Esp32-S3 Technical Reference Manual en

ESP32S3
Technical Reference Manual
A RY
IN
IM
EL
PR
Pre-release v0.3
Espressif Systems
Copyright © 2021
www.espressif.com
About This Manual
The ESP32S3 Technical Reference Manual is addressed to application developers. The manual provides
detailed and complete information on how to use the ESP32-S3 memory and peripherals.
For pin definition, electrical characteristics, and package information, please see ESP32-S3 Datasheet.
Document Updates
Please always refer to the latest version on https://www.espressif.com/en/support/download/documents.
Revision History
RY
For revision history of this document, please refer to the last page.
Documentation Change Notification

Espressif provides email notifications to keep customers updated on changes to technical documentation.
A
Please subscribe at www.espressif.com/en/subscribe.
Certification
IN
Download certificates for Espressif products from www.espressif.com/en/certificates.
IM
EL
PR
Contents
Contents
1 ULP Coprocessor (ULPFSM, ULPRISCV) 25

1.1 Overview 25
1.2 Features 25
1.3 Programming Workflow 26
1.4 ULP Coprocessor Sleep and Weakup Workflow 27
1.5 ULP-FSM 29
1.5.1 Features 29
1.5.2 Instruction Set 29
RY
1.5.2.1 ALU - Perform Arithmetic and Logic Operations 30
1.5.2.2 ST – Store Data in Memory 32
1.5.2.3 LD – Load Data from Memory 35
1.5.2.4 JUMP – Jump to an Absolute Address 36
1.5.2.5 JUMPR – Jump to a Relative Address (Conditional upon R0) 36
A
1.5.2.6 JUMPS – Jump to a Relative Address (Conditional upon Stage Count Register) 37
1.5.2.7 HALT – End the Program 38
1.5.2.8 WAKE – Wake up the Chip 38
1.5.2.9
IN
WAIT – Wait for a Number of Cycles
1.5.2.10 TSENS – Take Measurement with Temperature Sensor
38
39
1.5.2.11 ADC – Take Measurement with ADC 39
1.5.2.12 REG_RD – Read from Peripheral Register 40
IM
1.5.2.13 REG_WR – Write to Peripheral Register 40
1.6 ULP-RISC-V 41
1.6.1 Features 41
1.6.2 Multiplier and Divider 41
1.6.3 ULP-RISC-V Interrupts 42
EL
1.6.3.1 Introduction 42
1.6.3.2 Interrupt Controller 42
1.6.3.3 Interrupt Instructions 43
1.6.3.4 RTC Peripheral Interrupts 44
1.7 RTC I2C Controller 45
PR
1.7.1 Connecting RTC I2C Signals 45

1.7.2 Configuring RTC I2C 46
1.7.3 Using RTC I2C 46
1.7.3.1 Instruction Format 46
1.7.3.2 I2C_RD - I2C Read Workflow 47
1.7.3.3 I2C_WR - I2C Write Workflow 47
1.7.3.4 Detecting Error Conditions 48
1.7.4 RTC I2C Interrupts 48
1.8 Address Mapping 49
1.9 Register Summary 49
1.9.1 ULP (ALWAYS_ON) Register Summary 49
1.9.2 ULP (RTC_PERI) Register Summary 50
Espressif Systems 3 ESP32-S3 TRM (Pre-release v0.3)

Submit Documentation Feedback
Contents
1.9.3 RTC I2C (RTC_PERI) Register Summary 50

1.9.4 RTC I2C (I2C) Register Summary 50
1.10 Registers 51
1.10.1 ULP (ALWAYS_ON) Registers 51
1.10.2 ULP (RTC_PERI) Registers 54
1.10.3 RTC I2C (RTC_PERI) Registers 58
1.10.4 RTC I2C (I2C) Registers 60
2 GDMA Controller (GDMA) 74

