Memory Map and Register Reference

1. Memory Map

This section provides a comprehensive overview of the SMC memory map. The SMC address space is organized to provide access to various functional units including CPU control, peripheral interfaces, system management functions, and fabric control mechanisms.

All addresses below are expressed as BASE + offset, where BASE can be either the local alias (LOCAL_BASE, fixed read-only at 0xC000_0000) or the global system address (GLOBAL_BASE, programmable by firmware). The fabric routes transactions to SMC resources identically regardless of which base is used, as long as the access falls inside the relevant local or global aperture. Both apertures are sized by the SMC REGION_SIZE CSR, which resets to 16 MiB and may be reprogrammed by firmware. Address ranges include both endpoints. Addresses are 32-bit aligned and follow standard AXI4-Lite addressing conventions. For details on how LOCAL_BASE and GLOBAL_BASE relate and how an adopter maps this aperture into the system address space, refer to the SMC Address Map Integration section of the Integration Guide.

1.1. Address Space Organization

The generated component map reports each allocated aperture separately from the extent occupied by registers.

Table 1. SMC Functional Address-Space Organization
Address Range	Size	Unit	Description
BASE + 0x0 – BASE + 0xFFF	4 KiB	Watchdog Timers	Per-core watchdog timers.
BASE + 0x2000 – BASE + 0xBFFF	40 KiB	System and Peripheral Control	Reset, GPIO, serial peripherals, eFuse, telemetry, timer, DTP, and DFT status.
BASE + 0x10000 – BASE + 0x16FFF	28 KiB	Fabric Control	Base configuration, address remapping, and traffic filters.
BASE + 0x18000 – BASE + 0x37FFF	128 KiB	Mailbox	Thirty-two bidirectional mailbox pairs.
BASE + 0x38000 – BASE + 0x382FF	768 B	Data Processing	DMA controller and memory zeroer.
BASE + 0x39000 – BASE + 0x3FFFF	28 KiB	CPU and I/O Control	CPU-cluster control and OCA I3C controller.
BASE + 0x40000 – BASE + 0x15FFFF	1152 KiB	Local Memories	Scratchpad ROM and RAM.
BASE + 0x160000 – BASE + 0x163FFF	16 KiB	CLA	Core Logic Analyzer debug and trace.
BASE + 0x400000 – BASE + 0x406547	25928 B	Adopter External	Adopter-owned technology-specific and supplementary peripherals.
BASE + 0x1000000 – BASE + 0x1FFFFFF	16 MiB	Address Remapping	Machine-mode and hypervisor remapped regions.
BASE + 0x4000000 – BASE + 0x7FFFFFF	64 MiB	PLIC	Platform-Level Interrupt Controller aperture.
BASE + 0x8000000 – BASE + 0x8013FFF	80 KiB	Core-Local Timer and Errors	Core-local timer and per-core bus-error units.

