + [18:18] + read-write + + + AUTOPULL + Pull automatically when the output shift register is emptied, i.e. on or following an OUT instruction which causes the output shift counter to reach or exceed PULL_THRESH. + [17:17] + read-write + + + AUTOPUSH + Push automatically when the input shift register is filled, i.e. on an IN instruction which causes the input shift counter to reach or exceed PUSH_THRESH. + [16:16] + read-write + + + FJOIN_RX_PUT + If 1, disable this state machine's RX FIFO, make its storage available for random write access by the state machine (using the `put` instruction) and, unless FJOIN_RX_GET is also set, random read access by the processor (through the RXFx_PUTGETy registers). + + If FJOIN_RX_PUT and FJOIN_RX_GET are both set, then the RX FIFO's registers can be randomly read/written by the state machine, but are completely inaccessible to the processor. + + Setting this bit will clear the FJOIN_TX and FJOIN_RX bits. + [15:15] + read-write + + + FJOIN_RX_GET + If 1, disable this state machine's RX FIFO, make its storage available for random read access by the state machine (using the `get` instruction) and, unless FJOIN_RX_PUT is also set, random write access by the processor (through the RXFx_PUTGETy registers). + + If FJOIN_RX_PUT and FJOIN_RX_GET are both set, then the RX FIFO's registers can be randomly read/written by the state machine, but are completely inaccessible to the processor. + + Setting this bit will clear the FJOIN_TX and FJOIN_RX bits. + [14:14] + read-write + + + IN_COUNT + Set the number of pins which are not masked to 0 when read by an IN PINS, WAIT PIN or MOV x, PINS instruction. + + For example, an IN_COUNT of 5 means that the 5 LSBs of the IN pin group are visible (bits 4:0), but the remaining 27 MSBs are masked to 0. A count of 32 is encoded with a field value of 0, so the default behaviour is to not perform any masking. + + Note this masking is applied in addition to the masking usually performed by the IN instruction. This is mainly useful for the MOV x, PINS instruction, which otherwise has no way of masking pins. + [4:0] + read-write + + + + + SM3_ADDR + 0x0000011c + Current instruction address of state machine 3 + 0x00000000 + + + SM3_ADDR + [4:0] + read-only + + + + + SM3_INSTR + 0x00000120 + Read to see the instruction currently addressed by state machine 3's program counter + Write to execute an instruction immediately (including jumps) and then resume execution. + 0x00000000 + + + SM3_INSTR + [15:0] + read-write + + + + + SM3_PINCTRL + 0x00000124 + State machine pin control + 0x14000000 + + + SIDESET_COUNT + The number of MSBs of the Delay/Side-set instruction field which are used for side-set. Inclusive of the enable bit, if present. Minimum of 0 (all delay bits, no side-set) and maximum of 5 (all side-set, no delay). + [31:29] + read-write + + + SET_COUNT + The number of pins asserted by a SET. In the range 0 to 5 inclusive. + [28:26] + read-write + + + OUT_COUNT + The number of pins asserted by an OUT PINS, OUT PINDIRS or MOV PINS instruction. In the range 0 to 32 inclusive. + [25:20] + read-write + + + IN_BASE + The pin which is mapped to the least-significant bit of a state machine's IN data bus. Higher-numbered pins are mapped to consecutively more-significant data bits, with a modulo of 32 applied to pin number. + [19:15] + read-write + + + SIDESET_BASE + The lowest-numbered pin that will be affected by a side-set operation. The MSBs of an instruction's side-set/delay field (up to 5, determined by SIDESET_COUNT) are used for side-set data, with the remaining LSBs used for delay. The least-significant bit of the side-set portion is the bit written to this pin, with more-significant bits written to higher-numbered pins. + [14:10] + read-write + + + SET_BASE + The lowest-numbered pin that will be affected by a SET PINS or SET PINDIRS instruction. The data written to this pin is the least-significant bit of the SET data. + [9:5] + read-write + + + OUT_BASE + The lowest-numbered pin that will be affected by an OUT PINS, OUT PINDIRS or MOV PINS instruction. The data written to this pin will always be the least-significant bit of the OUT or MOV data. + [4:0] + read-write + + + + + RXF0_PUTGET0 + 0x00000128 + Direct read/write access to entry 0 of SM0's RX FIFO, if SHIFTCTRL_FJOIN_RX_PUT xor SHIFTCTRL_FJOIN_RX_GET is set. + 0x00000000 + + + RXF0_PUTGET0 + [31:0] + read-write + + + + + RXF0_PUTGET1 + 0x0000012c + Direct read/write access to entry 1 of SM0's RX FIFO, if SHIFTCTRL_FJOIN_RX_PUT xor SHIFTCTRL_FJOIN_RX_GET is set. + 0x00000000 + + + RXF0_PUTGET1 + [31:0] + read-write + + + + + RXF0_PUTGET2 + 0x00000130 + Direct read/write access to entry 2 of SM0's RX FIFO, if SHIFTCTRL_FJOIN_RX_PUT xor SHIFTCTRL_FJOIN_RX_GET is set. + 0x00000000 + + + RXF0_PUTGET2 + [31:0] + read-write + + + + + RXF0_PUTGET3 + 0x00000134 + Direct read/write access to entry 3 of SM0's RX FIFO, if SHIFTCTRL_FJOIN_RX_PUT xor SHIFTCTRL_FJOIN_RX_GET is set. + 0x00000000 + + + RXF0_PUTGET3 + [31:0] + read-write + + + + + RXF1_PUTGET0 + 0x00000138 + Direct read/write access to entry 0 of SM1's RX FIFO, if SHIFTCTRL_FJOIN_RX_PUT xor SHIFTCTRL_FJOIN_RX_GET is set. + 0x00000000 + + + RXF1_PUTGET0 + [31:0] + read-write + + + + + RXF1_PUTGET1 + 0x0000013c + Direct read/write access to entry 1 of SM1's RX FIFO, if SHIFTCTRL_FJOIN_RX_PUT xor SHIFTCTRL_FJOIN_RX_GET is set. + 0x00000000 + + + RXF1_PUTGET1 + [31:0] + read-write + + + + + RXF1_PUTGET2 + 0x00000140 + Direct read/write access to entry 2 of SM1's RX FIFO, if SHIFTCTRL_FJOIN_RX_PUT xor SHIFTCTRL_FJOIN_RX_GET is set. + 0x00000000 + + + RXF1_PUTGET2 + [31:0] + read-write + + + + + RXF1_PUTGET3 + 0x00000144 + Direct read/write access to entry 3 of SM1's RX FIFO, if SHIFTCTRL_FJOIN_RX_PUT xor SHIFTCTRL_FJOIN_RX_GET is set. + 0x00000000 + + + RXF1_PUTGET3 + [31:0] + read-write + + + + + RXF2_PUTGET0 + 0x00000148 + Direct read/write access to entry 0 of SM2's RX FIFO, if SHIFTCTRL_FJOIN_RX_PUT xor SHIFTCTRL_FJOIN_RX_GET is set. + 0x00000000 + + + RXF2_PUTGET0 + [31:0] + read-write + + + + + RXF2_PUTGET1 + 0x0000014c + Direct read/write access to entry 1 of SM2's RX FIFO, if SHIFTCTRL_FJOIN_RX_PUT xor SHIFTCTRL_FJOIN_RX_GET is set. + 0x00000000 + + + RXF2_PUTGET1 + [31:0] + read-write + + + + + RXF2_PUTGET2 + 0x00000150 + Direct read/write access to entry 2 of SM2's RX FIFO, if SHIFTCTRL_FJOIN_RX_PUT xor SHIFTCTRL_FJOIN_RX_GET is set. + 0x00000000 + + + RXF2_PUTGET2 + [31:0] + read-write + + + + + RXF2_PUTGET3 + 0x00000154 + Direct read/write access to entry 3 of SM2's RX FIFO, if SHIFTCTRL_FJOIN_RX_PUT xor SHIFTCTRL_FJOIN_RX_GET is set. + 0x00000000 + + + RXF2_PUTGET3 + [31:0] + read-write + + + + + RXF3_PUTGET0 + 0x00000158 + Direct read/write access to entry 0 of SM3's RX FIFO, if SHIFTCTRL_FJOIN_RX_PUT xor SHIFTCTRL_FJOIN_RX_GET is set. + 0x00000000 + + + RXF3_PUTGET0 + [31:0] + read-write + + + + + RXF3_PUTGET1 + 0x0000015c + Direct read/write access to entry 1 of SM3's RX FIFO, if SHIFTCTRL_FJOIN_RX_PUT xor SHIFTCTRL_FJOIN_RX_GET is set. + 0x00000000 + + + RXF3_PUTGET1 + [31:0] + read-write + + + + + RXF3_PUTGET2 + 0x00000160 + Direct read/write access to entry 2 of SM3's RX FIFO, if SHIFTCTRL_FJOIN_RX_PUT xor SHIFTCTRL_FJOIN_RX_GET is set. + 0x00000000 + + + RXF3_PUTGET2 + [31:0] + read-write + + + + + RXF3_PUTGET3 + 0x00000164 + Direct read/write access to entry 3 of SM3's RX FIFO, if SHIFTCTRL_FJOIN_RX_PUT xor SHIFTCTRL_FJOIN_RX_GET is set. + 0x00000000 + + + RXF3_PUTGET3 + [31:0] + read-write + + + + + GPIOBASE + 0x00000168 + Relocate GPIO 0 (from PIO's point of view) in the system GPIO numbering, to access more than 32 GPIOs from PIO. + + Only the values 0 and 16 are supported (only bit 4 is writable). + 0x00000000 + + + GPIOBASE + [4:4] + read-write + + + + + INTR + 0x0000016c + Raw Interrupts + 0x00000000 + + + SM7 + [15:15] + read-only + + + SM6 + [14:14] + read-only + + + SM5 + [13:13] + read-only + + + SM4 + [12:12] + read-only + + + SM3 + [11:11] + read-only + + + SM2 + [10:10] + read-only + + + SM1 + [9:9] + read-only + + + SM0 + [8:8] + read-only + + + SM3_TXNFULL + [7:7] + read-only + + + SM2_TXNFULL + [6:6] + read-only + + + SM1_TXNFULL + [5:5] + read-only + + + SM0_TXNFULL + [4:4] + read-only + + + SM3_RXNEMPTY + [3:3] + read-only + + + SM2_RXNEMPTY + [2:2] + read-only + + + SM1_RXNEMPTY + [1:1] + read-only + + + SM0_RXNEMPTY + [0:0] + read-only + + + + + IRQ0_INTE + 0x00000170 + Interrupt Enable for irq0 + 0x00000000 + + + SM7 + [15:15] + read-write + + + SM6 + [14:14] + read-write + + + SM5 + [13:13] + read-write + + + SM4 + [12:12] + read-write + + + SM3 + [11:11] + read-write + + + SM2 + [10:10] + read-write + + + SM1 + [9:9] + read-write + + + SM0 + [8:8] + read-write + + + SM3_TXNFULL + [7:7] + read-write + + + SM2_TXNFULL + [6:6] + read-write + + + SM1_TXNFULL + [5:5] + read-write + + + SM0_TXNFULL + [4:4] + read-write + + + SM3_RXNEMPTY + [3:3] + read-write + + + SM2_RXNEMPTY + [2:2] + read-write + + + SM1_RXNEMPTY + [1:1] + read-write + + + SM0_RXNEMPTY + [0:0] + read-write + + + + + IRQ0_INTF + 0x00000174 + Interrupt Force for irq0 + 0x00000000 + + + SM7 + [15:15] + read-write + + + SM6 + [14:14] + read-write + + + SM5 + [13:13] + read-write + + + SM4 + [12:12] + read-write + + + SM3 + [11:11] + read-write + + + SM2 + [10:10] + read-write + + + SM1 + [9:9] + read-write + + + SM0 + [8:8] + read-write + + + SM3_TXNFULL + [7:7] + read-write + + + SM2_TXNFULL + [6:6] + read-write + + + SM1_TXNFULL + [5:5] + read-write + + + SM0_TXNFULL + [4:4] + read-write + + + SM3_RXNEMPTY + [3:3] + read-write + + + SM2_RXNEMPTY + [2:2] + read-write + + + SM1_RXNEMPTY + [1:1] + read-write + + + SM0_RXNEMPTY + [0:0] + read-write + + + + + IRQ0_INTS + 0x00000178 + Interrupt status after masking & forcing for irq0 + 0x00000000 + + + SM7 + [15:15] + read-only + + + SM6 + [14:14] + read-only + + + SM5 + [13:13] + read-only + + + SM4 + [12:12] + read-only + + + SM3 + [11:11] + read-only + + + SM2 + [10:10] + read-only + + + SM1 + [9:9] + read-only + + + SM0 + [8:8] + read-only + + + SM3_TXNFULL + [7:7] + read-only + + + SM2_TXNFULL + [6:6] + read-only + + + SM1_TXNFULL + [5:5] + read-only + + + SM0_TXNFULL + [4:4] + read-only + + + SM3_RXNEMPTY + [3:3] + read-only + + + SM2_RXNEMPTY + [2:2] + read-only + + + SM1_RXNEMPTY + [1:1] + read-only + + + SM0_RXNEMPTY + [0:0] + read-only + + + + + IRQ1_INTE + 0x0000017c + Interrupt Enable for irq1 + 0x00000000 + + + SM7 + [15:15] + read-write + + + SM6 + [14:14] + read-write + + + SM5 + [13:13] + read-write + + + SM4 + [12:12] + read-write + + + SM3 + [11:11] + read-write + + + SM2 + [10:10] + read-write + + + SM1 + [9:9] + read-write + + + SM0 + [8:8] + read-write + + + SM3_TXNFULL + [7:7] + read-write + + + SM2_TXNFULL + [6:6] + read-write + + + SM1_TXNFULL + [5:5] + read-write + + + SM0_TXNFULL + [4:4] + read-write + + + SM3_RXNEMPTY + [3:3] + read-write + + + SM2_RXNEMPTY + [2:2] + read-write + + + SM1_RXNEMPTY + [1:1] + read-write + + + SM0_RXNEMPTY + [0:0] + read-write + + + + + IRQ1_INTF + 0x00000180 + Interrupt Force for irq1 + 0x00000000 + + + SM7 + [15:15] + read-write + + + SM6 + [14:14] + read-write + + + SM5 + [13:13] + read-write + + + SM4 + [12:12] + read-write + + + SM3 + [11:11] + read-write + + + SM2 + [10:10] + read-write + + + SM1 + [9:9] + read-write + + + SM0 + [8:8] + read-write + + + SM3_TXNFULL + [7:7] + read-write + + + SM2_TXNFULL + [6:6] + read-write + + + SM1_TXNFULL + [5:5] + read-write + + + SM0_TXNFULL + [4:4] + read-write + + + SM3_RXNEMPTY + [3:3] + read-write + + + SM2_RXNEMPTY + [2:2] + read-write + + + SM1_RXNEMPTY + [1:1] + read-write + + + SM0_RXNEMPTY + [0:0] + read-write + + + + + IRQ1_INTS + 0x00000184 + Interrupt status after masking & forcing for irq1 + 0x00000000 + + + SM7 + [15:15] + read-only + + + SM6 + [14:14] + read-only + + + SM5 + [13:13] + read-only + + + SM4 + [12:12] + read-only + + + SM3 + [11:11] + read-only + + + SM2 + [10:10] + read-only + + + SM1 + [9:9] + read-only + + + SM0 + [8:8] + read-only + + + SM3_TXNFULL + [7:7] + read-only + + + SM2_TXNFULL + [6:6] + read-only + + + SM1_TXNFULL + [5:5] + read-only + + + SM0_TXNFULL + [4:4] + read-only + + + SM3_RXNEMPTY + [3:3] + read-only + + + SM2_RXNEMPTY + [2:2] + read-only + + + SM1_RXNEMPTY + [1:1] + read-only + + + SM0_RXNEMPTY + [0:0] + read-only + + + + + + + PIO1 + 0x50300000 + + PIO1_IRQ_0 + 17 + + + PIO1_IRQ_1 + 18 + + + + PIO2 + 0x50400000 + + PIO2_IRQ_0 + 19 + + + PIO2_IRQ_1 + 20 + + + + BUSCTRL + Register block for busfabric control signals and performance counters + 0x40068000 + + 0 + 44 + registers + + + + BUS_PRIORITY + 0x00000000 + Set the priority of each master for bus arbitration. + 0x00000000 + + + DMA_W + 0 - low priority, 1 - high priority + [12:12] + read-write + + + DMA_R + 0 - low priority, 1 - high priority + [8:8] + read-write + + + PROC1 + 0 - low priority, 1 - high priority + [4:4] + read-write + + + PROC0 + 0 - low priority, 1 - high priority + [0:0] + read-write + + + + + BUS_PRIORITY_ACK + 0x00000004 + Bus priority acknowledge + 0x00000000 + + + BUS_PRIORITY_ACK + Goes to 1 once all arbiters have registered the new global priority levels. + Arbiters update their local priority when servicing a new nonsequential access. + In normal circumstances this will happen almost immediately. + [0:0] + read-only + + + + + PERFCTR_EN + 0x00000008 + Enable the performance counters. If 0, the performance counters do not increment. This can be used to precisely start/stop event sampling around the profiled section of code. + + The performance counters are initially disabled, to save energy. + 0x00000000 + + + PERFCTR_EN + [0:0] + read-write + + + + + PERFCTR0 + 0x0000000c + Bus fabric performance counter 0 + 0x00000000 + + + PERFCTR0 + Busfabric saturating performance counter 0 + Count some event signal from the busfabric arbiters, if PERFCTR_EN is set. + Write any value to clear. Select an event to count using PERFSEL0 + [23:0] + read-write + oneToClear + + + + + PERFSEL0 + 0x00000010 + Bus fabric performance event select for PERFCTR0 + 0x0000001f + + + PERFSEL0 + Select an event for PERFCTR0. For each downstream port of the main crossbar, four events are available: ACCESS, an access took place; ACCESS_CONTESTED, an access took place that previously stalled due to contention from other masters; STALL_DOWNSTREAM, count cycles where any master stalled due to a stall on the downstream bus; STALL_UPSTREAM, count cycles where any master stalled for any reason, including contention from other masters. + [6:0] + read-write + + + siob_proc1_stall_upstream + 0 + + + siob_proc1_stall_downstream + 1 + + + siob_proc1_access_contested + 2 + + + siob_proc1_access + 3 + + + siob_proc0_stall_upstream + 4 + + + siob_proc0_stall_downstream + 5 + + + siob_proc0_access_contested + 6 + + + siob_proc0_access + 7 + + + apb_stall_upstream + 8 + + + apb_stall_downstream + 9 + + + apb_access_contested + 10 + + + apb_access + 11 + + + fastperi_stall_upstream + 12 + + + fastperi_stall_downstream + 13 + + + fastperi_access_contested + 14 + + + fastperi_access + 15 + + + sram9_stall_upstream + 16 + + + sram9_stall_downstream + 17 + + + sram9_access_contested + 18 + + + sram9_access + 19 + + + sram8_stall_upstream + 20 + + + sram8_stall_downstream + 21 + + + sram8_access_contested + 22 + + + sram8_access + 23 + + + sram7_stall_upstream + 24 + + + sram7_stall_downstream + 25 + + + sram7_access_contested + 26 + + + sram7_access + 27 + + + sram6_stall_upstream + 28 + + + sram6_stall_downstream + 29 + + + sram6_access_contested + 30 + + + sram6_access + 31 + + + sram5_stall_upstream + 32 + + + sram5_stall_downstream + 33 + + + sram5_access_contested + 34 + + + sram5_access + 35 + + + sram4_stall_upstream + 36 + + + sram4_stall_downstream + 37 + + + sram4_access_contested + 38 + + + sram4_access + 39 + + + sram3_stall_upstream + 40 + + + sram3_stall_downstream + 41 + + + sram3_access_contested + 42 + + + sram3_access + 43 + + + sram2_stall_upstream + 44 + + + sram2_stall_downstream + 45 + + + sram2_access_contested + 46 + + + sram2_access + 47 + + + sram1_stall_upstream + 48 + + + sram1_stall_downstream + 49 + + + sram1_access_contested + 50 + + + sram1_access + 51 + + + sram0_stall_upstream + 52 + + + sram0_stall_downstream + 53 + + + sram0_access_contested + 54 + + + sram0_access + 55 + + + xip_main1_stall_upstream + 56 + + + xip_main1_stall_downstream + 57 + + + xip_main1_access_contested + 58 + + + xip_main1_access + 59 + + + xip_main0_stall_upstream + 60 + + + xip_main0_stall_downstream + 61 + + + xip_main0_access_contested + 62 + + + xip_main0_access + 63 + + + rom_stall_upstream + 64 + + + rom_stall_downstream + 65 + + + rom_access_contested + 66 + + + rom_access + 67 + + + + + + + PERFCTR1 + 0x00000014 + Bus fabric performance counter 1 + 0x00000000 + + + PERFCTR1 + Busfabric saturating performance counter 1 + Count some event signal from the busfabric arbiters, if PERFCTR_EN is set. + Write any value to clear. Select an event to count using PERFSEL1 + [23:0] + read-write + oneToClear + + + + + PERFSEL1 + 0x00000018 + Bus fabric performance event select for PERFCTR1 + 0x0000001f + + + PERFSEL1 + Select an event for PERFCTR1. For each downstream port of the main crossbar, four events are available: ACCESS, an access took place; ACCESS_CONTESTED, an access took place that previously stalled due to contention from other masters; STALL_DOWNSTREAM, count cycles where any master stalled due to a stall on the downstream bus; STALL_UPSTREAM, count cycles where any master stalled for any reason, including contention from other masters. + [6:0] + read-write + + + siob_proc1_stall_upstream + 0 + + + siob_proc1_stall_downstream + 1 + + + siob_proc1_access_contested + 2 + + + siob_proc1_access + 3 + + + siob_proc0_stall_upstream + 4 + + + siob_proc0_stall_downstream + 5 + + + siob_proc0_access_contested + 6 + + + siob_proc0_access + 7 + + + apb_stall_upstream + 8 + + + apb_stall_downstream + 9 + + + apb_access_contested + 10 + + + apb_access + 11 + + + fastperi_stall_upstream + 12 + + + fastperi_stall_downstream + 13 + + + fastperi_access_contested + 14 + + + fastperi_access + 15 + + + sram9_stall_upstream + 16 + + + sram9_stall_downstream + 17 + + + sram9_access_contested + 18 + + + sram9_access + 19 + + + sram8_stall_upstream + 20 + + + sram8_stall_downstream + 21 + + + sram8_access_contested + 22 + + + sram8_access + 23 + + + sram7_stall_upstream + 24 + + + sram7_stall_downstream + 25 + + + sram7_access_contested + 26 + + + sram7_access + 27 + + + sram6_stall_upstream + 28 + + + sram6_stall_downstream + 29 + + + sram6_access_contested + 30 + + + sram6_access + 31 + + + sram5_stall_upstream + 32 + + + sram5_stall_downstream + 33 + + + sram5_access_contested + 34 + + + sram5_access + 35 + + + sram4_stall_upstream + 36 + + + sram4_stall_downstream + 37 + + + sram4_access_contested + 38 + + + sram4_access + 39 + + + sram3_stall_upstream + 40 + + + sram3_stall_downstream + 41 + + + sram3_access_contested + 42 + + + sram3_access + 43 + + + sram2_stall_upstream + 44 + + + sram2_stall_downstream + 45 + + + sram2_access_contested + 46 + + + sram2_access + 47 + + + sram1_stall_upstream + 48 + + + sram1_stall_downstream + 49 + + + sram1_access_contested + 50 + + + sram1_access + 51 + + + sram0_stall_upstream + 52 + + + sram0_stall_downstream + 53 + + + sram0_access_contested + 54 + + + sram0_access + 55 + + + xip_main1_stall_upstream + 56 + + + xip_main1_stall_downstream + 57 + + + xip_main1_access_contested + 58 + + + xip_main1_access + 59 + + + xip_main0_stall_upstream + 60 + + + xip_main0_stall_downstream + 61 + + + xip_main0_access_contested + 62 + + + xip_main0_access + 63 + + + rom_stall_upstream + 64 + + + rom_stall_downstream + 65 + + + rom_access_contested + 66 + + + rom_access + 67 + + + + + + + PERFCTR2 + 0x0000001c + Bus fabric performance counter 2 + 0x00000000 + + + PERFCTR2 + Busfabric saturating performance counter 2 + Count some event signal from the busfabric arbiters, if PERFCTR_EN is set. + Write any value to clear. Select an event to count using PERFSEL2 + [23:0] + read-write + oneToClear + + + + + PERFSEL2 + 0x00000020 + Bus fabric performance event select for PERFCTR2 + 0x0000001f + + + PERFSEL2 + Select an event for PERFCTR2. For each downstream port of the main crossbar, four events are available: ACCESS, an access took place; ACCESS_CONTESTED, an access took place that previously stalled due to contention from other masters; STALL_DOWNSTREAM, count cycles where any master stalled due to a stall on the downstream bus; STALL_UPSTREAM, count cycles where any master stalled for any reason, including contention from other masters. + [6:0] + read-write + + + siob_proc1_stall_upstream + 0 + + + siob_proc1_stall_downstream + 1 + + + siob_proc1_access_contested + 2 + + + siob_proc1_access + 3 + + + siob_proc0_stall_upstream + 4 + + + siob_proc0_stall_downstream + 5 + + + siob_proc0_access_contested + 6 + + + siob_proc0_access + 7 + + + apb_stall_upstream + 8 + + + apb_stall_downstream + 9 + + + apb_access_contested + 10 + + + apb_access + 11 + + + fastperi_stall_upstream + 12 + + + fastperi_stall_downstream + 13 + + + fastperi_access_contested + 14 + + + fastperi_access + 15 + + + sram9_stall_upstream + 16 + + + sram9_stall_downstream + 17 + + + sram9_access_contested + 18 + + + sram9_access + 19 + + + sram8_stall_upstream + 20 + + + sram8_stall_downstream + 21 + + + sram8_access_contested + 22 + + + sram8_access + 23 + + + sram7_stall_upstream + 24 + + + sram7_stall_downstream + 25 + + + sram7_access_contested + 26 + + + sram7_access + 27 + + + sram6_stall_upstream + 28 + + + sram6_stall_downstream + 29 + + + sram6_access_contested + 30 + + + sram6_access + 31 + + + sram5_stall_upstream + 32 + + + sram5_stall_downstream + 33 + + + sram5_access_contested + 34 + + + sram5_access + 35 + + + sram4_stall_upstream + 36 + + + sram4_stall_downstream + 37 + + + sram4_access_contested + 38 + + + sram4_access + 39 + + + sram3_stall_upstream + 40 + + + sram3_stall_downstream + 41 + + + sram3_access_contested + 42 + + + sram3_access + 43 + + + sram2_stall_upstream + 44 + + + sram2_stall_downstream + 45 + + + sram2_access_contested + 46 + + + sram2_access + 47 + + + sram1_stall_upstream + 48 + + + sram1_stall_downstream + 49 + + + sram1_access_contested + 50 + + + sram1_access + 51 + + + sram0_stall_upstream + 52 + + + sram0_stall_downstream + 53 + + + sram0_access_contested + 54 + + + sram0_access + 55 + + + xip_main1_stall_upstream + 56 + + + xip_main1_stall_downstream + 57 + + + xip_main1_access_contested + 58 + + + xip_main1_access + 59 + + + xip_main0_stall_upstream + 60 + + + xip_main0_stall_downstream + 61 + + + xip_main0_access_contested + 62 + + + xip_main0_access + 63 + + + rom_stall_upstream + 64 + + + rom_stall_downstream + 65 + + + rom_access_contested + 66 + + + rom_access + 67 + + + + + + + PERFCTR3 + 0x00000024 + Bus fabric performance counter 3 + 0x00000000 + + + PERFCTR3 + Busfabric saturating performance counter 3 + Count some event signal from the busfabric arbiters, if PERFCTR_EN is set. + Write any value to clear. Select an event to count using PERFSEL3 + [23:0] + read-write + oneToClear + + + + + PERFSEL3 + 0x00000028 + Bus fabric performance event select for PERFCTR3 + 0x0000001f + + + PERFSEL3 + Select an event for PERFCTR3. For each downstream port of the main crossbar, four events are available: ACCESS, an access took place; ACCESS_CONTESTED, an access took place that previously stalled due to contention from other masters; STALL_DOWNSTREAM, count cycles where any master stalled due to a stall on the downstream bus; STALL_UPSTREAM, count cycles where any master stalled for any reason, including contention from other masters. + [6:0] + read-write + + + siob_proc1_stall_upstream + 0 + + + siob_proc1_stall_downstream + 1 + + + siob_proc1_access_contested + 2 + + + siob_proc1_access + 3 + + + siob_proc0_stall_upstream + 4 + + + siob_proc0_stall_downstream + 5 + + + siob_proc0_access_contested + 6 + + + siob_proc0_access + 7 + + + apb_stall_upstream + 8 + + + apb_stall_downstream + 9 + + + apb_access_contested + 10 + + + apb_access + 11 + + + fastperi_stall_upstream + 12 + + + fastperi_stall_downstream + 13 + + + fastperi_access_contested + 14 + + + fastperi_access + 15 + + + sram9_stall_upstream + 16 + + + sram9_stall_downstream + 17 + + + sram9_access_contested + 18 + + + sram9_access + 19 + + + sram8_stall_upstream + 20 + + + sram8_stall_downstream + 21 + + + sram8_access_contested + 22 + + + sram8_access + 23 + + + sram7_stall_upstream + 24 + + + sram7_stall_downstream + 25 + + + sram7_access_contested + 26 + + + sram7_access + 27 + + + sram6_stall_upstream + 28 + + + sram6_stall_downstream + 29 + + + sram6_access_contested + 30 + + + sram6_access + 31 + + + sram5_stall_upstream + 32 + + + sram5_stall_downstream + 33 + + + sram5_access_contested + 34 + + + sram5_access + 35 + + + sram4_stall_upstream + 36 + + + sram4_stall_downstream + 37 + + + sram4_access_contested + 38 + + + sram4_access + 39 + + + sram3_stall_upstream + 40 + + + sram3_stall_downstream + 41 + + + sram3_access_contested + 42 + + + sram3_access + 43 + + + sram2_stall_upstream + 44 + + + sram2_stall_downstream + 45 + + + sram2_access_contested + 46 + + + sram2_access + 47 + + + sram1_stall_upstream + 48 + + + sram1_stall_downstream + 49 + + + sram1_access_contested + 50 + + + sram1_access + 51 + + + sram0_stall_upstream + 52 + + + sram0_stall_downstream + 53 + + + sram0_access_contested + 54 + + + sram0_access + 55 + + + xip_main1_stall_upstream + 56 + + + xip_main1_stall_downstream + 57 + + + xip_main1_access_contested + 58 + + + xip_main1_access + 59 + + + xip_main0_stall_upstream + 60 + + + xip_main0_stall_downstream + 61 + + + xip_main0_access_contested + 62 + + + xip_main0_access + 63 + + + rom_stall_upstream + 64 + + + rom_stall_downstream + 65 + + + rom_access_contested + 66 + + + rom_access + 67 + + + + + + + + + SIO + Single-cycle IO block + Provides core-local and inter-core hardware for the two processors, with single-cycle access. + 0xd0000000 + + 0 + 488 + registers + + + SIO_IRQ_FIFO + 25 + + + SIO_IRQ_BELL + 26 + + + SIO_IRQ_FIFO_NS + 27 + + + SIO_IRQ_BELL_NS + 28 + + + SIO_IRQ_MTIMECMP + 29 + + + + CPUID + 0x00000000 + Processor core identifier + 0x00000000 + + + CPUID + Value is 0 when read from processor core 0, and 1 when read from processor core 1. + [31:0] + read-only + + + + + GPIO_IN + 0x00000004 + Input value for GPIO0...31. + + In the Non-secure SIO, Secure-only GPIOs (as per ACCESSCTRL) appear as zero. + 0x00000000 + + + GPIO_IN + [31:0] + read-only + + + + + GPIO_HI_IN + 0x00000008 + Input value on GPIO32...47, QSPI IOs and USB pins + + In the Non-secure SIO, Secure-only GPIOs (as per ACCESSCTRL) appear as zero. + 0x00000000 + + + QSPI_SD + Input value on QSPI SD0 (MOSI), SD1 (MISO), SD2 and SD3 pins + [31:28] + read-only + + + QSPI_CSN + Input value on QSPI CSn pin + [27:27] + read-only + + + QSPI_SCK + Input value on QSPI SCK pin + [26:26] + read-only + + + USB_DM + Input value on USB D- pin + [25:25] + read-only + + + USB_DP + Input value on USB D+ pin + [24:24] + read-only + + + GPIO + Input value on GPIO32...47 + [15:0] + read-only + + + + + GPIO_OUT + 0x00000010 + GPIO0...31 output value + 0x00000000 + + + GPIO_OUT + Set output level (1/0 -> high/low) for GPIO0...31. Reading back gives the last value written, NOT the input value from the pins. + + If core 0 and core 1 both write to GPIO_OUT simultaneously (or to a SET/CLR/XOR alias), the result is as though the write from core 0 took place first, and the write from core 1 was then applied to that intermediate result. + + In the Non-secure SIO, Secure-only GPIOs (as per ACCESSCTRL) ignore writes, and their output status reads back as zero. This is also true for SET/CLR/XOR aliases of this register. + [31:0] + read-write + + + + + GPIO_HI_OUT + 0x00000014 + Output value for GPIO32...47, QSPI IOs and USB pins. + + Write to set output level (1/0 -> high/low). Reading back gives the last value written, NOT the input value from the pins. If core 0 and core 1 both write to GPIO_HI_OUT simultaneously (or to a SET/CLR/XOR alias), the result is as though the write from core 0 took place first, and the write from core 1 was then applied to that intermediate result. + + In the Non-secure SIO, Secure-only GPIOs (as per ACCESSCTRL) ignore writes, and their output status reads back as zero. This is also true for SET/CLR/XOR aliases of this register. + 0x00000000 + + + QSPI_SD + Output value for QSPI SD0 (MOSI), SD1 (MISO), SD2 and SD3 pins + [31:28] + read-write + + + QSPI_CSN + Output value for QSPI CSn pin + [27:27] + read-write + + + QSPI_SCK + Output value for QSPI SCK pin + [26:26] + read-write + + + USB_DM + Output value for USB D- pin + [25:25] + read-write + + + USB_DP + Output value for USB D+ pin + [24:24] + read-write + + + GPIO + Output value for GPIO32...47 + [15:0] + read-write + + + + + GPIO_OUT_SET + 0x00000018 + GPIO0...31 output value set + 0x00000000 + + + GPIO_OUT_SET + Perform an atomic bit-set on GPIO_OUT, i.e. `GPIO_OUT |= wdata` + [31:0] + write-only + + + + + GPIO_HI_OUT_SET + 0x0000001c + Output value set for GPIO32..47, QSPI IOs and USB pins. + Perform an atomic bit-set on GPIO_HI_OUT, i.e. `GPIO_HI_OUT |= wdata` + 0x00000000 + + + QSPI_SD + [31:28] + write-only + + + QSPI_CSN + [27:27] + write-only + + + QSPI_SCK + [26:26] + write-only + + + USB_DM + [25:25] + write-only + + + USB_DP + [24:24] + write-only + + + GPIO + [15:0] + write-only + + + + + GPIO_OUT_CLR + 0x00000020 + GPIO0...31 output value clear + 0x00000000 + + + GPIO_OUT_CLR + Perform an atomic bit-clear on GPIO_OUT, i.e. `GPIO_OUT &= ~wdata` + [31:0] + write-only + + + + + GPIO_HI_OUT_CLR + 0x00000024 + Output value clear for GPIO32..47, QSPI IOs and USB pins. + Perform an atomic bit-clear on GPIO_HI_OUT, i.e. `GPIO_HI_OUT &= ~wdata` + 0x00000000 + + + QSPI_SD + [31:28] + write-only + + + QSPI_CSN + [27:27] + write-only + + + QSPI_SCK + [26:26] + write-only + + + USB_DM + [25:25] + write-only + + + USB_DP + [24:24] + write-only + + + GPIO + [15:0] + write-only + + + + + GPIO_OUT_XOR + 0x00000028 + GPIO0...31 output value XOR + 0x00000000 + + + GPIO_OUT_XOR + Perform an atomic bitwise XOR on GPIO_OUT, i.e. `GPIO_OUT ^= wdata` + [31:0] + write-only + + + + + GPIO_HI_OUT_XOR + 0x0000002c + Output value XOR for GPIO32..47, QSPI IOs and USB pins. + Perform an atomic bitwise XOR on GPIO_HI_OUT, i.e. `GPIO_HI_OUT ^= wdata` + 0x00000000 + + + QSPI_SD + [31:28] + write-only + + + QSPI_CSN + [27:27] + write-only + + + QSPI_SCK + [26:26] + write-only + + + USB_DM + [25:25] + write-only + + + USB_DP + [24:24] + write-only + + + GPIO + [15:0] + write-only + + + + + GPIO_OE + 0x00000030 + GPIO0...31 output enable + 0x00000000 + + + GPIO_OE + Set output enable (1/0 -> output/input) for GPIO0...31. Reading back gives the last value written. + + If core 0 and core 1 both write to GPIO_OE simultaneously (or to a SET/CLR/XOR alias), the result is as though the write from core 0 took place first, and the write from core 1 was then applied to that intermediate result. + + In the Non-secure SIO, Secure-only GPIOs (as per ACCESSCTRL) ignore writes, and their output status reads back as zero. This is also true for SET/CLR/XOR aliases of this register. + [31:0] + read-write + + + + + GPIO_HI_OE + 0x00000034 + Output enable value for GPIO32...47, QSPI IOs and USB pins. + + Write output enable (1/0 -> output/input). Reading back gives the last value written. If core 0 and core 1 both write to GPIO_HI_OE simultaneously (or to a SET/CLR/XOR alias), the result is as though the write from core 0 took place first, and the write from core 1 was then applied to that intermediate result. + + In the Non-secure SIO, Secure-only GPIOs (as per ACCESSCTRL) ignore writes, and their output status reads back as zero. This is also true for SET/CLR/XOR aliases of this register. + 0x00000000 + + + QSPI_SD + Output enable value for QSPI SD0 (MOSI), SD1 (MISO), SD2 and SD3 pins + [31:28] + read-write + + + QSPI_CSN + Output enable value for QSPI CSn pin + [27:27] + read-write + + + QSPI_SCK + Output enable value for QSPI SCK pin + [26:26] + read-write + + + USB_DM + Output enable value for USB D- pin + [25:25] + read-write + + + USB_DP + Output enable value for USB D+ pin + [24:24] + read-write + + + GPIO + Output enable value for GPIO32...47 + [15:0] + read-write + + + + + GPIO_OE_SET + 0x00000038 + GPIO0...31 output enable set + 0x00000000 + + + GPIO_OE_SET + Perform an atomic bit-set on GPIO_OE, i.e. `GPIO_OE |= wdata` + [31:0] + write-only + + + + + GPIO_HI_OE_SET + 0x0000003c + Output enable set for GPIO32...47, QSPI IOs and USB pins. + Perform an atomic bit-set on GPIO_HI_OE, i.e. `GPIO_HI_OE |= wdata` + 0x00000000 + + + QSPI_SD + [31:28] + write-only + + + QSPI_CSN + [27:27] + write-only + + + QSPI_SCK + [26:26] + write-only + + + USB_DM + [25:25] + write-only + + + USB_DP + [24:24] + write-only + + + GPIO + [15:0] + write-only + + + + + GPIO_OE_CLR + 0x00000040 + GPIO0...31 output enable clear + 0x00000000 + + + GPIO_OE_CLR + Perform an atomic bit-clear on GPIO_OE, i.e. `GPIO_OE &= ~wdata` + [31:0] + write-only + + + + + GPIO_HI_OE_CLR + 0x00000044 + Output enable clear for GPIO32...47, QSPI IOs and USB pins. + Perform an atomic bit-clear on GPIO_HI_OE, i.e. `GPIO_HI_OE &= ~wdata` + 0x00000000 + + + QSPI_SD + [31:28] + write-only + + + QSPI_CSN + [27:27] + write-only + + + QSPI_SCK + [26:26] + write-only + + + USB_DM + [25:25] + write-only + + + USB_DP + [24:24] + write-only + + + GPIO + [15:0] + write-only + + + + + GPIO_OE_XOR + 0x00000048 + GPIO0...31 output enable XOR + 0x00000000 + + + GPIO_OE_XOR + Perform an atomic bitwise XOR on GPIO_OE, i.e. `GPIO_OE ^= wdata` + [31:0] + write-only + + + + + GPIO_HI_OE_XOR + 0x0000004c + Output enable XOR for GPIO32...47, QSPI IOs and USB pins. + Perform an atomic bitwise XOR on GPIO_HI_OE, i.e. `GPIO_HI_OE ^= wdata` + 0x00000000 + + + QSPI_SD + [31:28] + write-only + + + QSPI_CSN + [27:27] + write-only + + + QSPI_SCK + [26:26] + write-only + + + USB_DM + [25:25] + write-only + + + USB_DP + [24:24] + write-only + + + GPIO + [15:0] + write-only + + + + + FIFO_ST + 0x00000050 + Status register for inter-core FIFOs (mailboxes). + There is one FIFO in the core 0 -> core 1 direction, and one core 1 -> core 0. Both are 32 bits wide and 8 words deep. + Core 0 can see the read side of the 1->0 FIFO (RX), and the write side of 0->1 FIFO (TX). + Core 1 can see the read side of the 0->1 FIFO (RX), and the write side of 1->0 FIFO (TX). + The SIO IRQ for each core is the logical OR of the VLD, WOF and ROE fields of its FIFO_ST register. + 0x00000002 + + + ROE + Sticky flag indicating the RX FIFO was read when empty. This read was ignored by the FIFO. + [3:3] + read-write + oneToClear + + + WOF + Sticky flag indicating the TX FIFO was written when full. This write was ignored by the FIFO. + [2:2] + read-write + oneToClear + + + RDY + Value is 1 if this core's TX FIFO is not full (i.e. if FIFO_WR is ready for more data) + [1:1] + read-only + + + VLD + Value is 1 if this core's RX FIFO is not empty (i.e. if FIFO_RD is valid) + [0:0] + read-only + + + + + FIFO_WR + 0x00000054 + Write access to this core's TX FIFO + 0x00000000 + + + FIFO_WR + [31:0] + write-only + + + + + FIFO_RD + 0x00000058 + Read access to this core's RX FIFO + 0x00000000 + + + FIFO_RD + [31:0] + read-only + modify + + + + + SPINLOCK_ST + 0x0000005c + Spinlock state + A bitmap containing the state of all 32 spinlocks (1=locked). + Mainly intended for debugging. + 0x00000000 + + + SPINLOCK_ST + [31:0] + read-only + + + + + INTERP0_ACCUM0 + 0x00000080 + Read/write access to accumulator 0 + 0x00000000 + + + INTERP0_ACCUM0 + [31:0] + read-write + + + + + INTERP0_ACCUM1 + 0x00000084 + Read/write access to accumulator 1 + 0x00000000 + + + INTERP0_ACCUM1 + [31:0] + read-write + + + + + INTERP0_BASE0 + 0x00000088 + Read/write access to BASE0 register. + 0x00000000 + + + INTERP0_BASE0 + [31:0] + read-write + + + + + INTERP0_BASE1 + 0x0000008c + Read/write access to BASE1 register. + 0x00000000 + + + INTERP0_BASE1 + [31:0] + read-write + + + + + INTERP0_BASE2 + 0x00000090 + Read/write access to BASE2 register. + 0x00000000 + + + INTERP0_BASE2 + [31:0] + read-write + + + + + INTERP0_POP_LANE0 + 0x00000094 + Read LANE0 result, and simultaneously write lane results to both accumulators (POP). + 0x00000000 + + + INTERP0_POP_LANE0 + [31:0] + read-only + + + + + INTERP0_POP_LANE1 + 0x00000098 + Read LANE1 result, and simultaneously write lane results to both accumulators (POP). + 0x00000000 + + + INTERP0_POP_LANE1 + [31:0] + read-only + + + + + INTERP0_POP_FULL + 0x0000009c + Read FULL result, and simultaneously write lane results to both accumulators (POP). + 0x00000000 + + + INTERP0_POP_FULL + [31:0] + read-only + + + + + INTERP0_PEEK_LANE0 + 0x000000a0 + Read LANE0 result, without altering any internal state (PEEK). + 0x00000000 + + + INTERP0_PEEK_LANE0 + [31:0] + read-only + + + + + INTERP0_PEEK_LANE1 + 0x000000a4 + Read LANE1 result, without altering any internal state (PEEK). + 0x00000000 + + + INTERP0_PEEK_LANE1 + [31:0] + read-only + + + + + INTERP0_PEEK_FULL + 0x000000a8 + Read FULL result, without altering any internal state (PEEK). + 0x00000000 + + + INTERP0_PEEK_FULL + [31:0] + read-only + + + + + INTERP0_CTRL_LANE0 + 0x000000ac + Control register for lane 0 + 0x00000000 + + + OVERF + Set if either OVERF0 or OVERF1 is set. + [25:25] + read-only + + + OVERF1 + Indicates if any masked-off MSBs in ACCUM1 are set. + [24:24] + read-only + + + OVERF0 + Indicates if any masked-off MSBs in ACCUM0 are set. + [23:23] + read-only + + + BLEND + Only present on INTERP0 on each core. If BLEND mode is enabled: + - LANE1 result is a linear interpolation between BASE0 and BASE1, controlled + by the 8 LSBs of lane 1 shift and mask value (a fractional number between + 0 and 255/256ths) + - LANE0 result does not have BASE0 added (yields only the 8 LSBs of lane 1 shift+mask value) + - FULL result does not have lane 1 shift+mask value added (BASE2 + lane 0 shift+mask) + LANE1 SIGNED flag controls whether the interpolation is signed or unsigned. + [21:21] + read-write + + + FORCE_MSB + ORed into bits 29:28 of the lane result presented to the processor on the bus. + No effect on the internal 32-bit datapath. Handy for using a lane to generate sequence + of pointers into flash or SRAM. + [20:19] + read-write + + + ADD_RAW + If 1, mask + shift is bypassed for