2.1 Overview 74
2.2 Features 74
RY
2.3 Architecture 75
2.4 Functional Description 76
2.4.1 Linked List 76
2.4.2 Peripheral-to-Memory and Memory-to-Peripheral Data Transfer 77
2.4.3 Memory-to-Memory Data Transfer 77
2.4.4 Channel Buffer 78
A
2.4.5 Enabling GDMA 78
2.4.6 Linked List Reading Process 79
2.4.7 EOF 79
2.4.8
2.4.9
Accessing Internal RAM
Accessing External RAM
IN 80
80
2.4.10 External RAM Access Permissions 81
2.4.11 Seamless Access to Internal and External RAM 82
IM
2.4.12 Arbitration 82
2.4.13 Bandwidth 82
2.4.13.1 Bandwidth to Access Internal RAM 82
2.5 GDMA Interrupts 83
2.6 Programming Procedures 83
EL
2.6.1 Programming Procedures for GDMA’s Transmit Channel 83

2.6.2 Programming Procedures for GDMA’s Receive Channel 84
2.6.3 Programming Procedures for Memory-to-Memory Transfer 84
2.8 Registers 91
PR
3 System and Memory 114

3.1 Overview 114
3.2 Features 114
3.3.1 Address Mapping 115
3.3.2 Internal Memory 116
3.3.3 External Memory 119
3.3.3.1 External Memory Address Mapping 119
3.3.3.2 Cache 119
3.3.3.3 Cache Operations 120
3.3.4 GDMA Address Space 121

Contents
3.3.5 Modules/Peripherals 122

3.3.5.1 Module/Peripheral Address Mapping 122
4 eFuse Controller 125

4.1 Overview 125
4.2 Features 125
4.3.1 Structure 125
4.3.1.1 EFUSE_WR_DIS 132
4.3.1.2 EFUSE_RD_DIS 132
4.3.1.3 Data Storage 132
RY
4.3.2 Programming of Parameters 133
4.3.3 User Read of Parameters 135
4.3.4 eFuse VDDQ Timing 137
4.3.5 The Use of Parameters by Hardware Modules 137
4.3.6 Interrupts 137
A
4.5 Registers 142
5 IO MUX and GPIO Matrix (GPIO, IO MUX) 185

5.1
5.2
Overview
Features
IN 185
185
5.3 Architectural Overview 185
5.4 Peripheral Input via GPIO Matrix 187
IM
5.4.1 Overview 187
5.4.2 Signal Synchronization 187
5.4.3 Functional Description 188
5.4.4 Simple GPIO Input 189
5.5 Peripheral Output via GPIO Matrix 189
EL
5.5.1 Overview 189

5.5.3 Simple GPIO Output 191
5.5.4 Sigma Delta Modulated Output 191
5.5.4.1 Functional Description 191
PR
5.5.4.2 SDM Configuration 192

5.6 Direct Input and Output via IO MUX 192
5.6.1 Overview 192
5.7 RTC IO MUX for Low Power and Analog Input/Output 192
5.7.1 Overview 192
5.7.2 Low Power Capabilities 193
5.7.3 Analog Functions 193
5.8 Pin Functions in Light-sleep 193
5.9 Pin Hold Feature 194
5.10 Power Supply and Management of GPIO Pins 194
5.10.1 Power Supply of GPIO Pins 194

Contents
5.10.2 Power Supply Management 194

5.11 Peripheral Signals via GPIO Matrix 194
5.12 IO MUX Function List 206
5.13 RTC IO MUX Pin List 207
5.14.1 GPIO Matrix Register Summary 209
5.14.2 IO MUX Register Summary 210
5.14.3 SDM Output Register Summary 212
5.14.4 RTC IO MUX Register Summary 212
5.15 Registers 213
5.15.1 GPIO Matrix Registers 214
RY
5.15.2 IO MUX Registers 225
5.15.3 SDM Output Registers 227
5.15.4 RTC IO MUX Registers 229
6 Reset and Clock 238

6.1 Reset 238
A
6.1.1 Overview 238
6.1.2 Architectural Overview 238
6.1.3 Features 238
6.2
6.1.4
Clock
Functional Description
IN 239
240
6.2.1 Overview 240
6.2.2 Architectural Overview 240
IM
6.2.3 Features 240
6.2.4.1 CPU Clock 241
6.2.4.2 Peripheral Clocks 241
6.2.4.3 Wi-Fi and Bluetooth LE Clock 243
EL
6.2.4.4 RTC Clock 243
7 Chip Boot Control 244