Table 2. SMC Component Address Map
Address Range	Size	Decoded Extent	Unit	Instances	Stride	Description	Hole in Extent (R / W)	Past Extent (R / W)
BASE + 0x0 – BASE + 0x3FF	1 KiB	36 B	Watchdog Timer Address Map	1 instance	-	Core 0 watchdog timer.	OKAY, 0x0 / OKAY	DECERR, 0xBADCAB1E / DECERR
BASE + 0x400 – BASE + 0x7FF	1 KiB	36 B	Watchdog Timer Address Map	1 instance	-	Core 1 watchdog timer.	OKAY, 0x0 / OKAY	DECERR, 0xBADCAB1E / DECERR
BASE + 0x800 – BASE + 0xBFF	1 KiB	36 B	Watchdog Timer Address Map	1 instance	-	Core 2 watchdog timer.	OKAY, 0x0 / OKAY	DECERR, 0xBADCAB1E / DECERR
BASE + 0xC00 – BASE + 0xFFF	1 KiB	36 B	Watchdog Timer Address Map	1 instance	-	Core 3 watchdog timer.	OKAY, 0x0 / OKAY	DECERR, 0xBADCAB1E / DECERR
BASE + 0x1000 – BASE + 0x1867	2152 B	2152 B	Debug Module Hart Interface	1 instance	-	Memory region through which a hart in Debug Mode exchanges state with the Debug Module: handshake mailboxes, generated instructions, program buffer, data registers, per-hart flags and the debug ROM. Only the harts of the CPU cluster reach this region; SMC bus initiators outside the cluster do not. The debugger-facing Debug Module registers (dmcontrol, dmstatus, abstractcs, sbcs, …) are reached over the Debug Module Interface and do not appear in this map.	DECERR, 0xBADCAB1E / DECERR^[1]	-
BASE + 0x2000 – BASE + 0x27FF	2 KiB	204 B	Reset Unit Address Map	1 instance	-	System reset control.	OKAY, 0x0 / OKAY	DECERR, 0xBADCAB1E / SLVERR
BASE + 0x2800 – BASE + 0x2FFF	2 KiB	524 B	SMC Miscellaneous Wrapper Address Map	1 instance	-	Aggregates the SMC scratch, chip-configuration, and NDM-reset register blocks.	DECERR, 0xBADCAB1E / SLVERR	DECERR, 0xBADCAB1E / SLVERR
BASE + 0x3000 – BASE + 0x3FFF	4 KiB	1040 B	GPIO Interface Address Map	65 instances	16 B	GPIO interface configuration: pad/core routing, receive and transmit enables, and interrupt control.	OKAY, 0x0 / OKAY	DECERR, 0xBADCAB1E / SLVERR
BASE + 0x4000 – BASE + 0x4FFF	4 KiB	92 B	AVSBus Controller Address Map	1 instance	-	Command, readback, status, and interrupt registers for the AVSBus (V1.3.1) controller.	OKAY, 0x0 / OKAY	DECERR, 0xBADCAB1E / SLVERR
BASE + 0x5000 – BASE + 0x5FFF	4 KiB	3596 B	I2C Wrapper Address Map	1 instance	-	I2C and SMBus controller.	DECERR, 0xBADCAB1E / SLVERR	DECERR, 0xBADCAB1E / SLVERR
BASE + 0x6000 – BASE + 0x6FFF	4 KiB	4 KiB	UART Wrapper Address Map	1 instance	-	UART controller.	OKAY, 0x0 / OKAY; between sub-blocks: DECERR, 0xBADCAB1E / SLVERR	-
BASE + 0x7000 – BASE + 0x7FFF	4 KiB	1 KiB	Efuse address map of physical efuse macro	1 instance	-	Address map for efuse shadow registers providing access to various chip configuration and ID fields	-	DECERR, 0xBADCAB1E / SLVERR
BASE + 0x8000 – BASE + 0x8FFF	4 KiB	28 B	eFuse Interface Control Address Map	1 instance	-	eFuse command and status registers.	-	DECERR, 0xBADCAB1E / SLVERR
BASE + 0x9000 – BASE + 0x9FFF	4 KiB	768 B	Telemetry Receiver Wrapper Address Map	1 instance	-	Telemetry data receiver.	OKAY, 0x0 / OKAY	DECERR, 0xBADCAB1E / SLVERR
BASE + 0xA000 – BASE + 0xAFFF	4 KiB	36 B	OCTS System Timer Address Map	1 instance	-	Open Chiplet Time Synchronization (OCTS) System Timer Registers	-	DECERR, 0xBADCAB1E / SLVERR
BASE + 0xB000 – BASE + 0xB7FF	2 KiB	2 KiB	dtp_ctrl_reg	1 instance	-	512-entry DTP control block.	Forwarded	-
BASE + 0xB800 – BASE + 0xBFFF	2 KiB	24 B	DFX Control and Status Address Map	1 instance	-	DFT status exposed to boot firmware.	OKAY, 0x0 / OKAY	DECERR, 0xBADCAB1E / DECERR
BASE + 0x10000 – BASE + 0x11FFF	8 KiB	76 B	SMC Base Configuration Address Map	1 instance	-	SMC base-address and aperture configuration.	OKAY, 0x0 / OKAY	DECERR, 0xBADCAB1E / SLVERR
BASE + 0x12000 – BASE + 0x12FFF	4 KiB	256 B	AXI Alias Remap Address Map	8 instances	32 B	TLB Registers for address remapping and attribute tagging	OKAY, 0x0 / OKAY	DECERR, 0xBADCAB1E / SLVERR
BASE + 0x13000 – BASE + 0x13FFF	4 KiB	64 B	Output Remap Address Map	8 instances	8 B	Address-translation registers that remap outbound transactions and tag their attributes.	-	DECERR, 0xBADCAB1E / SLVERR
BASE + 0x14000 – BASE + 0x14FFF	4 KiB	64 B	Output Remap Address Map	8 instances	8 B	Address-translation registers that remap outbound transactions and tag their attributes.	-	DECERR, 0xBADCAB1E / SLVERR
BASE + 0x15000 – BASE + 0x15FFF	4 KiB	512 B	AXI Filter Control Address Map	16 instances	32 B	Per-filter access-control registers defining permitted address ranges and transaction attributes.	OKAY, 0x0 / OKAY	DECERR, 0xBADCAB1E / SLVERR
BASE + 0x16000 – BASE + 0x16FFF	4 KiB	512 B	AXI Filter Control Address Map	16 instances	32 B	Per-filter access-control registers defining permitted address ranges and transaction attributes.	OKAY, 0x0 / OKAY	DECERR, 0xBADCAB1E / SLVERR
BASE + 0x18000 – BASE + 0x37FFF	128 KiB	129104 B	SMC AXI-Lite Mailbox Wrapper Address Map	1 instance	-	Thirty-two bidirectional mailbox pairs.	SLVERR, 0x0 / SLVERR	DECERR, 0xBADCAB1E / DECERR
BASE + 0x38000 – BASE + 0x381FF	512 B	312 B	iDMA Controller Address Map	1 instance	-	Direct-memory-access controller.	OKAY, 0xFFFFFFFF / OKAY	DECERR, 0xBADCAB1E / DECERR
BASE + 0x38200 – BASE + 0x382FF	256 B	24 B	Zeroer Control Address Map	1 instance	-	Control and status registers for the AXI memory-zeroing engine.	-	DECERR, 0xBADCAB1E / DECERR
BASE + 0x39000 – BASE + 0x39FFF	4 KiB	704 B	CPU Control Address Map	1 instance	-	SMC CPU-cluster control.	OKAY, 0x0 / OKAY	DECERR, 0xBADCAB1E / DECERR
BASE + 0x3A000 – BASE + 0x3FFFF	24 KiB	24 KiB	OCA I3C Controller Wrapper Address Map	1 instance	-	Wrapper address map instantiating the per-controller I3C CSR blocks.	OKAY, 0x0 / OKAY^[2]	-
BASE + 0x40000 – BASE + 0x5FFFF	128 KiB	128 KiB	spm_rom_memory	1 instance	-	Scratchpad ROM memory, present only in non-CPL configurations.	-^[3]	-
BASE + 0x60000 – BASE + 0x15FFFF	1 MiB	1 MiB	spm_memory	1 instance	-	Scratch RAM Memory - only present for non-CPL configurations	-	-
BASE + 0x160000 – BASE + 0x163FFF	16 KiB	16 KiB	SMC DFD MMR Aperture Address Map	1 instance	-	Core Logic Analyzer debug and trace aperture.	OKAY, 0x0 / OKAY	-
BASE + 0x400000 – BASE + 0x406547	25928 B	25928 B	SMC External Window Address Map	1 instance	-	Adopter-owned external peripheral aperture.	Adopter-defined	-
BASE + 0x1000000 – BASE + 0x17FFFFF	8 MiB	8 MiB	mmode_region	1 instance	-	Address region whose accesses an output remap redirects.	Forwarded	-
BASE + 0x1800000 – BASE + 0x1FFFFFF	8 MiB	8 MiB	xvisor_region	1 instance	-	Address region whose accesses an output remap redirects.	Forwarded	-
BASE + 0x4000000 – BASE + 0x7FFFFFF	64 MiB	2125832 B	PLIC Address Map	1 instance	-	Platform-Level Interrupt Controller.	OKAY, 0x0 / OKAY^[4]	DECERR, 0xBADCAB1E / DECERR
BASE + 0x8000000 – BASE + 0x800FFFF	64 KiB	48 KiB	CLINT Address Map	1 instance	-	Core-Local Interruptor.	OKAY, 0x0 / OKAY	DECERR, 0xBADCAB1E / DECERR
BASE + 0x8010000 – BASE + 0x8010FFF	4 KiB	48 B	Bus Error Unit Address Map	1 instance	-	Core 0 bus-error unit.	-	DECERR, 0xBADCAB1E / DECERR
BASE + 0x8011000 – BASE + 0x8011FFF	4 KiB	48 B	Bus Error Unit Address Map	1 instance	-	Core 1 bus-error unit.	-	DECERR, 0xBADCAB1E / DECERR
BASE + 0x8012000 – BASE + 0x8012FFF	4 KiB	48 B	Bus Error Unit Address Map	1 instance	-	Core 2 bus-error unit.	-	DECERR, 0xBADCAB1E / DECERR
BASE + 0x8013000 – BASE + 0x8013FFF	4 KiB	48 B	Bus Error Unit Address Map	1 instance	-	Core 3 bus-error unit.	-	DECERR, 0xBADCAB1E / DECERR
BASE + 0x8014000 – BASE + 0x8014FFF	4 KiB	4 KiB	smc_cluster_error_device	1 instance	-	Error responder for unmapped cluster-bus accesses.	DECERR, 0xBADCAB1E / DECERR^[1]	-