LANE0 result. This does not affect FULL result. + [18:18] + read-write + + + CROSS_RESULT + If 1, feed the opposite lane's result into this lane's accumulator on POP. + [17:17] + read-write + + + CROSS_INPUT + If 1, feed the opposite lane's accumulator into this lane's shift + mask hardware. + Takes effect even if ADD_RAW is set (the CROSS_INPUT mux is before the shift+mask bypass) + [16:16] + read-write + + + SIGNED + If SIGNED is set, the shifted and masked accumulator value is sign-extended to 32 bits + before adding to BASE0, and LANE0 PEEK/POP appear extended to 32 bits when read by processor. + [15:15] + read-write + + + MASK_MSB + The most-significant bit allowed to pass by the mask (inclusive) + Setting MSB < LSB may cause chip to turn inside-out + [14:10] + read-write + + + MASK_LSB + The least-significant bit allowed to pass by the mask (inclusive) + [9:5] + read-write + + + SHIFT + Right-rotate applied to accumulator before masking. By appropriately configuring the masks, left and right shifts can be synthesised. + [4:0] + read-write + + + + + INTERP0_CTRL_LANE1 + 0x000000b0 + Control register for lane 1 + 0x00000000 + + + FORCE_MSB + ORed into bits 29:28 of the lane result presented to the processor on the bus. + No effect on the internal 32-bit datapath. Handy for using a lane to generate sequence + of pointers into flash or SRAM. + [20:19] + read-write + + + ADD_RAW + If 1, mask + shift is bypassed for LANE1 result. This does not affect FULL result. + [18:18] + read-write + + + CROSS_RESULT + If 1, feed the opposite lane's result into this lane's accumulator on POP. + [17:17] + read-write + + + CROSS_INPUT + If 1, feed the opposite lane's accumulator into this lane's shift + mask hardware. + Takes effect even if ADD_RAW is set (the CROSS_INPUT mux is before the shift+mask bypass) + [16:16] + read-write + + + SIGNED + If SIGNED is set, the shifted and masked accumulator value is sign-extended to 32 bits + before adding to BASE1, and LANE1 PEEK/POP appear extended to 32 bits when read by processor. + [15:15] + read-write + + + MASK_MSB + The most-significant bit allowed to pass by the mask (inclusive) + Setting MSB < LSB may cause chip to turn inside-out + [14:10] + read-write + + + MASK_LSB + The least-significant bit allowed to pass by the mask (inclusive) + [9:5] + read-write + + + SHIFT + Right-rotate applied to accumulator before masking. By appropriately configuring the masks, left and right shifts can be synthesised. + [4:0] + read-write + + + + + INTERP0_ACCUM0_ADD + 0x000000b4 + Values written here are atomically added to ACCUM0 + Reading yields lane 0's raw shift and mask value (BASE0 not added). + 0x00000000 + + + INTERP0_ACCUM0_ADD + [23:0] + read-write + + + + + INTERP0_ACCUM1_ADD + 0x000000b8 + Values written here are atomically added to ACCUM1 + Reading yields lane 1's raw shift and mask value (BASE1 not added). + 0x00000000 + + + INTERP0_ACCUM1_ADD + [23:0] + read-write + + + + + INTERP0_BASE_1AND0 + 0x000000bc + On write, the lower 16 bits go to BASE0, upper bits to BASE1 simultaneously. + Each half is sign-extended to 32 bits if that lane's SIGNED flag is set. + 0x00000000 + + + INTERP0_BASE_1AND0 + [31:0] + write-only + + + + + INTERP1_ACCUM0 + 0x000000c0 + Read/write access to accumulator 0 + 0x00000000 + + + INTERP1_ACCUM0 + [31:0] + read-write + + + + + INTERP1_ACCUM1 + 0x000000c4 + Read/write access to accumulator 1 + 0x00000000 + + + INTERP1_ACCUM1 + [31:0] + read-write + + + + + INTERP1_BASE0 + 0x000000c8 + Read/write access to BASE0 register. + 0x00000000 + + + INTERP1_BASE0 + [31:0] + read-write + + + + + INTERP1_BASE1 + 0x000000cc + Read/write access to BASE1 register. + 0x00000000 + + + INTERP1_BASE1 + [31:0] + read-write + + + + + INTERP1_BASE2 + 0x000000d0 + Read/write access to BASE2 register. + 0x00000000 + + + INTERP1_BASE2 + [31:0] + read-write + + + + + INTERP1_POP_LANE0 + 0x000000d4 + Read LANE0 result, and simultaneously write lane results to both accumulators (POP). + 0x00000000 + + + INTERP1_POP_LANE0 + [31:0] + read-only + + + + + INTERP1_POP_LANE1 + 0x000000d8 + Read LANE1 result, and simultaneously write lane results to both accumulators (POP). + 0x00000000 + + + INTERP1_POP_LANE1 + [31:0] + read-only + + + + + INTERP1_POP_FULL + 0x000000dc + Read FULL result, and simultaneously write lane results to both accumulators (POP). + 0x00000000 + + + INTERP1_POP_FULL + [31:0] + read-only + + + + + INTERP1_PEEK_LANE0 + 0x000000e0 + Read LANE0 result, without altering any internal state (PEEK). + 0x00000000 + + + INTERP1_PEEK_LANE0 + [31:0] + read-only + + + + + INTERP1_PEEK_LANE1 + 0x000000e4 + Read LANE1 result, without altering any internal state (PEEK). + 0x00000000 + + + INTERP1_PEEK_LANE1 + [31:0] + read-only + + + + + INTERP1_PEEK_FULL + 0x000000e8 + Read FULL result, without altering any internal state (PEEK). + 0x00000000 + + + INTERP1_PEEK_FULL + [31:0] + read-only + + + + + INTERP1_CTRL_LANE0 + 0x000000ec + Control register for lane 0 + 0x00000000 + + + OVERF + Set if either OVERF0 or OVERF1 is set. + [25:25] + read-only + + + OVERF1 + Indicates if any masked-off MSBs in ACCUM1 are set. + [24:24] + read-only + + + OVERF0 + Indicates if any masked-off MSBs in ACCUM0 are set. + [23:23] + read-only + + + CLAMP + Only present on INTERP1 on each core. If CLAMP mode is enabled: + - LANE0 result is shifted and masked ACCUM0, clamped by a lower bound of + BASE0 and an upper bound of BASE1. + - Signedness of these comparisons is determined by LANE0_CTRL_SIGNED + [22:22] + read-write + + + FORCE_MSB + ORed into bits 29:28 of the lane result presented to the processor on the bus. + No effect on the internal 32-bit datapath. Handy for using a lane to generate sequence + of pointers into flash or SRAM. + [20:19] + read-write + + + ADD_RAW + If 1, mask + shift is bypassed for LANE0 result. This does not affect FULL result. + [18:18] + read-write + + + CROSS_RESULT + If 1, feed the opposite lane's result into this lane's accumulator on POP. + [17:17] + read-write + + + CROSS_INPUT + If 1, feed the opposite lane's accumulator into this lane's shift + mask hardware. + Takes effect even if ADD_RAW is set (the CROSS_INPUT mux is before the shift+mask bypass) + [16:16] + read-write + + + SIGNED + If SIGNED is set, the shifted and masked accumulator value is sign-extended to 32 bits + before adding to BASE0, and LANE0 PEEK/POP appear extended to 32 bits when read by processor. + [15:15] + read-write + + + MASK_MSB + The most-significant bit allowed to pass by the mask (inclusive) + Setting MSB < LSB may cause chip to turn inside-out + [14:10] + read-write + + + MASK_LSB + The least-significant bit allowed to pass by the mask (inclusive) + [9:5] + read-write + + + SHIFT + Right-rotate applied to accumulator before masking. By appropriately configuring the masks, left and right shifts can be synthesised. + [4:0] + read-write + + + + + INTERP1_CTRL_LANE1 + 0x000000f0 + Control register for lane 1 + 0x00000000 + + + FORCE_MSB + ORed into bits 29:28 of the lane result presented to the processor on the bus. + No effect on the internal 32-bit datapath. Handy for using a lane to generate sequence + of pointers into flash or SRAM. + [20:19] + read-write + + + ADD_RAW + If 1, mask + shift is bypassed for LANE1 result. This does not affect FULL result. + [18:18] + read-write + + + CROSS_RESULT + If 1, feed the opposite lane's result into this lane's accumulator on POP. + [17:17] + read-write + + + CROSS_INPUT + If 1, feed the opposite lane's accumulator into this lane's shift + mask hardware. + Takes effect even if ADD_RAW is set (the CROSS_INPUT mux is before the shift+mask bypass) + [16:16] + read-write + + + SIGNED + If SIGNED is set, the shifted and masked accumulator value is sign-extended to 32 bits + before adding to BASE1, and LANE1 PEEK/POP appear extended to 32 bits when read by processor. + [15:15] + read-write + + + MASK_MSB + The most-significant bit allowed to pass by the mask (inclusive) + Setting MSB < LSB may cause chip to turn inside-out + [14:10] + read-write + + + MASK_LSB + The least-significant bit allowed to pass by the mask (inclusive) + [9:5] + read-write + + + SHIFT + Right-rotate applied to accumulator before masking. By appropriately configuring the masks, left and right shifts can be synthesised. + [4:0] + read-write + + + + + INTERP1_ACCUM0_ADD + 0x000000f4 + Values written here are atomically added to ACCUM0 + Reading yields lane 0's raw shift and mask value (BASE0 not added). + 0x00000000 + + + INTERP1_ACCUM0_ADD + [23:0] + read-write + + + + + INTERP1_ACCUM1_ADD + 0x000000f8 + Values written here are atomically added to ACCUM1 + Reading yields lane 1's raw shift and mask value (BASE1 not added). + 0x00000000 + + + INTERP1_ACCUM1_ADD + [23:0] + read-write + + + + + INTERP1_BASE_1AND0 + 0x000000fc + On write, the lower 16 bits go to BASE0, upper bits to BASE1 simultaneously. + Each half is sign-extended to 32 bits if that lane's SIGNED flag is set. + 0x00000000 + + + INTERP1_BASE_1AND0 + [31:0] + write-only + + + + + SPINLOCK0 + 0x00000100 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK0 + [31:0] + read-write + modify + + + + + SPINLOCK1 + 0x00000104 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK1 + [31:0] + read-write + modify + + + + + SPINLOCK2 + 0x00000108 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK2 + [31:0] + read-write + modify + + + + + SPINLOCK3 + 0x0000010c + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK3 + [31:0] + read-write + modify + + + + + SPINLOCK4 + 0x00000110 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK4 + [31:0] + read-write + modify + + + + + SPINLOCK5 + 0x00000114 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK5 + [31:0] + read-write + modify + + + + + SPINLOCK6 + 0x00000118 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK6 + [31:0] + read-write + modify + + + + + SPINLOCK7 + 0x0000011c + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK7 + [31:0] + read-write + modify + + + + + SPINLOCK8 + 0x00000120 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK8 + [31:0] + read-write + modify + + + + + SPINLOCK9 + 0x00000124 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK9 + [31:0] + read-write + modify + + + + + SPINLOCK10 + 0x00000128 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK10 + [31:0] + read-write + modify + + + + + SPINLOCK11 + 0x0000012c + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK11 + [31:0] + read-write + modify + + + + + SPINLOCK12 + 0x00000130 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK12 + [31:0] + read-write + modify + + + + + SPINLOCK13 + 0x00000134 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK13 + [31:0] + read-write + modify + + + + + SPINLOCK14 + 0x00000138 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK14 + [31:0] + read-write + modify + + + + + SPINLOCK15 + 0x0000013c + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK15 + [31:0] + read-write + modify + + + + + SPINLOCK16 + 0x00000140 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK16 + [31:0] + read-write + modify + + + + + SPINLOCK17 + 0x00000144 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK17 + [31:0] + read-write + modify + + + + + SPINLOCK18 + 0x00000148 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK18 + [31:0] + read-write + modify + + + + + SPINLOCK19 + 0x0000014c + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK19 + [31:0] + read-write + modify + + + + + SPINLOCK20 + 0x00000150 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK20 + [31:0] + read-write + modify + + + + + SPINLOCK21 + 0x00000154 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK21 + [31:0] + read-write + modify + + + + + SPINLOCK22 + 0x00000158 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK22 + [31:0] + read-write + modify + + + + + SPINLOCK23 + 0x0000015c + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK23 + [31:0] + read-write + modify + + + + + SPINLOCK24 + 0x00000160 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK24 + [31:0] + read-write + modify + + + + + SPINLOCK25 + 0x00000164 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK25 + [31:0] + read-write + modify + + + + + SPINLOCK26 + 0x00000168 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK26 + [31:0] + read-write + modify + + + + + SPINLOCK27 + 0x0000016c + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK27 + [31:0] + read-write + modify + + + + + SPINLOCK28 + 0x00000170 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK28 + [31:0] + read-write + modify + + + + + SPINLOCK29 + 0x00000174 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK29 + [31:0] + read-write + modify + + + + + SPINLOCK30 + 0x00000178 + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK30 + [31:0] + read-write + modify + + + + + SPINLOCK31 + 0x0000017c + Reading from a spinlock address will: + - Return 0 if lock is already locked + - Otherwise return nonzero, and simultaneously claim the lock + + Writing (any value) releases the lock. + If core 0 and core 1 attempt to claim the same lock simultaneously, core 0 wins. + The value returned on success is 0x1 << lock number. + 0x00000000 + + + SPINLOCK31 + [31:0] + read-write + modify + + + + + DOORBELL_OUT_SET + 0x00000180 + Trigger a doorbell interrupt on the opposite core. + + Write 1 to a bit to set the corresponding bit in DOORBELL_IN on the opposite core. This raises the opposite core's doorbell interrupt. + + Read to get the status of the doorbells currently asserted on the opposite core. This is equivalent to that core reading its own DOORBELL_IN status. + 0x00000000 + + + DOORBELL_OUT_SET + [7:0] + read-write + + + + + DOORBELL_OUT_CLR + 0x00000184 + Clear doorbells which have been posted to the opposite core. This register is intended for debugging and initialisation purposes. + + Writing 1 to a bit in DOORBELL_OUT_CLR clears the corresponding bit in DOORBELL_IN on the opposite core. Clearing all bits will cause that core's doorbell interrupt to deassert. Since the usual order of events is for software to send events using DOORBELL_OUT_SET, and acknowledge incoming events by writing to DOORBELL_IN_CLR, this register should be used with caution to avoid race conditions. + + Reading returns the status of the doorbells currently asserted on the other core, i.e. is equivalent to that core reading its own DOORBELL_IN status. + 0x00000000 + + + DOORBELL_OUT_CLR + [7:0] + read-write + oneToClear + + + + + DOORBELL_IN_SET + 0x00000188 + Write 1s to trigger doorbell interrupts on this core. Read to get status of doorbells currently asserted on this core. + 0x00000000 + + + DOORBELL_IN_SET + [7:0] + read-write + + + + + DOORBELL_IN_CLR + 0x0000018c + Check and acknowledge doorbells posted to this core. This core's doorbell interrupt is asserted when any bit in this register is 1. + + Write 1 to each bit to clear that bit. The doorbell interrupt deasserts once all bits are cleared. Read to get status of doorbells currently asserted on this core. + 0x00000000 + + + DOORBELL_IN_CLR + [7:0] + read-write + oneToClear + + + + + PERI_NONSEC + 0x00000190 + Detach certain core-local peripherals from Secure SIO, and attach them to Non-secure SIO, so that Non-secure software can use them. Attempting to access one of these peripherals from the Secure SIO when it is attached to the Non-secure SIO, or vice versa, will generate a bus error. + + This register is per-core, and is only present on the Secure SIO. + + Most SIO hardware is duplicated across the Secure and Non-secure SIO, so is not listed in this register. + 0x00000000 + + + TMDS + IF 1, detach TMDS encoder (of this core) from the Secure SIO, and attach to the Non-secure SIO. + [5:5] + read-write + + + INTERP1 + If 1, detach interpolator 1 (of this core) from the Secure SIO, and attach to the Non-secure SIO. + [1:1] + read-write + + + INTERP0 + If 1, detach interpolator 0 (of this core) from the Secure SIO, and attach to the Non-secure SIO. + [0:0] + read-write + + + + + RISCV_SOFTIRQ + 0x000001a0 + Control the assertion of the standard software interrupt (MIP.MSIP) on the RISC-V cores. + + Unlike the RISC-V timer, this interrupt is not routed to a normal system-level interrupt line, so can not be used by the Arm cores. + + It is safe for both cores to write to this register on the same cycle. The set/clear effect is accumulated across both cores, and then applied. If a flag is both set and cleared on the same cycle, only the set takes effect. + 0x00000000 + + + CORE1_CLR + Write 1 to atomically clear the core 1 software interrupt flag. Read to get the status of this flag. + [9:9] + read-write + + + CORE0_CLR + Write 1 to atomically clear the core 0 software interrupt flag. Read to get the status of this flag. + [8:8] + read-write + + + CORE1_SET + Write 1 to atomically set the core 1 software interrupt flag. Read to get the status of this flag. + [1:1] + read-write + + + CORE0_SET + Write 1 to atomically set the core 0 software interrupt flag. Read to get the status of this flag. + [0:0] + read-write + + + + + MTIME_CTRL + 0x000001a4 + Control register for the RISC-V 64-bit Machine-mode timer. This timer is only present in the Secure SIO, so is only accessible to an Arm core in Secure mode or a RISC-V core in Machine mode. + + Note whilst this timer follows the RISC-V privileged specification, it is equally usable by the Arm cores. The interrupts are routed to normal system-level interrupt lines as well as to the MIP.MTIP inputs on the RISC-V cores. + 0x0000000d + + + DBGPAUSE_CORE1 + If 1, the timer pauses when core 1 is in the debug halt state. + [3:3] + read-write + + + DBGPAUSE_CORE0 + If 1, the timer pauses when core 0 is in the debug halt state. + [2:2] + read-write + + + FULLSPEED + If 1, increment the timer every cycle (i.e. run directly from the system clock), rather than incrementing on the system-level timer tick input. + [1:1] + read-write + + + EN + Timer enable bit. When 0, the timer will not increment automatically. + [0:0] + read-write + + + + + MTIME + 0x000001b0 + Read/write access to the high half of RISC-V Machine-mode timer. This register is shared between both cores. If both cores write on the same cycle, core 1 takes precedence. + 0x00000000 + + + MTIME + [31:0] + read-write + + + + + MTIMEH + 0x000001b4 + Read/write access to the high half of RISC-V Machine-mode timer. This register is shared between both cores. If both cores write on the same cycle, core 1 takes precedence. + 0x00000000 + + + MTIMEH + [31:0] + read-write + + + + + MTIMECMP + 0x000001b8 + Low half of RISC-V Machine-mode timer comparator. This register is core-local, i.e., each core gets a copy of this register, with the comparison result routed to its own interrupt line. + + The timer interrupt is asserted whenever MTIME is greater than or equal to MTIMECMP. This comparison is unsigned, and performed on the full 64-bit values. + 0xffffffff + + + MTIMECMP + [31:0] + read-write + + + + + MTIMECMPH + 0x000001bc + High half of RISC-V Machine-mode timer comparator. This register is core-local. + + The timer interrupt is asserted whenever MTIME is greater than or equal to MTIMECMP. This comparison is unsigned, and performed on the full 64-bit values. + 0xffffffff + + + MTIMECMPH + [31:0] + read-write + + + + + TMDS_CTRL + 0x000001c0 + Control register for TMDS encoder. + 0x00000000 + + + CLEAR_BALANCE + Clear the running DC balance state of the TMDS encoders. This bit should be written once at the beginning of each scanline. + [28:28] + write-only + + + PIX2_NOSHIFT + When encoding two pixels's worth of symbols in one cycle (a read of a PEEK/POP_DOUBLE register), the second encoder sees a shifted version of the colour data register. + + This control disables that shift, so that both encoder layers see the same pixel data. This is used for pixel doubling. + [27:27] + read-write + + + PIX_SHIFT + Shift applied to the colour data register with each read of a POP alias register. + + Reading from the POP_SINGLE register, or reading from the POP_DOUBLE register with PIX2_NOSHIFT set (for pixel doubling), shifts by the indicated amount. + + Reading from a POP_DOUBLE register when PIX2_NOSHIFT is clear will shift by double the indicated amount. (Shift by 32 means no shift.) + [26:24] + read-write + + + 0 + 0 + Do not shift the colour data register. + + + 1 + 1 + Shift the colour data register by 1 bit + + + 2 + 2 + Shift the colour data register by 2 bits + + + 4 + 3 + Shift the colour data register by 4 bits + + + 8 + 4 + Shift the colour data register by 8 bits + + + 16 + 5 + Shift the colour data register by 16 bits + + + + + INTERLEAVE + Enable lane interleaving for reads of PEEK_SINGLE/POP_SINGLE. + + When interleaving is disabled, each of the 3 symbols appears as a contiguous 10-bit field, with lane 0 being the least-significant and starting at bit 0 of the register. + + When interleaving is enabled, the symbols are packed into 5 chunks of 3 lanes times 2 bits (30 bits total). Each chunk contains two bits of a TMDS symbol per lane, with lane 0 being the least significant. + [23:23] + read-write + + + L2_NBITS + Number of valid colour MSBs for lane 2 (1-8 bits, encoded as 0 through 7). Remaining LSBs are masked to 0 after the rotate. + [20:18] + read-write + + + L1_NBITS + Number of valid colour MSBs for lane 1 (1-8 bits, encoded as 0 through 7). Remaining LSBs are masked to 0 after the rotate. + [17:15] + read-write + + + L0_NBITS + Number of valid colour MSBs for lane 0 (1-8 bits, encoded as 0 through 7). Remaining LSBs are masked to 0 after the rotate. + [14:12] + read-write + + + L2_ROT + Right-rotate the 16 LSBs of the colour accumulator by 0-15 bits, in order to get the MSB of the lane 2 (red) colour data aligned with the MSB of the 8-bit encoder input. + + For example, for RGB565 (red most significant), red is bits 15:11, so should be right-rotated by 8 bits to align with bits 7:3 of the encoder input. + [11:8] + read-write + + + L1_ROT + Right-rotate the 16 LSBs of the colour accumulator by 0-15 bits, in order to get the MSB of the lane 1 (green) colour data aligned with the MSB of the 8-bit encoder input. + + For example, for RGB565, green is bits 10:5, so should be right-rotated by 3 bits to align with bits 7:2 of the encoder input. + [7:4] + read-write + + + L0_ROT + Right-rotate the 16 LSBs of the colour accumulator by 0-15 bits, in order to get the MSB of the lane 0 (blue) colour data aligned with the MSB of the 8-bit encoder input. + + For example, for RGB565 (red most significant), blue is bits 4:0, so should be right-rotated by 13 to align with bits 7:3 of the encoder input. + [3:0] + read-write + + + + + TMDS_WDATA + 0x000001c4 + Write-only access to the TMDS colour data register. + 0x00000000 + + + TMDS_WDATA + [31:0] + write-only + + + + + TMDS_PEEK_SINGLE + 0x000001c8 + Get the encoding of one pixel's worth of colour data, packed into a 32-bit value (3x10-bit symbols). + + The PEEK alias does not shift the colour register when read, but still advances the running DC balance state of each encoder. This is useful for pixel doubling. + 0x00000000 + + + TMDS_PEEK_SINGLE + [31:0] + read-only + modify + + + + + TMDS_POP_SINGLE + 0x000001cc + Get the encoding of one pixel's worth of colour data, packed into a 32-bit value. The packing is 5 chunks of 3 lanes times 2 bits (30 bits total). Each chunk contains two bits of a TMDS symbol per lane. This format is intended for shifting out with the HSTX peripheral on RP2350. + + The POP alias shifts the colour register when read, as well as advancing the running DC balance state of each encoder. + 0x00000000 + + + TMDS_POP_SINGLE + [31:0] + read-only + modify + + + + + TMDS_PEEK_DOUBLE_L0 + 0x000001d0 + Get lane 0 of the encoding of two pixels' worth of colour data. Two 10-bit TMDS symbols are packed at the bottom of a 32-bit word. + + The PEEK alias does not shift the colour register when read, but still advances the lane 0 DC balance state. This is useful if all 3 lanes' worth of encode are to be read at once, rather than processing the entire scanline for one lane before moving to the next lane. + 0x00000000 + + + TMDS_PEEK_DOUBLE_L0 + [31:0] + read-only + modify + + + + + TMDS_POP_DOUBLE_L0 + 0x000001d4 + Get lane 0 of the encoding of two pixels' worth of colour data. Two 10-bit TMDS symbols are packed at the bottom of a 32-bit word. + + The POP alias shifts the colour register when read, according to the values of PIX_SHIFT and PIX2_NOSHIFT. + 0x00000000 + + + TMDS_POP_DOUBLE_L0 + [31:0] + read-only + modify + + + + + TMDS_PEEK_DOUBLE_L1 + 0x000001d8 + Get lane 1 of the encoding of two pixels' worth of colour data. Two 10-bit TMDS symbols are packed at the bottom of a 32-bit word. + + The PEEK alias does not shift the colour register when read, but still advances the lane 1 DC balance state. This is useful if all 3 lanes' worth of encode are to be read at once, rather than processing the entire scanline for one lane before moving to the next lane. + 0x00000000 + + + TMDS_PEEK_DOUBLE_L1 + [31:0] + read-only + modify + + + + + TMDS_POP_DOUBLE_L1 + 0x000001dc + Get lane 1 of the encoding of two pixels' worth of colour data. Two 10-bit TMDS symbols are packed at the bottom of a 32-bit word. + + The POP alias shifts the colour register when read, according to the values of PIX_SHIFT and PIX2_NOSHIFT. + 0x00000000 + + + TMDS_POP_DOUBLE_L1 + [31:0] + read-only + modify + + + + + TMDS_PEEK_DOUBLE_L2 + 0x000001e0 + Get lane 2 of the encoding of two pixels' worth of colour data. Two 10-bit TMDS symbols are packed at the bottom of a 32-bit word. + + The PEEK alias does not shift the colour register when read, but still advances the lane 2 DC balance state. This is useful if all 3 lanes' worth of encode are to be read at once, rather than processing the entire scanline for one lane before moving to the next lane. + 0x00000000 + + + TMDS_PEEK_DOUBLE_L2 + [31:0] + read-only + modify + + + + + TMDS_POP_DOUBLE_L2 + 0x000001e4 + Get lane 2 of the encoding of two pixels' worth of colour data. Two 10-bit TMDS symbols are packed at the bottom of a 32-bit word. + + The POP alias shifts the colour register when read, according to the values of PIX_SHIFT and PIX2_NOSHIFT. + 0x00000000 + + + TMDS_POP_DOUBLE_L2 + [31:0] + read-only + modify + + + + + + + SIO_NS + 0xd0020000 + + + BOOTRAM + Additional registers mapped adjacent to the bootram, for use by the bootrom. + 0x400e0000 + + 0 + 2092 + registers + + + + WRITE_ONCE0 + 0x00000800 + This registers always ORs writes into its current contents. Once a bit is set, it can only be cleared by a reset. + 0x00000000 + + + WRITE_ONCE0 + [31:0] + read-write + + + + + WRITE_ONCE1 + 0x00000804 + This registers always ORs writes into its current contents. Once a bit is set, it can only be cleared by a reset. + 0x00000000 + + + WRITE_ONCE1 + [31:0] + read-write + + + + + BOOTLOCK_STAT + 0x00000808 + Bootlock status register. 1=unclaimed, 0=claimed. These locks function identically to the SIO spinlocks, but are reserved for bootrom use. + 0x000000ff + + + BOOTLOCK_STAT + [7:0] + read-write + + + + + BOOTLOCK0 + 0x0000080c + Read to claim and check. Write to unclaim. The value returned on successful claim is 1 << n, and on failed claim is zero. + 0x00000000 + + + BOOTLOCK0 + [31:0] + read-write + + + + + BOOTLOCK1 + 0x00000810 + Read to claim and check. Write to unclaim. The value returned on successful claim is 1 << n, and on failed claim is zero. + 0x00000000 + + + BOOTLOCK1 + [31:0] + read-write + + + + + BOOTLOCK2 + 0x00000814 + Read to claim and check. Write to unclaim. The value returned on successful claim is 1 << n, and on failed claim is zero. + 0x00000000 + + + BOOTLOCK2 + [31:0] + read-write + + + + + BOOTLOCK3 + 0x00000818 + Read to claim and check. Write to unclaim. The value returned on successful claim is 1 << n, and on failed claim is zero. + 0x00000000 + + + BOOTLOCK3 + [31:0] + read-write + + + + + BOOTLOCK4 + 0x0000081c + Read to claim and check. Write to unclaim. The value returned on successful claim is 1 << n, and on failed claim is zero. + 0x00000000 + + + BOOTLOCK4 + [31:0] + read-write + + + + + BOOTLOCK5 + 0x00000820 + Read to claim and check. Write to unclaim. The value returned on successful claim is 1 << n, and on failed claim is zero. + 0x00000000 + + + BOOTLOCK5 + [31:0] + read-write + + + + + BOOTLOCK6 + 0x00000824 + Read to claim and check. Write to unclaim. The value returned on successful claim is 1 << n, and on failed claim is zero. + 0x00000000 + + + BOOTLOCK6 + [31:0] + read-write + + + + + BOOTLOCK7 + 0x00000828 + Read to claim and check. Write to unclaim. The value returned on successful claim is 1 << n, and on failed claim is zero. + 0x00000000 + + + BOOTLOCK7 + [31:0] + read-write + + + + + + + CORESIGHT_TRACE + Coresight block - RP specific registers + 0x50700000 + + 0 + 8 + registers + + + + CTRL_STATUS + 0x00000000 + Control and status register + 0x00000001 + + + TRACE_CAPTURE_FIFO_OVERFLOW + This status flag is set high when trace data has been dropped due to the FIFO being full at the point trace data was sampled. Write 1 to acknowledge and clear the bit. + [1:1] + read-write + + + TRACE_CAPTURE_FIFO_FLUSH + Set to 1 to continuously hold the trace FIFO in a flushed state and prevent overflow. + + Before clearing this flag, configure and start a DMA channel with the correct DREQ for the TRACE_CAPTURE_FIFO register. + + Clear this flag to begin sampling trace data, and set once again once the trace capture buffer is full. You must configure the TPIU in order to generate trace packets to be captured, as well as components like the ETM further upstream to generate the event stream propagated to the TPIU. + [0:0] + read-write + + + + + TRACE_CAPTURE_FIFO + 0x00000004 + FIFO for trace data captured from the TPIU + 0x00000000 + + + RDATA + Read from an 8 x 32-bit FIFO containing trace data captured from the TPIU. + + Hardware pushes to the FIFO on rising edges of clk_sys, when either of the following is true: + + * TPIU TRACECTL output is low (normal trace data) + + * TPIU TRACETCL output is high, and TPIU TRACEDATA0 and TRACEDATA1 are both low (trigger packet) + + These conditions are in accordance with Arm Coresight Architecture Spec v3.0 section D3.3.3: Decoding requirements for Trace Capture Devices + + The data captured into the FIFO is the full 32-bit TRACEDATA bus output by the TPIU. Note that the TPIU is a DDR output at half of clk_sys, therefore this interface can capture the full 32-bit TPIU DDR output bandwidth as it samples once per active edge of the TPIU output clock. + [31:0] + read-only + modify + + + + + + + USB + USB FS/LS controller device registers + 0x50110000 + + 0 + 280 + registers + + + USBCTRL_IRQ + 14 + + + + ADDR_ENDP + 0x00000000 + Device address and endpoint control + 0x00000000 + + + ENDPOINT + Device endpoint to send data to. Only valid for HOST mode. + [19:16] + read-write + + + ADDRESS + In device mode, the address that the device should respond to. Set in response to a SET_ADDR setup packet from the host. In host mode set to the address of the device to communicate with. + [6:0] + read-write + + + + + ADDR_ENDP1 + 0x00000004 + Interrupt endpoint 1. Only valid for HOST mode. + 0x00000000 + + + INTEP_PREAMBLE + Interrupt EP requires preamble (is a low speed device on a full speed hub) + [26:26] + read-write + + + INTEP_DIR + Direction of the interrupt endpoint. In=0, Out=1 + [25:25] + read-write + + + ENDPOINT + Endpoint number of the interrupt endpoint + [19:16] + read-write + + + ADDRESS + Device address + [6:0] + read-write + + + + + ADDR_ENDP2 + 0x00000008 + Interrupt endpoint 2. Only valid for HOST mode. + 0x00000000 + + + INTEP_PREAMBLE + Interrupt EP requires preamble (is a low speed device on a full speed hub) + [26:26] + read-write + + + INTEP_DIR + Direction of the interrupt endpoint. In=0, Out=1 + [25:25] + read-write + + + ENDPOINT + Endpoint number of the interrupt endpoint + [19:16] + read-write + + + ADDRESS + Device address + [6:0] + read-write + + + + + ADDR_ENDP3 + 0x0000000c + Interrupt endpoint 3. Only valid for HOST mode. + 0x00000000 + + + INTEP_PREAMBLE + Interrupt EP requires preamble (is a low speed device on a full speed hub) + [26:26] + read-write + + + INTEP_DIR + Direction of the interrupt endpoint. In=0, Out=1 + [25:25] + read-write + + + ENDPOINT + Endpoint number of the interrupt endpoint + [19:16] + read-write + + + ADDRESS + Device address + [6:0] + read-write + + + + + ADDR_ENDP4 + 0x00000010 + Interrupt endpoint 4. Only valid for HOST mode. + 0x00000000 + + + INTEP_PREAMBLE + Interrupt EP requires preamble (is a low speed device on a full speed hub) + [26:26] + read-write + + + INTEP_DIR + Direction of the interrupt endpoint. In=0, Out=1 + [25:25] + read-write + + + ENDPOINT + Endpoint number of the interrupt endpoint + [19:16] + read-write + + + ADDRESS + Device address + [6:0] + read-write + + + + + ADDR_ENDP5 + 0x00000014 + Interrupt endpoint 5. Only valid for HOST mode. + 0x00000000 + + + INTEP_PREAMBLE + Interrupt EP requires preamble (is a low speed device on a full speed hub) + [26:26] + read-write + + + INTEP_DIR + Direction of the interrupt endpoint. In=0, Out=1 + [25:25] + read-write + + + ENDPOINT + Endpoint number of the interrupt endpoint + [19:16] + read-write + + + ADDRESS + Device address + [6:0] + read-write + + + + + ADDR_ENDP6 + 0x00000018 + Interrupt endpoint 6. Only valid for HOST mode. + 0x00000000 + + + INTEP_PREAMBLE + Interrupt EP requires preamble (is a low speed device on a full speed hub) + [26:26] + read-write + + + INTEP_DIR + Direction of the interrupt endpoint. In=0, Out=1 + [25:25] + read-write + + + ENDPOINT + Endpoint number of the interrupt endpoint + [19:16] + read-write + + + ADDRESS + Device address + [6:0] + read-write + + + + + ADDR_ENDP7 + 0x0000001c + Interrupt endpoint 7. Only valid for HOST mode. + 0x00000000 + + + INTEP_PREAMBLE + Interrupt EP requires preamble (is a low speed device on a full speed hub) + [26:26] + read-write + + + INTEP_DIR + Direction of the interrupt endpoint. In=0, Out=1 + [25:25] + read-write + + + ENDPOINT + Endpoint number of the interrupt endpoint + [19:16] + read-write + + + ADDRESS + Device address + [6:0] + read-write + + + + + ADDR_ENDP8 + 0x00000020 + Interrupt endpoint 8. Only valid for HOST mode. + 0x00000000 + + + INTEP_PREAMBLE + Interrupt EP requires preamble (is a low speed device on a full speed hub) + [26:26] + read-write + + + INTEP_DIR + Direction of the interrupt endpoint. In=0, Out=1 + [25:25] + read-write + + + ENDPOINT + Endpoint number of the interrupt endpoint + [19:16] + read-write + + + ADDRESS + Device address + [6:0] + read-write + + + + + ADDR_ENDP9 + 0x00000024 + Interrupt endpoint 9. Only valid for HOST mode. + 0x00000000 + + + INTEP_PREAMBLE + Interrupt EP requires preamble (is a low speed device on a full speed hub) + [26:26] + read-write + + + INTEP_DIR + Direction of the interrupt endpoint. In=0, Out=1 + [25:25] + read-write + + + ENDPOINT + Endpoint number of the interrupt endpoint + [19:16] + read-write + + + ADDRESS + Device address + [6:0] + read-write + + + + + ADDR_ENDP10 + 0x00000028 + Interrupt endpoint 10. Only valid for HOST mode. + 0x00000000 + + + INTEP_PREAMBLE + Interrupt EP requires preamble (is a low speed device on a full speed hub) + [26:26] + read-write + + + INTEP_DIR + Direction of the interrupt endpoint. In=0, Out=1 + [25:25] + read-write + + + ENDPOINT + Endpoint number of the interrupt endpoint + [19:16] + read-write + + + ADDRESS + Device address + [6:0] + read-write + + + + + ADDR_ENDP11 + 0x0000002c + Interrupt endpoint 11. Only valid for HOST mode. + 0x00000000 + + + INTEP_PREAMBLE + Interrupt EP requires preamble (is a low speed device on a full speed hub) + [26:26] + read-write + + + INTEP_DIR + Direction of the interrupt endpoint. In=0, Out=1 + [25:25] + read-write + + + ENDPOINT + Endpoint number of the interrupt endpoint + [19:16] + read-write + + + ADDRESS + Device address + [6:0] + read-write + + + + + ADDR_ENDP12 + 0x00000030 + Interrupt endpoint 12. Only valid for HOST mode. + 0x00000000 + + + INTEP_PREAMBLE + Interrupt EP requires preamble (is a low speed device on a full speed hub) + [26:26] + read-write + + + INTEP_DIR + Direction of the interrupt endpoint. In=0, Out=1 + [25:25] + read-write + + + ENDPOINT + Endpoint number of the interrupt endpoint + [19:16] + read-write + + + ADDRESS + Device address + [6:0] + read-write + + + + + ADDR_ENDP13 + 0x00000034 + Interrupt endpoint 13. Only valid for HOST mode. + 0x00000000 + + + INTEP_PREAMBLE + Interrupt EP requires preamble (is a low speed device on a full speed hub) + [26:26] + read-write + + + INTEP_DIR + Direction of the interrupt endpoint. In=0, Out=1 + [25:25] + read-write + + + ENDPOINT + Endpoint number of the interrupt endpoint + [19:16] + read-write + + + ADDRESS + Device address + [6:0] + read-write + + + + + ADDR_ENDP14 + 0x00000038 + Interrupt endpoint 14. Only valid for HOST mode. + 0x00000000 + + + INTEP_PREAMBLE + Interrupt EP requires preamble (is a low speed device on a full speed hub) + [26:26] + read-write + + + INTEP_DIR + Direction of the interrupt endpoint. In=0, Out=1 + [25:25] + read-write + + + ENDPOINT + Endpoint number of the interrupt endpoint + [19:16] + read-write + + + ADDRESS + Device address + [6:0] + read-write + + + + + ADDR_ENDP15 + 0x0000003c + Interrupt endpoint 15. Only valid for HOST mode. + 0x00000000 + + + INTEP_PREAMBLE + Interrupt EP requires preamble (is a low speed device on a full speed hub) + [26:26] + read-write + + + INTEP_DIR + Direction of the interrupt endpoint. In=0, Out=1 + [25:25] + read-write + + + ENDPOINT + Endpoint number of the interrupt endpoint + [19:16] + read-write + + + ADDRESS + Device address + [6:0] + read-write + + + + + MAIN_CTRL + 0x00000040 + Main control register + 0x00000004 + + + SIM_TIMING + Reduced timings for simulation + [31:31] + read-write + + + PHY_ISO + Isolates USB phy after controller power-up + Remove isolation once software has configured the controller + Not isolated = 0, Isolated = 1 + [2:2] + read-write + + + HOST_NDEVICE + Device mode = 0, Host mode = 1 + [1:1] + read-write + + + CONTROLLER_EN + Enable controller + [0:0] + read-write + + + + + SOF_WR + 0x00000044 + Set the SOF (Start of Frame) frame number in the host controller. The SOF packet is sent every 1ms and the host will increment the frame number by 1 each time. + 0x00000000 + + + COUNT + [10:0] + write-only + + + + + SOF_RD + 0x00000048 + Read the last SOF (Start of Frame) frame number seen. In device mode the last SOF received from the host. In host mode the last SOF sent by the host. + 0x00000000 + + + COUNT + [10:0] + read-only + + + + + SIE_CTRL + 0x0000004c + SIE control register + 0x00008000 + + + EP0_INT_STALL + Device: Set bit in EP_STATUS_STALL_NAK when EP0 sends a STALL + [31:31] + read-write + + + EP0_DOUBLE_BUF + Device: EP0 single buffered = 0, double buffered = 1 + [30:30] + read-write + + + EP0_INT_1BUF + Device: Set bit in BUFF_STATUS for every buffer completed on EP0 + [29:29] + read-write + + + EP0_INT_2BUF + Device: Set bit in BUFF_STATUS for every 2 buffers completed on EP0 + [28:28] + read-write + + + EP0_INT_NAK + Device: Set bit in EP_STATUS_STALL_NAK when EP0 sends a NAK + [27:27] + read-write + + + DIRECT_EN + Direct bus drive enable + [26:26] + read-write + + + DIRECT_DP + Direct control of DP + [25:25] + read-write + + + DIRECT_DM + Direct control of DM + [24:24] + read-write + + + EP0_STOP_ON_SHORT_PACKET + Device: Stop EP0 on a short packet. + [19:19] + read-write + + + TRANSCEIVER_PD + Power down bus transceiver + [18:18] + read-write + + + RPU_OPT + Device: Pull-up strength (0=1K2, 1=2k3) + [17:17] + read-write + + + PULLUP_EN + Device: Enable pull up resistor + [16:16] + read-write + + + PULLDOWN_EN + Host: Enable pull down resistors + [15:15] + read-write + + + RESET_BUS + Host: Reset bus + [13:13] + write-only + + + RESUME + Device: Remote wakeup. Device can initiate its own resume after suspend. + [12:12] + write-only + + + VBUS_EN + Host: Enable VBUS + [11:11] + read-write + + + KEEP_ALIVE_EN + Host: Enable keep alive packet (for low speed bus) + [10:10] + read-write + + + SOF_EN + Host: Enable SOF generation (for full speed bus) + [9:9] + read-write + + + SOF_SYNC + Host: Delay packet(s) until after SOF + [8:8] + read-write + + + PREAMBLE_EN + Host: Preable enable for LS device on FS hub + [6:6] + read-write + + + STOP_TRANS + Host: Stop transaction + [4:4] + write-only + + + RECEIVE_DATA + Host: Receive transaction (IN to host) + [3:3] + read-write + + + SEND_DATA + Host: Send transaction (OUT from host) + [2:2] + read-write + + + SEND_SETUP + Host: Send Setup packet + [1:1] + read-write + + + START_TRANS + Host: Start transaction + [0:0] + write-only + + + + + SIE_STATUS + 0x00000050 + SIE status register + 0x00000000 + + + DATA_SEQ_ERROR + Data Sequence Error. + + The device can raise a sequence error in the following conditions: + + * A SETUP packet is received followed by a DATA1 packet (data phase should always be DATA0) * An OUT packet is received from the host but doesn't match the data pid in the buffer control register read from DPSRAM + + The host can raise a data sequence error in the following conditions: + + * An IN packet from the device has the wrong data PID + [31:31] + read-write + oneToClear + + + ACK_REC + ACK received. Raised by both host and device. + [30:30] + read-write + oneToClear + + + STALL_REC + Host: STALL received + [29:29] + read-write + oneToClear + + + NAK_REC + Host: NAK received + [28:28] + read-write + oneToClear + + + RX_TIMEOUT + RX timeout is raised by both the host and device if an ACK is not received in the maximum time specified by the USB spec. + [27:27] + read-write + oneToClear + + + RX_OVERFLOW + RX overflow is raised by the Serial RX engine if the incoming data is too fast. + [26:26] + read-write + oneToClear + + + BIT_STUFF_ERROR + Bit Stuff Error. Raised by the Serial RX engine. + [25:25] + read-write + oneToClear + + + CRC_ERROR + CRC Error. Raised by the Serial RX engine. + [24:24] + read-write + oneToClear + + + ENDPOINT_ERROR + An endpoint has encountered an error. Read the ep_rx_error and ep_tx_error registers to find out which endpoint had an error. + [23:23] + read-write + oneToClear + + + BUS_RESET + Device: bus reset received + [19:19] + read-write + oneToClear + + + TRANS_COMPLETE + Transaction complete. + + Raised by device if: + + * An IN or OUT packet is sent with the `LAST_BUFF` bit set in the buffer control register + + Raised by host if: + + * A setup packet is sent when no data in or data out transaction follows * An IN packet is received and the `LAST_BUFF` bit is set in the buffer control register * An IN packet is received with zero length * An OUT packet is sent and the `LAST_BUFF` bit is set + [18:18] + read-write + oneToClear + + + SETUP_REC + Device: Setup packet received + [17:17] + read-write + oneToClear + + + CONNECTED + Device: connected + [16:16] + read-only + + + RX_SHORT_PACKET + Device or Host has received a short packet. This is when the data received is less than configured in the buffer control register. Device: If using double buffered mode on device the buffer select will not be toggled after writing status back to the buffer control register. This is to prevent any further transactions on that endpoint until the user has reset the buffer control registers. Host: the current transfer will be stopped early. + [12:12] + read-write + oneToClear + + + RESUME + Host: Device has initiated a remote resume. Device: host has initiated a resume. + [11:11] + read-write + oneToClear + + + VBUS_OVER_CURR + VBUS over current detected + [10:10] + read-only + + + SPEED + Host: device speed. Disconnected = 00, LS = 01, FS = 10 + [9:8] + read-only + + + SUSPENDED + Bus in suspended state. Valid for device. Device will go into suspend if neither Keep Alive / SOF frames are enabled. + [4:4] + read-write + oneToClear + + + LINE_STATE + USB bus line state + [3:2] + read-only + + + VBUS_DETECTED + Device: VBUS Detected + [0:0] + read-only + + + + + INT_EP_CTRL + 0x00000054 + interrupt endpoint control register + 0x00000000 + + + INT_EP_ACTIVE + Host: Enable interrupt endpoint 1 -> 15 + [15:1] + read-write + + + + + BUFF_STATUS + 0x00000058 + Buffer status register. A bit set here indicates that a buffer has completed on the endpoint (if the buffer interrupt is enabled). It is possible for 2 buffers to be completed, so clearing the buffer status bit may instantly re set it on the next clock cycle. + 0x00000000 + + + EP15_OUT + [31:31] + read-write + oneToClear + + + EP15_IN + [30:30] + read-write + oneToClear + + + EP14_OUT + [29:29] + read-write + oneToClear + + + EP14_IN + [28:28] + read-write + oneToClear + + + EP13_OUT + [27:27] + read-write + oneToClear + + + EP13_IN + [26:26] + read-write + oneToClear + + + EP12_OUT + [25:25] + read-write + oneToClear + + + EP12_IN + [24:24] + read-write + oneToClear + + + EP11_OUT + [23:23] + read-write + oneToClear + + + EP11_IN + [22:22] + read-write + oneToClear + + + EP10_OUT + [21:21] + read-write + oneToClear + + + EP10_IN + [20:20] + read-write + oneToClear + + + EP9_OUT + [19:19] + read-write + oneToClear + + + EP9_IN + [18:18] + read-write + oneToClear + + + EP8_OUT + [17:17] + read-write + oneToClear + + + EP8_IN + [16:16] + read-write + oneToClear + + + EP7_OUT + [15:15] + read-write + oneToClear + + + EP7_IN + [14:14] + read-write + oneToClear + + + EP6_OUT + [13:13] + read-write + oneToClear + + + EP6_IN + [12:12] + read-write + oneToClear + + + EP5_OUT + [11:11] + read-write + oneToClear + + + EP5_IN + [10:10] + read-write + oneToClear + + + EP4_OUT + [9:9] + read-write + oneToClear + + + EP4_IN + [8:8] + read-write + oneToClear + + + EP3_OUT + [7:7] + read-write + oneToClear + + + EP3_IN + [6:6] + read-write + oneToClear + + + EP2_OUT + [5:5] + read-write + oneToClear + + + EP2_IN + [4:4] + read-write + oneToClear + + + EP1_OUT + [3:3] + read-write + oneToClear + + + EP1_IN + [2:2] + read-write + oneToClear + + + EP0_OUT + [1:1] + read-write + oneToClear + + + EP0_IN + [0:0] + read-write + oneToClear + + + + + BUFF_CPU_SHOULD_HANDLE + 0x0000005c + Which of the double buffers should be handled. Only valid if using an interrupt per buffer (i.e. not per 2 buffers). Not valid for host interrupt endpoint polling because they are only single buffered. + 0x00000000 + + + EP15_OUT + [31:31] + read-only + + + EP15_IN + [30:30] + read-only + + + EP14_OUT + [29:29] + read-only + + + EP14_IN + [28:28] + read-only + + + EP13_OUT + [27:27] + read-only + + + EP13_IN + [26:26] + read-only + + + EP12_OUT + [25:25] + read-only + + + EP12_IN + [24:24] + read-only + + + EP11_OUT + [23:23] + read-only + + + EP11_IN + [22:22] + read-only + + + EP10_OUT + [21:21] + read-only + + + EP10_IN + [20:20] + read-only + + + EP9_OUT + [19:19] + read-only + + + EP9_IN + [18:18] + read-only + + + EP8_OUT + [17:17] + read-only + + + EP8_IN + [16:16] + read-only + + + EP7_OUT + [15:15] + read-only + + + EP7_IN + [14:14] + read-only + + + EP6_OUT + [13:13] + read-only + + + EP6_IN + [12:12] + read-only + + + EP5_OUT + [11:11] + read-only + + + EP5_IN + [10:10] + read-only + + + EP4_OUT + [9:9] + read-only + + + EP4_IN + [8:8] + read-only + + + EP3_OUT + [7:7] + read-only + + + EP3_IN + [6:6] + read-only + + + EP2_OUT + [5:5] + read-only + + + EP2_IN + [4:4] + read-only + + + EP1_OUT + [3:3] + read-only + + + EP1_IN + [2:2] + read-only + + + EP0_OUT + [1:1] + read-only + + + EP0_IN + [0:0] + read-only + + + + + EP_ABORT + 0x00000060 + Device only: Can be set to ignore the buffer control register for this endpoint in case you would like to revoke a buffer. A NAK will be sent for every access to the endpoint until this bit is cleared. A corresponding bit in `EP_ABORT_DONE` is set when it is safe to modify the buffer control register. + 0x00000000 + + + EP15_OUT + [31:31] + read-write + + + EP15_IN + [30:30] + read-write + + + EP14_OUT + [29:29] + read-write + + + EP14_IN + [28:28] + read-write + + + EP13_OUT + [27:27] + read-write + + + EP13_IN + [26:26] + read-write + + + EP12_OUT + [25:25] + read-write + + + EP12_IN + [24:24] + read-write + + + EP11_OUT + [23:23] + read-write + + + EP11_IN + [22:22] + read-write + + + EP10_OUT + [21:21] + read-write + + + EP10_IN + [20:20] + read-write + + + EP9_OUT + [19:19] + read-write + + + EP9_IN + [18:18] + read-write + + + EP8_OUT + [17:17] + read-write + + + EP8_IN + [16:16] + read-write + + + EP7_OUT + [15:15] + read-write + + + EP7_IN + [14:14] + read-write + + + EP6_OUT + [13:13] + read-write + + + EP6_IN + [12:12] + read-write + + + EP5_OUT + [11:11] + read-write + + + EP5_IN + [10:10] + read-write + + + EP4_OUT + [9:9] + read-write + + + EP4_IN + [8:8] + read-write + + + EP3_OUT + [7:7] + read-write + + + EP3_IN + [6:6] + read-write + + + EP2_OUT + [5:5] + read-write + + + EP2_IN + [4:4] + read-write + + + EP1_OUT + [3:3] + read-write + + + EP1_IN + [2:2] + read-write + + + EP0_OUT + [1:1] + read-write + + + EP0_IN + [0:0] + read-write + + + + + EP_ABORT_DONE + 0x00000064 + Device only: Used in conjunction with `EP_ABORT`. Set once an endpoint is idle so the programmer knows it is safe to modify the buffer control register. + 0x00000000 + + + EP15_OUT + [31:31] + read-write + oneToClear + + + EP15_IN + [30:30] + read-write + oneToClear + + + EP14_OUT + [29:29] + read-write + oneToClear + + + EP14_IN + [28:28] + read-write + oneToClear + + + EP13_OUT + [27:27] + read-write + oneToClear + + + EP13_IN + [26:26] + read-write + oneToClear + + + EP12_OUT + [25:25] + read-write + oneToClear + + + EP12_IN + [24:24] + read-write + oneToClear + + + EP11_OUT + [23:23] + read-write + oneToClear + + + EP11_IN + [22:22] + read-write + oneToClear + + + EP10_OUT + [21:21] + read-write + oneToClear + + + EP10_IN + [20:20] + read-write + oneToClear + + + EP9_OUT + [19:19] + read-write + oneToClear + + + EP9_IN + [18:18] + read-write + oneToClear + + + EP8_OUT + [17:17] + read-write + oneToClear + + + EP8_IN + [16:16] + read-write + oneToClear + + + EP7_OUT + [15:15] + read-write + oneToClear + + + EP7_IN + [14:14] + read-write + oneToClear + + + EP6_OUT + [13:13] + read-write + oneToClear + + + EP6_IN + [12:12] + read-write + oneToClear + + + EP5_OUT + [11:11] + read-write + oneToClear + + + EP5_IN + [10:10] + read-write + oneToClear + + + EP4_OUT + [9:9] + read-write + oneToClear + + + EP4_IN + [8:8] + read-write + oneToClear + + + EP3_OUT + [7:7] + read-write + oneToClear + + + EP3_IN + [6:6] + read-write + oneToClear + + + EP2_OUT + [5:5] + read-write + oneToClear + + + EP2_IN + [4:4] + read-write + oneToClear + + + EP1_OUT + [3:3] + read-write + oneToClear + + + EP1_IN + [2:2] + read-write + oneToClear + + + EP0_OUT + [1:1] + read-write + oneToClear + + + EP0_IN + [0:0] + read-write + oneToClear + + + + + EP_STALL_ARM + 0x00000068 + Device: this bit must be set in conjunction with the `STALL` bit in the buffer control register to send a STALL on EP0. The device controller clears these bits when a SETUP packet is received because the USB spec requires that a STALL condition is cleared when a SETUP packet is received. + 0x00000000 + + + EP0_OUT + [1:1] + read-write + + + EP0_IN + [0:0] + read-write + + + + + NAK_POLL + 0x0000006c + Used by the host controller. Sets the wait time in microseconds before trying again if the device replies with a NAK. + 0x00100010 + + + RETRY_COUNT_HI + Bits 9:6 of nak_retry count + [31:28] + read-only + + + EPX_STOPPED_ON_NAK + EPX polling has stopped because a nak was received + [27:27] + read-write + oneToClear + + + STOP_EPX_ON_NAK + Stop polling epx when a nak is received + [26:26] + read-write + + + DELAY_FS + NAK polling interval for a full speed device + [25:16] + read-write + + + RETRY_COUNT_LO + Bits 5:0 of nak_retry_count + [15:10] + read-only + + + DELAY_LS + NAK polling interval for a low speed device + [9:0] + read-write + + + + + EP_STATUS_STALL_NAK + 0x00000070 + Device: bits are set when the `IRQ_ON_NAK` or `IRQ_ON_STALL` bits are set. For EP0 this comes from `SIE_CTRL`. For all other endpoints it comes from the endpoint control register. + 0x00000000 + + + EP15_OUT + [31:31] + read-write + oneToClear + + + EP15_IN + [30:30] + read-write + oneToClear + + + EP14_OUT + [29:29] + read-write + oneToClear + + + EP14_IN + [28:28] + read-write + oneToClear + + + EP13_OUT + [27:27] + read-write + oneToClear + + + EP13_IN + [26:26] + read-write + oneToClear + + + EP12_OUT + [25:25] + read-write + oneToClear + + + EP12_IN + [24:24] + read-write + oneToClear + + + EP11_OUT + [23:23] + read-write + oneToClear + + + EP11_IN + [22:22] + read-write + oneToClear + + + EP10_OUT + [21:21] + read-write + oneToClear + + + EP10_IN + [20:20] + read-write + oneToClear + + + EP9_OUT + [19:19] + read-write + oneToClear + + + EP9_IN + [18:18] + read-write + oneToClear + + + EP8_OUT + [17:17] + read-write + oneToClear + + + EP8_IN + [16:16] + read-write + oneToClear + + + EP7_OUT + [15:15] + read-write + oneToClear + + + EP7_IN + [14:14] + read-write + oneToClear + + + EP6_OUT + [13:13] + read-write + oneToClear + + + EP6_IN + [12:12] + read-write + oneToClear + + + EP5_OUT + [11:11] + read-write + oneToClear + + + EP5_IN + [10:10] + read-write + oneToClear + + + EP4_OUT + [9:9] + read-write + oneToClear + + + EP4_IN + [8:8] + read-write + oneToClear + + + EP3_OUT + [7:7] + read-write + oneToClear + + + EP3_IN + [6:6] + read-write + oneToClear + + + EP2_OUT + [5:5] + read-write + oneToClear + + + EP2_IN + [4:4] + read-write + oneToClear + + + EP1_OUT + [3:3] + read-write + oneToClear + + + EP1_IN + [2:2] + read-write + oneToClear + + + EP0_OUT + [1:1] + read-write + oneToClear + + + EP0_IN + [0:0] + read-write + oneToClear + + + + + USB_MUXING + 0x00000074 + Where to connect the USB controller. Should be to_phy by default. + 0x00000001 + + + SWAP_DPDM + Swap the USB PHY DP and DM pins and all related controls and flip receive differential data. Can be used to switch USB DP/DP on the PCB. + This is done at a low level so overrides all other controls. + [31:31] + read-write + + + USBPHY_AS_GPIO + Use the usb DP and DM pins as GPIO pins instead of connecting them to the USB controller. + [4:4] + read-write + + + SOFTCON + [3:3] + read-write + + + TO_DIGITAL_PAD + [2:2] + read-write + + + TO_EXTPHY + [1:1] + read-write + + + TO_PHY + [0:0] + read-write + + + + + USB_PWR + 0x00000078 + Overrides for the power signals in the event that the VBUS signals are not hooked up to GPIO. Set the value of the override and then the override enable to switch over to the override value. + 0x00000000 + + + OVERCURR_DETECT_EN + [5:5] + read-write + + + OVERCURR_DETECT + [4:4] + read-write + + + VBUS_DETECT_OVERRIDE_EN + [3:3] + read-write + + + VBUS_DETECT + [2:2] + read-write + + + VBUS_EN_OVERRIDE_EN + [1:1] + read-write + + + VBUS_EN + [0:0] + read-write + + + + + USBPHY_DIRECT + 0x0000007c + This register allows for direct control of the USB phy. Use in conjunction with usbphy_direct_override register to enable each override bit. + 0x00000000 + + + RX_DM_OVERRIDE + Override rx_dm value into controller + [25:25] + read-write + + + RX_DP_OVERRIDE + Override rx_dp value into controller + [24:24] + read-write + + + RX_DD_OVERRIDE + Override rx_dd value into controller + [23:23] + read-write + + + DM_OVV + DM over voltage + [22:22] + read-only + + + DP_OVV + DP over voltage + [21:21] + read-only + + + DM_OVCN + DM overcurrent + [20:20] + read-only + + + DP_OVCN + DP overcurrent + [19:19] + read-only + + + RX_DM + DPM pin state + [18:18] + read-only + + + RX_DP + DPP pin state + [17:17] + read-only + + + RX_DD + Differential RX + [16:16] + read-only + + + TX_DIFFMODE + TX_DIFFMODE=0: Single ended mode + TX_DIFFMODE=1: Differential drive mode (TX_DM, TX_DM_OE ignored) + [15:15] + read-write + + + TX_FSSLEW + TX_FSSLEW=0: Low speed slew rate + TX_FSSLEW=1: Full speed slew rate + [14:14] + read-write + + + TX_PD + TX power down override (if override enable is set). 1 = powered down. + [13:13] + read-write + + + RX_PD + RX power down override (if override enable is set). 1 = powered down. + [12:12] + read-write + + + TX_DM + Output data. TX_DIFFMODE=1, Ignored + TX_DIFFMODE=0, Drives DPM only. TX_DM_OE=1 to enable drive. DPM=TX_DM + [11:11] + read-write + + + TX_DP + Output data. If TX_DIFFMODE=1, Drives DPP/DPM diff pair. TX_DP_OE=1 to enable drive. DPP=TX_DP, DPM=~TX_DP + If TX_DIFFMODE=0, Drives DPP only. TX_DP_OE=1 to enable drive. DPP=TX_DP + [10:10] + read-write + + + TX_DM_OE + Output enable. If TX_DIFFMODE=1, Ignored. + If TX_DIFFMODE=0, OE for DPM only. 0 - DPM in Hi-Z state; 1 - DPM driving + [9:9] + read-write + + + TX_DP_OE + Output enable. If TX_DIFFMODE=1, OE for DPP/DPM diff pair. 0 - DPP/DPM in Hi-Z state; 1 - DPP/DPM driving + If TX_DIFFMODE=0, OE for DPP only. 0 - DPP in Hi-Z state; 1 - DPP driving + [8:8] + read-write + + + DM_PULLDN_EN + DM pull down enable + [6:6] + read-write + + + DM_PULLUP_EN + DM pull up enable + [5:5] + read-write + + + DM_PULLUP_HISEL + Enable the second DM pull up resistor. 0 - Pull = Rpu2; 1 - Pull = Rpu1 + Rpu2 + [4:4] + read-write + + + DP_PULLDN_EN + DP pull down enable + [2:2] + read-write + + + DP_PULLUP_EN + DP pull up enable + [1:1] + read-write + + + DP_PULLUP_HISEL + Enable the second DP pull up resistor. 0 - Pull = Rpu2; 1 - Pull = Rpu1 + Rpu2 + [0:0] + read-write + + + + + USBPHY_DIRECT_OVERRIDE + 0x00000080 + Override enable for each control in usbphy_direct + 0x00000000 + + + RX_DM_OVERRIDE_EN + [18:18] + read-write + + + RX_DP_OVERRIDE_EN + [17:17] + read-write + + + RX_DD_OVERRIDE_EN + [16:16] + read-write + + + TX_DIFFMODE_OVERRIDE_EN + [15:15] + read-write + + + DM_PULLUP_OVERRIDE_EN + [12:12] + read-write + + + TX_FSSLEW_OVERRIDE_EN + [11:11] + read-write + + + TX_PD_OVERRIDE_EN + [10:10] + read-write + + + RX_PD_OVERRIDE_EN + [9:9] + read-write + + + TX_DM_OVERRIDE_EN + [8:8] + read-write + + + TX_DP_OVERRIDE_EN + [7:7] + read-write + + + TX_DM_OE_OVERRIDE_EN + [6:6] + read-write + + + TX_DP_OE_OVERRIDE_EN + [5:5] + read-write + + + DM_PULLDN_EN_OVERRIDE_EN + [4:4] + read-write + + + DP_PULLDN_EN_OVERRIDE_EN + [3:3] + read-write + + + DP_PULLUP_EN_OVERRIDE_EN + [2:2] + read-write + + + DM_PULLUP_HISEL_OVERRIDE_EN + [1:1] + read-write + + + DP_PULLUP_HISEL_OVERRIDE_EN + [0:0] + read-write + + + + + USBPHY_TRIM + 0x00000084 + Used to adjust trim values of USB phy pull down resistors. + 0x00001f1f + + + DM_PULLDN_TRIM + Value to drive to USB PHY + DM pulldown resistor trim control + Experimental data suggests that the reset value will work, but this register allows adjustment if required + [12:8] + read-write + + + DP_PULLDN_TRIM + Value to drive to USB PHY + DP pulldown resistor trim control + Experimental data suggests that the reset value will work, but this register allows adjustment if required + [4:0] + read-write + + + + + LINESTATE_TUNING + 0x00000088 + Used for debug only. + 0x000000f8 + + + SPARE_FIX + [11:8] + read-write + + + DEV_LS_WAKE_FIX + Device - exit suspend on any non-idle signalling, not qualified with a 1ms timer + [7:7] + read-write + + + DEV_RX_ERR_QUIESCE + Device - suppress repeated errors until the device FSM is next in the process of decoding an inbound packet. + [6:6] + read-write + + + SIE_RX_CHATTER_SE0_FIX + RX - when recovering from line chatter or bitstuff errors, treat SE0 as the end of chatter as well as + 8 consecutive idle bits. + [5:5] + read-write + + + SIE_RX_BITSTUFF_FIX + RX - when a bitstuff error is signalled by rx_dasm, unconditionally terminate RX decode to + avoid a hang during certain packet phases. + [4:4] + read-write + + + DEV_BUFF_CONTROL_DOUBLE_READ_FIX + Device - the controller FSM performs two reads of the buffer status memory address to + avoid sampling metastable data. An enabled buffer is only used if both reads match. + [3:3] + read-write + + + MULTI_HUB_FIX + Host - increase inter-packet and turnaround timeouts to accommodate worst-case hub delays. + [2:2] + read-write + + + LINESTATE_DELAY + Device/Host - add an extra 1-bit debounce of linestate sampling. + [1:1] + read-write + + + RCV_DELAY + Device - register the received data to account for hub bit dribble before EOP. Only affects certain hubs. + [0:0] + read-write + + + + + INTR + 0x0000008c + Raw Interrupts + 0x00000000 + + + EPX_STOPPED_ON_NAK + Source: NAK_POLL.EPX_STOPPED_ON_NAK + [23:23] + read-only + + + DEV_SM_WATCHDOG_FIRED + Source: DEV_SM_WATCHDOG.FIRED + [22:22] + read-only + + + ENDPOINT_ERROR + Source: SIE_STATUS.ENDPOINT_ERROR + [21:21] + read-only + + + RX_SHORT_PACKET + Source: SIE_STATUS.RX_SHORT_PACKET + [20:20] + read-only + + + EP_STALL_NAK + Raised when any bit in EP_STATUS_STALL_NAK is set. Clear by clearing all bits in EP_STATUS_STALL_NAK. + [19:19] + read-only + + + ABORT_DONE + Raised when any bit in ABORT_DONE is set. Clear by clearing all bits in ABORT_DONE. + [18:18] + read-only + + + DEV_SOF + Set every time the device receives a SOF (Start of Frame) packet. Cleared by reading SOF_RD + [17:17] + read-only + + + SETUP_REQ + Device. Source: SIE_STATUS.SETUP_REC + [16:16] + read-only + + + DEV_RESUME_FROM_HOST + Set when the device receives a resume from the host. Cleared by writing to SIE_STATUS.RESUME + [15:15] + read-only + + + DEV_SUSPEND + Set when the device suspend state changes. Cleared by writing to SIE_STATUS.SUSPENDED + [14:14] + read-only + + + DEV_CONN_DIS + Set when the device connection state changes. Cleared by writing to SIE_STATUS.CONNECTED + [13:13] + read-only + + + BUS_RESET + Source: SIE_STATUS.BUS_RESET + [12:12] + read-only + + + VBUS_DETECT + Source: SIE_STATUS.VBUS_DETECTED + [11:11] + read-only + + + STALL + Source: SIE_STATUS.STALL_REC + [10:10] + read-only + + + ERROR_CRC + Source: SIE_STATUS.CRC_ERROR + [9:9] + read-only + + + ERROR_BIT_STUFF + Source: SIE_STATUS.BIT_STUFF_ERROR + [8:8] + read-only + + + ERROR_RX_OVERFLOW + Source: SIE_STATUS.RX_OVERFLOW + [7:7] + read-only + + + ERROR_RX_TIMEOUT + Source: SIE_STATUS.RX_TIMEOUT + [6:6] + read-only + + + ERROR_DATA_SEQ + Source: SIE_STATUS.DATA_SEQ_ERROR + [5:5] + read-only + + + BUFF_STATUS + Raised when any bit in BUFF_STATUS is set. Clear by clearing all bits in BUFF_STATUS. + [4:4] + read-only + + + TRANS_COMPLETE + Raised every time SIE_STATUS.TRANS_COMPLETE is set. Clear by writing to this bit. + [3:3] + read-only + + + HOST_SOF + Host: raised every time the host sends a SOF (Start of Frame). Cleared by reading SOF_RD + [2:2] + read-only + + + HOST_RESUME + Host: raised when a device wakes up the host. Cleared by writing to SIE_STATUS.RESUME + [1:1] + read-only + + + HOST_CONN_DIS + Host: raised when a device is connected or disconnected (i.e. when SIE_STATUS.SPEED changes). Cleared by writing to SIE_STATUS.SPEED + [0:0] + read-only + + + + + INTE + 0x00000090 + Interrupt Enable + 0x00000000 + + + EPX_STOPPED_ON_NAK + Source: NAK_POLL.EPX_STOPPED_ON_NAK + [23:23] + read-write + + + DEV_SM_WATCHDOG_FIRED + Source: DEV_SM_WATCHDOG.FIRED + [22:22] + read-write + + + ENDPOINT_ERROR + Source: SIE_STATUS.ENDPOINT_ERROR + [21:21] + read-write + + + RX_SHORT_PACKET + Source: SIE_STATUS.RX_SHORT_PACKET + [20:20] + read-write + + + EP_STALL_NAK + Raised when any bit in EP_STATUS_STALL_NAK is set. Clear by clearing all bits in EP_STATUS_STALL_NAK. + [19:19] + read-write + + + ABORT_DONE + Raised when any bit in ABORT_DONE is set. Clear by clearing all bits in ABORT_DONE. + [18:18] + read-write + + + DEV_SOF + Set every time the device receives a SOF (Start of Frame) packet. Cleared by reading SOF_RD + [17:17] + read-write + + + SETUP_REQ + Device. Source: SIE_STATUS.SETUP_REC + [16:16] + read-write + + + DEV_RESUME_FROM_HOST + Set when the device receives a resume from the host. Cleared by writing to SIE_STATUS.RESUME + [15:15] + read-write + + + DEV_SUSPEND + Set when the device suspend state changes. Cleared by writing to SIE_STATUS.SUSPENDED + [14:14] + read-write + + + DEV_CONN_DIS + Set when the device connection state changes. Cleared by writing to SIE_STATUS.CONNECTED + [13:13] + read-write + + + BUS_RESET + Source: SIE_STATUS.BUS_RESET + [12:12] + read-write + + + VBUS_DETECT + Source: SIE_STATUS.VBUS_DETECTED + [11:11] + read-write + + + STALL + Source: SIE_STATUS.STALL_REC + [10:10] + read-write + + + ERROR_CRC + Source: SIE_STATUS.CRC_ERROR + [9:9] + read-write + + + ERROR_BIT_STUFF + Source: SIE_STATUS.BIT_STUFF_ERROR + [8:8] + read-write + + + ERROR_RX_OVERFLOW + Source: SIE_STATUS.RX_OVERFLOW + [7:7] + read-write + + + ERROR_RX_TIMEOUT + Source: SIE_STATUS.RX_TIMEOUT + [6:6] + read-write + + + ERROR_DATA_SEQ + Source: SIE_STATUS.DATA_SEQ_ERROR + [5:5] + read-write + + + BUFF_STATUS + Raised when any bit in BUFF_STATUS is set. Clear by clearing all bits in BUFF_STATUS. + [4:4] + read-write + + + TRANS_COMPLETE + Raised every time SIE_STATUS.TRANS_COMPLETE is set. Clear by writing to this bit. + [3:3] + read-write + + + HOST_SOF + Host: raised every time the host sends a SOF (Start of Frame). Cleared by reading SOF_RD + [2:2] + read-write + + + HOST_RESUME + Host: raised when a device wakes up the host. Cleared by writing to SIE_STATUS.RESUME + [1:1] + read-write + + + HOST_CONN_DIS + Host: raised when a device is connected or disconnected (i.e. when SIE_STATUS.SPEED changes). Cleared by writing to SIE_STATUS.SPEED + [0:0] + read-write + + + + + INTF + 0x00000094 + Interrupt Force + 0x00000000 + + + EPX_STOPPED_ON_NAK + Source: NAK_POLL.EPX_STOPPED_ON_NAK + [23:23] + read-write + + + DEV_SM_WATCHDOG_FIRED + Source: DEV_SM_WATCHDOG.FIRED + [22:22] + read-write + + + ENDPOINT_ERROR + Source: SIE_STATUS.ENDPOINT_ERROR + [21:21] + read-write + + + RX_SHORT_PACKET + Source: SIE_STATUS.RX_SHORT_PACKET + [20:20] + read-write + + + EP_STALL_NAK + Raised when any bit in EP_STATUS_STALL_NAK is set. Clear by clearing all bits in EP_STATUS_STALL_NAK. + [19:19] + read-write + + + ABORT_DONE + Raised when any bit in ABORT_DONE is set. Clear by clearing all bits in ABORT_DONE. + [18:18] + read-write + + + DEV_SOF + Set every time the device receives a SOF (Start of Frame) packet. Cleared by reading SOF_RD + [17:17] + read-write + + + SETUP_REQ + Device. Source: SIE_STATUS.SETUP_REC + [16:16] + read-write + + + DEV_RESUME_FROM_HOST + Set when the device receives a resume from the host. Cleared by writing to SIE_STATUS.RESUME + [15:15] + read-write + + + DEV_SUSPEND + Set when the device suspend state changes. Cleared by writing to SIE_STATUS.SUSPENDED + [14:14] + read-write + + + DEV_CONN_DIS + Set when the device connection state changes. Cleared by writing to SIE_STATUS.CONNECTED + [13:13] + read-write + + + BUS_RESET + Source: SIE_STATUS.BUS_RESET + [12:12] + read-write + + + VBUS_DETECT + Source: SIE_STATUS.VBUS_DETECTED + [11:11] + read-write + + + STALL + Source: SIE_STATUS.STALL_REC + [10:10] + read-write + + + ERROR_CRC + Source: SIE_STATUS.CRC_ERROR + [9:9] + read-write + + + ERROR_BIT_STUFF + Source: SIE_STATUS.BIT_STUFF_ERROR + [8:8] + read-write + + + ERROR_RX_OVERFLOW + Source: SIE_STATUS.RX_OVERFLOW + [7:7] + read-write + + + ERROR_RX_TIMEOUT + Source: SIE_STATUS.RX_TIMEOUT + [6:6] + read-write + + + ERROR_DATA_SEQ + Source: SIE_STATUS.DATA_SEQ_ERROR + [5:5] + read-write + + + BUFF_STATUS + Raised when any bit in BUFF_STATUS is set. Clear by clearing all bits in BUFF_STATUS. + [4:4] + read-write + + + TRANS_COMPLETE + Raised every time SIE_STATUS.TRANS_COMPLETE is set. Clear by writing to this bit. + [3:3] + read-write + + + HOST_SOF + Host: raised every time the host sends a SOF (Start of Frame). Cleared by reading SOF_RD + [2:2] + read-write + + + HOST_RESUME + Host: raised when a device wakes up the host. Cleared by writing to SIE_STATUS.RESUME + [1:1] + read-write + + + HOST_CONN_DIS + Host: raised when a device is connected or disconnected (i.e. when SIE_STATUS.SPEED changes). Cleared by writing to SIE_STATUS.SPEED + [0:0] + read-write + + + + + INTS + 0x00000098 + Interrupt status after masking & forcing + 0x00000000 + + + EPX_STOPPED_ON_NAK + Source: NAK_POLL.EPX_STOPPED_ON_NAK + [23:23] + read-only + + + DEV_SM_WATCHDOG_FIRED + Source: DEV_SM_WATCHDOG.FIRED + [22:22] + read-only + + + ENDPOINT_ERROR + Source: SIE_STATUS.ENDPOINT_ERROR + [21:21] + read-only + + + RX_SHORT_PACKET + Source: SIE_STATUS.RX_SHORT_PACKET + [20:20] + read-only + + + EP_STALL_NAK + Raised when any bit in EP_STATUS_STALL_NAK is set. Clear by clearing all bits in EP_STATUS_STALL_NAK. + [19:19] + read-only + + + ABORT_DONE + Raised when any bit in ABORT_DONE is set. Clear by clearing all bits in ABORT_DONE. + [18:18] + read-only + + + DEV_SOF + Set every time the device receives a SOF (Start of Frame) packet. Cleared by reading SOF_RD + [17:17] + read-only + + + SETUP_REQ + Device. Source: SIE_STATUS.SETUP_REC + [16:16] + read-only + + + DEV_RESUME_FROM_HOST + Set when the device receives a resume from the host. Cleared by writing to SIE_STATUS.RESUME + [15:15] + read-only + + + DEV_SUSPEND + Set when the device suspend state changes. Cleared by writing to SIE_STATUS.SUSPENDED + [14:14] + read-only + + + DEV_CONN_DIS + Set when the device connection state changes. Cleared by writing to SIE_STATUS.CONNECTED + [13:13] + read-only + + + BUS_RESET + Source: SIE_STATUS.BUS_RESET + [12:12] + read-only + + + VBUS_DETECT + Source: SIE_STATUS.VBUS_DETECTED + [11:11] + read-only + + + STALL + Source: SIE_STATUS.STALL_REC + [10:10] + read-only + + + ERROR_CRC + Source: SIE_STATUS.CRC_ERROR + [9:9] + read-only + + + ERROR_BIT_STUFF + Source: SIE_STATUS.BIT_STUFF_ERROR + [8:8] + read-only + + + ERROR_RX_OVERFLOW + Source: SIE_STATUS.RX_OVERFLOW + [7:7] + read-only + + + ERROR_RX_TIMEOUT + Source: SIE_STATUS.RX_TIMEOUT + [6:6] + read-only + + + ERROR_DATA_SEQ + Source: SIE_STATUS.DATA_SEQ_ERROR + [5:5] + read-only + + + BUFF_STATUS + Raised when any bit in BUFF_STATUS is set. Clear by clearing all bits in BUFF_STATUS. + [4:4] + read-only + + + TRANS_COMPLETE + Raised every time SIE_STATUS.TRANS_COMPLETE is set. Clear by writing to this bit. + [3:3] + read-only + + + HOST_SOF + Host: raised every time the host sends a SOF (Start of Frame). Cleared by reading SOF_RD + [2:2] + read-only + + + HOST_RESUME + Host: raised when a device wakes up the host. Cleared by writing to SIE_STATUS.RESUME + [1:1] + read-only + + + HOST_CONN_DIS + Host: raised when a device is connected or disconnected (i.e. when SIE_STATUS.SPEED changes). Cleared by writing to SIE_STATUS.SPEED + [0:0] + read-only + + + + + SOF_TIMESTAMP_RAW + 0x00000100 + Device only. Raw value of free-running PHY clock counter @48MHz. Used to calculate time between SOF events. + 0x00000000 + + + SOF_TIMESTAMP_RAW + [20:0] + read-only + + + + + SOF_TIMESTAMP_LAST + 0x00000104 + Device only. Value of free-running PHY clock counter @48MHz when last SOF event occurred. + 0x00000000 + + + SOF_TIMESTAMP_LAST + [20:0] + read-only + + + + + SM_STATE + 0x00000108 + 0x00000000 + + + RX_DASM + [11:8] + read-only + + + BC_STATE + [7:5] + read-only + + + STATE + [4:0] + read-only + + + + + EP_TX_ERROR + 0x0000010c + TX error count for each endpoint. Write to each field to reset the counter to 0. + 0x00000000 + + + EP15 + [31:30] + read-write + oneToClear + + + EP14 + [29:28] + read-write + oneToClear + + + EP13 + [27:26] + read-write + oneToClear + + + EP12 + [25:24] + read-write + oneToClear + + + EP11 + [23:22] + read-write + oneToClear + + + EP10 + [21:20] + read-write + oneToClear + + + EP9 + [19:18] + read-write + oneToClear + + + EP8 + [17:16] + read-write + oneToClear + + + EP7 + [15:14] + read-write + oneToClear + + + EP6 + [13:12] + read-write + oneToClear + + + EP5 + [11:10] + read-write + oneToClear + + + EP4 + [9:8] + read-write + oneToClear + + + EP3 + [7:6] + read-write + oneToClear + + + EP2 + [5:4] + read-write + oneToClear + + + EP1 + [3:2] + read-write + oneToClear + + + EP0 + [1:0] + read-write + oneToClear + + + + + EP_RX_ERROR + 0x00000110 + RX error count for each endpoint. Write to each field to reset the counter to 0. + 0x00000000 + + + EP15_SEQ + [31:31] + read-write + oneToClear + + + EP15_TRANSACTION + [30:30] + read-write + oneToClear + + + EP14_SEQ + [29:29] + read-write + oneToClear + + + EP14_TRANSACTION + [28:28] + read-write + oneToClear + + + EP13_SEQ + [27:27] + read-write + oneToClear + + + EP13_TRANSACTION + [26:26] + read-write + oneToClear + + + EP12_SEQ + [25:25] + read-write + oneToClear + + + EP12_TRANSACTION + [24:24] + read-write + oneToClear + + + EP11_SEQ + [23:23] + read-write + oneToClear + + + EP11_TRANSACTION + [22:22] + read-write + oneToClear + + + EP10_SEQ + [21:21] + read-write + oneToClear + + + EP10_TRANSACTION + [20:20] + read-write + oneToClear + + + EP9_SEQ + [19:19] + read-write + oneToClear + + + EP9_TRANSACTION + [18:18] + read-write + oneToClear + + + EP8_SEQ + [17:17] + read-write + oneToClear + + + EP8_TRANSACTION + [16:16] + read-write + oneToClear + + + EP7_SEQ + [15:15] + read-write + oneToClear + + + EP7_TRANSACTION + [14:14] + read-write + oneToClear + + + EP6_SEQ + [13:13] + read-write + oneToClear + + + EP6_TRANSACTION + [12:12] + read-write + oneToClear + + + EP5_SEQ + [11:11] + read-write + oneToClear + + + EP5_TRANSACTION + [10:10] + read-write + oneToClear + + + EP4_SEQ + [9:9] + read-write + oneToClear + + + EP4_TRANSACTION + [8:8] + read-write + oneToClear + + + EP3_SEQ + [7:7] + read-write + oneToClear + + + EP3_TRANSACTION + [6:6] + read-write + oneToClear + + + EP2_SEQ + [5:5] + read-write + oneToClear + + + EP2_TRANSACTION + [4:4] + read-write + oneToClear + + + EP1_SEQ + [3:3] + read-write + oneToClear + + + EP1_TRANSACTION + [2:2] + read-write + oneToClear + + + EP0_SEQ + [1:1] + read-write + oneToClear + + + EP0_TRANSACTION + [0:0] + read-write + oneToClear + + + + + DEV_SM_WATCHDOG + 0x00000114 + Watchdog that forces the device state machine to idle and raises an interrupt if the device stays in a state that isn't idle for the configured limit. The counter is reset on every state transition. + Set limit while enable is low and then set the enable. + 0x00000000 + + + FIRED + [20:20] + read-write + oneToClear + + + RESET + Set to 1 to forcibly reset the device state machine on watchdog expiry + [19:19] + read-write + + + ENABLE + [18:18] + read-write + + + LIMIT + [17:0] + read-write + + + + + + + TRNG + ARM TrustZone RNG register block + 0x400f0000 + + 0 + 492 + registers + + + TRNG_IRQ + 39 + + + + RNG_IMR + 0x00000100 + Interrupt masking. + 0x0000000f + + + RESERVED + RESERVED + [31:4] + read-only + + + VN_ERR_INT_MASK + 1'b1-mask interrupt, no interrupt will be generated. See RNG_ISR for an explanation on this interrupt. + [3:3] + read-write + + + CRNGT_ERR_INT_MASK + 1'b1-mask interrupt, no interrupt will be generated. See RNG_ISR for an explanation on this interrupt. + [2:2] + read-write + + + AUTOCORR_ERR_INT_MASK + 1'b1-mask interrupt, no interrupt will be generated. See RNG_ISR for an explanation on this interrupt. + [1:1] + read-write + + + EHR_VALID_INT_MASK + 1'b1-mask interrupt, no interrupt will be generated. See RNG_ISR for an explanation on this interrupt. + [0:0] + read-write + + + + + RNG_ISR + 0x00000104 + RNG status register. If corresponding RNG_IMR bit is unmasked, an interrupt will be generated. + 0x00000000 + + + RESERVED + RESERVED + [31:4] + read-only + + + VN_ERR + 1'b1 indicates Von Neuman error. Error in von Neuman occurs if 32 consecutive collected bits are identical, ZERO or ONE. + [3:3] + read-only + + + CRNGT_ERR + 1'b1 indicates CRNGT in the RNG test failed. Failure occurs when two consecutive blocks of 16 collected bits are equal. + [2:2] + read-only + + + AUTOCORR_ERR + 1'b1 indicates Autocorrelation test failed four times in a row. When set, RNG cease from functioning until next reset. + [1:1] + read-only + + + EHR_VALID + 1'b1 indicates that 192 bits have been collected in the RNG, and are ready to be read. + [0:0] + read-only + + + + + RNG_ICR + 0x00000108 + Interrupt/status bit clear Register. + 0x00000000 + + + RESERVED + RESERVED + [31:4] + read-only + + + VN_ERR + Write 1'b1 - clear corresponding bit in RNG_ISR. + [3:3] + read-write + + + CRNGT_ERR + Write 1'b1 - clear corresponding bit in RNG_ISR. + [2:2] + read-write + + + AUTOCORR_ERR + Cannot be cleared by SW! Only RNG reset clears this bit. + [1:1] + read-write + + + EHR_VALID + Write 1'b1 - clear corresponding bit in RNG_ISR. + [0:0] + read-write + + + + + TRNG_CONFIG + 0x0000010c + Selecting the inverter-chain length. + 0x00000000 + + + RESERVED + RESERVED + [31:2] + read-only + + + RND_SRC_SEL + Selects the number of inverters (out of four possible selections) in the ring oscillator (the entropy source). + [1:0] + read-write + + + + + TRNG_VALID + 0x00000110 + 192 bit collection indication. + 0x00000000 + + + RESERVED + RESERVED + [31:1] + read-only + + + EHR_VALID + 1'b1 indicates that collection of bits in the RNG is completed, and data can be read from EHR_DATA register. + [0:0] + read-only + + + + + EHR_DATA0 + 0x00000114 + RNG collected bits. + 0x00000000 + + + EHR_DATA0 + Bits [31:0] of Entropy Holding Register (EHR) - RNG output register + [31:0] + read-only + + + + + EHR_DATA1 + 0x00000118 + RNG collected bits. + 0x00000000 + + + EHR_DATA1 + Bits [63:32] of Entropy Holding Register (EHR) - RNG output register + [31:0] + read-only + + + + + EHR_DATA2 + 0x0000011c + RNG collected bits. + 0x00000000 + + + EHR_DATA2 + Bits [95:64] of Entropy Holding Register (EHR) - RNG output register + [31:0] + read-only + + + + + EHR_DATA3 + 0x00000120 + RNG collected bits. + 0x00000000 + + + EHR_DATA3 + Bits [127:96] of Entropy Holding Register (EHR) - RNG output register + [31:0] + read-only + + + + + EHR_DATA4 + 0x00000124 + RNG collected bits. + 0x00000000 + + + EHR_DATA4 + Bits [159:128] of Entropy Holding Register (EHR) - RNG output register + [31:0] + read-only + + + + + EHR_DATA5 + 0x00000128 + RNG collected bits. + 0x00000000 + + + EHR_DATA5 + Bits [191:160] of Entropy Holding Register (EHR) - RNG output register + [31:0] + read-only + + + + + RND_SOURCE_ENABLE + 0x0000012c + Enable signal for the random source. + 0x00000000 + + + RESERVED + RESERVED + [31:1] + read-only + + + RND_SRC_EN + * 1'b1 - entropy source is enabled. *1'b0 - entropy source is disabled + [0:0] + read-write + + + + + SAMPLE_CNT1 + 0x00000130 + Counts clocks between sampling of random bit. + 0x0000ffff + + + SAMPLE_CNTR1 + Sets the number of rng_clk cycles between two consecutive ring oscillator samples. Note! If the Von-Neuman is bypassed, the minimum value for sample counter must not be less then decimal seventeen + [31:0] + read-write + + + + + AUTOCORR_STATISTIC + 0x00000134 + Statistic about Autocorrelation test activations. + 0x00000000 + + + RESERVED + RESERVED + [31:22] + read-only + + + AUTOCORR_FAILS + Count each time an autocorrelation test fails. Any write to the register reset the counter. Stop collecting statistic if one of the counters reached the limit. + [21:14] + read-write + + + AUTOCORR_TRYS + Count each time an autocorrelation test starts. Any write to the register reset the counter. Stop collecting statistic if one of the counters reached the limit. + [13:0] + read-write + + + + + TRNG_DEBUG_CONTROL + 0x00000138 + Debug register. + 0x00000000 + + + AUTO_CORRELATE_BYPASS + When set, the autocorrelation test in the TRNG module is bypassed. + [3:3] + read-write + + + TRNG_CRNGT_BYPASS + When set, the CRNGT test in the RNG is bypassed. + [2:2] + read-write + + + VNC_BYPASS + When set, the Von-Neuman balancer is bypassed (including the 32 consecutive bits test). + [1:1] + read-write + + + RESERVED + N/A + [0:0] + read-only + + + + + TRNG_SW_RESET + 0x00000140 + Generate internal SW reset within the RNG block. + 0x00000000 + + + RESERVED + RESERVED + [31:1] + read-only + + + TRNG_SW_RESET + Writing 1'b1 to this register causes an internal RNG reset. + [0:0] + read-write + + + + + RNG_DEBUG_EN_INPUT + 0x000001b4 + Enable the RNG debug mode + 0x00000000 + + + RESERVED + RESERVED + [31:1] + read-only + + + RNG_DEBUG_EN + * 1'b1 - debug mode is enabled. *1'b0 - debug mode is disabled + [0:0] + read-write + + + + + TRNG_BUSY + 0x000001b8 + RNG Busy indication. + 0x00000000 + + + RESERVED + RESERVED + [31:1] + read-only + + + TRNG_BUSY + Reflects rng_busy status. + [0:0] + read-only + + + + + RST_BITS_COUNTER + 0x000001bc + Reset the counter of collected bits in the RNG. + 0x00000000 + + + RESERVED + RESERVED + [31:1] + read-only + + + RST_BITS_COUNTER + Writing any value to this address will reset the bits counter and RNG valid registers. RND_SORCE_ENABLE register must be unset in order for the reset to take place. + [0:0] + read-write + + + + + RNG_VERSION + 0x000001c0 + Displays the version settings of the TRNG. + 0x00000000 + + + RESERVED + RESERVED + [31:8] + read-only + + + RNG_USE_5_SBOXES + * 1'b1 - 5 SBOX AES. *1'b0 - 20 SBOX AES + [7:7] + read-only + + + RESEEDING_EXISTS + * 1'b1 - Exists. *1'b0 - Does not exist + [6:6] + read-only + + + KAT_EXISTS + * 1'b1 - Exists. *1'b0 - Does not exist + [5:5] + read-only + + + PRNG_EXISTS + * 1'b1 - Exists. *1'b0 - Does not exist + [4:4] + read-only + + + TRNG_TESTS_BYPASS_EN + * 1'b1 - Exists. *1'b0 - Does not exist + [3:3] + read-only + + + AUTOCORR_EXISTS + * 1'b1 - Exists. *1'b0 - Does not exist + [2:2] + read-only + + + CRNGT_EXISTS + * 1'b1 - Exists. *1'b0 - Does not exist + [1:1] + read-only + + + EHR_WIDTH_192 + * 1'b1 - 192-bit EHR. *1'b0 - 128-bit EHR + [0:0] + read-only + + + + + RNG_BIST_CNTR_0 + 0x000001e0 + Collected BIST results. + 0x00000000 + + + RESERVED + RESERVED + [31:22] + read-only + + + ROSC_CNTR_VAL + Reflects the results of RNG BIST counter. + [21:0] + read-only + + + + + RNG_BIST_CNTR_1 + 0x000001e4 + Collected BIST results. + 0x00000000 + + + RESERVED + RESERVED + [31:22] + read-only + + + ROSC_CNTR_VAL + Reflects the results of RNG BIST counter. + [21:0] + read-only + + + + + RNG_BIST_CNTR_2 + 0x000001e8 + Collected BIST results. + 0x00000000 + + + RESERVED + RESERVED + [31:22] + read-only + + + ROSC_CNTR_VAL + Reflects the results of RNG BIST counter. + [21:0] + read-only + + + + + + + GLITCH_DETECTOR + Glitch detector controls + 0x40158000 + + 0 + 24 + registers + + + + ARM + 0x00000000 + Forcibly arm the glitch detectors, if they are not already armed by OTP. When armed, any individual detector trigger will cause a restart of the switched core power domain's power-on reset state machine. + + Glitch detector triggers are recorded accumulatively in TRIG_STATUS. If the system is reset by a glitch detector trigger, this is recorded in POWMAN_CHIP_RESET. + + This register is Secure read/write only. + 0x00005bad + + + ARM + [15:0] + read-write + + + no + 23469 + Do not force the glitch detectors to be armed + + + yes + 0 + Force the glitch detectors to be armed. (Any value other than ARM_NO counts as YES) + + + + + + + DISARM + 0x00000004 + 0x00000000 + + + DISARM + Forcibly disarm the glitch detectors, if they are armed by OTP. Ignored if ARM is YES. + + This register is Secure read/write only. + [15:0] + read-write + + + no + 0 + Do not disarm the glitch detectors. (Any value other than DISARM_YES counts as NO) + + + yes + 56495 + Disarm the glitch detectors + + + + + + + SENSITIVITY + 0x00000008 + Adjust the sensitivity of glitch detectors to values other than their OTP-provided defaults. + + This register is Secure read/write only. + 0x00000000 + + + DEFAULT + [31:24] + read-write + + + yes + 0 + Use the default sensitivity configured in OTP for all detectors. (Any value other than DEFAULT_NO counts as YES) + + + no + 222 + Do not use the default sensitivity configured in OTP. Instead use the value from this register. + + + + + DET3_INV + Must be the inverse of DET3, else the default value is used. + [15:14] + read-write + + + DET2_INV + Must be the inverse of DET2, else the default value is used. + [13:12] + read-write + + + DET1_INV + Must be the inverse of DET1, else the default value is used. + [11:10] + read-write + + + DET0_INV + Must be the inverse of DET0, else the default value is used. + [9:8] + read-write + + + DET3 + Set sensitivity for detector 3. Higher values are more sensitive. + [7:6] + read-write + + + DET2 + Set sensitivity for detector 2. Higher values are more sensitive. + [5:4] + read-write + + + DET1 + Set sensitivity for detector 1. Higher values are more sensitive. + [3:2] + read-write + + + DET0 + Set sensitivity for detector 0. Higher values are more sensitive. + [1:0] + read-write + + + + + LOCK + 0x0000000c + 0x00000000 + + + LOCK + Write any nonzero value to disable writes to ARM, DISARM, SENSITIVITY and LOCK. This register is Secure read/write only. + [7:0] + read-write + + + + + TRIG_STATUS + 0x00000010 + Set when a detector output triggers. Write-1-clear. + + (May immediately return high if the detector remains in a failed state. Detectors can only be cleared by a full reset of the switched core power domain.) + + This register is Secure read/write only. + 0x00000000 + + + DET3 + [3:3] + read-write + oneToClear + + + DET2 + [2:2] + read-write + oneToClear + + + DET1 + [1:1] + read-write + oneToClear + + + DET0 + [0:0] + read-write + oneToClear + + + + + TRIG_FORCE + 0x00000014 + Simulate the firing of one or more detectors. Writing ones to this register will set the matching bits in STATUS_TRIG. + + If the glitch detectors are currently armed, writing ones will also immediately reset the switched core power domain, and set the reset reason latches in POWMAN_CHIP_RESET to indicate a glitch detector resets. + + This register is Secure read/write only. + 0x00000000 + + + TRIG_FORCE + [3:0] + write-only + + + + + + + OTP + SNPS OTP control IF (SBPI and RPi wrapper control) + 0x40120000 + + 0 + 372 + registers + + + OTP_IRQ + 38 + + + + SW_LOCK0 + 0x00000000 + Software lock register for page 0. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK1 + 0x00000004 + Software lock register for page 1. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK2 + 0x00000008 + Software lock register for page 2. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK3 + 0x0000000c + Software lock register for page 3. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK4 + 0x00000010 + Software lock register for page 4. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK5 + 0x00000014 + Software lock register for page 5. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK6 + 0x00000018 + Software lock register for page 6. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK7 + 0x0000001c + Software lock register for page 7. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK8 + 0x00000020 + Software lock register for page 8. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK9 + 0x00000024 + Software lock register for page 9. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK10 + 0x00000028 + Software lock register for page 10. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK11 + 0x0000002c + Software lock register for page 11. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK12 + 0x00000030 + Software lock register for page 12. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK13 + 0x00000034 + Software lock register for page 13. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK14 + 0x00000038 + Software lock register for page 14. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK15 + 0x0000003c + Software lock register for page 15. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK16 + 0x00000040 + Software lock register for page 16. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK17 + 0x00000044 + Software lock register for page 17. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK18 + 0x00000048 + Software lock register for page 18. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK19 + 0x0000004c + Software lock register for page 19. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK20 + 0x00000050 + Software lock register for page 20. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK21 + 0x00000054 + Software lock register for page 21. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK22 + 0x00000058 + Software lock register for page 22. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK23 + 0x0000005c + Software lock register for page 23. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK24 + 0x00000060 + Software lock register for page 24. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK25 + 0x00000064 + Software lock register for page 25. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK26 + 0x00000068 + Software lock register for page 26. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK27 + 0x0000006c + Software lock register for page 27. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK28 + 0x00000070 + Software lock register for page 28. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK29 + 0x00000074 + Software lock register for page 29. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK30 + 0x00000078 + Software lock register for page 30. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK31 + 0x0000007c + Software lock register for page 31. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK32 + 0x00000080 + Software lock register for page 32. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK33 + 0x00000084 + Software lock register for page 33. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK34 + 0x00000088 + Software lock register for page 34. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK35 + 0x0000008c + Software lock register for page 35. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK36 + 0x00000090 + Software lock register for page 36. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK37 + 0x00000094 + Software lock register for page 37. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK38 + 0x00000098 + Software lock register for page 38. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK39 + 0x0000009c + Software lock register for page 39. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK40 + 0x000000a0 + Software lock register for page 40. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK41 + 0x000000a4 + Software lock register for page 41. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK42 + 0x000000a8 + Software lock register for page 42. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK43 + 0x000000ac + Software lock register for page 43. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK44 + 0x000000b0 + Software lock register for page 44. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK45 + 0x000000b4 + Software lock register for page 45. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK46 + 0x000000b8 + Software lock register for page 46. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK47 + 0x000000bc + Software lock register for page 47. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK48 + 0x000000c0 + Software lock register for page 48. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK49 + 0x000000c4 + Software lock register for page 49. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK50 + 0x000000c8 + Software lock register for page 50. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK51 + 0x000000cc + Software lock register for page 51. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK52 + 0x000000d0 + Software lock register for page 52. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK53 + 0x000000d4 + Software lock register for page 53. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK54 + 0x000000d8 + Software lock register for page 54. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK55 + 0x000000dc + Software lock register for page 55. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK56 + 0x000000e0 + Software lock register for page 56. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK57 + 0x000000e4 + Software lock register for page 57. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK58 + 0x000000e8 + Software lock register for page 58. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK59 + 0x000000ec + Software lock register for page 59. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK60 + 0x000000f0 + Software lock register for page 60. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK61 + 0x000000f4 + Software lock register for page 61. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK62 + 0x000000f8 + Software lock register for page 62. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SW_LOCK63 + 0x000000fc + Software lock register for page 63. + + Locks are initialised from the OTP lock pages at reset. This register can be written to further advance the lock state of each page (until next reset), and read to check the current lock state of a page. + 0x00000000 + + + NSEC + Non-secure lock status. Writes are OR'd with the current value. + [3:2] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + SEC + Secure lock status. Writes are OR'd with the current value. This field is read-only to Non-secure code. + [1:0] + read-write + + + read_write + 0 + + + read_only + 1 + + + inaccessible + 3 + + + + + + + SBPI_INSTR + 0x00000100 + Dispatch instructions to the SBPI interface, used for programming the OTP fuses. + 0x00000000 + + + EXEC + Execute instruction + [30:30] + write-only + + + IS_WR + Payload type is write + [29:29] + read-write + + + HAS_PAYLOAD + Instruction has payload (data to be written or to be read) + [28:28] + read-write + + + PAYLOAD_SIZE_M1 + Instruction payload size in bytes minus 1 + [27:24] + read-write + + + TARGET + Instruction target, it can be PMC (0x3a) or DAP (0x02) + [23:16] + read-write + + + CMD + [15:8] + read-write + + + SHORT_WDATA + wdata to be used only when payload_size_m1=0 + [7:0] + read-write + + + + + SBPI_WDATA_0 + 0x00000104 + SBPI write payload bytes 3..0 + 0x00000000 + + + SBPI_WDATA_0 + [31:0] + read-write + + + + + SBPI_WDATA_1 + 0x00000108 + SBPI write payload bytes 7..4 + 0x00000000 + + + SBPI_WDATA_1 + [31:0] + read-write + + + + + SBPI_WDATA_2 + 0x0000010c + SBPI write payload bytes 11..8 + 0x00000000 + + + SBPI_WDATA_2 + [31:0] + read-write + + + + + SBPI_WDATA_3 + 0x00000110 + SBPI write payload bytes 15..12 + 0x00000000 + + + SBPI_WDATA_3 + [31:0] + read-write + + + + + SBPI_RDATA_0 + 0x00000114 + Read payload bytes 3..0. Once read, the data in the register will automatically clear to 0. + 0x00000000 + + + SBPI_RDATA_0 + [31:0] + read-only + modify + + + + + SBPI_RDATA_1 + 0x00000118 + Read payload bytes 7..4. Once read, the data in the register will automatically clear to 0. + 0x00000000 + + + SBPI_RDATA_1 + [31:0] + read-only + modify + + + + + SBPI_RDATA_2 + 0x0000011c + Read payload bytes 11..8. Once read, the data in the register will automatically clear to 0. + 0x00000000 + + + SBPI_RDATA_2 + [31:0] + read-only + modify + + + + + SBPI_RDATA_3 + 0x00000120 + Read payload bytes 15..12. Once read, the data in the register will automatically clear to 0. + 0x00000000 + + + SBPI_RDATA_3 + [31:0] + read-only + modify + + + + + SBPI_STATUS + 0x00000124 + 0x00000000 + + + MISO + SBPI MISO (master in - slave out): response from SBPI + [23:16] + read-only + + + FLAG + SBPI flag + [12:12] + read-only + + + INSTR_MISS + Last instruction missed (dropped), as the previous has not finished running + [8:8] + read-write + oneToClear + + + INSTR_DONE + Last instruction done + [4:4] + read-write + oneToClear + + + RDATA_VLD + Read command has returned data + [0:0] + read-write + oneToClear + + + + + USR + 0x00000128 + Controls for APB data read interface (USER interface) + 0x00000001 + + + PD + Power-down; 1 disables current reference. Must be 0 to read data from the OTP. + [4:4] + read-write + + + DCTRL + 1 enables USER interface; 0 disables USER interface (enables SBPI). + + This bit must be cleared before performing any SBPI access, such as when programming the OTP. The APB data read interface (USER interface) will be inaccessible during this time, and will return a bus error if any read is attempted. + [0:0] + read-write + + + + + DBG + 0x0000012c + Debug for OTP power-on state machine + 0x00000000 + + + CUSTOMER_RMA_FLAG + The chip is in RMA mode + [12:12] + read-only + + + PSM_STATE + Monitor the PSM FSM's state + [7:4] + read-only + + + ROSC_UP + Ring oscillator is up and running + [3:3] + read-only + + + ROSC_UP_SEEN + Ring oscillator was seen up and running + [2:2] + read-write + oneToClear + + + BOOT_DONE + PSM boot done status flag + [1:1] + read-only + + + PSM_DONE + PSM done status flag + [0:0] + read-only + + + + + BIST + 0x00000134 + During BIST, count address locations that have at least one leaky bit + 0x0fff0000 + + + CNT_FAIL + Flag if the count of address locations with at least one leaky bit exceeds cnt_max + [30:30] + read-only + + + CNT_CLR + Clear counter before use + [29:29] + write-only + + + CNT_ENA + Enable the counter before the BIST function is initiated + [28:28] + read-write + + + CNT_MAX + The cnt_fail flag will be set if the number of leaky locations exceeds this number + [27:16] + read-write + + + CNT + Number of locations that have at least one leaky bit. Note: This count is true only if the BIST was initiated without the fix option. + [12:0] + read-only + + + + + CRT_KEY_W0 + 0x00000138 + Word 0 (bits 31..0) of the key. Write only, read returns 0x0 + 0x00000000 + + + CRT_KEY_W0 + [31:0] + write-only + + + + + CRT_KEY_W1 + 0x0000013c + Word 1 (bits 63..32) of the key. Write only, read returns 0x0 + 0x00000000 + + + CRT_KEY_W1 + [31:0] + write-only + + + + + CRT_KEY_W2 + 0x00000140 + Word 2 (bits 95..64) of the key. Write only, read returns 0x0 + 0x00000000 + + + CRT_KEY_W2 + [31:0] + write-only + + + + + CRT_KEY_W3 + 0x00000144 + Word 3 (bits 127..96) of the key. Write only, read returns 0x0 + 0x00000000 + + + CRT_KEY_W3 + [31:0] + write-only + + + + + CRITICAL + 0x00000148 + Quickly check values of critical flags read during boot up + 0x00000000 + + + RISCV_DISABLE + [17:17] + read-only + + + ARM_DISABLE + [16:16] + read-only + + + GLITCH_DETECTOR_SENS + [6:5] + read-only + + + GLITCH_DETECTOR_ENABLE + [4:4] + read-only + + + DEFAULT_ARCHSEL + [3:3] + read-only + + + DEBUG_DISABLE + [2:2] + read-only + + + SECURE_DEBUG_DISABLE + [1:1] + read-only + + + SECURE_BOOT_ENABLE + [0:0] + read-only + + + + + KEY_VALID + 0x0000014c + Which keys were valid (enrolled) at boot time + 0x00000000 + + + KEY_VALID + [7:0] + read-only + + + + + DEBUGEN + 0x00000150 + Enable a debug feature that has been disabled. Debug features are disabled if one of the relevant critical boot flags is set in OTP (DEBUG_DISABLE or SECURE_DEBUG_DISABLE), OR if a debug key is marked valid in OTP, and the matching key value has not been supplied over SWD. + + Specifically: + + - The DEBUG_DISABLE flag disables all debug features. This can be fully overridden by setting all bits of this register. + + - The SECURE_DEBUG_DISABLE flag disables secure processor debug. This can be fully overridden by setting the PROC0_SECURE and PROC1_SECURE bits of this register. + + - If a single debug key has been registered, and no matching key value has been supplied over SWD, then all debug features are disabled. This can be fully overridden by setting all bits of this register. + + - If both debug keys have been registered, and the Non-secure key's value (key 6) has been supplied over SWD, secure processor debug is disabled. This can be fully overridden by setting the PROC0_SECURE and PROC1_SECURE bits of this register. + + - If both debug keys have been registered, and the Secure key's value (key 5) has been supplied over SWD, then no debug features are disabled by the key mechanism. However, note that in this case debug features may still be disabled by the critical boot flags. + 0x00000000 + + + MISC + Enable other debug components. Specifically, the CTI, and the APB-AP used to access the RISC-V Debug Module. + + These components are disabled by default if either of the debug disable critical flags is set, or if at least one debug key has been enrolled and the least secure of these enrolled key values has not been provided over SWD. + [8:8] + read-write + + + PROC1_SECURE + Permit core 1's Mem-AP to generate Secure accesses, assuming it is enabled at all. Also enable secure debug of core 1 (SPIDEN and SPNIDEN). + + Secure debug of core 1 is disabled by default if the secure debug disable critical flag is set, or if at least one debug key has been enrolled and the most secure of these enrolled key values not yet provided over SWD. + [3:3] + read-write + + + PROC1 + Enable core 1's Mem-AP if it is currently disabled. + + The Mem-AP is disabled by default if either of the debug disable critical flags is set, or if at least one debug key has been enrolled and the least secure of these enrolled key values has not been provided over SWD. + [2:2] + read-write + + + PROC0_SECURE + Permit core 0's Mem-AP to generate Secure accesses, assuming it is enabled at all. Also enable secure debug of core 0 (SPIDEN and SPNIDEN). + + Secure debug of core 0 is disabled by default if the secure debug disable critical flag is set, or if at least one debug key has been enrolled and the most secure of these enrolled key values not yet provided over SWD. + + Note also that core Mem-APs are unconditionally disabled when a core is switched to RISC-V mode (by setting the ARCHSEL bit and performing a warm reset of the core). + [1:1] + read-write + + + PROC0 + Enable core 0's Mem-AP if it is currently disabled. + + The Mem-AP is disabled by default if either of the debug disable critical flags is set, or if at least one debug key has been enrolled and the least secure of these enrolled key values has not been provided over SWD. + + Note also that core Mem-APs are unconditionally disabled when a core is switched to RISC-V mode (by setting the ARCHSEL bit and performing a warm reset of the core). + [0:0] + read-write + + + + + DEBUGEN_LOCK + 0x00000154 + Write 1s to lock corresponding bits in DEBUGEN. This register is reset by the processor cold reset. + 0x00000000 + + + MISC + Write 1 to lock the MISC bit of DEBUGEN. Can't be cleared once set. + [8:8] + read-write + + + PROC1_SECURE + Write 1 to lock the PROC1_SECURE bit of DEBUGEN. Can't be cleared once set. + [3:3] + read-write + + + PROC1 + Write 1 to lock the PROC1 bit of DEBUGEN. Can't be cleared once set. + [2:2] + read-write + + + PROC0_SECURE + Write 1 to lock the PROC0_SECURE bit of DEBUGEN. Can't be cleared once set. + [1:1] + read-write + + + PROC0 + Write 1 to lock the PROC0 bit of DEBUGEN. Can't be cleared once set. + [0:0] + read-write + + + + + ARCHSEL + 0x00000158 + Architecture select (Arm/RISC-V). The default and allowable values of this register are constrained by the critical boot flags. + + This register is reset by the earliest reset in the switched core power domain (before a processor cold reset). + + Cores sample their architecture select signal on a warm reset. The source of the warm reset could be the system power-up state machine, the watchdog timer, Arm SYSRESETREQ or from RISC-V hartresetreq. + + Note that when an Arm core is deselected, its cold reset domain is also held in reset, since in particular the SYSRESETREQ bit becomes inaccessible once the core is deselected. Note also the RISC-V cores do not have a cold reset domain, since their corresponding controls are located in the Debug Module. + 0x00000000 + + + CORE1 + Select architecture for core 1. + [1:1] + read-write + + + arm + 0 + Switch core 1 to Arm (Cortex-M33) + + + riscv + 1 + Switch core 1 to RISC-V (Hazard3) + + + + + CORE0 + Select architecture for core 0. + [0:0] + read-write + + + arm + 0 + Switch core 0 to Arm (Cortex-M33) + + + riscv + 1 + Switch core 0 to RISC-V (Hazard3) + + + + + + + ARCHSEL_STATUS + 0x0000015c + Get the current architecture select state of each core. Cores sample the current value of the ARCHSEL register when their warm reset is released, at which point the corresponding bit in this register will also update. + 0x00000000 + + + CORE1 + Current architecture for core 0. Updated on processor warm reset. + [1:1] + read-only + + + arm + 0 + Core 1 is currently Arm (Cortex-M33) + + + riscv + 1 + Core 1 is currently RISC-V (Hazard3) + + + + + CORE0 + Current architecture for core 0. Updated on processor warm reset. + [0:0] + read-only + + + arm + 0 + Core 0 is currently Arm (Cortex-M33) + + + riscv + 1 + Core 0 is currently RISC-V (Hazard3) + + + + + + + BOOTDIS + 0x00000160 + Tell the bootrom to ignore scratch register boot vectors (both power manager and watchdog) on the next power up. + + If an early boot stage has soft-locked some OTP pages in order to protect their contents from later stages, there is a risk that Secure code running at a later stage can unlock the pages by performing a watchdog reset that resets the OTP. + + This register can be used to ensure that the bootloader runs as normal on the next power up, preventing Secure code at a later stage from accessing OTP in its unlocked state. + + Should be used in conjunction with the power manager BOOTDIS register. + 0x00000000 + + + NEXT + This flag always ORs writes into its current contents. It can be set but not cleared by software. + + The BOOTDIS_NEXT bit is OR'd into the BOOTDIS_NOW bit when the core is powered down. Simultaneously, the BOOTDIS_NEXT bit is cleared. Setting this bit means that the boot scratch registers will be ignored following the next core power down. + + This flag should be set by an early boot stage that has soft-locked OTP pages, to prevent later stages from unlocking it via watchdog reset. + [1:1] + read-write + + + NOW + When the core is powered down, the current value of BOOTDIS_NEXT is OR'd into BOOTDIS_NOW, and BOOTDIS_NEXT is cleared. + + The bootrom checks this flag before reading the boot scratch registers. If it is set, the bootrom clears it, and ignores the BOOT registers. This prevents Secure software from diverting the boot path before a bootloader has had the chance to soft lock OTP pages containing sensitive data. + [0:0] + read-write + oneToClear + + + + + INTR + 0x00000164 + Raw Interrupts + 0x00000000 + + + APB_RD_NSEC_FAIL + [4:4] + read-write + oneToClear + + + APB_RD_SEC_FAIL + [3:3] + read-write + oneToClear + + + APB_DCTRL_FAIL + [2:2] + read-write + oneToClear + + + SBPI_WR_FAIL + [1:1] + read-write + oneToClear + + + SBPI_FLAG_N + [0:0] + read-only + + + + + INTE + 0x00000168 + Interrupt Enable + 0x00000000 + + + APB_RD_NSEC_FAIL + [4:4] + read-write + + + APB_RD_SEC_FAIL + [3:3] + read-write + + + APB_DCTRL_FAIL + [2:2] + read-write + + + SBPI_WR_FAIL + [1:1] + read-write + + + SBPI_FLAG_N + [0:0] + read-write + + + + + INTF + 0x0000016c + Interrupt Force + 0x00000000 + + + APB_RD_NSEC_FAIL + [4:4] + read-write + + + APB_RD_SEC_FAIL + [3:3] + read-write + + + APB_DCTRL_FAIL + [2:2] + read-write + + + SBPI_WR_FAIL + [1:1] + read-write + + + SBPI_FLAG_N + [0:0] + read-write + + + + + INTS + 0x00000170 + Interrupt status after masking & forcing + 0x00000000 + + + APB_RD_NSEC_FAIL + [4:4] + read-only + + + APB_RD_SEC_FAIL + [3:3] + read-only + + + APB_DCTRL_FAIL + [2:2] + read-only + + + SBPI_WR_FAIL + [1:1] + read-only + + + SBPI_FLAG_N + [0:0] + read-only + + + + + + + OTP_DATA + Predefined OTP data layout for RP2350 + 0x40130000 + + 0 + 7920 + registers + + + + CHIPID0 + 0x0000 + Bits 15:0 of public device ID. (ECC) + + The CHIPID0..3 rows contain a 64-bit random identifier for this chip, which can be read from the USB bootloader PICOBOOT interface or from the get_sys_info ROM API. + + The number of random bits makes the occurrence of twins exceedingly unlikely: for example, a fleet of a hundred million devices has a 99.97% probability of no twinned IDs. This is estimated to be lower than the occurrence of process errors in the assignment of sequential random IDs, and for practical purposes CHIPID may be treated as unique. + 16 + 0x0000 + + + CHIPID0 + [15:0] + read-only + + + + + CHIPID1 + 0x0002 + Bits 31:16 of public device ID (ECC) + 16 + 0x0000 + + + CHIPID1 + [15:0] + read-only + + + + + CHIPID2 + 0x0004 + Bits 47:32 of public device ID (ECC) + 16 + 0x0000 + + + CHIPID2 + [15:0] + read-only + + + + + CHIPID3 + 0x0006 + Bits 63:48 of public device ID (ECC) + 16 + 0x0000 + + + CHIPID3 + [15:0] + read-only + + + + + RANDID0 + 0x0008 + Bits 15:0 of private per-device random number (ECC) + + The RANDID0..7 rows form a 128-bit random number generated during device test. + + This ID is not exposed through the USB PICOBOOT GET_INFO command or the ROM `get_sys_info()` API. However note that the USB PICOBOOT OTP access point can read the entirety of page 0, so this value is not meaningfully private unless the USB PICOBOOT interface is disabled via the DISABLE_BOOTSEL_USB_PICOBOOT_IFC flag in BOOT_FLAGS0. + 16 + 0x0000 + + + RANDID0 + [15:0] + read-only + + + + + RANDID1 + 0x000a + Bits 31:16 of private per-device random number (ECC) + 16 + 0x0000 + + + RANDID1 + [15:0] + read-only + + + + + RANDID2 + 0x000c + Bits 47:32 of private per-device random number (ECC) + 16 + 0x0000 + + + RANDID2 + [15:0] + read-only + + + + + RANDID3 + 0x000e + Bits 63:48 of private per-device random number (ECC) + 16 + 0x0000 + + + RANDID3 + [15:0] + read-only + + + + + RANDID4 + 0x0010 + Bits 79:64 of private per-device random number (ECC) + 16 + 0x0000 + + + RANDID4 + [15:0] + read-only + + + + + RANDID5 + 0x0012 + Bits 95:80 of private per-device random number (ECC) + 16 + 0x0000 + + + RANDID5 + [15:0] + read-only + + + + + RANDID6 + 0x0014 + Bits 111:96 of private per-device random number (ECC) + 16 + 0x0000 + + + RANDID6 + [15:0] + read-only + + + + + RANDID7 + 0x0016 + Bits 127:112 of private per-device random number (ECC) + 16 + 0x0000 + + + RANDID7 + [15:0] + read-only + + + + + ROSC_CALIB + 0x0020 + Ring oscillator frequency in kHz, measured during manufacturing (ECC) + + This is measured at 1.1 V, at room temperature, with the ROSC configuration registers in their reset state. + 16 + 0x0000 + + + ROSC_CALIB + [15:0] + read-only + + + + + LPOSC_CALIB + 0x0022 + Low-power oscillator frequency in Hz, measured during manufacturing (ECC) + + This is measured at 1.1V, at room temperature, with the LPOSC trim register in its reset state. + 16 + 0x0000 + + + LPOSC_CALIB + [15:0] + read-only + + + + + NUM_GPIOS + 0x0030 + The number of main user GPIOs (bank 0). Should read 48 in the QFN80 package, and 30 in the QFN60 package. (ECC) + 16 + 0x0000 + + + NUM_GPIOS + [7:0] + read-only + + + + + INFO_CRC0 + 0x006c + Lower 16 bits of CRC32 of OTP addresses 0x00 through 0x6b (polynomial 0x4c11db7, input reflected, output reflected, seed all-ones, final XOR all-ones) (ECC) + 16 + 0x0000 + + + INFO_CRC0 + [15:0] + read-only + + + + + INFO_CRC1 + 0x006e + Upper 16 bits of CRC32 of OTP addresses 0x00 through 0x6b (ECC) + 16 + 0x0000 + + + INFO_CRC1 + [15:0] + read-only + + + + + FLASH_DEVINFO + 0x00a8 + Stores information about external flash device(s). (ECC) + + Assumed to be valid if BOOT_FLAGS0_FLASH_DEVINFO_ENABLE is set. + 16 + 0x0000 + + + CS1_SIZE + The size of the flash/PSRAM device on chip select 1 (addressable at 0x11000000 through 0x11ffffff). + + A value of zero is decoded as a size of zero (no device). Nonzero values are decoded as 4kiB << CS1_SIZE. For example, four megabytes is encoded with a CS1_SIZE value of 10, and 16 megabytes is encoded with a CS1_SIZE value of 12. + + When BOOT_FLAGS0_FLASH_DEVINFO_ENABLE is not set, a default of zero is used. + [15:12] + read-only + + + NONE + 0 + + + 8K + 1 + + + 16K + 2 + + + 32K + 3 + + + 64k + 4 + + + 128K + 5 + + + 256K + 6 + + + 512K + 7 + + + 1M + 8 + + + 2M + 9 + + + 4M + 10 + + + 8M + 11 + + + 16M + 12 + + + + + CS0_SIZE + The size of the flash/PSRAM device on chip select 0 (addressable at 0x10000000 through 0x10ffffff). + + A value of zero is decoded as a size of zero (no device). Nonzero values are decoded as 4kiB << CS0_SIZE. For example, four megabytes is encoded with a CS0_SIZE value of 10, and 16 megabytes is encoded with a CS0_SIZE value of 12. + + When BOOT_FLAGS0_FLASH_DEVINFO_ENABLE is not set, a default of 12 (16 MiB) is used. + [11:8] + read-only + + + NONE + 0 + + + 8K + 1 + + + 16K + 2 + + + 32K + 3 + + + 64k + 4 + + + 128K + 5 + + + 256K + 6 + + + 512K + 7 + + + 1M + 8 + + + 2M + 9 + + + 4M + 10 + + + 8M + 11 + + + 16M + 12 + + + + + D8H_ERASE_SUPPORTED + If true, all attached devices are assumed to support (or ignore, in the case of PSRAM) a block erase command with a command prefix of D8h, an erase size of 64 kiB, and a 24-bit address. Almost all 25-series flash devices support this command. + + If set, the bootrom will use the D8h erase command where it is able, to accelerate bulk erase operations. This makes flash programming faster. + + When BOOT_FLAGS0_FLASH_DEVINFO_ENABLE is not set, this field defaults to false. + [7:7] + read-only + + + CS1_GPIO + Indicate a GPIO number to be used for the secondary flash chip select (CS1), which selects the external QSPI device mapped at system addresses 0x11000000 through 0x11ffffff. There is no such configuration for CS0, as the primary chip select has a dedicated pin. + + On RP2350 the permissible GPIO numbers are 0, 8, 19 and 47. + + Ignored if CS1_size is zero. If CS1_SIZE is nonzero, the bootrom will automatically configure this GPIO as a second chip select upon entering the flash boot path, or entering any other path that may use the QSPI flash interface, such as BOOTSEL mode (nsboot). + [5:0] + read-only + + + + + FLASH_PARTITION_SLOT_SIZE + 0x00aa + Gap between partition table slot 0 and slot 1 at the start of flash (the default size is 4096 bytes) (ECC) Enabled by the OVERRIDE_FLASH_PARTITION_SLOT_SIZE bit in BOOT_FLAGS, the size is 4096 * (value + 1) + 16 + 0x0000 + + + FLASH_PARTITION_SLOT_SIZE + [15:0] + read-only + + + + + BOOTSEL_LED_CFG + 0x00ac + Pin configuration for LED status, used by USB bootloader. (ECC) + Must be valid if BOOT_FLAGS0_ENABLE_BOOTSEL_LED is set. + 16 + 0x0000 + + + ACTIVELOW + LED is active-low. (Default: active-high.) + [8:8] + read-only + + + PIN + GPIO index to use for bootloader activity LED. + [5:0] + read-only + + + + + BOOTSEL_PLL_CFG + 0x00ae + Optional PLL configuration for BOOTSEL mode. (ECC) + + This should be configured to produce an exact 48 MHz based on the crystal oscillator frequency. User mode software may also use this value to calculate the expected crystal frequency based on an assumed 48 MHz PLL output. + + If no configuration is given, the crystal is assumed to be 12 MHz. + + The PLL frequency can be calculated as: + + PLL out = (XOSC frequency / (REFDIV+1)) x FBDIV / (POSTDIV1 x POSTDIV2) + + Conversely the crystal frequency can be calculated as: + + XOSC frequency = 48 MHz x (REFDIV+1) x (POSTDIV1 x POSTDIV2) / FBDIV + + (Note the +1 on REFDIV is because the value stored in this OTP location is the actual divisor value minus one.) + + Used if and only if ENABLE_BOOTSEL_NON_DEFAULT_PLL_XOSC_CFG is set in BOOT_FLAGS0. That bit should be set only after this row and BOOTSEL_XOSC_CFG are both correctly programmed. + 16 + 0x0000 + + + REFDIV + PLL reference divisor, minus one. + + Programming a value of 0 means a reference divisor of 1. Programming a value of 1 means a reference divisor of 2 (for exceptionally fast XIN inputs) + [15:15] + read-only + + + POSTDIV2 + PLL post-divide 2 divisor, in the range 1..7 inclusive. + [14:12] + read-only + + + POSTDIV1 + PLL post-divide 1 divisor, in the range 1..7 