7.1 Overview 244
7.2 Boot Mode Control 245
PR
7.3 ROM Code Printing Control 245

7.4 VDD_SPI Voltage Control 246
7.5 JTAG Signal Source Control 246
8 Interrupt Matrix (INTERRUPT) 248

8.1 Overview 248
8.2 Features 248
8.3.1 Peripheral Interrupt Sources 249
8.3.2 CPU Interrupts 253
8.3.3 Allocate Peripheral Interrupt Source to CPUx Interrupt 254
8.3.3.1 Allocate one peripheral interrupt source (Source_Y) to CPUx 254

Contents
8.3.3.2 Allocate multiple peripheral interrupt sources (Source_Yn) to CPUx 255

8.3.3.3 Disable CPUx peripheral interrupt source (Source_Y) 255
8.3.4 Disable CPUx NMI Interrupt 255
8.3.5 Query Current Interrupt Status of Peripheral Interrupt Source 255
8.4.1 CPU0 Interrupt Register Summary 256
8.4.2 CPU1 Interrupt Register Summary 259
8.5 Registers 264
8.5.1 CPU0 Interrupt Registers 264
8.5.2 CPU1 Interrupt Registers 268
9 System Timer (SYSTIMER)
RY
274
9.1 Overview 274
9.2 Features 274
9.3 Clock Source Selection 275
9.4.1 Counter 275
A
9.4.2 Comparator and Alarm 276
9.4.3 Synchronization Operation 277
9.4.4 Interrupt 277
9.5 Programming Procedure
9.5.1 Read Current Count Value
IN 278
278
9.5.2 Configure One-Time Alarm in Target Mode 278
9.5.3 Configure Periodic Alarms in Period Mode 278
IM
9.5.4 Update After Deep-sleep and Light-sleep 278
9.7 Registers 281
10 Timer Group (TIMG) 294

EL
10.1 Overview 294

10.2.1 16-bit Prescaler and Clock Selection 295
10.2.2 54-bit Time-base Counter 295
10.2.3 Alarm Generation 295
PR
10.2.4 Timer Reload 296

10.2.5 SLOW_CLK Frequency Calculation 297
10.3 Configuration and Usage 298
10.3.1 Timer as a Simple Clock 298
10.3.2 Timer as One-shot Alarm 298
10.3.3 Timer as Periodic Alarm 298
10.3.4 SLOW_CLK Frequency Calculation 299
10.5 Registers 302
11 Watchdog Timers 312

Contents
11.1 Overview 312

11.2 Digital Watchdog Timers 313
11.2.1 Features 313
11.2.2.1 Clock Source and 32-Bit Counter 314
11.2.2.2 Stages and Timeout Actions 315
11.2.2.3 Write Protection 315
11.2.2.4 Flash Boot Protection 316
11.3 Super Watchdog 316
11.3.1 Features 316
11.3.2 Super Watchdog Controller 316
RY
11.3.2.1 Structure 317
11.3.2.2 Workflow 317
11.4 Interrupts 317
11.5 Registers 318
12 XTAL32K Watchdog Timers (XTWDT) 319
A
12.1 Overview 319
12.2 Features 319
12.2.1 Interrupt and Wake-Up 319
12.3
12.2.2 BACKUP32K_CLK
Functional Description
IN 319
319
12.3.1 Workflow 320
12.3.2 BACKUP32K_CLK Working Principle 320
IM
12.3.3 Configuring the Divisor Component of BACKUP32K_CLK 320
13 System Registers 322

13.1 Overview 322
13.2 Features 322
EL
13.3 Function Description 322

13.3.1 System and Memory Registers 322
13.3.1.1 Internal Memory 322
13.3.1.2 External Memory 323
13.3.1.3 RSA Memory 323
PR
13.3.2 Clock Registers 324

13.3.3 Interrupt Signal Registers 324
13.3.4 Low-power Management Registers 324
13.3.5 Peripheral Clock Gating and Reset Registers 324
13.3.6 CPU Control Registers 326
13.5 Registers 328
14 SHA Accelerator (SHA) 342