Notes

^[1] Only the harts of the CPU cluster reach this unit. An access from outside the cluster answers the same at every address in its aperture.
^[2] Each instance implements 16 DAT and 16 DCT entries: the DAT at 0x400-0x7FF repeats every 0x80 bytes, the DCT at 0x800-0xFFF repeats every 0x100 bytes, and DCT writes are dropped.
^[3] A write answers SLVERR and leaves the ROM unchanged.
^[4] 0x544, 0x102C and 0x202C are the upper halves of live 64-bit words, so a 64-bit read there returns live data.

The last two columns state how the SMC answers a 32-bit access that no register or memory backs, as seen at its inbound AXI port, and Decode Response Codes defines them and their codes.

An address between unit apertures reaches no unit. A read there answers DECERR with data 0xBADCAB1E, and a write answers DECERR, except from BASE + 0x001_7000 through BASE + 0x001_7FFF, where it answers SLVERR.

An address inside neither the local nor the global aperture answers DECERR to reads and writes. The M-mode and Xvisor remap regions forward accesses from SMC initiators only; an access to them from the inbound port answers DECERR.

The inbound port reaches a unit only while its whole aperture lies below BASE + REGION_SIZE. At the reset value the PLIC, CLINT and bus-error units lie beyond it and answer DECERR. The SMC harts reach the PLIC and CLINT inside the CPU cluster regardless of REGION_SIZE.

The I2C, UART, I3C, AVSBus and Telemetry Receiver windows answer SLVERR, with read data 0xBADCAB1E, while the peripheral’s CLOCK_GATE_CONTROL enable in SMC_BASE_CONFIG is set and its clock is stopped.

1.2. AXI-Lite External Window

The smc_external window at BASE + 0x040_0000 is the adopter extension window. OCAH exposes this AXI-Lite bus so an adopter can attach their own technology- and vendor-specific implementations of memory-mapped blocks. The window is split into two regions (see smc_external.rdl). Apart from the eFuse SHIM control block described below, hardware treats both identically; the split is purely organizational:

Mandatory (BASE + 0x040_0000): blocks every integration must implement. Their function is dictated by the OCAH specifications, but their implementation is inherently technology- and vendor-specific — the eFuse SHIM, the per-pad GPIO controls, the PLL wrapper and the strap registers at BASE + 0x040_3000.
Supplementary (BASE + 0x040_4000): any additional memory-mapped devices the adopter wants to expose, such as peripheral controllers, extra pad controls and the PVT wrapper.

The generated SMC map reports this as one opaque adopter-owned aperture. Concrete placements inside it are integration-specific and are documented by the adopter. The strap registers are read-only values consumed by boot firmware; how the adopter captures them is implementation-defined. Both boot ROMs read them at BASE + 0x040_3000, so an integration places them there.

The eFuse SHIM control block is the exception. Its placement is fixed at the base of the window, BASE + 0x040_0000, and its size is the EFUSE_SHIM_SIZE parameter (CFG.SMC_EFUSE_SHIM_SIZE at the SMU). The peripheral crossbar routes that range to the eFuse controller, which forwards it unchanged on efuse_bank_ctrl to the adopter’s SHIM. It never appears on the external port. The adopter defines the SHIM’s control registers at offset 0x0 of its own smc_external map.