inclusive. + [11:9] + read-only + + + FBDIV + PLL feedback divisor, in the range 16..320 inclusive. + [8:0] + read-only + + + + + BOOTSEL_XOSC_CFG + 0x00b0 + Non-default crystal oscillator configuration for the USB bootloader. (ECC) + + These values may also be used by user code configuring the crystal oscillator. + + Used if and only if ENABLE_BOOTSEL_NON_DEFAULT_PLL_XOSC_CFG is set in BOOT_FLAGS0. That bit should be set only after this row and BOOTSEL_PLL_CFG are both correctly programmed. + 16 + 0x0000 + + + RANGE + Value of the XOSC_CTRL_FREQ_RANGE register. + [15:14] + read-only + + + 1_15MHZ + 0 + + + 10_30MHZ + 1 + + + 25_60MHZ + 2 + + + 40_100MHZ + 3 + + + + + STARTUP + Value of the XOSC_STARTUP register + [13:0] + read-only + + + + + USB_WHITE_LABEL_ADDR + 0x00b8 + Row index of the USB_WHITE_LABEL structure within OTP (ECC) + + The table has 16 rows, each of which are also ECC and marked valid by the corresponding valid bit in USB_BOOT_FLAGS (ECC). + + The entries are either _VALUEs where the 16 bit value is used as is, or _STRDEFs which acts as a pointers to a string value. + + The value stored in a _STRDEF is two separate bytes: The low seven bits of the first (LSB) byte indicates the number of characters in the string, and the top bit of the first (LSB) byte if set to indicate that each character in the string is two bytes (Unicode) versus one byte if unset. The second (MSB) byte represents the location of the string data, and is encoded as the number of rows from this USB_WHITE_LABEL_ADDR; i.e. the row of the start of the string is USB_WHITE_LABEL_ADDR value + msb_byte. + + In each case, the corresponding valid bit enables replacing the default value for the corresponding item provided by the boot rom. + + Note that Unicode _STRDEFs are only supported for USB_DEVICE_PRODUCT_STRDEF, USB_DEVICE_SERIAL_NUMBER_STRDEF and USB_DEVICE_MANUFACTURER_STRDEF. Unicode values will be ignored if specified for other fields, and non-unicode values for these three items will be converted to Unicode characters by setting the upper 8 bits to zero. + + Note that if the USB_WHITE_LABEL structure or the corresponding strings are not readable by BOOTSEL mode based on OTP permissions, or if alignment requirements are not met, then the corresponding default values are used. + + The index values indicate where each field is located (row USB_WHITE_LABEL_ADDR value + index): + 16 + 0x0000 + + + USB_WHITE_LABEL_ADDR + [15:0] + read-only + + + INDEX_USB_DEVICE_VID_VALUE + 0 + + + INDEX_USB_DEVICE_PID_VALUE + 1 + + + INDEX_USB_DEVICE_BCD_DEVICE_VALUE + 2 + + + INDEX_USB_DEVICE_LANG_ID_VALUE + 3 + + + INDEX_USB_DEVICE_MANUFACTURER_STRDEF + 4 + + + INDEX_USB_DEVICE_PRODUCT_STRDEF + 5 + + + INDEX_USB_DEVICE_SERIAL_NUMBER_STRDEF + 6 + + + INDEX_USB_CONFIG_ATTRIBUTES_MAX_POWER_VALUES + 7 + + + INDEX_VOLUME_LABEL_STRDEF + 8 + + + INDEX_SCSI_INQUIRY_VENDOR_STRDEF + 9 + + + INDEX_SCSI_INQUIRY_PRODUCT_STRDEF + 10 + + + INDEX_SCSI_INQUIRY_VERSION_STRDEF + 11 + + + INDEX_INDEX_HTM_REDIRECT_URL_STRDEF + 12 + + + INDEX_INDEX_HTM_REDIRECT_NAME_STRDEF + 13 + + + INDEX_INFO_UF2_TXT_MODEL_STRDEF + 14 + + + INDEX_INFO_UF2_TXT_BOARD_ID_STRDEF + 15 + + + + + + + OTPBOOT_SRC + 0x00bc + OTP start row for the OTP boot image. (ECC) + + If OTP boot is enabled, the bootrom will load from this location into SRAM and then directly enter the loaded image. Note that the image must be signed if SECURE_BOOT_ENABLE is set. The image itself is assumed to be ECC-protected. + + This must be an even number. Equivalently, the OTP boot image must start at a word-aligned location in the ECC read data address window. + 16 + 0x0000 + + + OTPBOOT_SRC + [15:0] + read-only + + + + + OTPBOOT_LEN + 0x00be + Length in rows of the OTP boot image. (ECC) + + OTPBOOT_LEN must be even. The total image size must be a multiple of 4 bytes (32 bits). + 16 + 0x0000 + + + OTPBOOT_LEN + [15:0] + read-only + + + + + OTPBOOT_DST0 + 0x00c0 + Bits 15:0 of the OTP boot image load destination (and entry point). (ECC) + + This must be a location in main SRAM (main SRAM is addresses 0x20000000 through 0x20082000) and must be word-aligned. + 16 + 0x0000 + + + OTPBOOT_DST0 + [15:0] + read-only + + + + + OTPBOOT_DST1 + 0x00c2 + Bits 31:16 of the OTP boot image load destination (and entry point). (ECC) + + This must be a location in main SRAM (main SRAM is addresses 0x20000000 through 0x20082000) and must be word-aligned. + 16 + 0x0000 + + + OTPBOOT_DST1 + [15:0] + read-only + + + + + BOOTKEY0_0 + 0x0100 + Bits 15:0 of SHA-256 hash of boot key 0 (ECC) + 16 + 0x0000 + + + BOOTKEY0_0 + [15:0] + read-only + + + + + BOOTKEY0_1 + 0x0102 + Bits 31:16 of SHA-256 hash of boot key 0 (ECC) + 16 + 0x0000 + + + BOOTKEY0_1 + [15:0] + read-only + + + + + BOOTKEY0_2 + 0x0104 + Bits 47:32 of SHA-256 hash of boot key 0 (ECC) + 16 + 0x0000 + + + BOOTKEY0_2 + [15:0] + read-only + + + + + BOOTKEY0_3 + 0x0106 + Bits 63:48 of SHA-256 hash of boot key 0 (ECC) + 16 + 0x0000 + + + BOOTKEY0_3 + [15:0] + read-only + + + + + BOOTKEY0_4 + 0x0108 + Bits 79:64 of SHA-256 hash of boot key 0 (ECC) + 16 + 0x0000 + + + BOOTKEY0_4 + [15:0] + read-only + + + + + BOOTKEY0_5 + 0x010a + Bits 95:80 of SHA-256 hash of boot key 0 (ECC) + 16 + 0x0000 + + + BOOTKEY0_5 + [15:0] + read-only + + + + + BOOTKEY0_6 + 0x010c + Bits 111:96 of SHA-256 hash of boot key 0 (ECC) + 16 + 0x0000 + + + BOOTKEY0_6 + [15:0] + read-only + + + + + BOOTKEY0_7 + 0x010e + Bits 127:112 of SHA-256 hash of boot key 0 (ECC) + 16 + 0x0000 + + + BOOTKEY0_7 + [15:0] + read-only + + + + + BOOTKEY0_8 + 0x0110 + Bits 143:128 of SHA-256 hash of boot key 0 (ECC) + 16 + 0x0000 + + + BOOTKEY0_8 + [15:0] + read-only + + + + + BOOTKEY0_9 + 0x0112 + Bits 159:144 of SHA-256 hash of boot key 0 (ECC) + 16 + 0x0000 + + + BOOTKEY0_9 + [15:0] + read-only + + + + + BOOTKEY0_10 + 0x0114 + Bits 175:160 of SHA-256 hash of boot key 0 (ECC) + 16 + 0x0000 + + + BOOTKEY0_10 + [15:0] + read-only + + + + + BOOTKEY0_11 + 0x0116 + Bits 191:176 of SHA-256 hash of boot key 0 (ECC) + 16 + 0x0000 + + + BOOTKEY0_11 + [15:0] + read-only + + + + + BOOTKEY0_12 + 0x0118 + Bits 207:192 of SHA-256 hash of boot key 0 (ECC) + 16 + 0x0000 + + + BOOTKEY0_12 + [15:0] + read-only + + + + + BOOTKEY0_13 + 0x011a + Bits 223:208 of SHA-256 hash of boot key 0 (ECC) + 16 + 0x0000 + + + BOOTKEY0_13 + [15:0] + read-only + + + + + BOOTKEY0_14 + 0x011c + Bits 239:224 of SHA-256 hash of boot key 0 (ECC) + 16 + 0x0000 + + + BOOTKEY0_14 + [15:0] + read-only + + + + + BOOTKEY0_15 + 0x011e + Bits 255:240 of SHA-256 hash of boot key 0 (ECC) + 16 + 0x0000 + + + BOOTKEY0_15 + [15:0] + read-only + + + + + BOOTKEY1_0 + 0x0120 + Bits 15:0 of SHA-256 hash of boot key 1 (ECC) + 16 + 0x0000 + + + BOOTKEY1_0 + [15:0] + read-only + + + + + BOOTKEY1_1 + 0x0122 + Bits 31:16 of SHA-256 hash of boot key 1 (ECC) + 16 + 0x0000 + + + BOOTKEY1_1 + [15:0] + read-only + + + + + BOOTKEY1_2 + 0x0124 + Bits 47:32 of SHA-256 hash of boot key 1 (ECC) + 16 + 0x0000 + + + BOOTKEY1_2 + [15:0] + read-only + + + + + BOOTKEY1_3 + 0x0126 + Bits 63:48 of SHA-256 hash of boot key 1 (ECC) + 16 + 0x0000 + + + BOOTKEY1_3 + [15:0] + read-only + + + + + BOOTKEY1_4 + 0x0128 + Bits 79:64 of SHA-256 hash of boot key 1 (ECC) + 16 + 0x0000 + + + BOOTKEY1_4 + [15:0] + read-only + + + + + BOOTKEY1_5 + 0x012a + Bits 95:80 of SHA-256 hash of boot key 1 (ECC) + 16 + 0x0000 + + + BOOTKEY1_5 + [15:0] + read-only + + + + + BOOTKEY1_6 + 0x012c + Bits 111:96 of SHA-256 hash of boot key 1 (ECC) + 16 + 0x0000 + + + BOOTKEY1_6 + [15:0] + read-only + + + + + BOOTKEY1_7 + 0x012e + Bits 127:112 of SHA-256 hash of boot key 1 (ECC) + 16 + 0x0000 + + + BOOTKEY1_7 + [15:0] + read-only + + + + + BOOTKEY1_8 + 0x0130 + Bits 143:128 of SHA-256 hash of boot key 1 (ECC) + 16 + 0x0000 + + + BOOTKEY1_8 + [15:0] + read-only + + + + + BOOTKEY1_9 + 0x0132 + Bits 159:144 of SHA-256 hash of boot key 1 (ECC) + 16 + 0x0000 + + + BOOTKEY1_9 + [15:0] + read-only + + + + + BOOTKEY1_10 + 0x0134 + Bits 175:160 of SHA-256 hash of boot key 1 (ECC) + 16 + 0x0000 + + + BOOTKEY1_10 + [15:0] + read-only + + + + + BOOTKEY1_11 + 0x0136 + Bits 191:176 of SHA-256 hash of boot key 1 (ECC) + 16 + 0x0000 + + + BOOTKEY1_11 + [15:0] + read-only + + + + + BOOTKEY1_12 + 0x0138 + Bits 207:192 of SHA-256 hash of boot key 1 (ECC) + 16 + 0x0000 + + + BOOTKEY1_12 + [15:0] + read-only + + + + + BOOTKEY1_13 + 0x013a + Bits 223:208 of SHA-256 hash of boot key 1 (ECC) + 16 + 0x0000 + + + BOOTKEY1_13 + [15:0] + read-only + + + + + BOOTKEY1_14 + 0x013c + Bits 239:224 of SHA-256 hash of boot key 1 (ECC) + 16 + 0x0000 + + + BOOTKEY1_14 + [15:0] + read-only + + + + + BOOTKEY1_15 + 0x013e + Bits 255:240 of SHA-256 hash of boot key 1 (ECC) + 16 + 0x0000 + + + BOOTKEY1_15 + [15:0] + read-only + + + + + BOOTKEY2_0 + 0x0140 + Bits 15:0 of SHA-256 hash of boot key 2 (ECC) + 16 + 0x0000 + + + BOOTKEY2_0 + [15:0] + read-only + + + + + BOOTKEY2_1 + 0x0142 + Bits 31:16 of SHA-256 hash of boot key 2 (ECC) + 16 + 0x0000 + + + BOOTKEY2_1 + [15:0] + read-only + + + + + BOOTKEY2_2 + 0x0144 + Bits 47:32 of SHA-256 hash of boot key 2 (ECC) + 16 + 0x0000 + + + BOOTKEY2_2 + [15:0] + read-only + + + + + BOOTKEY2_3 + 0x0146 + Bits 63:48 of SHA-256 hash of boot key 2 (ECC) + 16 + 0x0000 + + + BOOTKEY2_3 + [15:0] + read-only + + + + + BOOTKEY2_4 + 0x0148 + Bits 79:64 of SHA-256 hash of boot key 2 (ECC) + 16 + 0x0000 + + + BOOTKEY2_4 + [15:0] + read-only + + + + + BOOTKEY2_5 + 0x014a + Bits 95:80 of SHA-256 hash of boot key 2 (ECC) + 16 + 0x0000 + + + BOOTKEY2_5 + [15:0] + read-only + + + + + BOOTKEY2_6 + 0x014c + Bits 111:96 of SHA-256 hash of boot key 2 (ECC) + 16 + 0x0000 + + + BOOTKEY2_6 + [15:0] + read-only + + + + + BOOTKEY2_7 + 0x014e + Bits 127:112 of SHA-256 hash of boot key 2 (ECC) + 16 + 0x0000 + + + BOOTKEY2_7 + [15:0] + read-only + + + + + BOOTKEY2_8 + 0x0150 + Bits 143:128 of SHA-256 hash of boot key 2 (ECC) + 16 + 0x0000 + + + BOOTKEY2_8 + [15:0] + read-only + + + + + BOOTKEY2_9 + 0x0152 + Bits 159:144 of SHA-256 hash of boot key 2 (ECC) + 16 + 0x0000 + + + BOOTKEY2_9 + [15:0] + read-only + + + + + BOOTKEY2_10 + 0x0154 + Bits 175:160 of SHA-256 hash of boot key 2 (ECC) + 16 + 0x0000 + + + BOOTKEY2_10 + [15:0] + read-only + + + + + BOOTKEY2_11 + 0x0156 + Bits 191:176 of SHA-256 hash of boot key 2 (ECC) + 16 + 0x0000 + + + BOOTKEY2_11 + [15:0] + read-only + + + + + BOOTKEY2_12 + 0x0158 + Bits 207:192 of SHA-256 hash of boot key 2 (ECC) + 16 + 0x0000 + + + BOOTKEY2_12 + [15:0] + read-only + + + + + BOOTKEY2_13 + 0x015a + Bits 223:208 of SHA-256 hash of boot key 2 (ECC) + 16 + 0x0000 + + + BOOTKEY2_13 + [15:0] + read-only + + + + + BOOTKEY2_14 + 0x015c + Bits 239:224 of SHA-256 hash of boot key 2 (ECC) + 16 + 0x0000 + + + BOOTKEY2_14 + [15:0] + read-only + + + + + BOOTKEY2_15 + 0x015e + Bits 255:240 of SHA-256 hash of boot key 2 (ECC) + 16 + 0x0000 + + + BOOTKEY2_15 + [15:0] + read-only + + + + + BOOTKEY3_0 + 0x0160 + Bits 15:0 of SHA-256 hash of boot key 3 (ECC) + 16 + 0x0000 + + + BOOTKEY3_0 + [15:0] + read-only + + + + + BOOTKEY3_1 + 0x0162 + Bits 31:16 of SHA-256 hash of boot key 3 (ECC) + 16 + 0x0000 + + + BOOTKEY3_1 + [15:0] + read-only + + + + + BOOTKEY3_2 + 0x0164 + Bits 47:32 of SHA-256 hash of boot key 3 (ECC) + 16 + 0x0000 + + + BOOTKEY3_2 + [15:0] + read-only + + + + + BOOTKEY3_3 + 0x0166 + Bits 63:48 of SHA-256 hash of boot key 3 (ECC) + 16 + 0x0000 + + + BOOTKEY3_3 + [15:0] + read-only + + + + + BOOTKEY3_4 + 0x0168 + Bits 79:64 of SHA-256 hash of boot key 3 (ECC) + 16 + 0x0000 + + + BOOTKEY3_4 + [15:0] + read-only + + + + + BOOTKEY3_5 + 0x016a + Bits 95:80 of SHA-256 hash of boot key 3 (ECC) + 16 + 0x0000 + + + BOOTKEY3_5 + [15:0] + read-only + + + + + BOOTKEY3_6 + 0x016c + Bits 111:96 of SHA-256 hash of boot key 3 (ECC) + 16 + 0x0000 + + + BOOTKEY3_6 + [15:0] + read-only + + + + + BOOTKEY3_7 + 0x016e + Bits 127:112 of SHA-256 hash of boot key 3 (ECC) + 16 + 0x0000 + + + BOOTKEY3_7 + [15:0] + read-only + + + + + BOOTKEY3_8 + 0x0170 + Bits 143:128 of SHA-256 hash of boot key 3 (ECC) + 16 + 0x0000 + + + BOOTKEY3_8 + [15:0] + read-only + + + + + BOOTKEY3_9 + 0x0172 + Bits 159:144 of SHA-256 hash of boot key 3 (ECC) + 16 + 0x0000 + + + BOOTKEY3_9 + [15:0] + read-only + + + + + BOOTKEY3_10 + 0x0174 + Bits 175:160 of SHA-256 hash of boot key 3 (ECC) + 16 + 0x0000 + + + BOOTKEY3_10 + [15:0] + read-only + + + + + BOOTKEY3_11 + 0x0176 + Bits 191:176 of SHA-256 hash of boot key 3 (ECC) + 16 + 0x0000 + + + BOOTKEY3_11 + [15:0] + read-only + + + + + BOOTKEY3_12 + 0x0178 + Bits 207:192 of SHA-256 hash of boot key 3 (ECC) + 16 + 0x0000 + + + BOOTKEY3_12 + [15:0] + read-only + + + + + BOOTKEY3_13 + 0x017a + Bits 223:208 of SHA-256 hash of boot key 3 (ECC) + 16 + 0x0000 + + + BOOTKEY3_13 + [15:0] + read-only + + + + + BOOTKEY3_14 + 0x017c + Bits 239:224 of SHA-256 hash of boot key 3 (ECC) + 16 + 0x0000 + + + BOOTKEY3_14 + [15:0] + read-only + + + + + BOOTKEY3_15 + 0x017e + Bits 255:240 of SHA-256 hash of boot key 3 (ECC) + 16 + 0x0000 + + + BOOTKEY3_15 + [15:0] + read-only + + + + + KEY1_0 + 0x1e90 + Bits 15:0 of OTP access key 1 (ECC) + 16 + 0x0000 + + + KEY1_0 + [15:0] + read-only + + + + + KEY1_1 + 0x1e92 + Bits 31:16 of OTP access key 1 (ECC) + 16 + 0x0000 + + + KEY1_1 + [15:0] + read-only + + + + + KEY1_2 + 0x1e94 + Bits 47:32 of OTP access key 1 (ECC) + 16 + 0x0000 + + + KEY1_2 + [15:0] + read-only + + + + + KEY1_3 + 0x1e96 + Bits 63:48 of OTP access key 1 (ECC) + 16 + 0x0000 + + + KEY1_3 + [15:0] + read-only + + + + + KEY1_4 + 0x1e98 + Bits 79:64 of OTP access key 1 (ECC) + 16 + 0x0000 + + + KEY1_4 + [15:0] + read-only + + + + + KEY1_5 + 0x1e9a + Bits 95:80 of OTP access key 1 (ECC) + 16 + 0x0000 + + + KEY1_5 + [15:0] + read-only + + + + + KEY1_6 + 0x1e9c + Bits 111:96 of OTP access key 1 (ECC) + 16 + 0x0000 + + + KEY1_6 + [15:0] + read-only + + + + + KEY1_7 + 0x1e9e + Bits 127:112 of OTP access key 1 (ECC) + 16 + 0x0000 + + + KEY1_7 + [15:0] + read-only + + + + + KEY2_0 + 0x1ea0 + Bits 15:0 of OTP access key 2 (ECC) + 16 + 0x0000 + + + KEY2_0 + [15:0] + read-only + + + + + KEY2_1 + 0x1ea2 + Bits 31:16 of OTP access key 2 (ECC) + 16 + 0x0000 + + + KEY2_1 + [15:0] + read-only + + + + + KEY2_2 + 0x1ea4 + Bits 47:32 of OTP access key 2 (ECC) + 16 + 0x0000 + + + KEY2_2 + [15:0] + read-only + + + + + KEY2_3 + 0x1ea6 + Bits 63:48 of OTP access key 2 (ECC) + 16 + 0x0000 + + + KEY2_3 + [15:0] + read-only + + + + + KEY2_4 + 0x1ea8 + Bits 79:64 of OTP access key 2 (ECC) + 16 + 0x0000 + + + KEY2_4 + [15:0] + read-only + + + + + KEY2_5 + 0x1eaa + Bits 95:80 of OTP access key 2 (ECC) + 16 + 0x0000 + + + KEY2_5 + [15:0] + read-only + + + + + KEY2_6 + 0x1eac + Bits 111:96 of OTP access key 2 (ECC) + 16 + 0x0000 + + + KEY2_6 + [15:0] + read-only + + + + + KEY2_7 + 0x1eae + Bits 127:112 of OTP access key 2 (ECC) + 16 + 0x0000 + + + KEY2_7 + [15:0] + read-only + + + + + KEY3_0 + 0x1eb0 + Bits 15:0 of OTP access key 3 (ECC) + 16 + 0x0000 + + + KEY3_0 + [15:0] + read-only + + + + + KEY3_1 + 0x1eb2 + Bits 31:16 of OTP access key 3 (ECC) + 16 + 0x0000 + + + KEY3_1 + [15:0] + read-only + + + + + KEY3_2 + 0x1eb4 + Bits 47:32 of OTP access key 3 (ECC) + 16 + 0x0000 + + + KEY3_2 + [15:0] + read-only + + + + + KEY3_3 + 0x1eb6 + Bits 63:48 of OTP access key 3 (ECC) + 16 + 0x0000 + + + KEY3_3 + [15:0] + read-only + + + + + KEY3_4 + 0x1eb8 + Bits 79:64 of OTP access key 3 (ECC) + 16 + 0x0000 + + + KEY3_4 + [15:0] + read-only + + + + + KEY3_5 + 0x1eba + Bits 95:80 of OTP access key 3 (ECC) + 16 + 0x0000 + + + KEY3_5 + [15:0] + read-only + + + + + KEY3_6 + 0x1ebc + Bits 111:96 of OTP access key 3 (ECC) + 16 + 0x0000 + + + KEY3_6 + [15:0] + read-only + + + + + KEY3_7 + 0x1ebe + Bits 127:112 of OTP access key 3 (ECC) + 16 + 0x0000 + + + KEY3_7 + [15:0] + read-only + + + + + KEY4_0 + 0x1ec0 + Bits 15:0 of OTP access key 4 (ECC) + 16 + 0x0000 + + + KEY4_0 + [15:0] + read-only + + + + + KEY4_1 + 0x1ec2 + Bits 31:16 of OTP access key 4 (ECC) + 16 + 0x0000 + + + KEY4_1 + [15:0] + read-only + + + + + KEY4_2 + 0x1ec4 + Bits 47:32 of OTP access key 4 (ECC) + 16 + 0x0000 + + + KEY4_2 + [15:0] + read-only + + + + + KEY4_3 + 0x1ec6 + Bits 63:48 of OTP access key 4 (ECC) + 16 + 0x0000 + + + KEY4_3 + [15:0] + read-only + + + + + KEY4_4 + 0x1ec8 + Bits 79:64 of OTP access key 4 (ECC) + 16 + 0x0000 + + + KEY4_4 + [15:0] + read-only + + + + + KEY4_5 + 0x1eca + Bits 95:80 of OTP access key 4 (ECC) + 16 + 0x0000 + + + KEY4_5 + [15:0] + read-only + + + + + KEY4_6 + 0x1ecc + Bits 111:96 of OTP access key 4 (ECC) + 16 + 0x0000 + + + KEY4_6 + [15:0] + read-only + + + + + KEY4_7 + 0x1ece + Bits 127:112 of OTP access key 4 (ECC) + 16 + 0x0000 + + + KEY4_7 + [15:0] + read-only + + + + + KEY5_0 + 0x1ed0 + Bits 15:0 of OTP access key 5 (ECC) + 16 + 0x0000 + + + KEY5_0 + [15:0] + read-only + + + + + KEY5_1 + 0x1ed2 + Bits 31:16 of OTP access key 5 (ECC) + 16 + 0x0000 + + + KEY5_1 + [15:0] + read-only + + + + + KEY5_2 + 0x1ed4 + Bits 47:32 of OTP access key 5 (ECC) + 16 + 0x0000 + + + KEY5_2 + [15:0] + read-only + + + + + KEY5_3 + 0x1ed6 + Bits 63:48 of OTP access key 5 (ECC) + 16 + 0x0000 + + + KEY5_3 + [15:0] + read-only + + + + + KEY5_4 + 0x1ed8 + Bits 79:64 of OTP access key 5 (ECC) + 16 + 0x0000 + + + KEY5_4 + [15:0] + read-only + + + + + KEY5_5 + 0x1eda + Bits 95:80 of OTP access key 5 (ECC) + 16 + 0x0000 + + + KEY5_5 + [15:0] + read-only + + + + + KEY5_6 + 0x1edc + Bits 111:96 of OTP access key 5 (ECC) + 16 + 0x0000 + + + KEY5_6 + [15:0] + read-only + + + + + KEY5_7 + 0x1ede + Bits 127:112 of OTP access key 5 (ECC) + 16 + 0x0000 + + + KEY5_7 + [15:0] + read-only + + + + + KEY6_0 + 0x1ee0 + Bits 15:0 of OTP access key 6 (ECC) + 16 + 0x0000 + + + KEY6_0 + [15:0] + read-only + + + + + KEY6_1 + 0x1ee2 + Bits 31:16 of OTP access key 6 (ECC) + 16 + 0x0000 + + + KEY6_1 + [15:0] + read-only + + + + + KEY6_2 + 0x1ee4 + Bits 47:32 of OTP access key 6 (ECC) + 16 + 0x0000 + + + KEY6_2 + [15:0] + read-only + + + + + KEY6_3 + 0x1ee6 + Bits 63:48 of OTP access key 6 (ECC) + 16 + 0x0000 + + + KEY6_3 + [15:0] + read-only + + + + + KEY6_4 + 0x1ee8 + Bits 79:64 of OTP access key 6 (ECC) + 16 + 0x0000 + + + KEY6_4 + [15:0] + read-only + + + + + KEY6_5 + 0x1eea + Bits 95:80 of OTP access key 6 (ECC) + 16 + 0x0000 + + + KEY6_5 + [15:0] + read-only + + + + + KEY6_6 + 0x1eec + Bits 111:96 of OTP access key 6 (ECC) + 16 + 0x0000 + + + KEY6_6 + [15:0] + read-only + + + + + KEY6_7 + 0x1eee + Bits 127:112 of OTP access key 6 (ECC) + 16 + 0x0000 + + + KEY6_7 + [15:0] + read-only + + + + + + + OTP_DATA_RAW + Predefined OTP data layout for RP2350 + 0x40134000 + + 0 + 16384 + registers + + + + CHIPID0 + 0x00000000 + Bits 15:0 of public device ID. (ECC) + + The CHIPID0..3 rows contain a 64-bit random identifier for this chip, which can be read from the USB bootloader PICOBOOT interface or from the get_sys_info ROM API. + + The number of random bits makes the occurrence of twins exceedingly unlikely: for example, a fleet of a hundred million devices has a 99.97% probability of no twinned IDs. This is estimated to be lower than the occurrence of process errors in the assignment of sequential random IDs, and for practical purposes CHIPID may be treated as unique. + 0x00000000 + + + CHIPID0 + [15:0] + read-only + + + + + CHIPID1 + 0x00000004 + Bits 31:16 of public device ID (ECC) + 0x00000000 + + + CHIPID1 + [15:0] + read-only + + + + + CHIPID2 + 0x00000008 + Bits 47:32 of public device ID (ECC) + 0x00000000 + + + CHIPID2 + [15:0] + read-only + + + + + CHIPID3 + 0x0000000c + Bits 63:48 of public device ID (ECC) + 0x00000000 + + + CHIPID3 + [15:0] + read-only + + + + + RANDID0 + 0x00000010 + Bits 15:0 of private per-device random number (ECC) + + The RANDID0..7 rows form a 128-bit random number generated during device test. + + This ID is not exposed through the USB PICOBOOT GET_INFO command or the ROM `get_sys_info()` API. However note that the USB PICOBOOT OTP access point can read the entirety of page 0, so this value is not meaningfully private unless the USB PICOBOOT interface is disabled via the DISABLE_BOOTSEL_USB_PICOBOOT_IFC flag in BOOT_FLAGS0. + 0x00000000 + + + RANDID0 + [15:0] + read-only + + + + + RANDID1 + 0x00000014 + Bits 31:16 of private per-device random number (ECC) + 0x00000000 + + + RANDID1 + [15:0] + read-only + + + + + RANDID2 + 0x00000018 + Bits 47:32 of private per-device random number (ECC) + 0x00000000 + + + RANDID2 + [15:0] + read-only + + + + + RANDID3 + 0x0000001c + Bits 63:48 of private per-device random number (ECC) + 0x00000000 + + + RANDID3 + [15:0] + read-only + + + + + RANDID4 + 0x00000020 + Bits 79:64 of private per-device random number (ECC) + 0x00000000 + + + RANDID4 + [15:0] + read-only + + + + + RANDID5 + 0x00000024 + Bits 95:80 of private per-device random number (ECC) + 0x00000000 + + + RANDID5 + [15:0] + read-only + + + + + RANDID6 + 0x00000028 + Bits 111:96 of private per-device random number (ECC) + 0x00000000 + + + RANDID6 + [15:0] + read-only + + + + + RANDID7 + 0x0000002c + Bits 127:112 of private per-device random number (ECC) + 0x00000000 + + + RANDID7 + [15:0] + read-only + + + + + ROSC_CALIB + 0x00000040 + Ring oscillator frequency in kHz, measured during manufacturing (ECC) + + This is measured at 1.1 V, at room temperature, with the ROSC configuration registers in their reset state. + 0x00000000 + + + ROSC_CALIB + [15:0] + read-only + + + + + LPOSC_CALIB + 0x00000044 + Low-power oscillator frequency in Hz, measured during manufacturing (ECC) + + This is measured at 1.1V, at room temperature, with the LPOSC trim register in its reset state. + 0x00000000 + + + LPOSC_CALIB + [15:0] + read-only + + + + + NUM_GPIOS + 0x00000060 + The number of main user GPIOs (bank 0). Should read 48 in the QFN80 package, and 30 in the QFN60 package. (ECC) + 0x00000000 + + + NUM_GPIOS + [7:0] + read-only + + + + + INFO_CRC0 + 0x000000d8 + Lower 16 bits of CRC32 of OTP addresses 0x00 through 0x6b (polynomial 0x4c11db7, input reflected, output reflected, seed all-ones, final XOR all-ones) (ECC) + 0x00000000 + + + INFO_CRC0 + [15:0] + read-only + + + + + INFO_CRC1 + 0x000000dc + Upper 16 bits of CRC32 of OTP addresses 0x00 through 0x6b (ECC) + 0x00000000 + + + INFO_CRC1 + [15:0] + read-only + + + + + CRIT0 + 0x000000e0 + Page 0 critical boot flags (RBIT-8) + 0x00000000 + + + RISCV_DISABLE + Permanently disable RISC-V processors (Hazard3) + [1:1] + read-only + + + ARM_DISABLE + Permanently disable ARM processors (Cortex-M33) + [0:0] + read-only + + + + + CRIT0_R1 + 0x000000e4 + Redundant copy of CRIT0 + 0x00000000 + + + CRIT0_R1 + [23:0] + read-only + + + + + CRIT0_R2 + 0x000000e8 + Redundant copy of CRIT0 + 0x00000000 + + + CRIT0_R2 + [23:0] + read-only + + + + + CRIT0_R3 + 0x000000ec + Redundant copy of CRIT0 + 0x00000000 + + + CRIT0_R3 + [23:0] + read-only + + + + + CRIT0_R4 + 0x000000f0 + Redundant copy of CRIT0 + 0x00000000 + + + CRIT0_R4 + [23:0] + read-only + + + + + CRIT0_R5 + 0x000000f4 + Redundant copy of CRIT0 + 0x00000000 + + + CRIT0_R5 + [23:0] + read-only + + + + + CRIT0_R6 + 0x000000f8 + Redundant copy of CRIT0 + 0x00000000 + + + CRIT0_R6 + [23:0] + read-only + + + + + CRIT0_R7 + 0x000000fc + Redundant copy of CRIT0 + 0x00000000 + + + CRIT0_R7 + [23:0] + read-only + + + + + CRIT1 + 0x00000100 + Page 1 critical boot flags (RBIT-8) + 0x00000000 + + + GLITCH_DETECTOR_SENS + Increase the sensitivity of the glitch detectors from their default. + [6:5] + read-only + + + GLITCH_DETECTOR_ENABLE + Arm the glitch detectors to reset the system if an abnormal clock/power event is observed. + [4:4] + read-only + + + BOOT_ARCH + Set the default boot architecture, 0=ARM 1=RISC-V. Ignored if ARM_DISABLE, RISCV_DISABLE or SECURE_BOOT_ENABLE is set. + [3:3] + read-only + + + DEBUG_DISABLE + Disable all debug access + [2:2] + read-only + + + SECURE_DEBUG_DISABLE + Disable Secure debug access + [1:1] + read-only + + + SECURE_BOOT_ENABLE + Enable boot signature enforcement, and permanently disable the RISC-V cores. + [0:0] + read-only + + + + + CRIT1_R1 + 0x00000104 + Redundant copy of CRIT1 + 0x00000000 + + + CRIT1_R1 + [23:0] + read-only + + + + + CRIT1_R2 + 0x00000108 + Redundant copy of CRIT1 + 0x00000000 + + + CRIT1_R2 + [23:0] + read-only + + + + + CRIT1_R3 + 0x0000010c + Redundant copy of CRIT1 + 0x00000000 + + + CRIT1_R3 + [23:0] + read-only + + + + + CRIT1_R4 + 0x00000110 + Redundant copy of CRIT1 + 0x00000000 + + + CRIT1_R4 + [23:0] + read-only + + + + + CRIT1_R5 + 0x00000114 + Redundant copy of CRIT1 + 0x00000000 + + + CRIT1_R5 + [23:0] + read-only + + + + + CRIT1_R6 + 0x00000118 + Redundant copy of CRIT1 + 0x00000000 + + + CRIT1_R6 + [23:0] + read-only + + + + + CRIT1_R7 + 0x0000011c + Redundant copy of CRIT1 + 0x00000000 + + + CRIT1_R7 + [23:0] + read-only + + + + + BOOT_FLAGS0 + 0x00000120 + Disable/Enable boot paths/features in the RP2350 mask ROM. Disables always supersede enables. Enables are provided where there are other configurations in OTP that must be valid. (RBIT-3) + 0x00000000 + + + DISABLE_SRAM_WINDOW_BOOT + [21:21] + read-only + + + DISABLE_XIP_ACCESS_ON_SRAM_ENTRY + Disable all access to XIP after entering an SRAM binary. + + Note that this will cause bootrom APIs that access XIP to fail, including APIs that interact with the partition table. + [20:20] + read-only + + + DISABLE_BOOTSEL_UART_BOOT + [19:19] + read-only + + + DISABLE_BOOTSEL_USB_PICOBOOT_IFC + [18:18] + read-only + + + DISABLE_BOOTSEL_USB_MSD_IFC + [17:17] + read-only + + + DISABLE_WATCHDOG_SCRATCH + [16:16] + read-only + + + DISABLE_POWER_SCRATCH + [15:15] + read-only + + + ENABLE_OTP_BOOT + Enable OTP boot. A number of OTP rows specified by OTPBOOT_LEN will be loaded, starting from OTPBOOT_SRC, into the SRAM location specified by OTPBOOT_DST1 and OTPBOOT_DST0. + + The loaded program image is stored with ECC, 16 bits per row, and must contain a valid IMAGE_DEF. Do not set this bit without first programming an image into OTP and configuring OTPBOOT_LEN, OTPBOOT_SRC, OTPBOOT_DST0 and OTPBOOT_DST1. + + Note that OTPBOOT_LEN and OTPBOOT_SRC must be even numbers of OTP rows. Equivalently, the image must be a multiple of 32 bits in size, and must start at a 32-bit-aligned address in the ECC read data address window. + [14:14] + read-only + + + DISABLE_OTP_BOOT + Takes precedence over ENABLE_OTP_BOOT. + [13:13] + read-only + + + DISABLE_FLASH_BOOT + [12:12] + read-only + + + ROLLBACK_REQUIRED + Require binaries to have a rollback version. Set automatically the first time a binary with a rollback version is booted. + [11:11] + read-only + + + HASHED_PARTITION_TABLE + Require a partition table to be hashed (if not signed) + [10:10] + read-only + + + SECURE_PARTITION_TABLE + Require a partition table to be signed + [9:9] + read-only + + + DISABLE_AUTO_SWITCH_ARCH + Disable auto-switch of CPU architecture on boot when the (only) binary to be booted is for the other Arm/RISC-V architecture and both architectures are enabled + [8:8] + read-only + + + SINGLE_FLASH_BINARY + Restrict flash boot path to use of a single binary at the start of flash + [7:7] + read-only + + + OVERRIDE_FLASH_PARTITION_SLOT_SIZE + Override the limit for default flash metadata scanning. + + The value is specified in FLASH_PARTITION_SLOT_SIZE. Make sure FLASH_PARTITION_SLOT_SIZE is valid before setting this bit + [6:6] + read-only + + + FLASH_DEVINFO_ENABLE + Mark FLASH_DEVINFO as containing valid, ECC'd data which describes external flash devices. + [5:5] + read-only + + + FAST_SIGCHECK_ROSC_DIV + Enable quartering of ROSC divisor during signature check, to reduce secure boot time + [4:4] + read-only + + + FLASH_IO_VOLTAGE_1V8 + If 1, configure the QSPI pads for 1.8 V operation when accessing flash for the first time from the bootrom, using the VOLTAGE_SELECT register for the QSPI pads bank. This slightly improves the input timing of the pads at low voltages, but does not affect their output characteristics. + + If 0, leave VOLTAGE_SELECT in its reset state (suitable for operation at and above 2.5 V) + [3:3] + read-only + + + ENABLE_BOOTSEL_NON_DEFAULT_PLL_XOSC_CFG + Enable loading of the non-default XOSC and PLL configuration before entering BOOTSEL mode. + + Ensure that BOOTSEL_XOSC_CFG and BOOTSEL_PLL_CFG are correctly programmed before setting this bit. + + If this bit is set, user software may use the contents of BOOTSEL_PLL_CFG to calculated the expected XOSC frequency based on the fixed USB boot frequency of 48 MHz. + [2:2] + read-only + + + ENABLE_BOOTSEL_LED + Enable bootloader activity LED. If set, bootsel_led_cfg is assumed to be valid + [1:1] + read-only + + + DISABLE_BOOTSEL_EXEC2 + [0:0] + read-only + + + + + BOOT_FLAGS0_R1 + 0x00000124 + Redundant copy of BOOT_FLAGS0 + 0x00000000 + + + BOOT_FLAGS0_R1 + [23:0] + read-only + + + + + BOOT_FLAGS0_R2 + 0x00000128 + Redundant copy of BOOT_FLAGS0 + 0x00000000 + + + BOOT_FLAGS0_R2 + [23:0] + read-only + + + + + BOOT_FLAGS1 + 0x0000012c + Disable/Enable boot paths/features in the RP2350 mask ROM. Disables always supersede enables. Enables are provided where there are other configurations in OTP that must be valid. (RBIT-3) + 0x00000000 + + + DOUBLE_TAP + Enable entering BOOTSEL mode via double-tap of the RUN/RSTn pin. Adds a significant delay to boot time, as configured by DOUBLE_TAP_DELAY. + + This functions by waiting at startup (i.e. following a reset) to see if a second reset is applied soon afterward. The second reset is detected by the bootrom with help of the POWMAN_CHIP_RESET_DOUBLE_TAP flag, which is not reset by the external reset pin, and the bootrom enters BOOTSEL mode (NSBOOT) to await further instruction over USB or UART. + [19:19] + read-only + + + DOUBLE_TAP_DELAY + Adjust how long to wait for a second reset when double tap BOOTSEL mode is enabled via DOUBLE_TAP. The minimum is 50 milliseconds, and each unit of this field adds an additional 50 milliseconds. + + For example, settings this field to its maximum value of 7 will cause the chip to wait for 400 milliseconds at boot to check for a second reset which requests entry to BOOTSEL mode. + + 200 milliseconds (DOUBLE_TAP_DELAY=3) is a good intermediate value. + [18:16] + read-only + + + KEY_INVALID + Mark a boot key as invalid, or prevent it from ever becoming valid. The bootrom will ignore any boot key marked as invalid during secure boot signature checks. + + Each bit in this field corresponds to one of the four 256-bit boot key hashes that may be stored in page 2 of the OTP. + + When provisioning boot keys, it's recommended to mark any boot key slots you don't intend to use as KEY_INVALID, so that spurious keys can not be installed at a later time. + [11:8] + read-only + + + KEY_VALID + Mark each of the possible boot keys as valid. The bootrom will check signatures against all valid boot keys, and ignore invalid boot keys. + + Each bit in this field corresponds to one of the four 256-bit boot key hashes that may be stored in page 2 of the OTP. + + A KEY_VALID bit is ignored if the corresponding KEY_INVALID bit is set. Boot keys are considered valid only when KEY_VALID is set and KEY_INVALID is clear. + + Do not mark a boot key as KEY_VALID if it does not contain a valid SHA-256 hash of your secp256k1 public key. Verify keys after programming, before setting the KEY_VALID bits -- a boot key with uncorrectable ECC faults will render your device unbootable if secure boot is enabled. + + Do not enable secure boot without first installing a valid key. This will render your device unbootable. + [3:0] + read-only + + + + + BOOT_FLAGS1_R1 + 0x00000130 + Redundant copy of BOOT_FLAGS1 + 0x00000000 + + + BOOT_FLAGS1_R1 + [23:0] + read-only + + + + + BOOT_FLAGS1_R2 + 0x00000134 + Redundant copy of BOOT_FLAGS1 + 0x00000000 + + + BOOT_FLAGS1_R2 + [23:0] + read-only + + + + + DEFAULT_BOOT_VERSION0 + 0x00000138 + Default boot version thermometer counter, bits 23:0 (RBIT-3) + 0x00000000 + + + DEFAULT_BOOT_VERSION0 + [23:0] + read-only + + + + + DEFAULT_BOOT_VERSION0_R1 + 0x0000013c + Redundant copy of DEFAULT_BOOT_VERSION0 + 0x00000000 + + + DEFAULT_BOOT_VERSION0_R1 + [23:0] + read-only + + + + + DEFAULT_BOOT_VERSION0_R2 + 0x00000140 + Redundant copy of DEFAULT_BOOT_VERSION0 + 0x00000000 + + + DEFAULT_BOOT_VERSION0_R2 + [23:0] + read-only + + + + + DEFAULT_BOOT_VERSION1 + 0x00000144 + Default boot version thermometer counter, bits 47:24 (RBIT-3) + 0x00000000 + + + DEFAULT_BOOT_VERSION1 + [23:0] + read-only + + + + + DEFAULT_BOOT_VERSION1_R1 + 0x00000148 + Redundant copy of DEFAULT_BOOT_VERSION1 + 0x00000000 + + + DEFAULT_BOOT_VERSION1_R1 + [23:0] + read-only + + + + + DEFAULT_BOOT_VERSION1_R2 + 0x0000014c + Redundant copy of DEFAULT_BOOT_VERSION1 + 0x00000000 + + + DEFAULT_BOOT_VERSION1_R2 + [23:0] + read-only + + + + + FLASH_DEVINFO + 0x00000150 + Stores information about external flash device(s). (ECC) + + Assumed to be valid if BOOT_FLAGS0_FLASH_DEVINFO_ENABLE is set. + 0x00000000 + + + CS1_SIZE + The size of the flash/PSRAM device on chip select 1 (addressable at 0x11000000 through 0x11ffffff). + + A value of zero is decoded as a size of zero (no device). Nonzero values are decoded as 4kiB << CS1_SIZE. For example, four megabytes is encoded with a CS1_SIZE value of 10, and 16 megabytes is encoded with a CS1_SIZE value of 12. + + When BOOT_FLAGS0_FLASH_DEVINFO_ENABLE is not set, a default of zero is used. + [15:12] + read-only + + + NONE + 0 + + + 8K + 1 + + + 16K + 2 + + + 32K + 3 + + + 64k + 4 + + + 128K + 5 + + + 256K + 6 + + + 512K + 7 + + + 1M + 8 + + + 2M + 9 + + + 4M + 10 + + + 8M + 11 + + + 16M + 12 + + + + + CS0_SIZE + The size of the flash/PSRAM device on chip select 0 (addressable at 0x10000000 through 0x10ffffff). + + A value of zero is decoded as a size of zero (no device). Nonzero values are decoded as 4kiB << CS0_SIZE. For example, four megabytes is encoded with a CS0_SIZE value of 10, and 16 megabytes is encoded with a CS0_SIZE value of 12. + + When BOOT_FLAGS0_FLASH_DEVINFO_ENABLE is not set, a default of 12 (16 MiB) is used. + [11:8] + read-only + + + NONE + 0 + + + 8K + 1 + + + 16K + 2 + + + 32K + 3 + + + 64k + 4 + + + 128K + 5 + + + 256K + 6 + + + 512K + 7 + + + 1M + 8 + + + 2M + 9 + + + 4M + 10 + + + 8M + 11 + + + 16M + 12 + + + + + D8H_ERASE_SUPPORTED + If true, all attached devices are assumed to support (or ignore, in the case of PSRAM) a block erase command with a command prefix of D8h, an erase size of 64 kiB, and a 24-bit address. Almost all 25-series flash devices support this command. + + If set, the bootrom will use the D8h erase command where it is able, to accelerate bulk erase operations. This makes flash programming faster. + + When BOOT_FLAGS0_FLASH_DEVINFO_ENABLE is not set, this field defaults to false. + [7:7] + read-only + + + CS1_GPIO + Indicate a GPIO number to be used for the secondary flash chip select (CS1), which selects the external QSPI device mapped at system addresses 0x11000000 through 0x11ffffff. There is no such configuration for CS0, as the primary chip select has a dedicated pin. + + On RP2350 the permissible GPIO numbers are 0, 8, 19 and 47. + + Ignored if CS1_size is zero. If CS1_SIZE is nonzero, the bootrom will automatically configure this GPIO as a second chip select upon entering the flash boot path, or entering any other path that may use the QSPI flash interface, such as BOOTSEL mode (nsboot). + [5:0] + read-only + + + + + FLASH_PARTITION_SLOT_SIZE + 0x00000154 + Gap between partition table slot 0 and slot 1 at the start of flash (the default size is 4096 bytes) (ECC) Enabled by the OVERRIDE_FLASH_PARTITION_SLOT_SIZE bit in BOOT_FLAGS, the size is 4096 * (value + 1) + 0x00000000 + + + FLASH_PARTITION_SLOT_SIZE + [15:0] + read-only + + + + + BOOTSEL_LED_CFG + 0x00000158 + Pin configuration for LED status, used by USB bootloader. (ECC) + Must be valid if BOOT_FLAGS0_ENABLE_BOOTSEL_LED is set. + 0x00000000 + + + ACTIVELOW + LED is active-low. (Default: active-high.) + [8:8] + read-only + + + PIN + GPIO index to use for bootloader activity LED. + [5:0] + read-only + + + + + BOOTSEL_PLL_CFG + 0x0000015c + Optional PLL configuration for BOOTSEL mode. (ECC) + + This should be configured to produce an exact 48 MHz based on the crystal oscillator frequency. User mode software may also use this value to calculate the expected crystal frequency based on an assumed 48 MHz PLL output. + + If no configuration is given, the crystal is assumed to be 12 MHz. + + The PLL frequency can be calculated as: + + PLL out = (XOSC frequency / (REFDIV+1)) x FBDIV / (POSTDIV1 x POSTDIV2) + + Conversely the crystal frequency can be calculated as: + + XOSC frequency = 48 MHz x (REFDIV+1) x (POSTDIV1 x POSTDIV2) / FBDIV + + (Note the +1 on REFDIV is because the value stored in this OTP location is the actual divisor value minus one.) + + Used if and only if ENABLE_BOOTSEL_NON_DEFAULT_PLL_XOSC_CFG is set in BOOT_FLAGS0. That bit should be set only after this row and BOOTSEL_XOSC_CFG are both correctly programmed. + 0x00000000 + + + REFDIV + PLL reference divisor, minus one. + + Programming a value of 0 means a reference divisor of 1. Programming a value of 1 means a reference divisor of 2 (for exceptionally fast XIN inputs) + [15:15] + read-only + + + POSTDIV2 + PLL post-divide 2 divisor, in the range 1..7 inclusive. + [14:12] + read-only + + + POSTDIV1 + PLL post-divide 1 divisor, in the range 1..7 inclusive. + [11:9] + read-only + + + FBDIV + PLL feedback divisor, in the range 16..320 inclusive. + [8:0] + read-only + + + + + BOOTSEL_XOSC_CFG + 0x00000160 + Non-default crystal oscillator configuration for the USB bootloader. (ECC) + + These values may also be used by user code configuring the crystal oscillator. + + Used if and only if ENABLE_BOOTSEL_NON_DEFAULT_PLL_XOSC_CFG is set in BOOT_FLAGS0. That bit should be set only after this row and BOOTSEL_PLL_CFG are both correctly programmed. + 0x00000000 + + + RANGE + Value of the XOSC_CTRL_FREQ_RANGE register. + [15:14] + read-only + + + 1_15MHZ + 0 + + + 10_30MHZ + 1 + + + 25_60MHZ + 2 + + + 40_100MHZ + 3 + + + + + STARTUP + Value of the XOSC_STARTUP register + [13:0] + read-only + + + + + USB_BOOT_FLAGS + 0x00000164 + USB boot specific feature flags (RBIT-3) + 0x00000000 + + + DP_DM_SWAP + Swap DM/DP during USB boot, to support board layouts with mirrored USB routing (deliberate or accidental). + [23:23] + read-only + + + WHITE_LABEL_ADDR_VALID + valid flag for INFO_UF2_TXT_BOARD_ID_STRDEF entry of the USB_WHITE_LABEL struct (index 15) + [22:22] + read-only + + + WL_INFO_UF2_TXT_BOARD_ID_STRDEF_VALID + valid flag for the USB_WHITE_LABEL_ADDR field + [15:15] + read-only + + + WL_INFO_UF2_TXT_MODEL_STRDEF_VALID + valid flag for INFO_UF2_TXT_MODEL_STRDEF entry of the USB_WHITE_LABEL struct (index 14) + [14:14] + read-only + + + WL_INDEX_HTM_REDIRECT_NAME_STRDEF_VALID + valid flag for INDEX_HTM_REDIRECT_NAME_STRDEF entry of the USB_WHITE_LABEL struct (index 13) + [13:13] + read-only + + + WL_INDEX_HTM_REDIRECT_URL_STRDEF_VALID + valid flag for INDEX_HTM_REDIRECT_URL_STRDEF entry of the USB_WHITE_LABEL struct (index 12) + [12:12] + read-only + + + WL_SCSI_INQUIRY_VERSION_STRDEF_VALID + valid flag for SCSI_INQUIRY_VERSION_STRDEF entry of the USB_WHITE_LABEL struct (index 11) + [11:11] + read-only + + + WL_SCSI_INQUIRY_PRODUCT_STRDEF_VALID + valid flag for SCSI_INQUIRY_PRODUCT_STRDEF entry of the USB_WHITE_LABEL struct (index 10) + [10:10] + read-only + + + WL_SCSI_INQUIRY_VENDOR_STRDEF_VALID + valid flag for SCSI_INQUIRY_VENDOR_STRDEF entry of the USB_WHITE_LABEL struct (index 9) + [9:9] + read-only + + + WL_VOLUME_LABEL_STRDEF_VALID + valid flag for VOLUME_LABEL_STRDEF entry of the USB_WHITE_LABEL struct (index 8) + [8:8] + read-only + + + WL_USB_CONFIG_ATTRIBUTES_MAX_POWER_VALUES_VALID + valid flag for USB_CONFIG_ATTRIBUTES_MAX_POWER_VALUES entry of the USB_WHITE_LABEL struct (index 7) + [7:7] + read-only + + + WL_USB_DEVICE_SERIAL_NUMBER_STRDEF_VALID + valid flag for USB_DEVICE_SERIAL_NUMBER_STRDEF entry of the USB_WHITE_LABEL struct (index 6) + [6:6] + read-only + + + WL_USB_DEVICE_PRODUCT_STRDEF_VALID + valid flag for USB_DEVICE_PRODUCT_STRDEF entry of the USB_WHITE_LABEL struct (index 5) + [5:5] + read-only + + + WL_USB_DEVICE_MANUFACTURER_STRDEF_VALID + valid flag for USB_DEVICE_MANUFACTURER_STRDEF entry of the USB_WHITE_LABEL struct (index 4) + [4:4] + read-only + + + WL_USB_DEVICE_LANG_ID_VALUE_VALID + valid flag for USB_DEVICE_LANG_ID_VALUE entry of the USB_WHITE_LABEL struct (index 3) + [3:3] + read-only + + + WL_USB_DEVICE_SERIAL_NUMBER_VALUE_VALID + valid flag for USB_DEVICE_BCD_DEVICEVALUE entry of the USB_WHITE_LABEL struct (index 2) + [2:2] + read-only + + + WL_USB_DEVICE_PID_VALUE_VALID + valid flag for USB_DEVICE_PID_VALUE entry of the USB_WHITE_LABEL struct (index 1) + [1:1] + read-only + + + WL_USB_DEVICE_VID_VALUE_VALID + valid flag for USB_DEVICE_VID_VALUE entry of the USB_WHITE_LABEL struct (index 0) + [0:0] + read-only + + + + + USB_BOOT_FLAGS_R1 + 0x00000168 + Redundant copy of USB_BOOT_FLAGS + 0x00000000 + + + USB_BOOT_FLAGS_R1 + [23:0] + read-only + + + + + USB_BOOT_FLAGS_R2 + 0x0000016c + Redundant copy of USB_BOOT_FLAGS + 0x00000000 + + + USB_BOOT_FLAGS_R2 + [23:0] + read-only + + + + + USB_WHITE_LABEL_ADDR + 0x00000170 + Row index of the USB_WHITE_LABEL structure within OTP (ECC) + + The table has 16 rows, each of which are also ECC and marked valid by the corresponding valid bit in USB_BOOT_FLAGS (ECC). + + The entries are either _VALUEs where the 16 bit value is used as is, or _STRDEFs which acts as a pointers to a string value. + + The value stored in a _STRDEF is two separate bytes: The low seven bits of the first (LSB) byte indicates the number of characters in the string, and the top bit of the first (LSB) byte if set to indicate that each character in the string is two bytes (Unicode) versus one byte if unset. The second (MSB) byte represents the location of the string data, and is encoded as the number of rows from this USB_WHITE_LABEL_ADDR; i.e. the row of the start of the string is USB_WHITE_LABEL_ADDR value + msb_byte. + + In each case, the corresponding valid bit enables replacing the default value for the corresponding item provided by the boot rom. + + Note that Unicode _STRDEFs are only supported for USB_DEVICE_PRODUCT_STRDEF, USB_DEVICE_SERIAL_NUMBER_STRDEF and USB_DEVICE_MANUFACTURER_STRDEF. Unicode values will be ignored if specified for other fields, and non-unicode values for these three items will be converted to Unicode characters by setting the upper 8 bits to zero. + + Note that if the USB_WHITE_LABEL structure or the corresponding strings are not readable by BOOTSEL mode based on OTP permissions, or if alignment requirements are not met, then the corresponding default values are used. + + The index values indicate where each field is located (row USB_WHITE_LABEL_ADDR value + index): + 0x00000000 + + + USB_WHITE_LABEL_ADDR + [15:0] + read-only + + + INDEX_USB_DEVICE_VID_VALUE + 0 + + + INDEX_USB_DEVICE_PID_VALUE + 1 + + + INDEX_USB_DEVICE_BCD_DEVICE_VALUE + 2 + + + INDEX_USB_DEVICE_LANG_ID_VALUE + 3 + + + INDEX_USB_DEVICE_MANUFACTURER_STRDEF + 4 + + + INDEX_USB_DEVICE_PRODUCT_STRDEF + 5 + + + INDEX_USB_DEVICE_SERIAL_NUMBER_STRDEF + 6 + + + INDEX_USB_CONFIG_ATTRIBUTES_MAX_POWER_VALUES + 7 + + + INDEX_VOLUME_LABEL_STRDEF + 8 + + + INDEX_SCSI_INQUIRY_VENDOR_STRDEF + 9 + + + INDEX_SCSI_INQUIRY_PRODUCT_STRDEF + 10 + + + INDEX_SCSI_INQUIRY_VERSION_STRDEF + 11 + + + INDEX_INDEX_HTM_REDIRECT_URL_STRDEF + 12 + + + INDEX_INDEX_HTM_REDIRECT_NAME_STRDEF + 13 + + + INDEX_INFO_UF2_TXT_MODEL_STRDEF + 14 + + + INDEX_INFO_UF2_TXT_BOARD_ID_STRDEF + 15 + + + + + + + OTPBOOT_SRC + 0x00000178 + OTP start row for the OTP boot image. (ECC) + + If OTP boot is enabled, the bootrom will load from this location into SRAM and then directly enter the loaded image. Note that the image must be signed if SECURE_BOOT_ENABLE is set. The image itself is assumed to be ECC-protected. + + This must be an even number. Equivalently, the OTP boot image must start at a word-aligned location in the ECC read data address window. + 0x00000000 + + + OTPBOOT_SRC + [15:0] + read-only + + + + + OTPBOOT_LEN + 0x0000017c + Length in rows of the OTP boot image. (ECC) + + OTPBOOT_LEN must be even. The total image size must be a multiple of 4 bytes (32 bits). + 0x00000000 + + + OTPBOOT_LEN + [15:0] + read-only + + + + + OTPBOOT_DST0 + 0x00000180 + Bits 15:0 of the OTP boot image load destination (and entry point). (ECC) + + This must be a location in main SRAM (main SRAM is addresses 0x20000000 through 0x20082000) and must be word-aligned. + 0x00000000 + + + OTPBOOT_DST0 + [15:0] + read-only + + + + + OTPBOOT_DST1 + 0x00000184 + Bits 31:16 of the OTP boot image load destination (and entry point). (ECC) + + This must be a location in main SRAM (main SRAM is addresses 0x20000000 through 0x20082000) and must be word-aligned. + 0x00000000 + + + OTPBOOT_DST1 + [15:0] + read-only + + + + + BOOTKEY0_0 + 0x00000200 + Bits 15:0 of SHA-256 hash of boot key 0 (ECC) + 0x00000000 + + + BOOTKEY0_0 + [15:0] + read-only + + + + + BOOTKEY0_1 + 0x00000204 + Bits 31:16 of SHA-256 hash of boot key 0 (ECC) + 0x00000000 + + + BOOTKEY0_1 + [15:0] + read-only + + + + + BOOTKEY0_2 + 0x00000208 + Bits 47:32 of SHA-256 hash of boot key 0 (ECC) + 0x00000000 + + + BOOTKEY0_2 + [15:0] + read-only + + + + + BOOTKEY0_3 + 0x0000020c + Bits 63:48 of SHA-256 hash of boot key 0 (ECC) + 0x00000000 + + + BOOTKEY0_3 + [15:0] + read-only + + + + + BOOTKEY0_4 + 0x00000210 + Bits 79:64 of SHA-256 hash of boot key 0 (ECC) + 0x00000000 + + + BOOTKEY0_4 + [15:0] + read-only + + + + + BOOTKEY0_5 + 0x00000214 + Bits 95:80 of SHA-256 hash of boot key 0 (ECC) + 0x00000000 + + + BOOTKEY0_5 + [15:0] + read-only + + + + + BOOTKEY0_6 + 0x00000218 + Bits 111:96 of SHA-256 hash of boot key 0 (ECC) + 0x00000000 + + + BOOTKEY0_6 + [15:0] + read-only + + + + + BOOTKEY0_7 + 0x0000021c + Bits 127:112 of SHA-256 hash of boot key 0 (ECC) + 0x00000000 + + + BOOTKEY0_7 + [15:0] + read-only + + + + + BOOTKEY0_8 + 0x00000220 + Bits 143:128 of SHA-256 hash of boot key 0 (ECC) + 0x00000000 + + + BOOTKEY0_8 + [15:0] + read-only + + + + + BOOTKEY0_9 + 0x00000224 + Bits 159:144 of SHA-256 hash of boot key 0 (ECC) + 0x00000000 + + + BOOTKEY0_9 + [15:0] + read-only + + + + + BOOTKEY0_10 + 0x00000228 + Bits 175:160 of SHA-256 hash of boot key 0 (ECC) + 0x00000000 + + + BOOTKEY0_10 + [15:0] + read-only + + + + + BOOTKEY0_11 + 0x0000022c + Bits 191:176 of SHA-256 hash of boot key 0 (ECC) + 0x00000000 + + + BOOTKEY0_11 + [15:0] + read-only + + + + + BOOTKEY0_12 + 0x00000230 + Bits 207:192 of SHA-256 hash of boot key 0 (ECC) + 0x00000000 + + + BOOTKEY0_12 + [15:0] + read-only + + + + + BOOTKEY0_13 + 0x00000234 + Bits 223:208 of SHA-256 hash of boot key 0 (ECC) + 0x00000000 + + + BOOTKEY0_13 + [15:0] + read-only + + + + + BOOTKEY0_14 + 0x00000238 + Bits 239:224 of SHA-256 hash of boot key 0 (ECC) + 0x00000000 + + + BOOTKEY0_14 + [15:0] + read-only + + + + + BOOTKEY0_15 + 0x0000023c + Bits 255:240 of SHA-256 hash of boot key 0 (ECC) + 0x00000000 + + + BOOTKEY0_15 + [15:0] + read-only + + + + + BOOTKEY1_0 + 0x00000240 + Bits 15:0 of SHA-256 hash of boot key 1 (ECC) + 0x00000000 + + + BOOTKEY1_0 + [15:0] + read-only + + + + + BOOTKEY1_1 + 0x00000244 + Bits 31:16 of SHA-256 hash of boot key 1 (ECC) + 0x00000000 + + + BOOTKEY1_1 + [15:0] + read-only + + + + + BOOTKEY1_2 + 0x00000248 + Bits 47:32 of SHA-256 hash of boot key 1 (ECC) + 0x00000000 + + + BOOTKEY1_2 + [15:0] + read-only + + + + + BOOTKEY1_3 + 0x0000024c + Bits 63:48 of SHA-256 hash of boot key 1 (ECC) + 0x00000000 + + + BOOTKEY1_3 + [15:0] + read-only + + + + + BOOTKEY1_4 + 0x00000250 + Bits 79:64 of SHA-256 hash of boot key 1 (ECC) + 0x00000000 + + + BOOTKEY1_4 + [15:0] + read-only + + + + + BOOTKEY1_5 + 0x00000254 + Bits 95:80 of SHA-256 hash of boot key 1 (ECC) + 0x00000000 + + + BOOTKEY1_5 + [15:0] + read-only + + + + + BOOTKEY1_6 + 0x00000258 + Bits 111:96 of SHA-256 hash of boot key 1 (ECC) + 0x00000000 + + + BOOTKEY1_6 + [15:0] + read-only + + + + + BOOTKEY1_7 + 0x0000025c + Bits 127:112 of SHA-256 hash of boot key 1 (ECC) + 0x00000000 + + + BOOTKEY1_7 + [15:0] + read-only + + + + + BOOTKEY1_8 + 0x00000260 + Bits 143:128 of SHA-256 hash of boot key 1 (ECC) + 0x00000000 + + + BOOTKEY1_8 + [15:0] + read-only + + + + + BOOTKEY1_9 + 0x00000264 + Bits 159:144 of SHA-256 hash of boot key 1 (ECC) + 0x00000000 + + + BOOTKEY1_9 + [15:0] + read-only + + + + + BOOTKEY1_10 + 0x00000268 + Bits 175:160 of SHA-256 hash of boot key 1 (ECC) + 0x00000000 + + + BOOTKEY1_10 + [15:0] + read-only + + + + + BOOTKEY1_11 + 0x0000026c + Bits 191:176 of SHA-256 hash of boot key 1 (ECC) + 0x00000000 + + + BOOTKEY1_11 + [15:0] + read-only + + + + + BOOTKEY1_12 + 0x00000270 + Bits 207:192 of SHA-256 hash of boot key 1 (ECC) + 0x00000000 + + + BOOTKEY1_12 + [15:0] + read-only + + + + + BOOTKEY1_13 + 0x00000274 + Bits 223:208 of SHA-256 hash of boot key 1 (ECC) + 0x00000000 + + + BOOTKEY1_13 + [15:0] + read-only + + + + + BOOTKEY1_14 + 0x00000278 + Bits 239:224 of SHA-256 hash of boot key 1 (ECC) + 0x00000000 + + + BOOTKEY1_14 + [15:0] + read-only + + + + + BOOTKEY1_15 + 0x0000027c + Bits 255:240 of SHA-256 hash of boot key 1 (ECC) + 0x00000000 + + + BOOTKEY1_15 + [15:0] + read-only + + + + + BOOTKEY2_0 + 0x00000280 + Bits 15:0 of SHA-256 hash of boot key 2 (ECC) + 0x00000000 + + + BOOTKEY2_0 + [15:0] + read-only + + + + + BOOTKEY2_1 + 0x00000284 + Bits 31:16 of SHA-256 hash of boot key 2 (ECC) + 0x00000000 + + + BOOTKEY2_1 + [15:0] + read-only + + + + + BOOTKEY2_2 + 0x00000288 + Bits 47:32 of SHA-256 hash of boot key 2 (ECC) + 0x00000000 + + + BOOTKEY2_2 + [15:0] + read-only + + + + + BOOTKEY2_3 + 0x0000028c + Bits 63:48 of SHA-256 hash of boot key 2 (ECC) + 0x00000000 + + + BOOTKEY2_3 + [15:0] + read-only + + + + + BOOTKEY2_4 + 0x00000290 + Bits 79:64 of SHA-256 hash of boot key 2 (ECC) + 0x00000000 + + + BOOTKEY2_4 + [15:0] + read-only + + + + + BOOTKEY2_5 + 0x00000294 + Bits 95:80 of SHA-256 hash of boot key 2 (ECC) + 0x00000000 + + + BOOTKEY2_5 + [15:0] + read-only + + + + + BOOTKEY2_6 + 0x00000298 + Bits 111:96 of SHA-256 hash of boot key 2 (ECC) + 0x00000000 + + + BOOTKEY2_6 + [15:0] + read-only + + + + + BOOTKEY2_7 + 0x0000029c + Bits 127:112 of SHA-256 hash of boot key 2 (ECC) + 0x00000000 + + + BOOTKEY2_7 + [15:0] + read-only + + + + + BOOTKEY2_8 + 0x000002a0 + Bits 143:128 of SHA-256 hash of boot key 2 (ECC) + 0x00000000 + + + BOOTKEY2_8 + [15:0] + read-only + + + + + BOOTKEY2_9 + 0x000002a4 + Bits 159:144 of SHA-256 hash of boot key 2 (ECC) + 0x00000000 + + + BOOTKEY2_9 + [15:0] + read-only + + + + + BOOTKEY2_10 + 0x000002a8 + Bits 175:160 of SHA-256 hash of boot key 2 (ECC) + 0x00000000 + + + BOOTKEY2_10 + [15:0] + read-only + + + + + BOOTKEY2_11 + 0x000002ac + Bits 191:176 of SHA-256 hash of boot key 2 (ECC) + 0x00000000 + + + BOOTKEY2_11 + [15:0] + read-only + + + + + BOOTKEY2_12 + 0x000002b0 + Bits 207:192 of SHA-256 hash of boot key 2 (ECC) + 0x00000000 + + + BOOTKEY2_12 + [15:0] + read-only + + + + + BOOTKEY2_13 + 0x000002b4 + Bits 223:208 of SHA-256 hash of boot key 2 (ECC) + 0x00000000 + + + BOOTKEY2_13 + [15:0] + read-only + + + + + BOOTKEY2_14 + 0x000002b8 + Bits 239:224 of SHA-256 hash of boot key 2 (ECC) + 0x00000000 + + + BOOTKEY2_14 + [15:0] + read-only + + + + + BOOTKEY2_15 + 0x000002bc + Bits 255:240 of SHA-256 hash of boot key 2 (ECC) + 0x00000000 + + + BOOTKEY2_15 + [15:0] + read-only + + + + + BOOTKEY3_0 + 0x000002c0 + Bits 15:0 of SHA-256 hash of boot key 3 (ECC) + 0x00000000 + + + BOOTKEY3_0 + [15:0] + read-only + + + + + BOOTKEY3_1 + 0x000002c4 + Bits 31:16 of SHA-256 hash of boot key 3 (ECC) + 0x00000000 + + + BOOTKEY3_1 + [15:0] + read-only + + + + + BOOTKEY3_2 + 0x000002c8 + Bits 47:32 of SHA-256 hash of boot key 3 (ECC) + 0x00000000 + + + BOOTKEY3_2 + [15:0] + read-only + + + + + BOOTKEY3_3 + 0x000002cc + Bits 63:48 of SHA-256 hash of boot key 3 (ECC) + 0x00000000 + + + BOOTKEY3_3 + [15:0] + read-only + + + + + BOOTKEY3_4 + 0x000002d0 + Bits 79:64 of SHA-256 hash of boot key 3 (ECC) + 0x00000000 + + + BOOTKEY3_4 + [15:0] + read-only + + + + + BOOTKEY3_5 + 0x000002d4 + Bits 95:80 of SHA-256 hash of boot key 3 (ECC) + 0x00000000 + + + BOOTKEY3_5 + [15:0] + read-only + + + + + BOOTKEY3_6 + 0x000002d8 + Bits 111:96 of SHA-256 hash of boot key 3 (ECC) + 0x00000000 + + + BOOTKEY3_6 + [15:0] + read-only + + + + + BOOTKEY3_7 + 0x000002dc + Bits 127:112 of SHA-256 hash of boot key 3 (ECC) + 0x00000000 + + + BOOTKEY3_7 + [15:0] + read-only + + + + + BOOTKEY3_8 + 0x000002e0 + Bits 143:128 of SHA-256 hash of boot key 3 (ECC) + 0x00000000 + + + BOOTKEY3_8 + [15:0] + read-only + + + + + BOOTKEY3_9 + 0x000002e4 + Bits 159:144 of SHA-256 hash of boot key 3 (ECC) + 0x00000000 + + + BOOTKEY3_9 + [15:0] + read-only + + + + + BOOTKEY3_10 + 0x000002e8 + Bits 175:160 of SHA-256 hash of boot key 3 (ECC) + 0x00000000 + + + BOOTKEY3_10 + [15:0] + read-only + + + + + BOOTKEY3_11 + 0x000002ec + Bits 191:176 of SHA-256 hash of boot key 3 (ECC) + 0x00000000 + + + BOOTKEY3_11 + [15:0] + read-only + + + + + BOOTKEY3_12 + 0x000002f0 + Bits 207:192 of SHA-256 hash of boot key 3 (ECC) + 0x00000000 + + + BOOTKEY3_12 + [15:0] + read-only + + + + + BOOTKEY3_13 + 0x000002f4 + Bits 223:208 of SHA-256 hash of boot key 3 (ECC) + 0x00000000 + + + BOOTKEY3_13 + [15:0] + read-only + + + + + BOOTKEY3_14 + 0x000002f8 + Bits 239:224 of SHA-256 hash of boot key 3 (ECC) + 0x00000000 + + + BOOTKEY3_14 + [15:0] + read-only + + + + + BOOTKEY3_15 + 0x000002fc + Bits 255:240 of SHA-256 hash of boot key 3 (ECC) + 0x00000000 + + + BOOTKEY3_15 + [15:0] + read-only + + + + + KEY1_0 + 0x00003d20 + Bits 15:0 of OTP access key 1 (ECC) + 0x00000000 + + + KEY1_0 + [15:0] + read-only + + + + + KEY1_1 + 0x00003d24 + Bits 31:16 of OTP access key 1 (ECC) + 0x00000000 + + + KEY1_1 + [15:0] + read-only + + + + + KEY1_2 + 0x00003d28 + Bits 47:32 of OTP access key 1 (ECC) + 0x00000000 + + + KEY1_2 + [15:0] + read-only + + + + + KEY1_3 + 0x00003d2c + Bits 63:48 of OTP access key 1 (ECC) + 0x00000000 + + + KEY1_3 + [15:0] + read-only + + + + + KEY1_4 + 0x00003d30 + Bits 79:64 of OTP access key 1 (ECC) + 0x00000000 + + + KEY1_4 + [15:0] + read-only + + + + + KEY1_5 + 0x00003d34 + Bits 95:80 of OTP access key 1 (ECC) + 0x00000000 + + + KEY1_5 + [15:0] + read-only + + + + + KEY1_6 + 0x00003d38 + Bits 111:96 of OTP access key 1 (ECC) + 0x00000000 + + + KEY1_6 + [15:0] + read-only + + + + + KEY1_7 + 0x00003d3c + Bits 127:112 of OTP access key 1 (ECC) + 0x00000000 + + + KEY1_7 + [15:0] + read-only + + + + + KEY2_0 + 0x00003d40 + Bits 15:0 of OTP access key 2 (ECC) + 0x00000000 + + + KEY2_0 + [15:0] + read-only + + + + + KEY2_1 + 0x00003d44 + Bits 31:16 of OTP access key 2 (ECC) + 0x00000000 + + + KEY2_1 + [15:0] + read-only + + + + + KEY2_2 + 0x00003d48 + Bits 47:32 of OTP access key 2 (ECC) + 0x00000000 + + + KEY2_2 + [15:0] + read-only + + + + + KEY2_3 + 0x00003d4c + Bits 63:48 of OTP access key 2 (ECC) + 0x00000000 + + + KEY2_3 + [15:0] + read-only + + + + + KEY2_4 + 0x00003d50 + Bits 79:64 of OTP access key 2 (ECC) + 0x00000000 + + + KEY2_4 + [15:0] + read-only + + + + + KEY2_5 + 0x00003d54 + Bits 95:80 of OTP access key 2 (ECC) + 0x00000000 + + + KEY2_5 + [15:0] + read-only + + + + + KEY2_6 + 0x00003d58 + Bits 111:96 of OTP access key 2 (ECC) + 0x00000000 + + + KEY2_6 + [15:0] + read-only + + + + + KEY2_7 + 0x00003d5c + Bits 127:112 of OTP access key 2 (ECC) + 0x00000000 + + + KEY2_7 + [15:0] + read-only + + + + + KEY3_0 + 0x00003d60 + Bits 15:0 of OTP access key 3 (ECC) + 0x00000000 + + + KEY3_0 + [15:0] + read-only + + + + + KEY3_1 + 0x00003d64 + Bits 31:16 of OTP access key 3 (ECC) + 0x00000000 + + + KEY3_1 + [15:0] + read-only + + + + + KEY3_2 + 0x00003d68 + Bits 47:32 of OTP access key 3 (ECC) + 0x00000000 + + + KEY3_2 + [15:0] + read-only + + + + + KEY3_3 + 0x00003d6c + Bits 63:48 of OTP access key 3 (ECC) + 0x00000000 + + + KEY3_3 + [15:0] + read-only + + + + + KEY3_4 + 0x00003d70 + Bits 79:64 of OTP access key 3 (ECC) + 0x00000000 + + + KEY3_4 + [15:0] + read-only + + + + + KEY3_5 + 0x00003d74 + Bits 95:80 of OTP access key 3 (ECC) + 0x00000000 + + + KEY3_5 + [15:0] + read-only + + + + + KEY3_6 + 0x00003d78 + Bits 111:96 of OTP access key 3 (ECC) + 0x00000000 + + + KEY3_6 + [15:0] + read-only + + + + + KEY3_7 + 0x00003d7c + Bits 127:112 of OTP access key 3 (ECC) + 0x00000000 + + + KEY3_7 + [15:0] + read-only + + + + + KEY4_0 + 0x00003d80 + Bits 15:0 of OTP access key 4 (ECC) + 0x00000000 + + + KEY4_0 + [15:0] + read-only + + + + + KEY4_1 + 0x00003d84 + Bits 31:16 of OTP access key 4 (ECC) + 0x00000000 + + + KEY4_1 + [15:0] + read-only + + + + + KEY4_2 + 0x00003d88 + Bits 47:32 of OTP access key 4 (ECC) + 0x00000000 + + + KEY4_2 + [15:0] + read-only + + + + + KEY4_3 + 0x00003d8c + Bits 63:48 of OTP access key 4 (ECC) + 0x00000000 + + + KEY4_3 + [15:0] + read-only + + + + + KEY4_4 + 0x00003d90 + Bits 79:64 of OTP access key 4 (ECC) + 0x00000000 + + + KEY4_4 + [15:0] + read-only + + + + + KEY4_5 + 0x00003d94 + Bits 95:80 of OTP access key 4 (ECC) + 0x00000000 + + + KEY4_5 + [15:0] + read-only + + + + + KEY4_6 + 0x00003d98 + Bits 111:96 of OTP access key 4 (ECC) + 0x00000000 + + + KEY4_6 + [15:0] + read-only + + + + + KEY4_7 + 0x00003d9c + Bits 127:112 of OTP access key 4 (ECC) + 0x00000000 + + + KEY4_7 + [15:0] + read-only + + + + + KEY5_0 + 0x00003da0 + Bits 15:0 of OTP access key 5 (ECC) + 0x00000000 + + + KEY5_0 + [15:0] + read-only + + + + + KEY5_1 + 0x00003da4 + Bits 31:16 of OTP access key 5 (ECC) + 0x00000000 + + + KEY5_1 + [15:0] + read-only + + + + + KEY5_2 + 0x00003da8 + Bits 47:32 of OTP access key 5 (ECC) + 0x00000000 + + + KEY5_2 + [15:0] + read-only + + + + + KEY5_3 + 0x00003dac + Bits 63:48 of OTP access key 5 (ECC) + 0x00000000 + + + KEY5_3 + [15:0] + read-only + + + + + KEY5_4 + 0x00003db0 + Bits 79:64 of OTP access key 5 (ECC) + 0x00000000 + + + KEY5_4 + [15:0] + read-only + + + + + KEY5_5 + 0x00003db4 + Bits 95:80 of OTP access key 5 (ECC) + 0x00000000 + + + KEY5_5 + [15:0] + read-only + + + + + KEY5_6 + 0x00003db8 + Bits 111:96 of OTP access key 5 (ECC) + 0x00000000 + + + KEY5_6 + [15:0] + read-only + + + + + KEY5_7 + 0x00003dbc + Bits 127:112 of OTP access key 5 (ECC) + 0x00000000 + + + KEY5_7 + [15:0] + read-only + + + + + KEY6_0 + 0x00003dc0 + Bits 15:0 of OTP access key 6 (ECC) + 0x00000000 + + + KEY6_0 + [15:0] + read-only + + + + + KEY6_1 + 0x00003dc4 + Bits 31:16 of OTP access key 6 (ECC) + 0x00000000 + + + KEY6_1 + [15:0] + read-only + + + + + KEY6_2 + 0x00003dc8 + Bits 47:32 of OTP access key 6 (ECC) + 0x00000000 + + + KEY6_2 + [15:0] + read-only + + + + + KEY6_3 + 0x00003dcc + Bits 63:48 of OTP access key 6 (ECC) + 0x00000000 + + + KEY6_3 + [15:0] + read-only + + + + + KEY6_4 + 0x00003dd0 + Bits 79:64 of OTP access key 6 (ECC) + 0x00000000 + + + KEY6_4 + [15:0] + read-only + + + + + KEY6_5 + 0x00003dd4 + Bits 95:80 of OTP access key 6 (ECC) + 0x00000000 + + + KEY6_5 + [15:0] + read-only + + + + + KEY6_6 + 0x00003dd8 + Bits 111:96 of OTP access key 6 (ECC) + 0x00000000 + + + KEY6_6 + [15:0] + read-only + + + + + KEY6_7 + 0x00003ddc + Bits 127:112 of OTP access key 6 (ECC) + 0x00000000 + + + KEY6_7 + [15:0] + read-only + + + + + KEY1_VALID + 0x00003de4 + Valid flag for key 1. Once the valid flag is set, the key can no longer be read or written, and becomes a valid fixed key for protecting OTP pages. + 0x00000000 + + + VALID_R2 + Redundant copy of VALID, with 3-way majority vote + [16:16] + read-only + + + VALID_R1 + Redundant copy of VALID, with 3-way majority vote + [8:8] + read-only + + + VALID + [0:0] + read-only + + + + + KEY2_VALID + 0x00003de8 + Valid flag for key 2. Once the valid flag is set, the key can no longer be read or written, and becomes a valid fixed key for protecting OTP pages. + 0x00000000 + + + VALID_R2 + Redundant copy of VALID, with 3-way majority vote + [16:16] + read-only + + + VALID_R1 + Redundant copy of VALID, with 3-way majority vote + [8:8] + read-only + + + VALID + [0:0] + read-only + + + + + KEY3_VALID + 0x00003dec + Valid flag for key 3. Once the valid flag is set, the key can no longer be read or written, and becomes a valid fixed key for protecting OTP pages. + 0x00000000 + + + VALID_R2 + Redundant copy of VALID, with 3-way majority vote + [16:16] + read-only + + + VALID_R1 + Redundant copy of VALID, with 3-way majority vote + [8:8] + read-only + + + VALID + [0:0] + read-only + + + + + KEY4_VALID + 0x00003df0 + Valid flag for key 4. Once the valid flag is set, the key can no longer be read or written, and becomes a valid fixed key for protecting OTP pages. + 0x00000000 + + + VALID_R2 + Redundant copy of VALID, with 3-way majority vote + [16:16] + read-only + + + VALID_R1 + Redundant copy of VALID, with 3-way majority vote + [8:8] + read-only + + + VALID + [0:0] + read-only + + + + + KEY5_VALID + 0x00003df4 + Valid flag for key 5. Once the valid flag is set, the key can no longer be read or written, and becomes a valid fixed key for protecting OTP pages. + 0x00000000 + + + VALID_R2 + Redundant copy of VALID, with 3-way majority vote + [16:16] + read-only + + + VALID_R1 + Redundant copy of VALID, with 3-way majority vote + [8:8] + read-only + + + VALID + [0:0] + read-only + + + + + KEY6_VALID + 0x00003df8 + Valid flag for key 6. Once the valid flag is set, the key can no longer be read or written, and becomes a valid fixed key for protecting OTP pages. + 0x00000000 + + + VALID_R2 + Redundant copy of VALID, with 3-way majority vote + [16:16] + read-only + + + VALID_R1 + Redundant copy of VALID, with 3-way majority vote + [8:8] + read-only + + + VALID + [0:0] + read-only + + + + + PAGE0_LOCK0 + 0x00003e00 + Lock configuration LSBs for page 0 (rows 0x0 through 0x3f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE0_LOCK1 + 0x00003e04 + Lock configuration MSBs for page 0 (rows 0x0 through 0x3f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE1_LOCK0 + 0x00003e08 + Lock configuration LSBs for page 1 (rows 0x40 through 0x7f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE1_LOCK1 + 0x00003e0c + Lock configuration MSBs for page 1 (rows 0x40 through 0x7f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE2_LOCK0 + 0x00003e10 + Lock configuration LSBs for page 2 (rows 0x80 through 0xbf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE2_LOCK1 + 0x00003e14 + Lock configuration MSBs for page 2 (rows 0x80 through 0xbf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE3_LOCK0 + 0x00003e18 + Lock configuration LSBs for page 3 (rows 0xc0 through 0xff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE3_LOCK1 + 0x00003e1c + Lock configuration MSBs for page 3 (rows 0xc0 through 0xff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE4_LOCK0 + 0x00003e20 + Lock configuration LSBs for page 4 (rows 0x100 through 0x13f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE4_LOCK1 + 0x00003e24 + Lock configuration MSBs for page 4 (rows 0x100 through 0x13f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE5_LOCK0 + 0x00003e28 + Lock configuration LSBs for page 5 (rows 0x140 through 0x17f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE5_LOCK1 + 0x00003e2c + Lock configuration MSBs for page 5 (rows 0x140 through 0x17f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE6_LOCK0 + 0x00003e30 + Lock configuration LSBs for page 6 (rows 0x180 through 0x1bf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE6_LOCK1 + 0x00003e34 + Lock configuration MSBs for page 6 (rows 0x180 through 0x1bf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE7_LOCK0 + 0x00003e38 + Lock configuration LSBs for page 7 (rows 0x1c0 through 0x1ff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE7_LOCK1 + 0x00003e3c + Lock configuration MSBs for page 7 (rows 0x1c0 through 0x1ff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE8_LOCK0 + 0x00003e40 + Lock configuration LSBs for page 8 (rows 0x200 through 0x23f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE8_LOCK1 + 0x00003e44 + Lock configuration MSBs for page 8 (rows 0x200 through 0x23f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE9_LOCK0 + 0x00003e48 + Lock configuration LSBs for page 9 (rows 0x240 through 0x27f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE9_LOCK1 + 0x00003e4c + Lock configuration MSBs for page 9 (rows 0x240 through 0x27f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE10_LOCK0 + 0x00003e50 + Lock configuration LSBs for page 10 (rows 0x280 through 0x2bf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE10_LOCK1 + 0x00003e54 + Lock configuration MSBs for page 10 (rows 0x280 through 0x2bf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE11_LOCK0 + 0x00003e58 + Lock configuration LSBs for page 11 (rows 0x2c0 through 0x2ff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE11_LOCK1 + 0x00003e5c + Lock configuration MSBs for page 11 (rows 0x2c0 through 0x2ff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE12_LOCK0 + 0x00003e60 + Lock configuration LSBs for page 12 (rows 0x300 through 0x33f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE12_LOCK1 + 0x00003e64 + Lock configuration MSBs for page 12 (rows 0x300 through 0x33f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE13_LOCK0 + 0x00003e68 + Lock configuration LSBs for page 13 (rows 0x340 through 0x37f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE13_LOCK1 + 0x00003e6c + Lock configuration MSBs for page 13 (rows 0x340 through 0x37f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE14_LOCK0 + 0x00003e70 + Lock configuration LSBs for page 14 (rows 0x380 through 0x3bf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE14_LOCK1 + 0x00003e74 + Lock configuration MSBs for page 14 (rows 0x380 through 0x3bf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE15_LOCK0 + 0x00003e78 + Lock configuration LSBs for page 15 (rows 0x3c0 through 0x3ff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE15_LOCK1 + 0x00003e7c + Lock configuration MSBs for page 15 (rows 0x3c0 through 0x3ff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE16_LOCK0 + 0x00003e80 + Lock configuration LSBs for page 16 (rows 0x400 through 0x43f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE16_LOCK1 + 0x00003e84 + Lock configuration MSBs for page 16 (rows 0x400 through 0x43f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE17_LOCK0 + 0x00003e88 + Lock configuration LSBs for page 17 (rows 0x440 through 0x47f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE17_LOCK1 + 0x00003e8c + Lock configuration MSBs for page 17 (rows 0x440 through 0x47f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE18_LOCK0 + 0x00003e90 + Lock configuration LSBs for page 18 (rows 0x480 through 0x4bf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE18_LOCK1 + 0x00003e94 + Lock configuration MSBs for page 18 (rows 0x480 through 0x4bf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE19_LOCK0 + 0x00003e98 + Lock configuration LSBs for page 19 (rows 0x4c0 through 0x4ff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE19_LOCK1 + 0x00003e9c + Lock configuration MSBs for page 19 (rows 0x4c0 through 0x4ff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE20_LOCK0 + 0x00003ea0 + Lock configuration LSBs for page 20 (rows 0x500 through 0x53f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE20_LOCK1 + 0x00003ea4 + Lock configuration MSBs for page 20 (rows 0x500 through 0x53f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE21_LOCK0 + 0x00003ea8 + Lock configuration LSBs for page 21 (rows 0x540 through 0x57f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE21_LOCK1 + 0x00003eac + Lock configuration MSBs for page 21 (rows 0x540 through 0x57f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE22_LOCK0 + 0x00003eb0 + Lock configuration LSBs for page 22 (rows 0x580 through 0x5bf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE22_LOCK1 + 0x00003eb4 + Lock configuration MSBs for page 22 (rows 0x580 through 0x5bf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE23_LOCK0 + 0x00003eb8 + Lock configuration LSBs for page 23 (rows 0x5c0 through 0x5ff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE23_LOCK1 + 0x00003ebc + Lock configuration MSBs for page 23 (rows 0x5c0 through 0x5ff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE24_LOCK0 + 0x00003ec0 + Lock configuration LSBs for page 24 (rows 0x600 through 0x63f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE24_LOCK1 + 0x00003ec4 + Lock configuration MSBs for page 24 (rows 0x600 through 0x63f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE25_LOCK0 + 0x00003ec8 + Lock configuration LSBs for page 25 (rows 0x640 through 0x67f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE25_LOCK1 + 0x00003ecc + Lock configuration MSBs for page 25 (rows 0x640 through 0x67f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE26_LOCK0 + 0x00003ed0 + Lock configuration LSBs for page 26 (rows 0x680 through 0x6bf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE26_LOCK1 + 0x00003ed4 + Lock configuration MSBs for page 26 (rows 0x680 through 0x6bf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE27_LOCK0 + 0x00003ed8 + Lock configuration LSBs for page 27 (rows 0x6c0 through 0x6ff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE27_LOCK1 + 0x00003edc + Lock configuration MSBs for page 27 (rows 0x6c0 through 0x6ff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE28_LOCK0 + 0x00003ee0 + Lock configuration LSBs for page 28 (rows 0x700 through 0x73f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE28_LOCK1 + 0x00003ee4 + Lock configuration MSBs for page 28 (rows 0x700 through 0x73f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE29_LOCK0 + 0x00003ee8 + Lock configuration LSBs for page 29 (rows 0x740 through 0x77f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE29_LOCK1 + 0x00003eec + Lock configuration MSBs for page 29 (rows 0x740 through 0x77f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE30_LOCK0 + 0x00003ef0 + Lock configuration LSBs for page 30 (rows 0x780 through 0x7bf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE30_LOCK1 + 0x00003ef4 + Lock configuration MSBs for page 30 (rows 0x780 through 0x7bf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE31_LOCK0 + 0x00003ef8 + Lock configuration LSBs for page 31 (rows 0x7c0 through 0x7ff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE31_LOCK1 + 0x00003efc + Lock configuration MSBs for page 31 (rows 0x7c0 through 0x7ff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE32_LOCK0 + 0x00003f00 + Lock configuration LSBs for page 32 (rows 0x800 through 0x83f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE32_LOCK1 + 0x00003f04 + Lock configuration MSBs for page 32 (rows 0x800 through 0x83f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE33_LOCK0 + 0x00003f08 + Lock configuration LSBs for page 33 (rows 0x840 through 0x87f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE33_LOCK1 + 0x00003f0c + Lock configuration MSBs for page 33 (rows 0x840 through 0x87f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE34_LOCK0 + 0x00003f10 + Lock configuration LSBs for page 34 (rows 0x880 through 0x8bf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE34_LOCK1 + 0x00003f14 + Lock configuration MSBs for page 34 (rows 0x880 through 0x8bf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE35_LOCK0 + 0x00003f18 + Lock configuration LSBs for page 35 (rows 0x8c0 through 0x8ff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE35_LOCK1 + 0x00003f1c + Lock configuration MSBs for page 35 (rows 0x8c0 through 0x8ff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE36_LOCK0 + 0x00003f20 + Lock configuration LSBs for page 36 (rows 0x900 through 0x93f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE36_LOCK1 + 0x00003f24 + Lock configuration MSBs for page 36 (rows 0x900 through 0x93f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE37_LOCK0 + 0x00003f28 + Lock configuration LSBs for page 37 (rows 0x940 through 0x97f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE37_LOCK1 + 0x00003f2c + Lock configuration MSBs for page 37 (rows 0x940 through 0x97f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE38_LOCK0 + 0x00003f30 + Lock configuration LSBs for page 38 (rows 0x980 through 0x9bf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE38_LOCK1 + 0x00003f34 + Lock configuration MSBs for page 38 (rows 0x980 through 0x9bf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE39_LOCK0 + 0x00003f38 + Lock configuration LSBs for page 39 (rows 0x9c0 through 0x9ff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE39_LOCK1 + 0x00003f3c + Lock configuration MSBs for page 39 (rows 0x9c0 through 0x9ff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE40_LOCK0 + 0x00003f40 + Lock configuration LSBs for page 40 (rows 0xa00 through 0xa3f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE40_LOCK1 + 0x00003f44 + Lock configuration MSBs for page 40 (rows 0xa00 through 0xa3f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE41_LOCK0 + 0x00003f48 + Lock configuration LSBs for page 41 (rows 0xa40 through 0xa7f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE41_LOCK1 + 0x00003f4c + Lock configuration MSBs for page 41 (rows 0xa40 through 0xa7f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE42_LOCK0 + 0x00003f50 + Lock configuration LSBs for page 42 (rows 0xa80 through 0xabf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE42_LOCK1 + 0x00003f54 + Lock configuration MSBs for page 42 (rows 0xa80 through 0xabf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE43_LOCK0 + 0x00003f58 + Lock configuration LSBs for page 43 (rows 0xac0 through 0xaff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE43_LOCK1 + 0x00003f5c + Lock configuration MSBs for page 43 (rows 0xac0 through 0xaff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE44_LOCK0 + 0x00003f60 + Lock configuration LSBs for page 44 (rows 0xb00 through 0xb3f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE44_LOCK1 + 0x00003f64 + Lock configuration MSBs for page 44 (rows 0xb00 through 0xb3f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE45_LOCK0 + 0x00003f68 + Lock configuration LSBs for page 45 (rows 0xb40 through 0xb7f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE45_LOCK1 + 0x00003f6c + Lock configuration MSBs for page 45 (rows 0xb40 through 0xb7f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE46_LOCK0 + 0x00003f70 + Lock configuration LSBs for page 46 (rows 0xb80 through 0xbbf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE46_LOCK1 + 0x00003f74 + Lock configuration MSBs for page 46 (rows 0xb80 through 0xbbf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE47_LOCK0 + 0x00003f78 + Lock configuration LSBs for page 47 (rows 0xbc0 through 0xbff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE47_LOCK1 + 0x00003f7c + Lock configuration MSBs for page 47 (rows 0xbc0 through 0xbff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE48_LOCK0 + 0x00003f80 + Lock configuration LSBs for page 48 (rows 0xc00 through 0xc3f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE48_LOCK1 + 0x00003f84 + Lock configuration MSBs for page 48 (rows 0xc00 through 0xc3f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE49_LOCK0 + 0x00003f88 + Lock configuration LSBs for page 49 (rows 0xc40 through 0xc7f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE49_LOCK1 + 0x00003f8c + Lock configuration MSBs for page 49 (rows 0xc40 through 0xc7f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE50_LOCK0 + 0x00003f90 + Lock configuration LSBs for page 50 (rows 0xc80 through 0xcbf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE50_LOCK1 + 0x00003f94 + Lock configuration MSBs for page 50 (rows 0xc80 through 0xcbf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE51_LOCK0 + 0x00003f98 + Lock configuration LSBs for page 51 (rows 0xcc0 through 0xcff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE51_LOCK1 + 0x00003f9c + Lock configuration MSBs for page 51 (rows 0xcc0 through 0xcff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE52_LOCK0 + 0x00003fa0 + Lock configuration LSBs for page 52 (rows 0xd00 through 0xd3f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE52_LOCK1 + 0x00003fa4 + Lock configuration MSBs for page 52 (rows 0xd00 through 0xd3f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE53_LOCK0 + 0x00003fa8 + Lock configuration LSBs for page 53 (rows 0xd40 through 0xd7f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE53_LOCK1 + 0x00003fac + Lock configuration MSBs for page 53 (rows 0xd40 through 0xd7f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE54_LOCK0 + 0x00003fb0 + Lock configuration LSBs for page 54 (rows 0xd80 through 0xdbf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE54_LOCK1 + 0x00003fb4 + Lock configuration MSBs for page 54 (rows 0xd80 through 0xdbf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE55_LOCK0 + 0x00003fb8 + Lock configuration LSBs for page 55 (rows 0xdc0 through 0xdff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE55_LOCK1 + 0x00003fbc + Lock configuration MSBs for page 55 (rows 0xdc0 through 0xdff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE56_LOCK0 + 0x00003fc0 + Lock configuration LSBs for page 56 (rows 0xe00 through 0xe3f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE56_LOCK1 + 0x00003fc4 + Lock configuration MSBs for page 56 (rows 0xe00 through 0xe3f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE57_LOCK0 + 0x00003fc8 + Lock configuration LSBs for page 57 (rows 0xe40 through 0xe7f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE57_LOCK1 + 0x00003fcc + Lock configuration MSBs for page 57 (rows 0xe40 through 0xe7f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE58_LOCK0 + 0x00003fd0 + Lock configuration LSBs for page 58 (rows 0xe80 through 0xebf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE58_LOCK1 + 0x00003fd4 + Lock configuration MSBs for page 58 (rows 0xe80 through 0xebf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE59_LOCK0 + 0x00003fd8 + Lock configuration LSBs for page 59 (rows 0xec0 through 0xeff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE59_LOCK1 + 0x00003fdc + Lock configuration MSBs for page 59 (rows 0xec0 through 0xeff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE60_LOCK0 + 0x00003fe0 + Lock configuration LSBs for page 60 (rows 0xf00 through 0xf3f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE60_LOCK1 + 0x00003fe4 + Lock configuration MSBs for page 60 (rows 0xf00 through 0xf3f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE61_LOCK0 + 0x00003fe8 + Lock configuration LSBs for page 61 (rows 0xf40 through 0xf7f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE61_LOCK1 + 0x00003fec + Lock configuration MSBs for page 61 (rows 0xf40 through 0xf7f). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE62_LOCK0 + 0x00003ff0 + Lock configuration LSBs for page 62 (rows 0xf80 through 0xfbf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE62_LOCK1 + 0x00003ff4 + Lock configuration MSBs for page 62 (rows 0xf80 through 0xfbf). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + PAGE63_LOCK0 + 0x00003ff8 + Lock configuration LSBs for page 63 (rows 0xfc0 through 0xfff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + RMA + Decommission for RMA of a suspected faulty device. This re-enables the factory test JTAG interface, and makes pages 3 through 61 of the OTP permanently inaccessible. + [7:7] + read-only + + + NO_KEY_STATE + State when at least one key is registered for this page and no matching key has been entered. + [6:6] + read-only + + + read_only + 0 + + + inaccessible + 1 + + + + + KEY_R + Index 1-6 of a hardware key which must be entered to grant read access, or 0 if no such key is required. + [5:3] + read-only + + + KEY_W + Index 1-6 of a hardware key which must be entered to grant write access, or 0 if no such key is required. + [2:0] + read-only + + + + + PAGE63_LOCK1 + 0x00003ffc + Lock configuration MSBs for page 63 (rows 0xfc0 through 0xfff). Locks are stored with 3-way majority vote encoding, so that bits can be set independently. + + This OTP location is always readable, and is write-protected by its own permissions. + 0x00000000 + + + R2 + Redundant copy of bits 7:0 + [23:16] + read-only + + + R1 + Redundant copy of bits 7:0 + [15:8] + read-only + + + LOCK_BL + Dummy lock bits reserved for bootloaders (including the RP2350 USB bootloader) to store their own OTP access permissions. No hardware effect, and no corresponding SW_LOCKx registers. + [5:4] + read-only + + + read_write + 0 + Bootloader permits user reads and writes to this page + + + read_only + 1 + Bootloader permits user reads of this page + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE + + + inaccessible + 3 + Bootloader does not permit user access to this page + + + + + LOCK_NS + Lock state for Non-secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + + Note that READ_WRITE and READ_ONLY are equivalent in hardware, as the SBPI programming interface is not accessible to Non-secure software. However, Secure software may check these bits to apply write permissions to a Non-secure OTP programming API. + [3:2] + read-only + + + read_write + 0 + Page can be read by Non-secure software, and Secure software may permit Non-secure writes. + + + read_only + 1 + Page can be read by Non-secure software + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Non-secure software. + + + + + LOCK_S + Lock state for Secure accesses to this page. Thermometer-coded, so lock state can be advanced permanently from any state to any less-permissive state by programming OTP. Software can also advance the lock state temporarily (until next OTP reset) using the SW_LOCKx registers. + [1:0] + read-only + + + read_write + 0 + Page is fully accessible by Secure software. + + + read_only + 1 + Page can be read by Secure software, but can not be written. + + + reserved + 2 + Do not use. Behaves the same as INACCESSIBLE. + + + inaccessible + 3 + Page can not be accessed by Secure software. + + + + + + + + + TBMAN + For managing simulation testbenches + 0x40160000 + + 0 + 4 + registers + + + + PLATFORM + 0x00000000 + Indicates the type of platform in use + 0x00000001 + + + HDLSIM + Indicates the platform is a simulation + [2:2] + read-only + + + FPGA + Indicates the platform is an FPGA + [1:1] + read-only + + + ASIC + Indicates the platform is an ASIC + [0:0] + read-only + + + + + + + USB_DPRAM + DPRAM layout for USB device. + 0x50100000 + + 0 + 256 + registers + + + + SETUP_PACKET_LOW + 0x00000000 + Bytes 0-3 of the SETUP packet from the host. + 0x00000000 + + + WVALUE + [31:16] + read-write + + + BREQUEST + [15:8] + read-write + + + BMREQUESTTYPE + [7:0] + read-write + + + + + SETUP_PACKET_HIGH + 0x00000004 + Bytes 4-7 of the setup packet from the host. + 0x00000000 + + + WLENGTH + [31:16] + read-write + + + WINDEX + [15:0] + read-write + + + + + EP1_IN_CONTROL + 0x00000008 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP1_OUT_CONTROL + 0x0000000c + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP2_IN_CONTROL + 0x00000010 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP2_OUT_CONTROL + 0x00000014 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP3_IN_CONTROL + 0x00000018 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP3_OUT_CONTROL + 0x0000001c + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP4_IN_CONTROL + 0x00000020 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP4_OUT_CONTROL + 0x00000024 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP5_IN_CONTROL + 0x00000028 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP5_OUT_CONTROL + 0x0000002c + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP6_IN_CONTROL + 0x00000030 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP6_OUT_CONTROL + 0x00000034 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP7_IN_CONTROL + 0x00000038 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP7_OUT_CONTROL + 0x0000003c + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP8_IN_CONTROL + 0x00000040 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP8_OUT_CONTROL + 0x00000044 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP9_IN_CONTROL + 0x00000048 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP9_OUT_CONTROL + 0x0000004c + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP10_IN_CONTROL + 0x00000050 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP10_OUT_CONTROL + 0x00000054 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP11_IN_CONTROL + 0x00000058 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP11_OUT_CONTROL + 0x0000005c + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP12_IN_CONTROL + 0x00000060 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP12_OUT_CONTROL + 0x00000064 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP13_IN_CONTROL + 0x00000068 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP13_OUT_CONTROL + 0x0000006c + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP14_IN_CONTROL + 0x00000070 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP14_OUT_CONTROL + 0x00000074 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP15_IN_CONTROL + 0x00000078 + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP15_OUT_CONTROL + 0x0000007c + 0x00000000 + + + ENABLE + Enable this endpoint. The device will not reply to any packets for this endpoint if this bit is not set. + [31:31] + read-write + + + DOUBLE_BUFFERED + This endpoint is double buffered. + [30:30] + read-write + + + INTERRUPT_PER_BUFF + Trigger an interrupt each time a buffer is done. + [29:29] + read-write + + + INTERRUPT_PER_DOUBLE_BUFF + Trigger an interrupt each time both buffers are done. Only valid in double buffered mode. + [28:28] + read-write + + + ENDPOINT_TYPE + [27:26] + read-write + + + Control + 0 + + + Isochronous + 1 + + + Bulk + 2 + + + Interrupt + 3 + + + + + INTERRUPT_ON_STALL + Trigger an interrupt if a STALL is sent. Intended for debug only. + [17:17] + read-write + + + INTERRUPT_ON_NAK + Trigger an interrupt if a NAK is sent. Intended for debug only. + [16:16] + read-write + + + BUFFER_ADDRESS + 64 byte aligned buffer address for this EP (bits 0-5 are ignored). Relative to the start of the DPRAM. + [15:0] + read-write + + + + + EP0_IN_BUFFER_CONTROL + 0x00000080 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP0_OUT_BUFFER_CONTROL + 0x00000084 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP1_IN_BUFFER_CONTROL + 0x00000088 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP1_OUT_BUFFER_CONTROL + 0x0000008c + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP2_IN_BUFFER_CONTROL + 0x00000090 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP2_OUT_BUFFER_CONTROL + 0x00000094 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP3_IN_BUFFER_CONTROL + 0x00000098 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP3_OUT_BUFFER_CONTROL + 0x0000009c + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP4_IN_BUFFER_CONTROL + 0x000000a0 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP4_OUT_BUFFER_CONTROL + 0x000000a4 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP5_IN_BUFFER_CONTROL + 0x000000a8 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP5_OUT_BUFFER_CONTROL + 0x000000ac + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP6_IN_BUFFER_CONTROL + 0x000000b0 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP6_OUT_BUFFER_CONTROL + 0x000000b4 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP7_IN_BUFFER_CONTROL + 0x000000b8 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP7_OUT_BUFFER_CONTROL + 0x000000bc + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP8_IN_BUFFER_CONTROL + 0x000000c0 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP8_OUT_BUFFER_CONTROL + 0x000000c4 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP9_IN_BUFFER_CONTROL + 0x000000c8 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP9_OUT_BUFFER_CONTROL + 0x000000cc + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP10_IN_BUFFER_CONTROL + 0x000000d0 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP10_OUT_BUFFER_CONTROL + 0x000000d4 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP11_IN_BUFFER_CONTROL + 0x000000d8 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP11_OUT_BUFFER_CONTROL + 0x000000dc + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP12_IN_BUFFER_CONTROL + 0x000000e0 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP12_OUT_BUFFER_CONTROL + 0x000000e4 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP13_IN_BUFFER_CONTROL + 0x000000e8 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP13_OUT_BUFFER_CONTROL + 0x000000ec + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP14_IN_BUFFER_CONTROL + 0x000000f0 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP14_OUT_BUFFER_CONTROL + 0x000000f4 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP15_IN_BUFFER_CONTROL + 0x000000f8 + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + EP15_OUT_BUFFER_CONTROL + 0x000000fc + Buffer control for both buffers of an endpoint. Fields ending in a _1 are for buffer 1. + Fields ending in a _0 are for buffer 0. Buffer 1 controls are only valid if the endpoint is in double buffered mode. + 0x00000000 + + + FULL_1 + Buffer 1 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [31:31] + read-write + + + LAST_1 + Buffer 1 is the last buffer of the transfer. + [30:30] + read-write + + + PID_1 + The data pid of buffer 1. + [29:29] + read-write + + + DOUBLE_BUFFER_ISO_OFFSET + The number of bytes buffer 1 is offset from buffer 0 in Isochronous mode. Only valid in double buffered mode for an Isochronous endpoint. + For a non Isochronous endpoint the offset is always 64 bytes. + [28:27] + read-write + + + 128 + 0 + + + 256 + 1 + + + 512 + 2 + + + 1024 + 3 + + + + + AVAILABLE_1 + Buffer 1 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [26:26] + read-write + + + LENGTH_1 + The length of the data in buffer 1. + [25:16] + read-write + + + FULL_0 + Buffer 0 is full. For an IN transfer (TX to the host) the bit is set to indicate the data is valid. For an OUT transfer (RX from the host) this bit should be left as a 0. The host will set it when it has filled the buffer with data. + [15:15] + read-write + + + LAST_0 + Buffer 0 is the last buffer of the transfer. + [14:14] + read-write + + + PID_0 + The data pid of buffer 0. + [13:13] + read-write + + + RESET + Reset the buffer selector to buffer 0. + [12:12] + read-write + + + STALL + Reply with a stall (valid for both buffers). + [11:11] + read-write + + + AVAILABLE_0 + Buffer 0 is available. This bit is set to indicate the buffer can be used by the controller. The controller clears the available bit when writing the status back. + [10:10] + read-write + + + LENGTH_0 + The length of the data in buffer 1. + [9:0] + read-write + + + + + + + diff --git a/WEEK05/WEEK05.md b/WEEK05/WEEK05.md index e281ee0..c66ab20 100644 --- a/WEEK05/WEEK05.md +++ b/WEEK05/WEEK05.md @@ -108,26 +108,48 @@ Use this exact process any time you need to encode a decimal float manually. 2. Convert the number to binary. - Integer part: `42 = 101010 (base 2)` + - $42 = 32 + 8 + 2 = 2^5 + 2^3 + 2^1$ + - In 6-bit binary: `101010` - Fractional part: use repeated multiply-by-2 on the fraction. - Start with `0.5` - - `0.5 * 2 = 1.0` -> integer part is `1` (this is the first binary fractional bit) + - $0.5 \times 2 = 1.0 \implies$ integer part is `1` (this is the first binary fractional bit) - Remaining fractional part is now `0.0`, so we stop. - Therefore `0.5 = 0.1 (base 2)`. - - Combined: `42.5 = 101010.1 (base 2)` + - Combined fixed-point binary: `42.5 = 101010.1 (base 2)` -3. Normalize to the form `1.xxxxx * 2^n`. - - `101010.1 (base 2) = 1.010101 (base 2) * 2^5` - - So the true exponent is `n = 5`. +3. Normalize to scientific form ($1.\text{mantissa} \times 2^n$) - Where the 5 comes from! + - **Why is the exponent 5?** Look at the powers of 2 for the integer part (42): + - $2^4 = 16$ + - $2^5 = 32$ + - $2^6 = 64$ + - Because $32 \le 42 < 64$ (that is, $2^5 \le 42 < 2^6$), the largest power of 2 contained within 42 is $2^{\mathbf{5}}$. This mathematical bound guarantees that when normalized, the exponent **must be 5**. + - Now count the binary point shifts to bring the number into $1.xxxx$ form: -4. Compute the stored exponent (bias 127 for float). - - `stored exponent = n + 127 = 5 + 127 = 132` - - `132` in binary is `10000100` (8 bits). +``` +Original position: 1 0 1 0 1 0 . 1 x 2^0 (value: 42.5) +Shift 1 place left: 1 0 1 0 1 . 0 1 x 2^1 +Shift 2 places left: 1 0 1 0 . 1 0 1 x 2^2 +Shift 3 places left: 1 0 1 . 0 1 0 1 x 2^3 +Shift 4 places left: 1 0 . 1 0 1 0 1 x 2^4 +Shift 5 places left: 1 . 0 1 0 1 0 1 x 2^5 + ^ + Binary point is now right after the first '1'! +``` + + - We shifted the binary point **exactly 5 places to the left**, so the true exponent is $n = \mathbf{5}$: + $$101010.1_2 = 1.010101_2 \times 2^{\mathbf{5}}$$ + +4. Compute the stored exponent (bias 127 for float, 1023 for double). + - For a 32-bit `float`: + $$\text{stored exponent} = n + 127 = 5 + 127 = 132 = 10000100_2$$ + - For a 64-bit `double`: + $$\text{stored exponent} = n + 1023 = 5 + 1023 = 1028 = 10000000100_2$$ > Tip: **Why 127?** The exponent field is 8 bits wide, giving $2^8 = 256$ total values. Half of that range should represent negative exponents and half positive. The midpoint is $(2^8 / 2) - 1 = 127$. So a stored exponent of `127` means a real exponent of **0**, values below `127` are negative exponents, and values above `127` are positive exponents. Doubles use an 11-bit exponent field so their midpoint (bias) is $( 2^{11} / 2) - 1 = 1023$ instead. 5. Build the mantissa (fraction bits). - Take bits after the leading `1.` from `1.010101` -> `010101` - - Pad with zeros to 23 bits: + - Pad with zeros to 23 bits (for 32-bit float): - `01010100000000000000000` 6. Assemble all fields. @@ -147,32 +169,42 @@ Given the 32-bit pattern: - `0 | 10000100 | 01010100000000000000000` -Decode it field by field: +Decode it field by field back to decimal: 1. Sign bit - - Sign bit is `0` -> number is positive. - - So the sign multiplier is `(+1)`. + - Sign bit is `0` -> number is positive: `(+1)`. 2. Exponent field - Exponent bits are `10000100`. - - Convert to decimal: `10000100 (base 2) = 132`. - - Float bias is `127`, so true exponent is: - - `132 - 127 = 5`. + - Convert to decimal: $10000100_2 = 128 + 4 = 132$. + - Float bias is `127`, so subtract the bias to recover the true exponent: + $$132 - 127 = \mathbf{5}$$ + - Recovering **5** tells us the significand was scaled by $2^5$. 3. Mantissa field - Stored mantissa bits are `01010100000000000000000`. - - IEEE 754 normal numbers use an implicit leading `1`, so significand becomes: - - `1.010101 (base 2)`. + - IEEE 754 normal numbers restore the implicit leading `1.`, so significand becomes: + $$1.010101_2$$ -4. Rebuild the value - - Formula: `value = (+1) * 1.010101 (base 2) * 2^5`. - - Shift binary point right by 5: - - `1.010101 * 2^5 = 101010.1 (base 2)`. +4. Rebuild the value (undo the normalization) + - Formula: $\text{value} = (+1) \times 1.010101_2 \times 2^5$. + - Multiplying by $2^5$ shifts the binary point **5 places to the right**: -5. Convert `101010.1 (base 2)` to decimal - - Integer part: `101010 = 32 + 8 + 2 = 42` - - Fraction part: `.1 = 1/2 = 0.5` - - Total: `42 + 0.5 = 42.5` +``` +Start: 1 . 0 1 0 1 0 1 x 2^5 +Shift 1 place right: 1 0 . 1 0 1 0 1 x 2^4 +Shift 2 places right: 1 0 1 . 0 1 0 1 x 2^3 +Shift 3 places right: 1 0 1 0 . 1 0 1 x 2^2 +Shift 4 places right: 1 0 1 0 1 . 0 1 x 2^1 +Shift 5 places right: 1 0 1 0 1 0 . 1 x 2^0 = 101010.1 +``` + + - Resulting fixed-point binary: $101010.1_2$. + +5. Convert $101010.1_2$ to decimal + - Integer part: $101010_2 = 32 + 8 + 2 = 42$ + - Fraction part: $.1_2 = 1/2 = 0.5$ + - Total: $42 + 0.5 = \mathbf{42.5} \checkmark$ So the decoded value is exactly `42.5`. @@ -423,12 +455,12 @@ r2 (low 32 bits): 0x00000000 = 0000 0000 0000 0000 0000 0000 0000 0000 Laid out as a single 64-bit value with every bit numbered: ``` -Bit: 63 62-52 (11 bits) 51-32 (20 bits) 31-0 (32 bits) - +---+-----------------------+------------------------------------------+----------------------------------+ - | 0 | 1 0 0 0 0 0 0 0 1 0 0 | 0 1 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 | 00000000000000000000000000000000 | - +---+-----------------------+------------------------------------------+----------------------------------+ - Sign Exponent (11) Mantissa high 20 bits Mantissa low 32 bits - (from r3 bits 19-0) (from r2, all zero) +Bit: 63 62-52 (11b) 51-32 (20b from r3) 31-0 (32b from r2) ++---+-------------+---------------------+-------------------------+ +| 0 | 10000000100 | 01010100000000000000| 00000000...00000000 | ++---+-------------+---------------------+-------------------------+ +Sign Exponent Mantissa (High 20) Mantissa (Low 32) + (from r3 bits 19-0) (from r2, all zero) ``` **Step-by-step field extraction:** @@ -488,7 +520,7 @@ $$\text{real exponent} = \text{stored exponent} - \text{bias}$$ $$\text{real exponent} = 1028 - 1023 = \mathbf{5}$$ -This means the number is scaled by $2^5 = 32$. In other words, the mantissa gets shifted left by 5 binary places. +This confirms the number is scaled by $2^5 = 32$. When reconstructing the value, multiplying the significand $1.010101_2$ by $2^5$ shifts the binary point 5 places to the right, recovering $101010.1_2 = 42.5$. **3. Mantissa - bits 51-0 of the 64-bit value** @@ -772,7 +804,7 @@ int main(void) { 1. Hold the BOOTSEL button on your Pico 2 2. Plug in the USB cable (while holding BOOTSEL) 3. Release BOOTSEL - a drive called "RPI-RP2" appears -4. Drag and drop `0x000A_intro-to-doubles.uf2` onto the drive +4. Drag and drop `0x0011_double-floating-point-data-type.uf2` onto the drive 5. The Pico will reboot and start running! ### Step 2: Verify It's Working @@ -809,7 +841,7 @@ Ghidra will open. Now we need to create a new project. 1. Click **File** -> **New Project** 2. Select **Non-Shared Project** 3. Click **Next** -4. Enter Project Name: `0x000A_intro-to-doubles` +4. Enter Project Name: `0x0011_double-floating-point-data-type` 5. Click **Finish** ### Step 5: Import the Binary @@ -978,12 +1010,12 @@ r2 (low 32 bits): 0x645A1CAC = 0110 0100 0101 1010 0001 1100 1010 1100 Laid out as a single 64-bit value with every bit numbered: ``` -Bit: 63 62-52 (11 bits) 51-32 (20 bits) 31-0 (32 bits) - +---+-----------------------+------------------------------------------+------------------------------------------+ - | 0 | 1 0 0 0 0 0 0 0 1 0 0 | 0 1 0 1 0 1 0 0 0 0 1 1 0 0 1 1 1 0 1 1 | 01100100010110100001110010101100 | - +---+-----------------------+------------------------------------------+------------------------------------------+ - Sign Exponent (11) Mantissa high 20 bits Mantissa low 32 bits - (from r3 bits 19-0) (from r2) +Bit: 63 62-52 (11b) 51-32 (20b from r3) 31-0 (32b from r2) ++---+-------------+---------------------+-------------------------+ +| 0 | 10000000100 | 01010100001100111011| 01100100...10101100 | ++---+-------------+---------------------+-------------------------+ +Sign Exponent Mantissa (High 20) Mantissa (Low 32) + (from r3 bits 19-0) (from r2) ``` **Step-by-step field extraction:** @@ -1011,11 +1043,127 @@ Exponent bits: `10000000100` Convert to decimal: $2^{10} + 2^{2} = 1024 + 4 = 1028$ -Subtract the bias (same formula as Part 2 - the bias is 1023 for all doubles): +Subtract the bias (the bias is 1023 for all 64-bit doubles): $$\text{real exponent} = 1028 - 1023 = \mathbf{5}$$ -This means the mantissa gets shifted left by 5 binary places (i.e. multiplied by $2^5 = 32$). +#### Deep Dive: Where Did the Exponent 5 Come From? + +If you are wondering why the real exponent is **5**, let's walk through the foundational math step-by-step using `42.5`. This shows both how decimal `42.5` converts into IEEE 754 format, and how that converted value breaks down step-by-step back to `42.5`. + +##### 1. Forward Conversion: Decimal 42.5 to IEEE 754 + +**Step A: The Power-of-2 Bounding Rule (Why 5?)** +Why is the exponent 5 and not 4 or 6? Look at the powers of 2 around the integer part (42): +- $2^4 = 16$ +- $2^5 = 32$ +- $2^6 = 64$ + +Because $32 \le 42 < 64$ (that is, $2^{\mathbf{5}} \le 42 < 2^6$), the largest power of 2 contained within 42 is $2^{\mathbf{5}}$. This mathematical bound guarantees that when normalized, the exponent **must be 5**. + +**Step B: Convert 42.5 to Fixed-Point Binary** +- Integer part (42): + - $42 - 32 = 10 \implies 2^5$ bit is `1` + - $10 < 16 \implies 2^4$ bit is `0` + - $10 - 8 = 2 \implies 2^3$ bit is `1` + - $2 < 4 \implies 2^2$ bit is `0` + - $2 - 2 = 0 \implies 2^1$ bit is `1` + - $0 \implies 2^0$ bit is `0` + - Result: $42_{10} = 101010_2$ +- Fractional part (0.5): + - $0.5 \times 2 = 1.0 \implies$ integer part `1`, remainder `0.0` + - Result: $0.5_{10} = 0.1_2$ +- Combined fixed-point binary: + $$42.5_{10} = 101010.1_2$$ + +**Step C: Normalize to Scientific Notation (Counting the 5 Shifts Left)** +IEEE 754 requires every normal non-zero number to be represented in scientific form: +$$1.\text{mantissa} \times 2^n$$ +We start with $101010.1$ and shift the binary point to the left until exactly one non-zero bit (`1`) remains before the point: + +``` +Original position: 1 0 1 0 1 0 . 1 x 2^0 (value: 42.5) +Shift 1 place left: 1 0 1 0 1 . 0 1 x 2^1 +Shift 2 places left: 1 0 1 0 . 1 0 1 x 2^2 +Shift 3 places left: 1 0 1 . 0 1 0 1 x 2^3 +Shift 4 places left: 1 0 . 1 0 1 0 1 x 2^4 +Shift 5 places left: 1 . 0 1 0 1 0 1 x 2^5 + ^ + Point is now immediately after the first 1! +``` + +Notice we shifted the binary point **exactly 5 places to the left**. That shift count is our true exponent: +$$101010.1_2 = 1.010101_2 \times 2^{\mathbf{5}}$$ +**That is exactly where the 5 comes from!** + +**Step D: Add the Exponent Bias** +IEEE 754 adds a fixed bias so exponents are stored as unsigned positive integers: +- For `float` (bias 127): $\text{stored exponent} = 5 + 127 = 132 = 10000100_2$ +- For `double` (bias 1023): $\text{stored exponent} = 5 + 1023 = 1028 = 10000000100_2$ + +**Step E: Assemble the 64-Bit Double Pattern for 42.5** +- Sign (1 bit): `0` (positive) +- Exponent (11 bits): `10000000100` (1028) +- Mantissa (52 bits): `010101` followed by 46 zeros (the leading `1.` is implied) +- Register distribution: + - `r3` (high 32 bits): `0x40454000` + - `r2` (low 32 bits): `0x00000000` + +##### 2. Reverse Breakdown: IEEE 754 Double Back to Decimal 42.5 + +Now take `r3 = 0x40454000` and `r2 = 0x00000000` and break it down step-by-step back to `42.5`: + +**Step A: Recover the Real Exponent 5** +- Extract the 11 exponent bits from `r3` (bits 30-20): + $$\text{Stored exponent} = 10000000100_2 = 1024 + 4 = 1028$$ +- Subtract the 1023 bias: + $$\text{Real Exponent} = 1028 - 1023 = \mathbf{5}$$ +Subtracting 1023 recovers our shift count of **5**, telling us the significand was scaled by $2^{\mathbf{5}}$. + +**Step B: Restore the Significand (Reattach Implicit 1)** +- Stored mantissa bits from `r3`: `01010100000...` +- Reattach the implicit leading `1.`: + $$\text{Significand} = 1.010101_2$$ + +**Step C: Multiply by $2^5$ (Shift Binary Point 5 Places Right)** +$$\text{Value} = 1.010101_2 \times 2^{\mathbf{5}}$$ +Multiplying by $2^5$ shifts the binary point **5 places to the right**: + +``` +Start: 1 . 0 1 0 1 0 1 x 2^5 +Shift 1 place right: 1 0 . 1 0 1 0 1 x 2^4 +Shift 2 places right: 1 0 1 . 0 1 0 1 x 2^3 +Shift 3 places right: 1 0 1 0 . 1 0 1 x 2^2 +Shift 4 places right: 1 0 1 0 1 . 0 1 x 2^1 +Shift 5 places right: 1 0 1 0 1 0 . 1 x 2^0 = 101010.1 +``` + +The un-normalized fixed-point binary representation is: +$$101010.1_2$$ + +**Step D: Convert Fixed-Point Binary to Decimal** +- Integer part (`101010`): + - $1 \times 2^5 = 32$ + - $0 \times 2^4 = 0$ + - $1 \times 2^3 = 8$ + - $0 \times 2^2 = 0$ + - $1 \times 2^1 = 2$ + - $0 \times 2^0 = 0$ + - Sum: $32 + 8 + 2 = 42$ +- Fractional part (`.1`): + - $1 \times 2^{-1} = 0.5$ +- Final Total: + $$42 + 0.5 = \mathbf{42.5} \checkmark$$ + +##### 3. Why 42.52525 Shares the Exact Same Exponent 5 + +Now return to `42.52525` in our binary (`r3 = 0x4045433B`): +- The integer part of `42.52525` is still **42**. +- Since $32 \le 42.52525 < 64$ ($2^{\mathbf{5}} \le 42.52525 < 2^6$), the largest power of 2 fitting in the number is still $2^{\mathbf{5}}$. +- Normalizing $101010.10000110011101..._2$ to $1.xxxx...$ still requires shifting the binary point **5 places to the left**: + $$1.0101010000110011101..._2 \times 2^{\mathbf{5}}$$ +- Therefore, the stored exponent in `r3` is identically $5 + 1023 = 1028$ (`10000000100`), producing the exact same `0x404...` in the upper 12 bits of `r3`! +- The only difference between `42.5` (`0x40454000_00000000`) and `42.52525` (`0x4045433B_645A1CAC`) is in the remaining mantissa bits that capture the fractional difference between `0.5` and `0.52525`. **3. Mantissa - bits 51-0** @@ -1282,10 +1430,10 @@ fav_num: 99.990000 | - Split into high/low words | +-----------------------------------------------------------------+ | 5. Patch the constant(s) in Ghidra | -| - Edit bytes in the Bytes window (Pencil mode) | +| - Edit bytes in the Bytes window (Pencil mode) | | - Replace the old encoding with the new one | +-----------------------------------------------------------------+ -| 6. Export -> Convert to UF2 -> Flash -> Verify | +| 6. Export -> Convert to UF2 -> Flash -> Verify | | - Same workflow as integer patching | +-----------------------------------------------------------------+ ``` diff --git a/WEEK05/WEEK05.pdf b/WEEK05/WEEK05.pdf index dd82424..25f8f18 100644 Binary files a/WEEK05/WEEK05.pdf and b/WEEK05/WEEK05.pdf differ diff --git a/WEEK05/WEEK05a.md b/WEEK05/WEEK05a.md new file mode 100644 index 0000000..d454f5b --- /dev/null +++ b/WEEK05/WEEK05a.md @@ -0,0 +1,611 @@ +# Week 5a: Deep-Dive Hardware Architecture: RP2350 PADS_BANK0, IO_BANK0, SIO, and the GPIO Coprocessor (GPIOC) + +*** +**LEGAL DISCLAIMER:** +The information, tools, and code provided in this repository and course are strictly for educational, research, and defensive purposes only. + +You are explicitly prohibited from using any materials contained herein to access, test, modify, or exploit any device, network, or system that you do not own 100% or for which you do not have explicit, documented, and legally binding authorization to interact with. + +By using this repository and course, you acknowledge and agree that: + +1. Any illegal, unauthorized, or malicious use of this information is solely your responsibility. +2. The author(s) and contributor(s) of this repository and course shall not be held liable for any damages, legal repercussions, criminal charges, or unauthorized actions resulting from the use, misuse, or abuse of the contents herein. +3. You will comply with all applicable local, state, national, and international laws regarding cybersecurity and computer fraud. + +**IF YOU DO NOT AGREE WITH THESE TERMS, DO NOT USE THIS REPOSITORY AND COURSE.** + +*** + +## What You'll Learn This Week + +By the end of this tutorial, you will be able to: + +- Master the physical silicon reality of General Purpose Input/Output (GPIO) on the RP2350 microcontroller from Chapter 9 of the datasheet. +- Understand why microcontroller pins are never simple wires, dissecting the split between the internal 1.1V digital core domain ($V_{\text{core}} / \text{DVDD}$) and the external 3.3V analog pad ring domain ($V_{\text{io}} / \text{IOVDD}$). +- Decouple the two independent hardware layers: electrical pad configuration (`PADS_BANK0` at `0x40038000`) versus digital crossbar multiplexing (`IO_BANK0` at `0x40028000`). +- Dissect every bitfield of `PADS_BANK0`: Output Disable (`OD`), Input Enable (`IE`), Pad Isolation (`ISO`), Drive Strength ($2/4/8/12\text{ mA}$), Pull-Up (`PUE`), Pull-Down (`PDE`), Schmitt Trigger (`SCHMITT`), and Slew Rate (`SLEWFAST`). +- Discover why unconfigured RP2350 pins are physically isolated by default (`ISO = 1`) and why digital input buffers are disconnected (`IE = 0`) to prevent catastrophic CMOS shoot-through leakage current. +- Master RP2350 **Bus Keeper Mode**, activated by setting both `PUE = 1` and `PDE = 1` to weakly latch floating line states without power dissipation. +- Navigate the digital crossbar switchboard in `IO_BANK0`: function selection (`FUNCSEL 0..31`), peripheral routing (UART, SPI, I2C, PWM, SIO, PIO), and signal overrides (`OUTOVER`, `OEOVER`, `INOVER`, `IRQOVER`). +- Analyze edge-sensitive and level-sensitive hardware interrupt generation across `proc0`, `proc1`, and `dormant_wake`. +- Understand the hardware Single-Cycle I/O (`SIO` at `0xd0000000`) block and contrast standard MMIO load/store operations against the RP2350 **GPIO Coprocessor (GPIOC)** on ARM Cortex-M33 Coprocessor Port `p0` (Section 3.6.1 and Section 9.9). +- Trace Thumb-2 coprocessor instructions (`mcrr p0`, `mcr p0`, `mrrc p0`) that set, clear, toggle, and configure GPIO output-enables in a single clock cycle with zero memory bus arbitration. +- Deconstruct the assembly implementation in `0x000b_integer-data-type.c`, performing a cycle-accurate trace of `asm_init_gpio_range()` and `asm_blink_pin()`. +- Eliminate the disassembler "hardware MMIO blind spot" using PyCortexMDebug in GDB for live dynamic peripheral struct inspection. +- Import CMSIS-SVD hardware definitions into Ghidra using SVD-Loader-Ghidra to reconstruct clear, readable decompilation from raw binary firmware. + +--- + +## Part 1: Why Microcontroller Pins Are Not Simple Wires + +### The Silicon Reality: Core Logic vs. The Pad Ring + +In software, a developer writes `gpio_put(16, 1)` and visualizes a direct wire connecting a CPU register bit to an external copper pin. In silicon engineering, this concept is completely false. + +A modern microcontroller die like the RP2350 is divided into two radically distinct physical and electrical domains: + +1. **The Internal Digital Core Domain ($1.1\text{ V}$ nominal $\text{DVDD}$):** + The central silicon die contains the dual ARM Cortex-M33 processors, the bus fabric, static RAM, cache controllers, and digital peripheral state machines (UART, SPI, PIO). These circuits are fabricated using ultra-thin, low-voltage nanoscale transistors designed exclusively for high switching speeds ($150\text{ MHz}$) and ultra-low power consumption. These microscopic gates cannot tolerate voltages above $1.21\text{ V}$. Connecting an external $3.3\text{ V}$ signal directly to a core gate would instantly cause dielectric oxide breakdown, permanently melting the transistor. + +2. **The External Pad Ring Domain ($1.8\text{ V} - 3.3\text{ V}$ nominal $\text{IOVDD}$):** + Surrounding the perimeter of the die is the **Pad Ring**. The pad ring consists of specialized, high-voltage analog and electrical interface cells ("pad cells") fabricated with thick-oxide transistors. These cells translate internal $1.1\text{ V}$ digital logic signals up to external $3.3\text{ V}$ board voltages, provide electrostatic discharge (ESD) protection diodes, supply high output drive currents (up to $12\text{ mA}$) to charge external capacitive PCB traces, and filter noisy incoming analog edges. +``` ++-----------------------------------------------------------------+ +| RP2350 GPIO HARDWARE SUBSYSTEM ARCHITECTURE | +| | +| ARM Cortex-M33 Core / DMA / Interconnect | +| +---------------------------------------------------------+ | +| | Coprocessor Port p0 (GPIOC) / SIO (0xd0000000) | | +| | - 1-cycle atomic bit set/clear/toggle/oe (mcrr/mcr) | | +| | - 32-bit MMIO registers: GPIO_OUT, GPIO_OE, GPIO_IN | | +| +----------------------------+----------------------------+ | +| | | +| On-Chip Peripherals | | +| +----------------------------+----------------------------+ | +| | UART0/1, SPI0/1, I2C0/1, PWM, PIO0/1/2, CLK_GP, HSTX | | +| +----------------------------+----------------------------+ | +| | | +| v | +| Digital Routing Domain (clk_sys / 150 MHz) | +| +---------------------------------------------------------+ | +| | IO_BANK0 (0x40028000) - Digital Crossbar Switchboard | | +| | - FUNCSEL (bits 4:0): Selects function (0..31) | | +| | - Signal Overrides: OUTOVER, OEOVER, INOVER, IRQOVER | | +| | - Edge/Level Interrupt Detection (PROC0/1/DORMANT) | | +| +----------------------------+----------------------------+ | +| | | +| v | +| Physical / Electrical Domain (IOVDD 1.8V - 3.3V) | +| +---------------------------------------------------------+ | +| | PADS_BANK0 (0x40038000) - Die Perimeter Pad Ring | | +| | - ISO (bit 8): Pad Isolation Latch (frozen on reset!) | | +| | - OD / IE (bits 7,6): Output Disable / Input Enable | | +| | - DRIVE (bits 5:4): 2mA / 4mA / 8mA / 12mA Strength | | +| | - PUE / PDE (bits 3,2): Pull-Up / Pull-Down / Keeper | | +| | - SCHMITT / SLEWFAST (bits 1,0): Hysteresis & Slew | | +| +----------------------------+----------------------------+ | +| | | +| v | +| Physical Bond Pad & Pin | ++-----------------------------------------------------------------+ +``` +### The Physical Hazards of Uncontrolled I/O + +Why can't a microcontroller provide a single "GPIO register" where bit $n$ directly drives pin $n$? Because every physical pin faces severe physical and electrical constraints: + +- **CMOS Shoot-Through Current:** When a CMOS digital input buffer encounters a voltage near mid-rail (e.g., $1.65\text{ V}$ on a $3.3\text{ V}$ rail), both the upper P-channel and lower N-channel MOSFETs turn partially ON simultaneously. This creates a low-resistance path directly from `IOVDD` to ground, dissipating substantial leakage current and generating heat. To prevent this on unused or analog pins (such as ADC inputs), the chip must provide a hardware switch to completely disconnect the input buffer (`IE = 0`). +- **Electrostatic Discharge (ESD):** External human touch or inductive spikes can inject thousands of volts into a pin. Pad cells integrate dual clamping diodes to shunt overvoltage spikes safely into power and ground rails. +- **Power Domain Collapse during Deep Sleep:** When the RP2350 enters low-power dormant sleep, the $1.1\text{ V}$ core voltage can be completely powered down by the Power Manager (`POWMAN`). If the pad ring were directly connected to the core, the unpowered core outputs would float, causing external actuators, transceivers, or power supplies to turn on uncontrollably. The pad ring must therefore integrate **Pad Isolation Latches (`ISO`)** that freeze the external electrical state even when the CPU and digital core no longer exist! + +To solve these orthogonal challenges, the RP2350 divides GPIO into a clean three-tier hardware hierarchy: +- **`PADS_BANK0` (`0x40038000`):** Governs the electrical pad cells along the silicon die perimeter. +- **`IO_BANK0` (`0x40028000`):** Governs digital routing, multiplexing, and signal overrides. +- **`SIO` (`0xd0000000`) & Coprocessor Port `p0`:** Governs single-cycle processor execution. + +--- + +## Part 2: PADS_BANK0 Deep Dive: The Electrical Pad Ring + +### Physical Placement and Register Map + +The User Bank Pad Control registers reside at base address **`0x40038000`** (`PADS_BANK0_BASE`). + +According to **Chapter 9.11.3 (Table 851)** of the RP2350 Datasheet: +- Offset `0x00`: **`VOLTAGE_SELECT`** (Bank-wide voltage threshold: `0 = 3.3V`, `1 = 1.8V`). +- Offset `0x04`: **`GPIO0`** pad control register. +- Offset `0x08`: **`GPIO1`** pad control register. +- ... +- Offset `0x04 + (4 * x)`: **`GPIOx`** pad control register. + +Each 32-bit register controls the analog and physical circuitry of exactly