14.1 Introduction 342
14.2 Features 342
14.3 Working Modes 342

Contents
14.4 Function Description 343

14.4.1 Preprocessing 343
14.4.1.1 Padding the Message 343
14.4.1.2 Parsing the Message 344
14.4.1.3 Initial Hash Value 344
14.4.2 Hash task Process 345
14.4.2.1 Typical SHA Mode Process 345
14.4.2.2 DMA-SHA Mode Process 347
14.4.3 Message Digest 349
14.4.4 Interrupt 350
RY
14.6 Registers 351
15 AES Accelerator (AES) 356

15.2 Features 356
15.3 AES Working Modes 356
A
15.4 Typical AES Working Mode 357
15.4.1 Key, Plaintext, and Ciphertext 357
15.4.2 Endianness 358
15.5
15.4.3 Operation Process
DMA-AES Working Mode
IN 360
360
15.5.1 Key, Plaintext, and Ciphertext 361
15.5.2 Endianness 361
IM
15.5.3 Standard Incrementing Function 362
15.5.4 Block Number 362
15.5.5 Initialization Vector 362
15.5.6 Block Operation Process 363
15.6 Memory Summary 363
EL

15.8 Registers 365
16 RSA Accelerator (RSA) 369

PR
16.2 Features 369

16.3.1 Large Number Modular Exponentiation 369
16.3.2 Large Number Modular Multiplication 371
16.3.3 Large Number Multiplication 371
16.3.4 Options for Acceleration 372
16.6 Registers 374
17 HMAC Accelerator (HMAC) 378

17.1 Main Features 378

Contents

17.2.1 Upstream Mode 378
17.2.2 Downstream JTAG Enable Mode 379
17.2.3 Downstream Digital Signature Mode 379
17.2.4 HMAC eFuse Configuration 379
17.2.5 HMAC Initialization 380
17.2.6 HMAC Process (Detailed) 380
17.3 HMAC Algorithm Details 382
17.3.1 Padding Bits 382
17.3.2 HMAC Algorithm Structure 383
RY
17.5 Registers 387
18 Digital Signature (DS) 393

18.1 Overview 393
18.2 Features 393
A
18.3.1 Overview 393
18.3.2 Private Key Operands 394
18.3.3 Software Prerequisites 394
18.3.4 DS Operation at the Hardware Level
18.3.5 DS Operation at the Software Level
IN 395
396
IM
18.6 Registers 400
19 External Memory Encryption and Decryption (XTS_AES)402

19.1 Overview 402
19.2 Features 402
EL
19.3 Module Structure 402

19.4.1 XTS Algorithm 403
19.4.2 Key 403
19.4.3 Target Memory Space 404
PR
19.4.4 Data Padding 404

19.4.5 Manual Encryption Block 405
19.4.6 Auto Encryption Block 406
19.4.7 Auto Decryption Block 406
19.5 Software Process 407
19.7 Registers 409
20 Clock Glitch Detection 412

20.1 Overview 412
20.2.1 Clock Glitch Detection 412

Contents
20.2.2 Reset 412
21 Random Number Generator (RNG) 413

21.2 Features 413
21.4 Programming Procedure 414
21.6 Register 414
22 UART Controller (UART) 415
RY
22.1 Overview 415
22.2 Features 415
22.3 UART Structure 416
22.4.1 Clock and Reset 417
22.4.2 UART RAM 418
A
22.4.3 Baud Rate Generation and Detection 419
22.4.3.1 Baud Rate Generation 419
22.4.3.2 Baud Rate Detection 420
22.4.4 UART Data Frame
22.4.5 RS485
IN 421
422
22.4.5.1 Driver Control 422
22.4.5.2 Turnaround Delay 422
IM
22.4.5.3 Bus Snooping 422
22.4.6 IrDA 423
22.4.7 Wake-up 424
22.4.8 Loopback Test 424
22.4.9 Flow Control 424
EL
22.4.9.1 Hardware Flow Control 425

22.4.9.2 Software Flow Control 426
22.4.10 GDMA Mode 426
22.4.11 UART Interrupts 427
22.4.12 UHCI Interrupts 428
PR
22.5 Programming Procedures 428

22.5.1 Register Type 428
22.5.1.1 Synchronous Registers 429
22.5.1.2 Static Registers 430
22.5.1.3 Immediate Registers 431
22.5.2 Detailed Steps 431
22.5.2.1 Initializing UARTn 431
22.5.2.2 Configuring UARTn Communication 432
22.5.2.3 Enabling UARTn 432
22.6.1 UART Register Summary 434
22.6.2 UHCI Register Summary 435