The supplementary (optional) region of the window is passed through to the SMU’s smc_external_req_o / smc_external_resp_i ports for adopter integration. The adopter may implement any memory-mapped functions there, or may instead terminate the region with an error response. The reference integration (hw/top/smc_ip_integration.sv) terminates unclaimed accesses in this region with a DECERR response via the prim_axi_lite_err_slv helper; this is one integration choice, not a requirement.

1.3. Register Interface Standards

All SMC components use standard AMBA interfaces. We summarize the interfaces in Table 3:

Table 3. SMC Register Interface Standards
Interface	Address Width	Data Width	Description
AXI4-Lite	32-bit	64-bit	High-performance components
APB4	32-bit	32-bit	Peripheral components
Address Alignment: 32-bit registers on 4-byte boundaries, 64-bit on 8-byte boundaries
Endianness: Little-endian byte ordering throughout
Protection: AXI protection bits used for secure/non-secure access control

1.4. Access Control and Security

Table 4 summarises the SMC access-control mechanisms.

Table 4. SMC Access Control Mechanisms
Mechanism	Description
Address Filtering	Configurable inbound and outbound address filters
Protection Levels	AXI protection attribute enforcement
Secure Regions	eFuse and security-critical registers require elevated privileges
Error Handling	Bus error units provide comprehensive error logging and reporting

2. Detailed Register Map

2.1. External Window Reference Maps

The PLL and PVT maps below describe placeholder memory footprints used by the open verification models. Their memory words do not specify the control registers of an adopter’s clock or sensor implementation. The straps map describes captured GPIO values. Placement of these blocks within the external window is integration-specific.

PLL Wrapper Placeholder Address Map

Adopter clock-control placeholder reserving the PLL map slot; no CSRs are modeled.

Register Arrays:

mem_array[954]: 954 registers, base 0x0, stride 0x4

Register List:

Table 5. PLL Wrapper Placeholder Address Map register list
Address	Name	Access	Description
0x0 - 0xEE4	mem_array[954]	R	-

Register Details:

mem_array[954]

Table 6. pll_wrap.mem_array[954] fields
Bits	Field	Access	Reset	Description
31:0	data	R	-	-

PVT Wrapper Placeholder Address Map

Adopter PVT and monitor placeholder reserving the map slot; no CSRs are modeled.

Register Arrays:

mem_array[594]: 594 registers, base 0x0, stride 0x4

Register List:

Table 7. PVT Wrapper Placeholder Address Map register list
Address	Name	Access	Description
0x0 - 0x944	mem_array[594]	R	-

Register Details:

mem_array[594]

Table 8. pvt_wrap.mem_array[594] fields
Bits	Field	Access	Reset	Description
31:0	data	R	-	-

Straps Address Map

Configuration strap values. How they are captured is adopter-defined.

Register List:

Table 9. Straps Address Map register list
Address	Name	Access	Description
0x0	STRAPS_LO	R	-
0x4	STRAPS_HI	R	-

Register Details:

STRAPS_LO

Table 10. straps.STRAPS_LO fields
Bits	Field	Access	Reset	Description
31:0	straps	R	0x0	Configuration straps 0 - 31. Bits 0 - 10, 16, 17, 24 and 27 - 31 have no strap assigned; no strap function consumes them. Strap assignments in this range: * bit 11: CHIP_ID[3] - CHIP_ID is the I2C/I3C static address strap * bit 12: CHIP_ID[2] - CHIP_ID is the I2C/I3C static address strap * bit 13: BYPASS_SRAM_REPAIR - Bypass the memory repair process * bit 14: TEST_EN - Enable DFT test mode * bit 15: CHIP_ID[1] - CHIP_ID is the I2C/I3C static address strap * bit 18: BOOT_I2C - Default alternate boot channel is I3C0 and can be reconfigured to use I2C0 * bit 19: BOOT_RECOVERY - Use I3C0 for BL1 boot image loading instead of the SPI channel * bit 20: BL0_PLLCLK - Use the PLL generated clock by default in BL0, and override to use the reference clock when this strap is asserted * bit 21: STATUS_RPT_DISABLE - Disable BL0 status reporting. It is on by default * bit 22: SPI_USE_FUSED_CONFIG - Use the SPI configuration values stored in the fuse field * bit 23: CHIP_ID[0] - CHIP_ID is the I2C/I3C static address strap * bit 25: PRIMARY_CHIPLET - Identifies the primary chiplet, the boot master * bit 26: SRAM_AUTO_ZERO_DISABLE - Disable auto zero of the SMC SRAM when asserted

STRAPS_HI

Table 11. straps.STRAPS_HI fields
Bits	Field	Access	Reset	Description
31:29	Reserved	-	-	Reserved
28:0	straps	R	0x0	Configuration straps 32 - 60. All bits other than those listed below have no strap assigned; no strap function consumes them. Strap assignments in this range: * bit 22: MBIST_BYPASS - Ignore results of Power-On MBIST for boot * bit 26: ROTATE_UPDATE - Swaps primary and backup image in SEP BL0 ROM

3. Spare SMC Register Blocks

The following shows the detailed register map of a set of programmer-visible spare SMC blocks. They are spare but essential: for example, the scratch block provides general-purpose registers, and the chip-config and NDM-reset blocks hold system-level configuration and reset control.

3.1. Chip Config, Scratch, NDM Reset, and Misc Wrap

Chip Configuration Address Map

Chip version, identification, and lifecycle-state registers.

