QCORE-C1 Developer Guide

QCORE-DEV-001 Rev 0.9 — January 2026

Register-level programming guide for the QCORE-C1 chiplet covering the MMIO register map, DMA configuration, interrupt handling, and firmware development for bare-metal, RTOS, and Linux environments.

Register Map Overview #

The QCORE-C1 exposes a 64KB MMIO register space accessible through the QLI management sideband interface or JTAG debug port. All registers are 32-bit aligned with little-endian byte ordering.

Table 1 — Register Space Layout
Offset RangeBlockDescription
0x0000–0x00FFSystem ControlChip ID, version, global control, status, reset
0x0100–0x01FFQLI ControllerLink control/status, credits, counters, power states
0x0200–0x02FFNTT ArrayNTT control, configuration, lane status, debug
0x0300–0x03FFKeccak CoreHash control, mode selection, state access
0x0400–0x04FFKyber FSMOperation dispatch, parameter selection, status
0x0500–0x05FFDMA EngineDescriptor rings, source/dest addresses, control
0x0600–0x06FFInterrupt ControllerEnable, status, clear, coalescing timers
0x0700–0x07FFSecurityTamper status, zeroization trigger, key management
0x0800–0x0FFFPerformance CountersCycle counters, operation counts, stall metrics
0x1000–0xFFFFReserved / SRAM WindowDirect SRAM access for debug (JTAG only)

System Control Registers #

Table 2 — System Control Registers (0x0000–0x00FF)
OffsetNameR/WResetDescription
0x000CHIP_IDRO0x44594231Chip identification ("DYB1" ASCII)
0x004CHIP_VERSIONRO0x00000905RTL version (major.minor in BCD)
0x008CHIP_STATUSRO0x00000000Bit 0: NTT ready, Bit 1: QLI up, Bit 2: Keccak ready, Bit 3: SRAM initialized
0x00CCHIP_CTRLRW0x00000000Bit 0: Soft reset, Bit 1: Clock gate override, Bit 4–7: Power mode
0x010CHIP_FEATURESRO0x0000001FFeature flags: NTT[0], Keccak[1], CBD[2], QLI[3], DMA[4]
0x014NTT_CONFIGRO0x00080010Bits 7:0 = NTT lanes (8), Bits 23:16 = Radix (16)

Operation Dispatch #

ML-KEM operations are submitted through the Kyber FSM registers. A command-response model is used: write the operation parameters, write the command register to trigger, then poll (or wait for interrupt) until completion.

// ML-KEM-768 Key Generation — register-level example
// 1. Select parameter set
write_reg(0x0400, 0x00000003);    // KYBER_PARAM = ML-KEM-768 (k=3)

// 2. Set output buffer address (SRAM-relative)
write_reg(0x0408, 0x00002000);    // KYBER_PK_ADDR  = public key output
write_reg(0x040C, 0x00004000);    // KYBER_SK_ADDR  = secret key output

// 3. Provide seed (32 bytes via KYBER_SEED registers 0x0420–0x043F)
for (int i = 0; i < 8; i++)
    write_reg(0x0420 + i*4, seed[i]);

// 4. Trigger KeyGen
write_reg(0x0404, 0x00000001);    // KYBER_CMD = KEYGEN

// 5. Wait for completion
while (!(read_reg(0x0410) & 0x01))  // KYBER_STATUS.done
    ;  // Or use interrupt

// 6. Read result status
uint32_t status = read_reg(0x0410);
// Bit 0: done, Bit 1: error, Bits 7:4: error code
Table 3 — Kyber Command Codes
CommandValueDescription
KEYGEN0x01Generate ML-KEM key pair
ENCAPS0x02Encapsulate (requires public key + randomness)
DECAPS0x03Decapsulate (requires secret key + ciphertext)
NTT_FWD0x10Raw forward NTT on polynomial (debug)
NTT_INV0x11Raw inverse NTT on polynomial (debug)
HASH0x20SHA-3/SHAKE hash operation (debug)
ZEROIZE0xFFZeroize all key material in SRAM

DMA Engine #

The DMA engine transfers data between the QLI interface and internal SRAM without CPU intervention. It supports scatter-gather descriptor rings for efficient bulk key exchange operations.

Table 4 — DMA Registers (0x0500–0x05FF)
OffsetNameR/WDescription
0x500DMA_CTRLRWBit 0: Enable, Bit 1: Direction (0=RX, 1=TX), Bit 4: Scatter-gather
0x504DMA_STATUSROBit 0: Idle, Bit 1: Active, Bit 2: Error, Bits 15:8: Pending descriptors
0x508DMA_SRC_ADDRRWSource address (QLI address or SRAM offset)
0x50CDMA_DST_ADDRRWDestination address
0x510DMA_LENGTHRWTransfer length in bytes (max 4096)
0x514DMA_DESC_BASERWScatter-gather descriptor ring base (SRAM offset)
0x518DMA_DESC_COUNTRWNumber of descriptors in ring (max 32)
0x51CDMA_DESC_HEADRWProducer index (host writes)
0x520DMA_DESC_TAILROConsumer index (hardware updates)

Interrupt Controller #

Table 5 — Interrupt Sources
BitNameDescription
0KYBER_DONEML-KEM operation completed
1KYBER_ERRORML-KEM operation error
2DMA_DONEDMA transfer completed
3DMA_ERRORDMA transfer error
4QLI_LINK_DOWNQLI link lost
5QLI_CRC_ERRORQLI CRC error detected
6SRAM_ECC_ERRORSRAM ECC correction or detection
7TAMPER_DETECTSecurity tamper event
Table 6 — Interrupt Registers (0x0600–0x06FF)
OffsetNameR/WDescription
0x600INT_STATUSROActive interrupt flags
0x604INT_ENABLERWInterrupt enable mask
0x608INT_CLEARW1CWrite 1 to clear interrupt
0x60CINT_COALESCERWBits 15:0 = timer (μs), Bits 23:16 = count threshold

Firmware Development #

Bare-Metal

For bare-metal environments, the libqcore C library provides direct register access through memory-mapped I/O. The library includes a complete ML-KEM API, DMA management, and interrupt handling. The library has no external dependencies and compiles with any C99 compiler.

// Bare-metal ML-KEM-768 example (C)
#include <libqcore/qcore.h>
#include <libqcore/mlkem.h>

int main(void) {
    qcore_t *dev = qcore_init(QCORE_BASE_ADDR);

    // Generate keypair
    mlkem_keypair_t kp;
    mlkem_keygen(dev, MLKEM_768, &kp);

    // Encapsulate
    mlkem_encaps_result_t enc;
    mlkem_encaps(dev, MLKEM_768, kp.pk, &enc);

    // Decapsulate
    uint8_t ss[32];
    mlkem_decaps(dev, MLKEM_768, enc.ct, kp.sk, ss);

    // Verify
    assert(memcmp(enc.ss, ss, 32) == 0);
    qcore_zeroize(dev);  // Wipe key material
    return 0;
}

Linux Kernel Driver

A Linux kernel module (qcore_c1.ko) is available that exposes the QCORE-C1 as a character device (/dev/qcore0) with ioctl commands for ML-KEM operations. The driver supports multi-process access with per-context key isolation and integrates with the Linux Crypto API (AF_ALG) for transparent application-layer use.

RTOS Integration

The libqcore library is RTOS-agnostic. For FreeRTOS, Zephyr, or ThreadX environments, register the QCORE-C1 interrupt handler and use the provided semaphore-based completion API for non-blocking operation dispatch.

See also: QLI Interface Reference for QLI-specific registers, Security Architecture for tamper response programming.