Contents
22.7 Registers 437

22.7.1 UART Registers 437
22.7.2 UHCI Regsiters 456
23 I2C Controller (I2C) 475

23.1 Overview 475
23.2 Features 475
23.3 I2C Architecture 476
23.4.1 Clock Configuration 478
23.4.2 SCL and SDA Noise Filtering 478
RY
23.4.3 SCL Clock Stretching 479
23.4.4 Generating SCL Pulses in Idle State 479
23.4.5 Synchronization 479
23.4.6 Open-Drain Output 480
23.4.7 Timing Parameter Configuration 481
23.4.8 Timeout Control 482
A
23.4.9 Command Configuration 483
23.4.10 TX/RX RAM Data Storage 484
23.4.11 Data Conversion 485
23.4.12 Addressing Mode
23.4.13 R/W Bit Check in 10-bit Addressing Mode
IN 485
485
23.4.14 To Start the I2C Controller 486
23.5 Programming Example 486
IM
23.5.1 I2Cmaster Writes to I2Cslave with a 7-bit Address in One Command Sequence 486
23.5.1.2 Configuration Example 487
23.5.2 I2Cmaster Writes to I2Cslave with a 10-bit Address in One Command Sequence 488
EL

23.5.3 I2Cmaster Writes to I2Cslave with Two 7-bit Addresses in One Command Sequence 489
23.5.4 I2Cmaster Writes to I2Cslave with a 7-bit Address in Multiple Command Sequences 491
PR

23.5.5 I2Cmaster Reads I2Cslave with a 7-bit Address in One Command Sequence 494
23.5.6 I2Cmaster Reads I2Cslave with a 10-bit Address in One Command Sequence 496
23.5.7 I2Cmaster Reads I2Cslave with Two 7-bit Addresses in One Command Sequence 498
23.5.8 I2Cmaster Reads I2Cslave with a 7-bit Address in Multiple Command Sequences 500

Contents

23.6 Interrupts 503
23.8 Registers 507
24 Twowire Automotive Interface (TWAI®) 527

24.1 Overview 527
24.2 Features 527
24.3 Functional Protocol 527
24.3.1 TWAI Properties 527
RY
24.3.2 TWAI Messages 528
24.3.2.1 Data Frames and Remote Frames 529
24.3.2.2 Error and Overload Frames 531
24.3.2.3 Interframe Space 532
24.3.3 TWAI Errors 533
24.3.3.1 Error Types 533
A
24.3.3.2 Error States 533
24.3.3.3 Error Counters 534
24.3.4 TWAI Bit Timing 535
24.3.4.1 Nominal Bit
IN
24.3.4.2 Hard Synchronization and Resynchronization
535
536
24.4 Architectural Overview 536
24.4.1 Registers Block 537
IM
24.4.2 Bit Stream Processor 538
24.4.3 Error Management Logic 538
24.4.4 Bit Timing Logic 538
24.4.5 Acceptance Filter 538
24.4.6 Receive FIFO 538
EL

24.5.1 Modes 539
24.5.1.1 Reset Mode 539
24.5.1.2 Operation Mode 539
24.5.2 Bit Timing 539
PR
24.5.3 Interrupt Management 540

24.5.3.1 Receive Interrupt (RXI) 541
24.5.3.2 Transmit Interrupt (TXI) 541
24.5.3.3 Error Warning Interrupt (EWI) 541
24.5.3.4 Data Overrun Interrupt (DOI) 541
24.5.3.5 Error Passive Interrupt (TXI) 542
24.5.3.6 Arbitration Lost Interrupt (ALI) 542
24.5.3.7 Bus Error Interrupt (BEI) 542
24.5.3.8 Bus Status Interrupt (BSI) 542
24.5.4 Transmit and Receive Buffers 542
24.5.4.1 Overview of Buffers 542
24.5.4.2 Frame Information 543