Register List:

Table 12. Chip Configuration Address Map register list
Address	Name	Access	Description
0x0	VERSION_LO	R	-
0x4	VERSION_HI	R	-
0x8	CHIP_ID	R	-
0xC	LC_STATE	R	-

Register Details:

VERSION_LO

Table 13. chip_config.VERSION_LO fields
Bits	Field	Access	Reset	Description
31:0	version_lo	R	0x100A0	SMC version, lower 32 bits

VERSION_HI

Table 14. chip_config.VERSION_HI fields
Bits	Field	Access	Reset	Description
31:0	version_hi	R	0x0	SMC version, upper 32 bits

CHIP_ID

Table 15. chip_config.CHIP_ID fields
Bits	Field	Access	Reset	Description
31:0	chip_id	R	0x0	Chip ID (e.g. 0 = Memory, 1 = CPU, 2 = AI Compute, 3 = Ethernet)

LC_STATE

Table 16. chip_config.LC_STATE fields
Bits	Field	Access	Reset	Description
31:8	Reserved	-	-	Reserved
7:0	lc_state	R	0xF	Lifecycle state value from SEP. Default to invalid state

Scratch Address Map

General-purpose scratch register bank.

Register Arrays:

SCRATCH[8]: 8 registers, base 0x0, stride 0x4

Register List:

Table 17. Scratch Address Map register list
Address	Name	Access	Description
0x0 - 0x1C	SCRATCH[8]	RW	-

Register Details:

SCRATCH[8]

Table 18. scratch.SCRATCH[8] fields
Bits	Field	Access	Reset	Description
31:0	data	RW	0x0	Scratch register

NDM Reset Control Address Map

Per-cluster NDM reset handshake with an external CPU cluster debug module

Register List:

Table 19. NDM Reset Control Address Map register list
Address	Name	Access	Description
0x0	NDMRESET_REQUEST	R	-
0x4	NDMRESET_PROCESS	RW	-
0x8	NDMRESET_CLUSTER_COUNT	R	-

Register Details:

NDMRESET_REQUEST

Table 20. ndm_reset.NDMRESET_REQUEST fields
Bits	Field	Access	Reset	Description
31:0	ndmreset_request	R	0x0	Bit i is the NDM reset request from external CPU cluster i. Bits below ndmreset_cluster_count follow the request input. Bits at and above that count read as 0. The field holds up to 32 clusters.

NDMRESET_PROCESS

Table 21. ndm_reset.NDMRESET_PROCESS fields
Bits	Field	Access	Reset	Description
31:0	ndmreset_process	RW	0x0	Bit i is the firmware response to the NDM reset request from external CPU cluster i. Bits below ndmreset_cluster_count are driven on the process output. Bits at and above that count are stored and are not driven. The field holds up to 32 clusters.

NDMRESET_CLUSTER_COUNT

Table 22. ndm_reset.NDMRESET_CLUSTER_COUNT fields
Bits	Field	Access	Reset	Description
31:8	Reserved	-	-	Reserved
7:0	ndmreset_cluster_count	R	0x0	Number of external CPU clusters connected on the low bits of NDMRESET_REQUEST and NDMRESET_PROCESS. Software masks those registers with this value. The maximum is 32.

SMC Miscellaneous Wrapper Address Map

Aggregates the SMC scratch, chip-configuration, and NDM-reset register blocks.

Register Arrays:

scratch_cold.SCRATCH[8]: 8 registers, base 0x0, stride 0x4
scratch_cold_warm.SCRATCH[8]: 8 registers, base 0x80, stride 0x4

Register List:

Table 23. SMC Miscellaneous Wrapper Address Map register list
Address	Name	Access	Description
0x0 - 0x1C	scratch_cold.SCRATCH[8]	RW	-
0x80 - 0x9C	scratch_cold_warm.SCRATCH[8]	RW	-
0x100	VERSION_LO	R	-
0x104	VERSION_HI	R	-
0x108	CHIP_ID	R	-
0x10C	LC_STATE	R	-
0x200	NDMRESET_REQUEST	R	-
0x204	NDMRESET_PROCESS	RW	-
0x208	NDMRESET_CLUSTER_COUNT	R	-

Register Details:

scratch_cold.SCRATCH[8]

Table 24. misc_wrap.scratch_cold.SCRATCH[8] fields
Bits	Field	Access	Reset	Description
31:0	data	RW	0x0	Scratch register

scratch_cold_warm.SCRATCH[8]

Table 25. misc_wrap.scratch_cold_warm.SCRATCH[8] fields
Bits	Field	Access	Reset	Description
31:0	data	RW	0x0	Scratch register

VERSION_LO

Table 26. misc_wrap.VERSION_LO fields
Bits	Field	Access	Reset	Description
31:0	version_lo	R	0x100A0	SMC version, lower 32 bits

VERSION_HI

Table 27. misc_wrap.VERSION_HI fields
Bits	Field	Access	Reset	Description
31:0	version_hi	R	0x0	SMC version, upper 32 bits

CHIP_ID

Table 28. misc_wrap.CHIP_ID fields
Bits	Field	Access	Reset	Description
31:0	chip_id	R	0x0	Chip ID (e.g. 0 = Memory, 1 = CPU, 2 = AI Compute, 3 = Ethernet)

LC_STATE

Table 29. misc_wrap.LC_STATE fields
Bits	Field	Access	Reset	Description
31:8	Reserved	-	-	Reserved
7:0	lc_state	R	0xF	Lifecycle state value from SEP. Default to invalid state

NDMRESET_REQUEST

Table 30. misc_wrap.NDMRESET_REQUEST fields
Bits	Field	Access	Reset	Description
31:0	ndmreset_request	R	0x0	Bit i is the NDM reset request from external CPU cluster i. Bits below ndmreset_cluster_count follow the request input. Bits at and above that count read as 0. The field holds up to 32 clusters.

NDMRESET_PROCESS

Table 31. misc_wrap.NDMRESET_PROCESS fields
Bits	Field	Access	Reset	Description
31:0	ndmreset_process	RW	0x0	Bit i is the firmware response to the NDM reset request from external CPU cluster i. Bits below ndmreset_cluster_count are driven on the process output. Bits at and above that count are stored and are not driven. The field holds up to 32 clusters.