one pin. +``` ++-----------------------------------------------------------------+ +| ANATOMY OF A SINGLE RP2350 PAD CELL | +| | +| IO_BANK0 Digital Signal PADS_BANK0 Controls | +| +-----------------------+ +-------------------+ | +| | OUTTOPAD (Data) | | DRIVE (2/4/8/12mA)| | +| | OETOPAD (Enable) | | SLEWFAST (0/1) | | +| +-----------+-----------+ | ISO (Isolation) | | +| | | OD (Out Disable) | | +| v +---------+---------+ | +| [ISO Latch (bit 8)] | | +| | | | +| v v | +| +---------------+ +-------------------+ | +| | Output Buffer |<----------------| High-Voltage CMOS | | +| | Driver Stage | | Push-Pull MOSFETs | | +| +-------+-------+ +---------+---------+ | +| | | | +| +-----------------+-----------------+ | +| | | +| +-----------------------------+---------------------------+ | +| | PHYSICAL PAD (External Pin) | | +| | - ESD Protection Diodes to IOVDD and GND | | +| | - Switchable 50k Pull-Up (PUE) to IOVDD | | +| | - Switchable 50k Pull-Down (PDE) to GND | | +| | - Bus Keeper: PUE=1 + PDE=1 (Weak State Retention) | | +| +-----------------------------+---------------------------+ | +| | | +| v | +| [Schmitt Trigger Filter] | +| | | +| v | +| [Input Enable Gate (IE)] | +| | | +| v | +| INFROMPAD to IO_BANK0 | ++-----------------------------------------------------------------+ +``` +### The PADS_BANK0 Bitfield Breakdown + +Every 32-bit `GPIOx` register in `PADS_BANK0` has the exact bitfield structure defined in **Table 853**: +``` ++-----------------------------------------------------------------+ +| PADS_BANK0: GPIOx REGISTER BITFIELDS (Offset: 0x04 + 4*x) | +| | +| 31 9 8 7 6 5 4 3 2 1 0 | +| +---------------+---+---+---+-------+---+---+---+---+ | +| | Reserved |ISO|OD |IE | DRIVE |PUE|PDE|SCH|SLW| | +| +---------------+---+---+---+-------+---+---+---+---+ | +| | +| Bit 8: ISO - Pad isolation latch (1 = isolated/frozen) | +| Bit 7: OD - Output disable (1 = output driver off) | +| Bit 6: IE - Input enable (1 = digital input buffer on)| +| Bits 5:4 DRIVE - Drive strength (00=2mA, 01=4mA, 10=8mA, | +| 11=12mA) | +| Bit 3: PUE - Pull-up resistor enable (~50 kOhm) | +| Bit 2: PDE - Pull-down resistor enable (~50 kOhm) | +| PUE & PDE == 1 - Bus Keeper Mode (weakly holds last state) | +| Bit 1: SCHMITT - Schmitt trigger hysteresis filter | +| Bit 0: SLEWFAST - Slew rate control (0 = Slow, 1 = Fast) | ++-----------------------------------------------------------------+ +``` +Let us examine each bitfield with silicon-level precision: + +#### 1. ISO (Bit 8) - Pad Isolation Control +- **Reset Value:** `0x1` (Isolated!). +- **Function:** When `ISO = 1`, an analog transmission gate isolates the pad from the switched core domain. The output driver state, output enable, and pull resistors remain frozen at their last latched values. +- **The Startup Gotcha:** Upon microcontroller power-up or reset, `ISO` resets to `1` across all pads! Before any pin can be driven or read by software, **the application software must explicitly clear the `ISO` bit**. If you attempt to configure `IO_BANK0` or `SIO` while `ISO = 1`, the external pin will remain totally unresponsive! + +#### 2. OD (Bit 7) - Output Disable +- **Reset Value:** `0x0`. +- **Function:** Master hardware output disable. When `OD = 1`, the pad's output driver transistors are completely turned OFF, forcing the pin into high-impedance (High-Z) mode. +- **Priority:** `OD` has absolute silicon priority over any output-enable signal emitted by internal peripherals (UART, SPI, PWM, SIO). Even if the UART hardware attempts to transmit, setting `OD = 1` silences the pin. + +#### 3. IE (Bit 6) - Input Enable +- **Reset Value:** `0x0` (Disabled!). +- **Function:** Master hardware gate for the digital input buffer. +- **The Analog Protection Rule:** When a pin is used as an analog input (e.g., ADC pins GPIO 26..29), or when a pin is left disconnected/floating, `IE` must remain `0`. Disabling the input buffer prevents floating voltages from causing CMOS shoot-through currents across internal transistor pairs. +- **The Input Gotcha:** If you want to read digital input from a button or serial line using SIO (`sio_hw->gpio_in`), you **must explicitly set `IE = 1`** in `PADS_BANK0`. If `IE = 0`, reading `GPIO_IN` will always return `0`, regardless of the voltage applied to the physical pin! + +#### 4. DRIVE (Bits 5:4) - Output Drive Strength +- **Reset Value:** `0x1` ($4\text{ mA}$). +- **Options:** `00 = 2mA`, `01 = 4mA`, `10 = 8mA`, `11 = 12mA`. +- **Silicon Implementation:** Inside the pad cell, the output push-pull stage consists of parallel arrays of PMOS (pull-up) and NMOS (pull-down) transistors. Selecting $2\text{ mA}$ enables a single transistor pair; selecting $12\text{ mA}$ switches on all parallel pairs, dramatically lowering the driver's output resistance ($R_{\text{on}}$). +- **Engineering Trade-off:** High drive strength ($12\text{ mA}$) charges external trace capacitance rapidly, enabling high-speed $50\text{ MHz}+$ SPI clocks. However, it generates sharp current transients ($dI/dt$), leading to ground bounce, ringing, and electromagnetic interference (EMI). Low drive strength ($2\text{ mA}$) softens transitions, producing clean, low-noise waveforms on sensitive sensor buses. + +#### 5. PUE (Bit 3) & PDE (Bit 2) - Pull-Up and Pull-Down Resistors +- **Reset Value:** `PUE = 0`, `PDE = 1` (Pads reset with weak pull-downs active!). +- **Electrical Specification:** Nominal internal resistance of approximately $50\text{ k}\Omega$ to `IOVDD` (PUE) or ground (PDE). +- **Bus Keeper Mode (Section 9.6.1):** What happens if software sets both `PUE = 1` and `PDE = 1` simultaneously? On older microcontrollers, this would create an illegal cross-conduction voltage divider dissipating power. On the RP2350, setting both bits activates **Bus Keeper Mode**! In this mode: + - If the pad's voltage is High, the pad pulls weakly Up. + - If the pad's voltage is Low, the pad pulls weakly Down. + When an external device stops driving a shared bus (e.g., a bidirectional data line in tri-state), the Bus Keeper holds the last valid logic level indefinitely, preventing the line from floating into mid-rail states without drawing active power! + +#### 6. SCHMITT (Bit 1) - Schmitt Trigger Enable +- **Reset Value:** `0x1` (Enabled). +- **Function:** Adds voltage hysteresis to the input comparator ($V_{\text{IH}} \approx 2.0\text{ V}$, $V_{\text{IL}} \approx 0.8\text{ V}$). If an incoming digital signal has a slow rise time or is corrupted by high-frequency noise, the Schmitt trigger prevents false multi-triggering and oscillation at the digital threshold. + +#### 7. SLEWFAST (Bit 0) - Slew Rate Control +- **Reset Value:** `0x0` (Slow). +- **Function:** `0 = Slow`, `1 = Fast`. Slow slew rate actively limits the edge rate ($dV/dt$) of the output buffer, minimizing radiated emissions and transmission-line reflections on unterminated PCB traces. Fast slew rate is required for high-frequency interfaces like QSPI, HSTX, or high-speed UART. + +--- + +## Part 3: IO_BANK0 Deep Dive: The Digital Crossbar Switchboard + +### The Multiplexer Matrix (`0x40028000`) + +Once a signal passes through the electrical pad ring, it enters the digital core domain. Here sits **`IO_BANK0`**, located at base address **`0x40028000`** (`IO_BANK0_BASE`). + +`IO_BANK0` functions as an enormous digital crossbar switchboard. The RP2350 contains dozens of peripheral controllers: +- Two SPI controllers (`SPI0`, `SPI1`) +- Two UART controllers (`UART0`, `UART1`) +- Two I2C controllers (`I2C0`, `I2C1`) +- Up to 12 dual-channel PWM slices (`PWM0` through `PWM11`) +- Three Programmable I/O blocks (`PIO0`, `PIO1`, `PIO2`) +- Single-Cycle I/O (`SIO`) +- General Purpose Clock outputs (`CLK_GP`) +- High-Speed Serial Transmitter (`HSTX`) + +None of these peripherals own any dedicated physical pins! Instead, every peripheral signal is routed through `IO_BANK0`, which selects which peripheral connects to which pad. + +### Register Structure per Pin + +In `IO_BANK0`, every GPIO pin occupies an **8-byte stride** containing two 32-bit registers (Section 9.11.1, Table 649): + +$$\text{GPIOx\_STATUS Offset} = 0\text{x}000 + (8 \times x)$$ +$$\text{GPIOx\_CTRL Offset} = 0\text{x}004 + (8 \times x)$$ + +For example, for GPIO 16: +$$\text{GPIO16\_CTRL Offset} = 0\text{x}004 + (8 \times 16) = 0\text{x}004 + 0\text{x}080 = 0\text{x}084$$ +$$\text{Physical Address} = 0\text{x}40028000 + 0\text{x}084 = 0\text{x}40028084$$ + +### The GPIOx_CTRL Register: Function Selection & Overrides +``` ++-----------------------------------------------------------------+ +| IO_BANK0: GPIOx_CTRL REGISTER BITFIELDS (Offset: 0x04+8*x)| +| | +| 31 30 29 28 27 18 17 16 15 14 13 12 11 5 4 0 | +| +-----+-----+---------+-----+-----+-----+---------+---------+ | +| |Rsvd |IRQO |Reserved |INOV |OEOV |OUTOV|Reserved | FUNCSEL | | +| +-----+-----+---------+-----+-----+-----+---------+---------+ | +| | +| Bits 4:0 FUNCSEL - Function Select (0..31, 5=SIO, 31=NULL) | +| Bits 13:12 OUTOVER - Output signal override (0=norm, 1=invert, | +| 2=force low, 3=force high) | +| Bits 15:14 OEOVER - Output enable override (0=norm, 1=invert, | +| 2=force disable, 3=force enable) | +| Bits 17:16 INOVER - Input signal override (0=norm, 1=invert, | +| 2=force low, 3=force high) | +| Bits 29:28 IRQOVER - Interrupt override (0=norm, 1=invert, | +| 2=force low, 3=force high) | ++-----------------------------------------------------------------+ +``` +According to **Table 651**, the bitfields of `GPIOx_CTRL` provide ultimate routing and logic control: + +#### 1. FUNCSEL (Bits 4:0) - Function Select +A 5-bit multiplexer index determining which peripheral controls the pin: +- `0x00`: JTAG +- `0x01`: SPI +- `0x02`: UART +- `0x03`: I2C +- `0x04`: PWM +- **`0x05`: SIO (Single-Cycle I/O - CPU / Coprocessor Software Control)** +- `0x06`: PIO0 +- `0x07`: PIO1 +- `0x08`: PIO2 +- `0x09`: Clock / Auxiliary +- `0x1f` (`31`): **NULL / Disconnected** (Reset Value!) + +Upon reset, `FUNCSEL` is set to `0x1f` (NULL). The pin is completely disconnected from all internal peripherals. To control a pin via CPU software or inline assembly, you must write `5` to `FUNCSEL`. + +#### 2. Signal Overrides (OUTOVER, OEOVER, INOVER, IRQOVER) +The RP2350 allows hardware hackers and defensive engineers to intercept, invert, or force signals between peripherals and pads without reconfiguring peripheral registers: + +| Override Field | Bits | Values & Behavior | +|:---|:---|:---| +| **`OUTOVER`** | `13:12` | `0 = Normal` (Peripheral drives data)
`1 = Invert` (Invert peripheral data)
`2 = Force Low` (Drive 0 to pad)
`3 = Force High` (Drive 1 to pad) | +| **`OEOVER`** | `15:14` | `0 = Normal` (Peripheral drives OE)
`1 = Invert` (Invert OE)
`2 = Force Disable` (Disable output driver)
`3 = Force Enable` (Enable output driver) | +| **`INOVER`** | `17:16` | `0 = Normal` (Pad drives peripheral)
`1 = Invert` (Invert pad data to peripheral)
`2 = Force Low` (Peripheral sees 0)
`3 = Force High` (Peripheral sees 1) | +| **`IRQOVER`** | `29:28` | `0 = Normal` (Pad drives interrupt)
`1 = Invert` (Invert interrupt logic)
`2 = Force Low` (Deassert IRQ)
`3 = Force High` (Assert IRQ) | + +*Security/Hacking Implication:* If a target firmware runs a proprietary UART protocol on GPIO 0/1, an analyst can invert the transmitted serial stream in hardware by writing `0x1` to `OUTOVER`, without the target firmware ever detecting that its serial framing has been altered! + +### The GPIOx_STATUS Register: Real-Time Silicon Probing + +The read-only `GPIOx_STATUS` register (+`0x000`) provides a live digital probe inside the chip (Table 650): +- **`INFROMPAD` (Bit 17):** The raw digital logic level coming from the pad cell (after Schmitt trigger, before any `INOVER` inversion). +- **`OETOPAD` (Bit 13):** The effective Output Enable signal being transmitted to the pad cell after all overrides. +- **`OUTTOPAD` (Bit 9):** The effective Output Data signal being transmitted to the pad cell after all overrides. +- **`IRQTOPROC` (Bit 26):** The interrupt status signal sent to the CPU NVIC. + +--- + +## Part 4: SIO vs. The RP2350 GPIO Coprocessor (GPIOC) + +### The Single-Cycle I/O (SIO) Architecture + +When a pin's `FUNCSEL` is set to `5` in `IO_BANK0`, it connects to the **SIO (Single-Cycle I/O)** block, located at base address **`0xd0000000`** (`SIO_BASE`). + +SIO provides fast, non-blocking registers that allow the ARM CPU to manipulate GPIOs in 1 clock cycle: +- `GPIO_OUT` (`0xd0000010`): Direct 32-bit output value. +- `GPIO_OUT_SET` (`0xd0000014`): Atomic bit set (writing a `1` sets the corresponding pin High). +- `GPIO_OUT_CLR` (`0xd0000018`): Atomic bit clear (writing a `1` clears the corresponding pin Low). +- `GPIO_OUT_XOR` (`0xd000001c`): Atomic bit toggle (writing a `1` inverts the corresponding pin). +- `GPIO_OE` (`0xd0000020`), `GPIO_OE_SET`, `GPIO_OE_CLR`, `GPIO_OE_XOR`: Output Enable registers. +- `GPIO_IN` (`0xd0000004`): Direct 32-bit digital input read. + +### The Memory Bus Overhead Bottleneck + +While SIO registers respond in a single clock cycle, interacting with them via standard ARM memory-mapped instructions (`ldr`, `str`) suffers from severe software overhead: + +1. **Address Materialization:** Cortex-M33 instructions cannot embed a 32-bit address like `0xd0000014` directly in a single 16-bit Thumb opcode. The compiler must generate an `ldr r0, =0xd0000014` instruction, pulling the 32-bit address from a Flash literal pool (taking 2 cycles plus cache/wait-states). +2. **Register Pressure:** The CPU must allocate a general-purpose register (`r0`) to hold the address and a second register (`r1`) to hold the bitmask (`1 << pin`). +3. **Bus Arbitration:** Even though SIO is single-cycle, the `str` instruction still arbitrates across the internal AHB-Lite bus matrix. +``` ++-----------------------------------------------------------------+ +| SIO MMIO ACCESS VS. GPIOC COPROCESSOR PORT P0 | +| | +| Standard SIO Access (3 to 5 Instructions / Bus Bottleneck) | +| +---------------------------------------------------------+ | +| | ldr r0, =0xd0000000 ; Load 32-bit SIO base | | +| | movs r1, #1 ; Load bitmask | | +| | lsls r1, r1, #16 ; Shift to pin 16 | | +| | str r1, [r0, #0x14] ; Write to GPIO_OUT_SET | | +| | => Requires register allocation, memory bus arbitration| | +| +---------------------------------------------------------+ | +| | +| RP2350 GPIOC Coprocessor Access (1 Instruction / Zero Bus) | +| +---------------------------------------------------------+ | +| | mcrr p0, #4, r4, r5, c0 ; gpioc_bit_out_put(pin,val) | | +| | - r4 = pin number (16) | | +| | - r5 = value (1 = High, 0 = Low) | | +| | => 1 CPU clock cycle! Zero bus traffic! Zero address! | | +| +---------------------------------------------------------+ | ++-----------------------------------------------------------------+ +``` +### The Silicon Breakthrough: GPIOC on Coprocessor Port p0 + +To eliminate this overhead entirely, Raspberry Pi engineered a custom hardware **GPIO Coprocessor (GPIOC)** directly into each ARM Cortex-M33 core on **Coprocessor Port `p0`** (Datasheet Section 3.6.1 and Section 9.9). + +Instead of issuing memory load and store instructions across the system bus, the ARM core uses native ARMv8-M coprocessor instructions (`mcr`, `mcrr`, `mrc`, `mrrc`): +``` ++-----------------------------------------------------------------+ +| COMPLETE RP2350 GPIO SIGNAL FLOW PATH | +| | +| [ Cortex-M33 CPU ] | +| | | +| (Coprocessor p0 / SIO) | +| v | +| [ SIO Block (0xd0000000) ] | +| | (Raw Out Data & Out Enable) | +| v | +| [ IO_BANK0 Crossbar (0x40028000) ] | +| | - Mux: FUNCSEL = 5 (Select SIO) | +| | - Apply OUTOVER / OEOVER overrides | +| v | +| [ Voltage Level Shifter ] (1.1V DVDD Core -> 3.3V IOVDD Pad) | +| v | +| [ PADS_BANK0 (0x40038000) ] | +| | - Check ISO latch (Must be cleared = 0) | +| | - Check OD bit (Must be cleared = 0) | +| | - Apply DRIVE strength (2/4/8/12mA) and SLEWFAST | +| v | +| [ Physical Bond Pad & Package Pin ] | +| | | +| |------> External Circuit (e.g. LED, Scope, Target) | +| | | +| [ Schmitt Trigger Input Buffer ] | +| | | +| [ PADS_BANK0 IE Gate ] (Must be set = 1 to pass) | +| v | +| [ Voltage Level Shifter ] (3.3V IOVDD Pad -> 1.1V DVDD Core) | +| v | +| [ IO_BANK0 INFROMPAD ] | +| | - Apply INOVER override | +| | - Route to Edge/Level Interrupt Detector | +| v | +| [ SIO GPIO_IN Register / Peripheral RX ] | ++-----------------------------------------------------------------+ +``` +According to **Section 3.6.1**, the GPIOC instruction set provides instantaneous, zero-latency GPIO control: + +#### 1. Single-Bit Output Enable (gpioc_bit_oe_put) +$$\text{Opcode: } \texttt{mcrr p0, #4, Rt, Rt2, c4}$$ +- `Rt`: General-purpose register holding the pin number ($0..47$). +- `Rt2`: General-purpose register holding the 1-bit value ($1 = \text{Output}, 0 = \text{Input}$). +- **Operation:** Atomically sets or clears the output enable for pin `Rt` in **1 single clock cycle**! No 32-bit addresses, no bit-shifts (`1 << pin`), and zero bus traffic! + +#### 2. Single-Bit Output Data (gpioc_bit_out_put) +$$\text{Opcode: } \texttt{mcrr p0, #4, Rt, Rt2, c0}$$ +- `Rt`: Pin number ($0..47$). +- `Rt2`: Value ($1 = \text{High}, 0 = \text{Low}$). +- **Operation:** Atomically drives pin `Rt` High or Low in 1 clock cycle. + +#### 3. Single-Pin Direct Toggling / Setting / Clearing +- Toggle pin `Rt`: `mcr p0, #5, Rt, c0, c0` (`gpioc_bit_out_xor`) +- Set pin `Rt` High: `mcr p0, #6, Rt, c0, c0` (`gpioc_bit_out_set`) +- Clear pin `Rt` Low: `mcr p0, #7, Rt, c0, c0` (`gpioc_bit_out_clr`) + +#### 4. 64-Bit Simultaneous Sampling +$$\text{Opcode: } \texttt{mrrc p0, #0, Rt, Rt2, c0}$$ +- Reads back all 48 GPIO pins simultaneously into register pair `Rt:Rt2` in a single clock cycle! + +--- + +## Part 5: Deconstructing 0x000b_integer-data-type.c + +Now let us examine the production firmware in `0x000b_integer-data-type/0x000b_integer-data-type.c`. This program configures pins 16, 17, and 18 entirely through raw assembly, manipulating `PADS_BANK0`, `IO_BANK0`, and the `GPIOC` coprocessor. + +### Dissecting asm_init_gpio_range() + +```c +static void asm_init_gpio_range(void) { + __asm volatile ( + "ldr r3, =0x40038000\n" // address of PADS_BANK0_BASE + "ldr r2, =0x40028004\n" // address of IO_BANK0 GPIO0.ctrl + "movs r0, #16\n" // GPIO16 (start pin) + "init_loop:\n" // loop start + "lsls r1, r0, #2\n" // pin * 4 (pad offset) + "adds r4, r3, r1\n" // PADS base + offset + "ldr r5, [r4]\n" // load current config + "bic r5, r5, #0x180\n" // clear OD+ISO + "orr r5, r5, #0x40\n" // set IE + "str r5, [r4]\n" // store updated config + "lsls r1, r0, #3\n" // pin * 8 (ctrl offset) + "adds r4, r2, r1\n" // IO_BANK0 base + offset + "ldr r5, [r4]\n" // load current config + "bic r5, r5, #0x1f\n" // clear FUNCSEL bits [4:0] + "orr r5, r5, #5\n" // set FUNCSEL = 5 (SIO) + "str r5, [r4]\n" // store updated config + "mov r4, r0\n" // pin + "movs r5, #1\n" // bit 1; used for OUT/OE writes + "mcrr p0, #4, r4, r5, c4\n" // gpioc_bit_oe_put(pin,1) + "adds r0, r0, #1\n" // increment pin + "cmp r0, #20\n" // stop after pin 18 + "blt init_loop\n" // loop until r0 == 20 + ); +} +``` + +### Line-by-Line Machine Code and Silicon Execution Trace + +1. **`ldr r3, =0x40038000`:** Loads `PADS_BANK0_BASE` into `r3`. +2. **`ldr r2, =0x40028004`:** Loads the address of `IO_BANK0: GPIO0_CTRL` into `r2`. +3. **`movs r0, #16`:** Sets loop counter starting at GPIO 16. +4. **`lsls r1, r0, #2`:** Multiplies pin number by 4 ($16 \times 4 = 64 = 0\text{x}40$). +5. **`adds r4, r3, r1`:** Calculates the pad register address ($0\text{x}40038000 + 0\text{x}40 = 0\text{x}40038040$). +6. **`ldr r5, [r4]`:** Reads current pad configuration. +7. **`bic r5, r5, #0x180`:** Clears bits 7 and 8 ($0\text{x}180 = 0001\,1000\,0000_2$): + - **Bit 7 (`OD`):** Cleared to `0` $\rightarrow$ Output driver enabled! + - **Bit 8 (`ISO`):** Cleared to `0` $\rightarrow$ Pad isolation latch de-asserted! The pad is connected to internal core logic! +8. **`orr r5, r5, #0x40`:** Sets bit 6 ($0\text{x}40 = 0100\,0000_2$): + - **Bit 6 (`IE`):** Set to `1` $\rightarrow$ Input buffer enabled! +9. **`str r5, [r4]`:** Writes new configuration back to `PADS_BANK0`. The physical pad cell is now electrically active! +10. **`lsls r1, r0, #3`:** Multiplies pin number by 8 ($16 \times 8 = 128 = 0\text{x}80$). +11. **`adds r4, r2, r1`:** Calculates `GPIO16_CTRL` address ($0\text{x}40028004 + 0\text{x}80 = 0\text{x}40028084$). +12. **`ldr r5, [r4]`:** Reads current control register. +13. **`bic r5, r5, #0x1f`:** Clears bits 4:0 (`FUNCSEL`), wiping out the reset value of `31` (NULL). +14. **`orr r5, r5, #5`:** Sets `FUNCSEL = 5` $\rightarrow$ Connects pin 16 to the SIO block! +15. **`str r5, [r4]`:** Writes back to `IO_BANK0`. The digital routing switchboard is now connected! +16. **`mcrr p0, #4, r4, r5, c4`:** Calls `gpioc_bit_oe_put(16, 1)`. The GPIO coprocessor on port `p0` sets the Output Enable bit in SIO in 1 single clock cycle! + +### Dissecting asm_blink_pin() + +```c +static void asm_blink_pin(uint8_t pin) { + __asm volatile ( + "mov r4, %0\n" + "movs r5, #0x01\n" + "mcrr p0, #4, r4, r5, c0\n" // Drive High + : : "r"(pin) : "r4", "r5" + ); + sleep_ms(500); + __asm volatile ( + "mov r4, %0\n" + "movs r5, #0\n" + "mcrr p0, #4, r4, r5, c0\n" // Drive Low + : : "r"(pin) : "r4", "r5" + ); + sleep_ms(500); +} +``` + +- When `mcrr p0, #4, r4, r5, c0` executes with `r5 = 1`, the coprocessor drives the output bit High in 1 cycle. +- The high signal flows from SIO $\rightarrow$ `IO_BANK0` multiplexer $\rightarrow$ Voltage Level Shifter ($1.1\text{V} \rightarrow 3.3\text{V}$) $\rightarrow$ `PADS_BANK0` push-pull MOSFET driver $\rightarrow$ Physical Pin 16 $\rightarrow$ LED illuminates! +- When `mcrr p0, #4, r4, r5, c0` executes with `r5 = 0`, the coprocessor drives the output bit Low in 1 cycle, turning off the LED. + +--- + +## Part 6: Live GDB and Ghidra Dynamic & Static Reverse Engineering + +### The Hardware MMIO Blind Spot + +When a reverse engineer opens a stripped binary or analyzes a firmware dump, disassemblers do not possess semantic knowledge of microcontroller memory maps. + +In standard GDB disassembly, you encounter instructions like: +```text +0x10000320 <+16>: ldr r3, [pc, #48] ; =0x40038000 +0x10000322 <+18>: ldr r2, [pc, #48] ; =0x40028004 +0x1000032c <+28>: bic r5, r5, #384 ; 0x180 +0x10000336 <+38>: orr r5, r5, #5 +0x1000033c <+44>: mcrr p0, #4, r4, r5, c4 +``` + +To an unassisted analyst, `0x40038000` is an anonymous memory address, `0x180` is an arbitrary bitmask, and `mcrr p0` looks like an invalid or proprietary instruction. This is the **Hardware MMIO Blind Spot**. + +### Dynamic Hardware Awareness with PyCortexMDebug in GDB + +To eliminate this blind spot in live debugging, we use **PyCortexMDebug**. PyCortexMDebug ingests the official ARM CMSIS System View Description (`.svd`) file for the RP2350 (`rp2350.svd`). + +Once loaded into GDB over OpenOCD and SWD: + +```text +(gdb) svd-load /path/to/rp2350.svd +(gdb) svd PADS_BANK0 +PADS_BANK0 @ 0x40038000: + VOLTAGE_SELECT = 0x00000000 + GPIO0 = 0x00000104 [ISO=1, DRIVE=4mA, PDE=1, SCHMITT=1] + GPIO16 = 0x00000054 [ISO=0, OD=0, IE=1, DRIVE=4mA, PDE=1, SCHMITT=1] +``` + +Notice the difference! In an instant: +- We verify that `GPIO0` has `ISO=1` (pad is isolated). +- We verify that after `asm_init_gpio_range()` runs, `GPIO16` has `ISO=0`, `OD=0`, and `IE=1`! + +You can also read the live hardware status of the digital crossbar switchboard: +```text +(gdb) svd IO_BANK0 GPIO16_CTRL +IO_BANK0 -> GPIO16_CTRL @ 0x40028084: + FUNCSEL = 0x05 (SIO) + OUTOVER = 0x00 (NORMAL) + OEOVER = 0x00 (NORMAL) + INOVER = 0x00 (NORMAL) +``` + +GDB confirms that GPIO 16 is actively routed to the SIO block! + +### Static Reversing with SVD-Loader-Ghidra + +In static analysis with Ghidra, decompiled code for raw MMIO looks like: +```c +*(uint32_t *)(uVar3 + 0x40) = *(uint32_t *)(uVar3 + 0x40) & 0xfffffe7f | 0x40; +*(uint32_t *)(uVar2 + 0x80) = *(uint32_t *)(uVar2 + 0x80) & 0xffffffe0 | 5; +``` + +This decompilation is obscure. By running **SVD-Loader-Ghidra**: +1. Ghidra creates memory-mapped peripheral blocks labeled `PADS_BANK0` and `IO_BANK0`. +2. Ghidra generates C structure definitions matching the RP2350 hardware layout. +3. The decompilation transforms into clean, readable peripheral code: + +```c +pads_bank0->GPIO[16] = (pads_bank0->GPIO[16] & ~0x180) | 0x40; +io_bank0->GPIO[16].CTRL = (io_bank0->GPIO[16].CTRL & ~0x1f) | FUNCSEL_SIO; +``` + +--- + +## Part 7: Summary & Hardware Register Master Cheat Sheet + +### Architectural Summary + +1. **Hardware Split:** RP2350 enforces a strict division between electrical physics (`PADS_BANK0`) and digital logic (`IO_BANK0`). +2. **PADS_BANK0 (`0x40038000`):** Manages analog pad cells. Controls `ISO` (isolation latch), `OD` (output disable), `IE` (input enable), `DRIVE` ($2/4/8/12\text{ mA}$), `PUE`/`PDE` (pulls and Bus Keeper), `SCHMITT`, and `SLEWFAST`. +3. **IO_BANK0 (`0x40028000`):** Manages digital crossbar routing. Controls `FUNCSEL` (functions 0..31; $5 = \text{SIO}$), logic overrides (`OUTOVER`, `OEOVER`, `INOVER`, `IRQOVER`), and edge/level interrupt generation. +4. **SIO (`0xd0000000`):** Single-Cycle I/O memory-mapped registers for 32-bit atomic bit set, clear, toggle, and read. +5. **GPIOC (Coprocessor Port `p0`):** Native ARMv8-M coprocessor hardware enabling 1-cycle single-bit output and output-enable manipulation (`mcrr p0, #4`), single-pin toggling (`mcr p0, #5`), and 64-bit sampling (`mrrc p0, #0`) with zero memory bus overhead. + +### Hardware Register Reference Table + +| Subsystem | Base Address | Register / Offset | Key Bitfields & Silicon Function | +|:---|:---|:---|:---| +| **PADS_BANK0** | `0x40038000` | `VOLTAGE_SELECT` (`+0x00`) | Bit 0: Bank voltage select (`0 = 3.3V`, `1 = 1.8V`) | +| **PADS_BANK0** | `0x40038000` | `GPIOx` (`+0x04 + 4*x`) | Bit 8: `ISO` (Isolation Latch, reset=1)
Bit 7: `OD` (Output Disable)
Bit 6: `IE` (Input Enable, reset=0)
Bits 5:4: `DRIVE` (`00=2mA`, `01=4mA`, `10=8mA`, `11=12mA`)
Bit 3: `PUE` (Pull-Up Enable)
Bit 2: `PDE` (Pull-Down Enable)
Bit 1: `SCHMITT` (Hysteresis Enable)
Bit 0: `SLEWFAST` (Slew Rate Control) | +| **IO_BANK0** | `0x40028000` | `GPIOx_STATUS` (`+0x000 + 8*x`) | Bit 17: `INFROMPAD` (Raw input level)
Bit 13: `OETOPAD` (Effective Output Enable)
Bit 9: `OUTTOPAD` (Effective Output Data)
Bit 26: `IRQTOPROC` (Interrupt status) | +| **IO_BANK0** | `0x40028000` | `GPIOx_CTRL` (`+0x004 + 8*x`) | Bits 4:0: `FUNCSEL` (`0=JTAG`, `1=SPI`, `2=UART`, `3=I2C`, `4=PWM`, `5=SIO`, `6=PIO0`, `31=NULL`)
Bits 13:12: `OUTOVER`
Bits 15:14: `OEOVER`
Bits 17:16: `INOVER`
Bits 29:28: `IRQOVER` | +| **SIO** | `0xd0000000` | `GPIO_OUT` (`+0x10`) | Bits 31:0: Output data values | +| **SIO** | `0xd0000000` | `GPIO_OUT_SET` (`+0x14`) | Bits 31:0: Atomic bit set High | +| **SIO** | `0xd0000000` | `GPIO_OUT_CLR` (`+0x18`) | Bits 31:0: Atomic bit clear Low | +| **SIO** | `0xd0000000` | `GPIO_OUT_XOR` (`+0x1c`) | Bits 31:0: Atomic bit toggle | +| **SIO** | `0xd0000000` | `GPIO_OE` (`+0x20`) | Bits 31:0: Output enable ($1=\text{Out}, 0=\text{In}$) | +| **SIO** | `0xd0000000` | `GPIO_IN` (`+0x04`) | Bits 31:0: Direct input sample (Requires `IE=1`) | +| **GPIOC** | Port `p0` | `mcrr p0, #4, Rt, Rt2, c4` | Single-pin atomic output enable write (`gpioc_bit_oe_put`) | +| **GPIOC** | Port `p0` | `mcrr p0, #4, Rt, Rt2, c0` | Single-pin atomic output data write (`gpioc_bit_out_put`) | +| **GPIOC** | Port `p0` | `mcr p0, #5, Rt, c0, c0` | Single-pin atomic output toggle (`gpioc_bit_out_xor`) | +| **GPIOC** | Port `p0` | `mcr p0, #6, Rt, c0, c0` | Single-pin atomic output set (`gpioc_bit_out_set`) | +| **GPIOC** | Port `p0` | `mcr p0, #7, Rt, c0, c0` | Single-pin atomic output clear (`gpioc_bit_out_clr`) | +| **GPIOC** | Port `p0` | `mrrc p0, #0, Rt, Rt2, c0` | 64-bit dual-word simultaneous GPIO sample | + +*** diff --git a/WEEK05/WEEK05a.pdf b/WEEK05/WEEK05a.pdf new file mode 100644 index 0000000..6752a95 Binary files /dev/null and b/WEEK05/WEEK05a.pdf differ diff --git a/WEEK06/WEEK06.md b/WEEK06/WEEK06.md index 28cab05..be5411f 100644 --- a/WEEK06/WEEK06.md +++ b/WEEK06/WEEK06.md @@ -1171,7 +1171,7 @@ static_fav_num: 43 | - Identify key instructions and addresses | +-----------------------------------------------------------------+ | 2. Understand compiler optimizations | -| - Some functions get inlined (gpio_pull_up -> gpio_set_pulls)| +| - Some functions inlined (gpio_pull_up -> gpio_set_pulls) | | - Some variables are optimized away | +-----------------------------------------------------------------+ | 3. Calculate file offsets | diff --git a/WEEK06/WEEK06.pdf b/WEEK06/WEEK06.pdf index 5529512..e3fb0e9 100644 Binary files a/WEEK06/WEEK06.pdf and b/WEEK06/WEEK06.pdf differ diff --git a/WEEK10/WEEK10.md b/WEEK10/WEEK10.md index 38d465f..46cdad8 100644 --- a/WEEK10/WEEK10.md +++ b/WEEK10/WEEK10.md @@ -954,12 +954,20 @@ Next, let's change the word "one" to "fun": ### Step 31: Hack #3 - Speed Up the Servo -Let's change the 500ms delay to a 100ms delay. Since the compiler packed the `500` directly into a `mov.w` instruction, we can't just find it in the data section. Instead, let's use Ghidra's built-in assembler to rewrite the instruction! +Let's change the 500ms delay to a 100ms delay. Since the compiler packed the `500` directly into a `mov.w` instruction, we can't just find it in the data section. Instead, let's use Ghidra to rewrite the instruction! -1. In your `main` assembly code, look for the two `mov.w r0,#0x1f4` instructions (which happen right before calling `sleep_ms`). -2. Right-click the first `mov.w r0,#0x1f4` instruction and select **Patch Instruction** (or press `Ctrl+Shift+G`). -3. Delete the `#0x1f4` and type `#0x64` (which is 100 in hex). Press **Enter**! -4. Repeat this for the second `mov.w r0,#0x1f4` instruction. +**Method A: Bytes Window Workflow (Recommended)** +1. Ensure the Bytes window is open (**Window** -> **Bytes: 0x001d_static-conditionals.bin**). +2. Click the **pencil icon** (**Toggle Edit Mode**) in the Bytes window toolbar. +3. In the **Listing** window, locate the first `mov.w r0,#0x1f4` instruction (right before calling `sleep_ms`) and press **`C`** (**Clear Code Bytes**). +4. In the **Bytes** window at that offset, change the immediate byte from `f4` (`0x1f4`) to `64` (`0x64` = 100). +5. In the **Listing** window, click back on the address and press **`D`** (**Disassemble**). +6. Repeat for the second `mov.w r0,#0x1f4` instruction. + +**Method B: Patch Instruction** +1. Right-click the first `mov.w r0,#0x1f4` instruction and select **Patch Instruction** (or press `Ctrl+Shift+G`). +2. Delete the `#0x1f4` and type `#0x64` (which is 100 in hex). Press **Enter**! +3. Repeat this for the second `mov.w r0,#0x1f4` instruction. **Before:** 500ms delay (servo moves slowly) **After:** 100ms delay (servo moves FAST!) @@ -1346,10 +1354,22 @@ We want to create **secret commands** that: Navigate to the `main` function and find the two `cmp` instructions right after `getchar`: -1. At address `1000024a`, you will see `cmp r4,#0x31`. - - Right-click it, select **Patch Instruction**, and change it to `cmp r4,#0x78` (which is ASCII 'x'). -2. At address `1000024e`, you will see `cmp r4,#0x32`. - - Right-click it, select **Patch Instruction**, and change it to `cmp r4,#0x79` (which is ASCII 'y'). +Address `1000024a` contains `cmp r4,#0x31` (`31 2c`), and address `1000024e` contains `cmp r4,#0x32` (`32 2c`). + +**Method A: Bytes Window Workflow (Recommended)** +To ensure clean disassembly and prevent assembler context conflicts: +1. Ensure the Bytes window is open (**Window** -> **Bytes: 0x001d_static-conditionals.bin**). +2. Click the **pencil icon** (**Toggle Edit Mode**) in the Bytes window toolbar to enable editing. +3. In the **Listing** window, click on address `1000024a` and press **`C`** (**Clear Code Bytes**). +4. In the **Bytes** window at offset `1000024a`, click on byte `31` and change it to **`78`** (ASCII 'x'). +5. In the **Listing** window, click back on address `1000024a` and press **`D`** (**Disassemble**). +6. In the **Listing** window, click on address `1000024e` and press **`C`** (**Clear Code Bytes**). +7. In the **Bytes** window at offset `1000024e`, click on byte `32` and change it to **`79`** (ASCII 'y'). +8. In the **Listing** window, click back on address `1000024e` and press **`D`** (**Disassemble**). + +**Method B: Patch Instruction** +1. At address `1000024a`, right-click `cmp r4,#0x31`, select **Patch Instruction**, and change it to `cmp r4,#0x78` (which is ASCII 'x'). +2. At address `1000024e`, right-click `cmp r4,#0x32`, select **Patch Instruction**, and change it to `cmp r4,#0x79` (which is ASCII 'y'). ### Step 56: Redirect Branches to Skip Prints diff --git a/WEEK10/WEEK10.pdf b/WEEK10/WEEK10.pdf index 5d300d2..086657b 100644 Binary files a/WEEK10/WEEK10.pdf and b/WEEK10/WEEK10.pdf differ diff --git a/WEEK11/WEEK11.md b/WEEK11/WEEK11.md index e0eebc8..4e42763 100644 --- a/WEEK11/WEEK11.md +++ b/WEEK11/WEEK11.md @@ -950,22 +950,27 @@ Create a mental (or written) map: ## Part 14: Hacking Structures -### Step 31: Enable Instruction Patching +### Step 31: Patching Instructions -We will use Ghidra's **Patch Instruction** feature to modify the assembly directly instead of editing raw bytes. +To modify assembly instructions in Ghidra, you can use either the direct **Bytes Window** workflow or the GUI **Patch Instruction** dialog. Direct byte editing via the Bytes Window is the standard, bulletproof workflow across all embedded reverse engineering tasks because it avoids assembler context conflicts. ### Step 32: Swap LED Pin Assignments We'll swap the red and green LED pins to reverse their behavior! Because the compiler fully flattened the struct, modifying the `gpio_init` pins won't actually change the main loop's behavior (since all three pins are initialized anyway). We must patch the hardcoded pins inside the **main loop** itself! -**Find and patch the `movs` calls in the loop:** +**Method A: Bytes Window Workflow (Recommended)** +1. Ensure the Bytes window is open (**Window** -> **Bytes: 0x0023_structures.bin**). +2. Click the **pencil icon** (**Toggle Edit Mode**) in the Bytes window toolbar. +3. In the **Listing** window, navigate to `10000296` where the red LED pin is loaded (`movs r2,#0x10`) and press **`C`** (**Clear Code Bytes**). +4. In the **Bytes** window at offset `10000296`, change byte `10` to **`11`** (swap red to green's pin). +5. In the **Listing** window, click back on `10000296` and press **`D`** (**Disassemble**). +6. In the **Listing** window, navigate to `1000029c` where the green LED pin is loaded (`movs r2,#0x11`) and press **`C`** (**Clear Code Bytes**). +7. In the **Bytes** window at offset `1000029c`, change byte `11` to **`10`** (swap green to red's pin). +8. In the **Listing** window, click back on `1000029c` and press **`D`** (**Disassemble**). -1. Navigate to `10000296` where the red LED pin is loaded: `movs r2,#0x10` -2. Right-click the instruction -> **Patch Instruction** (or press Ctrl+Shift+G) -3. Change `#0x10` to `#0x11` (swap red to green's pin) and press **Enter** -4. Navigate to `1000029c` where the green LED pin is loaded: `movs r2,#0x11` -5. Right-click the instruction -> **Patch Instruction** -6. Change `#0x11` to `#0x10` (swap green to red's pin) and press **Enter** +**Method B: Patch Instruction** +1. Navigate to `10000296`: right-click `movs r2,#0x10` -> **Patch Instruction** (or press `Ctrl+Shift+G`), change `#0x10` to `#0x11`, and press **Enter**. +2. Navigate to `1000029c`: right-click `movs r2,#0x11` -> **Patch Instruction**, change `#0x11` to `#0x10`, and press **Enter**. **Before:** ``` @@ -1358,6 +1363,7 @@ We'll swap the red (GPIO 16) and yellow (GPIO 18) LEDs: **Find and patch in the .bin file:** +Using the Bytes window in Ghidra (enable the pencil icon, press **`C`** in the Listing, change the byte in the Bytes window, and press **`D`** in the Listing) or a hex editor: 1. Change `0x10` (16) to `0x12` (18) 2. Change `0x12` (18) to `0x10` (16) @@ -1378,7 +1384,7 @@ Button 3 -> LED 3 -> GPIO 16 -> Red (SWAPPED!) **Important:** Even though we analyzed the .elf, we patch the .bin! 1. Open the original `.bin` file in Ghidra (or a hex editor) -2. Apply the patches +2. Apply the patches using the Bytes window workflow 3. Export as `0x0026_functions-h.bin` ### Step 56: Convert and Flash diff --git a/WEEK11/WEEK11.pdf b/WEEK11/WEEK11.pdf index 54a2806..53459fd 100644 Binary files a/WEEK11/WEEK11.pdf and b/WEEK11/WEEK11.pdf differ diff --git a/DDI0553B_y_armv8m_arm.pdf b/datasheets/DDI0553B_y_armv8m_arm.pdf similarity index 100% rename from DDI0553B_y_armv8m_arm.pdf rename to datasheets/DDI0553B_y_armv8m_arm.pdf diff --git a/aapcs32.pdf b/datasheets/aapcs32.pdf similarity index 100% rename from aapcs32.pdf rename to datasheets/aapcs32.pdf diff --git a/advnote132.pdf b/datasheets/advnote132.pdf similarity index 100% rename from advnote132.pdf rename to datasheets/advnote132.pdf diff --git a/arm_cortex_m33_trm_100230_0100_03_en.pdf b/datasheets/arm_cortex_m33_trm_100230_0100_03_en.pdf similarity index 100% rename from arm_cortex_m33_trm_100230_0100_03_en.pdf rename to datasheets/arm_cortex_m33_trm_100230_0100_03_en.pdf diff --git a/raspberry-pi-pico-c-sdk.pdf b/datasheets/raspberry-pi-pico-c-sdk.pdf similarity index 100% rename from raspberry-pi-pico-c-sdk.pdf rename to datasheets/raspberry-pi-pico-c-sdk.pdf diff --git a/rp2350-datasheet.pdf b/datasheets/rp2350-datasheet.pdf similarity index 100% rename from rp2350-datasheet.pdf rename to datasheets/rp2350-datasheet.pdf diff --git a/EHP2.fzz b/hardware/EHP2.fzz similarity index 60% rename from EHP2.fzz rename to hardware/EHP2.fzz index cf56c6d..149e6b1 100644 Binary files a/EHP2.fzz and b/hardware/EHP2.fzz differ diff --git a/EHP2_bb.png b/hardware/EHP2_bb.png similarity index 71% rename from EHP2_bb.png rename to hardware/EHP2_bb.png index be809a8..3b81e76 100644 Binary files a/EHP2_bb.png and b/hardware/EHP2_bb.png differ diff --git a/dp.png b/hardware/dp.png similarity index 100% rename from dp.png rename to hardware/dp.png diff --git a/pico-2-r4-pinout.svg b/hardware/pico-2-r4-pinout.svg similarity index 100% rename from pico-2-r4-pinout.svg rename to hardware/pico-2-r4-pinout.svg diff --git a/Embedded-Hacking.pdf b/textbook/Embedded-Hacking.pdf similarity index 100% rename from Embedded-Hacking.pdf rename to textbook/Embedded-Hacking.pdf