Contents
24.5.4.3 Frame Identifier 544

24.5.4.4 Frame Data 545
24.5.5 Receive FIFO and Data Overruns 545
24.5.5.1 Single Filter Mode 546
24.5.5.2 Dual FIlter Mode 546
24.5.6 Error Management 547
24.5.6.1 Error Warning Limit 547
24.5.6.2 Error Passive 549
24.5.6.3 Bus-Off and Bus-Off Recovery 549
24.5.7 Error Code Capture 549
24.5.8 Arbitration Lost Capture 550
RY
24.7 Registers 553
25 USB OnTheGo (USB) 566

25.1 Overview 566
25.2 Features 566
A
25.2.1 General Features 566
25.2.2 Device Mode Features 566
25.2.3 Host Mode Features 566
25.3 Functional Description
25.3.1 Controller Core and Interfaces
IN 567
567
25.3.2 Memory Layout 568
25.3.2.1 Control & Status Registers 569
IM
25.3.2.2 FIFO Access 569
25.3.3 FIFO and Queue Organization 569
25.3.3.1 Host Mode FIFOs and Queues 570
25.3.3.2 Device Mode FIFOs 571
25.3.4 Interrupt Hierarchy 571
EL
25.3.5 DMA Modes and Slave Mode 573

25.3.5.1 Slave Mode 573
25.3.5.2 Buffer DMA Mode 573
25.3.5.3 Scatter/Gather DMA Mode 573
25.3.6 Transaction and Transfer Level Operation 574
PR
25.3.6.1 Transaction and Transfer Level in DMA Mode 574

25.3.6.2 Transaction and Transfer Level in Slave Mode 574
25.4 OTG 576
25.4.1 OTG Interface 576
25.4.2 ID Pin Detection 577
25.4.3 Session Request Protocol (SRP) 577
25.4.3.1 A-Device SRP 577
25.4.3.2 B-Device SRP 578
25.4.4 Host Negotiation Protocol (HNP) 579
25.4.4.1 A-Device HNP 579
25.4.4.2 B-Device HNP 580

Contents
26 USB Serial/JTAG Controller (USB_SERIAL_JTAG) 582

26.1 Overview 582
26.2 Features 582
26.3.1 USB Serial/JTAG host connection 584
26.3.2 CDC-ACM USB Interface Functional Description 586
26.3.3 CDC-ACM Firmware Interface Functional Description 587
26.3.4 USB-to-JTAG Interface 588
26.3.5 JTAG Command Processor 588
26.3.6 USB-to-JTAG Interface: CMD_REP usage example 589
26.3.7 USB-to-JTAG Interface: Response Capture Unit 589
RY
26.3.8 USB-to-JTAG Interface: Control Transfer Requests 590
26.4 Recommended Operation 591
26.4.1 Internal/external PHY selection 591
26.4.2 Runtime operation 591
26.6 Registers 594
A
27 SD/MMC Host Controller (SDHOST) 607
27.1 Overview 607
27.2
27.3
Features
SD/MMC External Interface Signals
IN 607
607
27.4.1 SD/MMC Host Controller Architecture 608
IM
27.4.1.1 Bus Interface Unit (BIU) 609
27.4.1.2 Card Interface Unit (CIU) 609
27.4.2 Command Path 609
27.4.3 Data Path 610
27.4.3.1 Data Transmit Operation 610
EL
27.4.3.2 Data Receive Operation 611

27.5 Software Restrictions for Proper CIU Operation 611
27.6 RAM for Receiving and Sending Data 613
27.6.1 TX RAM Module 613
27.6.2 RX RAM Module 613
PR
27.7 DMA Descriptor Chain 613

27.8 The Structure of DMA descriptor chain 613
27.9 Initialization 616
27.9.1 DMA Initialization 616
27.9.2 DMA Transmission Initialization 616
27.9.3 DMA Reception Initialization 617
27.10 Clock Phase Selection 617
27.11 Interrupt 618
27.13 Registers 622
28 LED PWM Controller (LEDC) 648

Contents
28.1 Overview 648

28.2 Features 648
28.3.1 Architecture 648
28.3.2 Timers 649
28.3.2.1 Clock Source 649
28.3.2.2 Clock Divider Configuration 650
28.3.2.3 14-bit Counter 651
28.3.3 PWM Generators 651
28.3.4 Duty Cycle Fading 652
RY
28.5 Registers 656
29 Motor Control PWM (MCPWM) 663

