Register Map

QCORE-REG-001 Rev 0.9 â€” January 2026

Complete 64KB MMIO register space definitions including control/status registers, NTT array configuration, Keccak core interface, DMA engine, and interrupt controller. All registers are 32-bit aligned, little-endian. Access via QLI sideband or JTAG REG_ACCESS instruction.

Memory Map Summary #

Offset Range	Block	Size	Access
`0x0000â€“0x00FF`	System Control	256 B	RO/RW
`0x0100â€“0x01FF`	QLI Controller	256 B	RO/RW/W1C
`0x0200â€“0x02FF`	NTT Array Control	256 B	RO/RW
`0x0300â€“0x03FF`	Keccak Core	256 B	RO/RW
`0x0400â€“0x04FF`	Kyber FSM	256 B	RO/RW
`0x0500â€“0x05FF`	DMA Engine	256 B	RO/RW
`0x0600â€“0x06FF`	Interrupt Controller	256 B	RO/RW/W1C
`0x0700â€“0x07FF`	Security Controller	256 B	RO/RW
`0x0800â€“0x0FFF`	Performance Counters	2 KB	RO
`0x1000â€“0xFFFF`	SRAM Debug Window	60 KB	RW (JTAG only)

System Control (0x0000â€“0x00FF) #

Offset	Name	R/W	Reset	Description
`0x000`	CHIP_ID	RO	`0x44594231`	Chip identification ("DYB1" in ASCII)
`0x004`	CHIP_VERSION	RO	`0x00000905`	Bits 15:8 = major (09), Bits 7:0 = minor (05)
`0x008`	CHIP_STATUS	RO	`0x00000000`	[0] NTT ready, [1] QLI link up, [2] Keccak ready, [3] SRAM init, [7] Zeroize done
`0x00C`	CHIP_CTRL	RW	`0x00000000`	[0] Soft reset, [1] Clock gate override, [7:4] Power mode (0=active, 1=idle, 2=sleep)
`0x010`	CHIP_FEATURES	RO	`0x0000001F`	[0] NTT, [1] Keccak, [2] CBD, [3] QLI, [4] DMA present
`0x014`	NTT_CONFIG	RO	`0x00080010`	[7:0] NTT lane count (8), [23:16] Radix (16)
`0x018`	SRAM_SIZE	RO	`0x00010000`	SRAM capacity in bytes (65536 = 64KB)
`0x01C`	SRAM_BANKS	RO	`0x00000004`	Number of SRAM banks (4)
`0x020`	BUILD_DATE	RO	varies	Build date in BCD: YYYYMMDD
`0x024`	BUILD_HASH	RO	varies	Git commit hash (first 32 bits)

NTT Array Registers (0x0200â€“0x02FF) #

Offset	Name	R/W	Description
`0x200`	NTT_CTRL	RW	[0] Enable, [1] Force idle, [3:2] Scheduling mode (0=auto, 1=round-robin, 2=priority)
`0x204`	NTT_STATUS	RO	[7:0] Per-engine busy flags, [15:8] Per-engine error flags
`0x208`	NTT_ENGINE_MAP	RO	Engine-to-polynomial assignment (debug)
`0x20C`	NTT_CYCLE_COUNT	RO	Total NTT cycles executed (32-bit, wraps)
`0x210`	NTT_STALL_COUNT	RO	SRAM contention stall cycles
`0x220`	NTT_SHUFFLE_SEED	RW	Shuffle PRNG seed for side-channel resistance
`0x224`	NTT_DUMMY_RATE	RW	[1:0] Dummy op rate: 0=0%, 1=10%, 2=25%, 3=50%

Keccak Core Registers (0x0300â€“0x03FF) #

Offset	Name	R/W	Description
`0x300`	KECCAK_CTRL	RW	[0] Enable, [3:1] Mode (0=SHA3-256, 1=SHA3-512, 2=SHAKE-128, 3=SHAKE-256)
`0x304`	KECCAK_STATUS	RO	[0] Busy, [1] Done, [2] Error
`0x308`	KECCAK_PERM_COUNT	RO	Total permutations executed
`0x310â€“0x3CF`	KECCAK_STATE[0:49]	RW	Direct access to 1600-bit state (50 Ã— 32-bit words, debug only)

Kyber FSM Registers (0x0400â€“0x04FF) #

Offset	Name	R/W	Description
`0x400`	KYBER_PARAM	RW	[1:0] Parameter set: 2=ML-KEM-512, 3=ML-KEM-768, 4=ML-KEM-1024
`0x404`	KYBER_CMD	RW	Command: 0x01=KeyGen, 0x02=Encaps, 0x03=Decaps, 0xFF=Zeroize
`0x408`	KYBER_PK_ADDR	RW	Public key SRAM address
`0x40C`	KYBER_SK_ADDR	RW	Secret key SRAM address
`0x410`	KYBER_STATUS	RO	[0] Done, [1] Error, [7:4] Error code
`0x414`	KYBER_CT_ADDR	RW	Ciphertext SRAM address (Encaps/Decaps)
`0x418`	KYBER_SS_ADDR	RW	Shared secret output SRAM address
`0x41C`	KYBER_CYCLES	RO	Cycle count of last operation
`0x420â€“0x43F`	KYBER_SEED[0:7]	RW	32-byte seed input (8 Ã— 32-bit words)

Security Registers (0x0700â€“0x07FF) #

Offset	Name	R/W	Description
`0x700`	SEC_CTRL	RW	[0] Masking enable, [1] Shuffling enable, [3:2] Dummy rate, [4] Tamper response enable
`0x704`	SEC_STATUS	RO	[0] Tamper detected, [1] Glitch detected, [2] Temp warning, [3] Temp critical
`0x708`	SEC_TAMPER_LOG	RO	Latched tamper event details (cleared on read)
`0x70C`	SEC_ZEROIZE	WO	Write 0xDEAD to trigger immediate zeroization
`0x710`	SEC_TEMP	RO	Current junction temperature (Â°C, 8-bit signed)
`0x714`	SEC_ECC_ERRORS	RO	[15:0] Correctable ECC count, [31:16] Uncorrectable count

See also: Developer Guide for programming examples, QLI Interface Reference for QLI controller registers (0x0100â€“0x01FF).