NDMRESET_CLUSTER_COUNT

Table 32. misc_wrap.NDMRESET_CLUSTER_COUNT fields
Bits	Field	Access	Reset	Description
31:8	Reserved	-	-	Reserved
7:0	ndmreset_cluster_count	R	0x0	Number of external CPU clusters connected on the low bits of NDMRESET_REQUEST and NDMRESET_PROCESS. Software masks those registers with this value. The maximum is 32.

3.2. Base Config and DFX Status

SMC Base Configuration Address Map

Base-address, region-size, per-block clock-gating enable, and interrupt configuration registers.

Register List:

Table 33. SMC Base Configuration Address Map register list
Address	Name	Access	Description
0x0	GLOBAL_BASE	RW	-
0x8	LOCAL_BASE	R	-
0x10	REGION_SIZE	RW	-
0x18	CLOCK_GATE_CONTROL	RW	-
0x20	HANG_DET_SYS_AXI_CTRL	RW	AXI hang detector control and interrupt status.
0x28	HANG_DET_SYS_AXI_TIMEOUT_THRESHOLD	RW	Consecutive cycles with outstanding AXI transactions and no completion before a timeout fires.
0x30	HANG_DET_SEP_AXI_CTRL	RW	AXI hang detector control and interrupt status.
0x38	HANG_DET_SEP_AXI_TIMEOUT_THRESHOLD	RW	Consecutive cycles with outstanding AXI transactions and no completion before a timeout fires.
0x40	HANG_DET_DATA_ACCEL_CTRL	RW	AXI hang detector control and interrupt status.
0x48	HANG_DET_DATA_ACCEL_TIMEOUT_THRESHOLD	RW	Consecutive cycles with outstanding AXI transactions and no completion before a timeout fires.

Register Details:

GLOBAL_BASE

Table 34. smc_base_config.GLOBAL_BASE fields
Bits	Field	Access	Reset	Description
63:56	Reserved	-	-	Reserved
55:0	base	RW	0x40000000	Global base address for the CPU

LOCAL_BASE

Table 35. smc_base_config.LOCAL_BASE fields
Bits	Field	Access	Reset	Description
63:56	Reserved	-	-	Reserved
55:0	base	R	0xC0000000	Local base address for the CPU

REGION_SIZE

Table 36. smc_base_config.REGION_SIZE fields
Bits	Field	Access	Reset	Description
63:32	Reserved	-	-	Reserved
31:0	size	RW	0x1000000	Region size for SMC resources, sizing both the local alias window and the global aperture. Must be a non-zero power of two: the fabric derives its local-alias address mask as (size - 1), so any other value produces a discontiguous mask and misroutes accesses. Zero leaves no reachable local aperture. GLOBAL_BASE and LOCAL_BASE must be aligned to this size. Inbound accesses to a unit whose window extends past this size answer DECERR. Defaults to 16MB (0x100_0000); FW reprograms per chiplet spec.

CLOCK_GATE_CONTROL

Table 37. smc_base_config.CLOCK_GATE_CONTROL fields
Bits	Field	Access	Reset	Description
63:30	Reserved	-	-	Reserved
29:24	cg_hysteresis	RW	0x1F	Clockgate cg_hysteresis
23:14	Reserved	-	-	Reserved
13	telemetry_cg_en	RW	0x0	Clock gate enable for telemetry. While set, the telemetry receiver clocks are stopped and every access to the SMC_TELEMETRY_RECEIVER_WRAP window answers SLVERR with read data 0xBADCAB1E.
12	uart_cg_en	RW	0x0	Clock gate enable for UART. While set, the UART peripheral clock is stopped and every access to the SMC_UART_WRAP window answers SLVERR with read data 0xBADCAB1E.
11	i2c_cg_en	RW	0x0	Clock gate enable for I2C. While set, the I2C peripheral clock is stopped and every access to the SMC_I2C_WRAP window answers SLVERR with read data 0xBADCAB1E.
10	avs_cg_en	RW	0x0	Clock gate enable for AVSBus. While set, the AVSBus controller clocks are stopped and every access to the SMC_AVSBUS_CONTROLLER window answers SLVERR with read data 0xBADCAB1E.
9	i3c_cg_en	RW	0x0	Clock gate enable for I3C. While set, the I3C peripheral clock is stopped and every access to the OCA_I3C_WRAP window answers SLVERR with read data 0xBADCAB1E.
8	zeroer_cg_en	RW	0x0	Clock gate enable for axi zeroer
7	output_fabric_cg_en	RW	0x0	Clock gate enable for the output fabric remap demux and mux
6	addr_remap_cg_en	RW	0x0	Clock gate enable for address remapper register logic
5	filter_ib_reg_cg_en	RW	0x0	Clockgate enable for inbound filter registers
4	filter_ib_axi_cg_en	RW	0x0	Clockgate enable for the inbound filters
3	filter_ob_reg_cg_en	RW	0x0	Clockgate enable for outbound filter registers
2	filter_ob_axi_cg_en	RW	0x0	Clockgate enable for the outbound filters
1	mailbox_cg_en	RW	0x0	Clockgate enable for the mailbox
0	dma_cg_en	RW	0x0	Clockgate enable for the DMA

HANG_DET_SYS_AXI_CTRL

Table 38. smc_base_config.HANG_DET_SYS_AXI_CTRL fields
Bits	Field	Access	Reset	Description
31:13	Reserved	-	-	Reserved
12	irq	R	0x0	Reads 1 while this detector's interrupt is asserted, from a timeout or from irq_test, and 0 while enable or irq_en is clear. A live level, not a latch: it clears when the interrupt drops. Writes are ignored.
11:9	Reserved	-	-	Reserved
8	irq_test	RW	0x0	Interrupt test. When 1, asserts irq_o without a bus stall, so firmware can exercise the interrupt path. Gated by enable and irq_en: it substitutes for the timeout, it does not override the interrupt enable.
7:5	Reserved	-	-	Reserved
4	irq_en	RW	0x0	Interrupt enable. When irq_en and enable are high, irq_o follows the detector; when 0, irq_o is held low. Gates a real timeout and irq_test alike.
3:1	Reserved	-	-	Reserved
0	enable	RW	0x0	When 1, the timeout counter runs. When 0, the counter reloads from the threshold and irq_o is forced low.