29.1 Overview 663
29.2 Features 663
A
29.3 Submodules 665
29.3.1 Overview 665
29.3.1.1 Prescaler Submodule 665
29.3.1.2 Timer Submodule
29.3.1.3 Operator Submodule
IN 665
666
29.3.1.4 Fault Detection Submodule 668
29.3.1.5 Capture Submodule 668
IM
29.3.2 PWM Timer Submodule 668
29.3.2.1 Configurations of the PWM Timer Submodule 668
29.3.2.2 PWM Timer’s Working Modes and Timing Event Generation 669
29.3.2.3 PWM Timer Shadow Register 673
29.3.2.4 PWM Timer Synchronization and Phase Locking 673
EL
29.3.3 PWM Operator Submodule 673

29.3.3.1 PWM Generator Submodule 674
29.3.3.2 Dead Time Generator Submodule 684
29.3.3.3 PWM Carrier Submodule 688
29.3.3.4 Fault Handler Submodule 690
PR
29.3.4 Capture Submodule 691

29.3.4.2 Capture Timer 692
29.3.4.3 Capture Channel 692
29.5 Registers 696
30 Remote Control Peripheral (RMT) 747

30.1 Overview 747
30.2 Features 747
30.3.1 Architecture 748

Contents
30.3.2 RAM 748

30.3.2.1 RAM Architecture 748
30.3.2.2 Use of RAM 749
30.3.2.3 RAM Access 750
30.3.3 Clock 751
30.3.4 Transmitter 751
30.3.4.1 Normal TX Mode 751
30.3.4.2 Wrap TX Mode 751
30.3.4.3 TX Modulation 752
30.3.4.4 Continuous TX Mode 752
30.3.4.5 Simultaneous TX Mode 752
RY
30.3.5 Receiver 753
30.3.5.1 Normal RX Mode 753
30.3.5.2 Wrap RX Mode 753
30.3.5.3 RX Filtering 753
30.3.5.4 RX Demodulation 754
30.3.6 Configuration Update 754
A
30.4 Interrupts 755
30.6 Registers 758
31 Pulse Count Controller (PCNT)

IN 772
31.1 Features 772
IM
31.3 Applications 775
31.3.1 Channel 0 Incrementing Independently 775
31.3.2 Channel 0 Decrementing Independently 776
31.3.3 Channel 0 and Channel 1 Incrementing Together 776
EL
31.5 Registers 779
Glossary 785
Abbreviations for Peripherals 785
Abbreviations for Registers 785
PR
Revision History 786

List of Tables
List of Tables
1-1 Comparison of the Two Coprocessors 26
1-2 ALU Operations Among Registers 31
1-3 ALU Operations with Immediate Value 32
1-4 ALU Operations with Stage Count Register 32
1-5 Data Storage Type - Automatic Storage Mode 34
1-6 Data Storage - Manual Storage Mode 35
1-7 Input Signals Measured Using the ADC Instruction 39
1-8 Instruction Efficiency 41
1-9 ULP-RISC-V Interrupt Sources 42
RY
1-10 ULP-RISC-V Interrupt Registers 43
1-11 ULP-RISC-V Interrupt List 45
1-12 Address Mapping 49
1-13 Description of Registers for Peripherals Accessible by ULP Coprocessors 49
2-1 Selecting Peripherals via Register Configuration 77
A
2-2 Descriptor Field Alignment Requirements for Accessing Internal RAM 80
2-3 Descriptor Field Alignment Requirements for Accessing External RAM 80
2-4 Relationship Between Configuration Register, Block Size and Alignment 81
2-5
3-1 Address Mapping
IN
Total Bandwidth Supported by GDMA to Access Internal RAM 82
116
3-2 Internal Memory Address Mapping 117
3-3 External Memory Address Mapping 119
3-4 Module/Peripheral Address Mapping 122
IM
4-1 Parameters in eFuse BLOCK0 126
4-2 Secure Key Purpose Values 129
4-3 Parameters in BLOCK1 to BLOCK10 130
4-4 Registers Information 135
EL
4-5 Configuration of Default VDDQ Timing Parameters 137

5-1 Bits Used to Control IO MUX Functions in Light-sleep Mode 193
5-2 Peripheral Signals via GPIO Matrix 196
5-3 IO MUX Pin Functions 206
5-4 RTC Functions of RTC IO MUX Pins 207
PR
5-5 Analog Functions of RTC IO MUX Pins 208