HANG_DET_SYS_AXI_TIMEOUT_THRESHOLD

Table 39. smc_base_config.HANG_DET_SYS_AXI_TIMEOUT_THRESHOLD fields
Bits	Field	Access	Reset	Description
31:20	Reserved	-	-	Reserved
19:0	value	RW	0x1000	Threshold in clock cycles. Default 0x1000. 20 bits => up to ~1M cycles (~1ms at 1GHz). 0 disables timeout detection: a stalled bus never asserts irq_o, though irq_test still asserts it. A threshold write takes effect when the stall count next restarts (on a completion, an idle bus, or enable cleared). So it does not change a stall already being timed.

HANG_DET_SEP_AXI_CTRL

Table 40. smc_base_config.HANG_DET_SEP_AXI_CTRL fields
Bits	Field	Access	Reset	Description
31:13	Reserved	-	-	Reserved
12	irq	R	0x0	Reads 1 while this detector's interrupt is asserted, from a timeout or from irq_test, and 0 while enable or irq_en is clear. A live level, not a latch: it clears when the interrupt drops. Writes are ignored.
11:9	Reserved	-	-	Reserved
8	irq_test	RW	0x0	Interrupt test. When 1, asserts irq_o without a bus stall, so firmware can exercise the interrupt path. Gated by enable and irq_en: it substitutes for the timeout, it does not override the interrupt enable.
7:5	Reserved	-	-	Reserved
4	irq_en	RW	0x0	Interrupt enable. When irq_en and enable are high, irq_o follows the detector; when 0, irq_o is held low. Gates a real timeout and irq_test alike.
3:1	Reserved	-	-	Reserved
0	enable	RW	0x0	When 1, the timeout counter runs. When 0, the counter reloads from the threshold and irq_o is forced low.

HANG_DET_SEP_AXI_TIMEOUT_THRESHOLD

Table 41. smc_base_config.HANG_DET_SEP_AXI_TIMEOUT_THRESHOLD fields
Bits	Field	Access	Reset	Description
31:20	Reserved	-	-	Reserved
19:0	value	RW	0x1000	Threshold in clock cycles. Default 0x1000. 20 bits => up to ~1M cycles (~1ms at 1GHz). 0 disables timeout detection: a stalled bus never asserts irq_o, though irq_test still asserts it. A threshold write takes effect when the stall count next restarts (on a completion, an idle bus, or enable cleared). So it does not change a stall already being timed.

HANG_DET_DATA_ACCEL_CTRL

Table 42. smc_base_config.HANG_DET_DATA_ACCEL_CTRL fields
Bits	Field	Access	Reset	Description
31:13	Reserved	-	-	Reserved
12	irq	R	0x0	Reads 1 while this detector's interrupt is asserted, from a timeout or from irq_test, and 0 while enable or irq_en is clear. A live level, not a latch: it clears when the interrupt drops. Writes are ignored.
11:9	Reserved	-	-	Reserved
8	irq_test	RW	0x0	Interrupt test. When 1, asserts irq_o without a bus stall, so firmware can exercise the interrupt path. Gated by enable and irq_en: it substitutes for the timeout, it does not override the interrupt enable.
7:5	Reserved	-	-	Reserved
4	irq_en	RW	0x0	Interrupt enable. When irq_en and enable are high, irq_o follows the detector; when 0, irq_o is held low. Gates a real timeout and irq_test alike.
3:1	Reserved	-	-	Reserved
0	enable	RW	0x0	When 1, the timeout counter runs. When 0, the counter reloads from the threshold and irq_o is forced low.

HANG_DET_DATA_ACCEL_TIMEOUT_THRESHOLD

Table 43. smc_base_config.HANG_DET_DATA_ACCEL_TIMEOUT_THRESHOLD fields
Bits	Field	Access	Reset	Description
31:20	Reserved	-	-	Reserved
19:0	value	RW	0x1000	Threshold in clock cycles. Default 0x1000. 20 bits => up to ~1M cycles (~1ms at 1GHz). 0 disables timeout detection: a stalled bus never asserts irq_o, though irq_test still asserts it. A threshold write takes effect when the stall count next restarts (on a completion, an idle bus, or enable cleared). So it does not change a stall already being timed.

DFX Control and Status Address Map

Memory-repair and MBIST status, debug clock and cross-trigger controls, and debug-mux selects.

Register List:

Table 44. DFX Control and Status Address Map register list
Address	Name	Access	Description
0x0	STATUS_SMU	R	-
0x8	DEBUG_CTRL	RW	-
0x10	DEBUG_BUS_MUX	RW	Mode, ID and lane selects for the twelve debug-bus muxes that reduce the SMC debug bus to the 16 CLA input lanes. Each mux takes its mode while Dbmid equals its ID, and its lane selects while Dbmid equals its ID and its mode is 1, so program one mux at a time.

Register Details:

STATUS_SMU

Table 45. dfx_ctrl_status.STATUS_SMU fields
Bits	Field	Access	Reset	Description
63:13	Reserved	-	-	Reserved
12	mbist_abort	R	0x0	One bit indicator from DFT logic to say that MBIST has hit timeout and aborted This register is sticky 1 and will hold the value until reset
11:9	Reserved	-	-	Reserved
8	mbist_pass	R	0x0	One bit indicator from DFT logic to say when MBIST is successful This register is sticky 1 and will hold the value until reset
7:5	Reserved	-	-	Reserved
4	mbist_done	R	0x0	One bit indicator from DFT logic to say when MBIST is completed This register is sticky 1 and will hold the value until reset
3	Reserved	-	-	Reserved
2	mem_repair_abort	R	0x0	One bit indicator from DFT logic to say that mem repair has hit timeout and aborted This register is sticky 1 and will hold the value until reset
1	mem_repair_success	R	0x0	One bit indicator from DFT logic to say if mem repair was successful This register is sticky 1 and will hold the value until reset
0	mem_repair_done	R	0x0	One bit indicator from DFT logic to say when mem repair is completed. This register is sticky 1 and will hold the value until reset

DEBUG_CTRL

Table 46. dfx_ctrl_status.DEBUG_CTRL fields
Bits	Field	Access	Reset	Description
31	Reserved	-	-	Reserved
30:23	debug_marker	RW	0x0	Holds the written value for software to read back. It has no effect in the SMC; the debug marker on the SMC debug bus comes from the core logic analyzer (CLA).
22:7	xtrig_clk_halt_mask	RW	0x0	CLA cross-trigger and halt-clock enable. Bit 0 (register bit 7) enables every CLA cross-trigger output lane together with the CLA halt-clock request; 0 holds them all inactive. Bits 15:1 hold the written value for software to read back and have no effect.
6	dtb_ew_en	RW	0x0	Holds the written value for software to read back. It has no effect in the SMC.
5	dtb_ns_en	RW	0x0	Holds the written value for software to read back. It has no effect in the SMC.
4	force_clk_en	RW	0x0	Design-for-debug (DFD) clock force. 1 keeps the DFD clock running whatever the value of cg_en.
3	cg_en	RW	0x0	DFD clock stop. 1 stops the clock to the debug-bus muxes and the CLA unless force_clk_en is 1; 0 lets it run. The clock also runs while the SMC is in reset.
2	gpio_en	RW	0x0	Holds the written value for software to read back. It has no effect in the SMC.
1:0	chiplet_enable	RW	0x0	Holds the written value for software to read back. It has no effect in the SMC.

DEBUG_BUS_MUX

Table 47. dfx_ctrl_status.DEBUG_BUS_MUX fields
Bits	Field	Access	Reset	Description
63:58	Muxselseg7	RW	0x0	No effect in the SMC: each debug-bus mux has four output lanes, selected by Muxselseg0 to Muxselseg3.
57:52	Muxselseg6	RW	0x0	No effect in the SMC: each debug-bus mux has four output lanes, selected by Muxselseg0 to Muxselseg3.
51:46	Muxselseg5	RW	0x0	No effect in the SMC: each debug-bus mux has four output lanes, selected by Muxselseg0 to Muxselseg3.
45:40	Muxselseg4	RW	0x0	No effect in the SMC: each debug-bus mux has four output lanes, selected by Muxselseg0 to Muxselseg3.
39:34	Muxselseg3	RW	0x0	Binary input-lane select for output lane 3 of the addressed debug-bus mux, which takes eight 16-bit input lanes and drives four. 0 selects input lane 3; a value k from 1 to 4 selects input lane k+3, so 4 selects lane 7; 5 to 63 drive zero.
33:28	Muxselseg2	RW	0x0	Binary input-lane select for output lane 2 of the addressed debug-bus mux, which takes eight 16-bit input lanes and drives four. 0 selects input lane 2; a value k from 1 to 4 selects input lane k+3, so 4 selects lane 7; 5 to 63 drive zero.
27:22	Muxselseg1	RW	0x0	Binary input-lane select for output lane 1 of the addressed debug-bus mux, which takes eight 16-bit input lanes and drives four. 0 selects input lane 1; a value k from 1 to 4 selects input lane k+3, so 4 selects lane 7; 5 to 63 drive zero.
21:16	Muxselseg0	RW	0x0	Binary input-lane select for output lane 0 of the addressed debug-bus mux, which takes eight 16-bit input lanes and drives four. 0 selects input lane 0; a value k from 1 to 4 selects input lane k+3, so 4 selects lane 7; 5 to 63 drive zero.
15:8	Rsvd158	RW	0x0	-
7:2	Dbmid	RW	0x0	ID of the debug-bus mux to program: 3 to 6 address the level-2 muxes and 7 to 14 the level-3 muxes.
1:0	Dbmmode	RW	0x0	Mode selection, 0: DBM off, 1: Normal debug mode, 2: DBM ID output mode, 3: Toggle Mode

3.3. Component Register References

For detailed register-level documentation of each SMC component, refer to the individual component documentation (Table 48).

Table 48. SMC Component Documentation
Category	Description	Reference
CPU and System Control	CPU Control, PLIC, CLINT, Watchdog Timers, and Bus Error Units	cpu
Interrupt Controller	Platform-Level Interrupt Controller (PLIC) details	interrupts
DMA Controller	DMA Controller detailed register interface	dma
Memory Zeroer	Memory Zeroer control registers	zeroer
Fabric Control	Address remapping, inbound/outbound filters, and fabric control registers	fabric
Peripherals and I/O	Mailbox, System Timer OCTS, eFuse, UART 16550, Log Engine, I2C, I3C, AVSBus, GPIO, and Telemetry Receiver	periphs
Reset Management	Reset unit and system control registers	clk_rst
Clock Generation	PLL wrapper and clock generation registers	pll
DFD / CLA	Design-for-debug wrap and Core Logic Analyzer register map	dfd