6-1 Reset Sources 239
6-2 CPU Clock Source 241
6-3 CPU Clock Frequency 241
6-4 Peripheral Clocks 242
6-5 APB_CLK Fequency 243
6-6 CRYPTO_PWM_CLK Frequency 243
7-1 Default Configuration of Strapping Pins 244
7-2 Boot Mode Control 245
7-3 ROM Code Printing Control 246
7-4 JTAG Signal Source Control 247
8-1 CPU Peripheral Interrupt Configuration/Status Registers and Peripheral Interrupt Sources 250

List of Tables
8-2 CPU Interrupts 253

9-1 UNITn Configuration Bits 276
9-2 Trigger Point 277
9-3 Synchronization Operation 277
10-1 Alarm Generation When Up-Down Counter Increments 296
10-2 Alarm Generation When Up-Down Counter Decrements 296
13-1 Internal Memory Controlling Bit 323
13-2 Peripheral Clock Gating and Reset Bits 325
14-1 SHA Accelerator Working Mode 343
14-2 SHA Hash Algorithm Selection 343
14-6 The Storage and Length of Message digest from Different Algorithms 349
RY
15-1 AES Accelerator Working Mode 357
15-2 Key Length and Encryption / Decryption 357
15-3 Working Status under Typical AES Working Mode 357
15-4 Text Endianness Type for Typical AES 358
15-5 Key Endianness Type for AES-128 Encryption and Decryption 358
15-6 Key Endianness Type for AES-256 Encryption and Decryption 359
A
15-7 Block Cipher Mode 360
15-8 Working Status under DMA-AES Working mode 361
15-9 TEXT-PADDING 361
15-10 Text Endianness for DMA-AES
16-1 Acceleration Performance
IN 362
373
16-2 RSA Accelerator Memory Blocks 373
17-1 HMAC Purposes and Configuration Values 380
IM
19-1 Key generated based on KeyA , KeyB and KeyC 404
19-2 Mapping Between Offsets and Registers 405
22-1 UARTn Synchronous Registers 429
22-2 UARTn Static Registers 430
23-1 I2C Synchronous Registers 480
EL
24-1 Data Frames and Remote Frames in SFF and EFF 530
24-2 Error Frame 531
24-3 Overload Frame 532
24-4 Interframe Space 532
24-5 Segments of a Nominal Bit Time 535
PR
24-6 Bit Information of TWAI_BUS_TIMING_0_REG (0x18) 540

24-7 Bit Information of TWAI_BUS_TIMING_1_REG (0x1c) 540
24-8 Buffer Layout for Standard Frame Format and Extended Frame Format 542
24-9 TX/RX Frame Information (SFF/EFF)�TWAI Address 0x40 543
24-10 TX/RX Identifier 1 (SFF); TWAI Address 0x44 544
24-11 TX/RX Identifier 2 (SFF); TWAI Address 0x48 544
24-12 TX/RX Identifier 1 (EFF); TWAI Address 0x44 544
24-14 TX/RX Identifier 3 (EFF); TWAI Address 0x4c 544
24-16 Bit Information of TWAI_ERR_CODE_CAP_REG (0x30) 549
24-17 Bit Information of Bits SEG.4 - SEG.0 550

List of Tables
24-18 Bit Information of TWAI_ARB LOST CAP_REG (0x2c) 551

25-1 IN and OUT Transactions in Slave Mode 575
25-2 UTMI OTG Interface 576
26-1 Standard CDC-ACM Control Requests 586
26-2 CDC-ACM Settings with RTS and DTR 587
26-3 Commands of a Nibble 588
26-4 USB-to-JTAG Control Requests 590
26-5 JTAG Capabilities Descriptor 590
26-6 Use cases and eFuse settings 591
26-7 Reset SoC into Download Mode 592
26-8 Reset SoC into Booting 592
RY
27-1 SD/MMC Signal Description 608
27-2 Word DES0 of SD/MMC GDMA Linked List 614
27-6 SDHOST Clk Phase Selection 618
A
29-1 Configuration Parameters of the Operator Submodule 667
29-2 Timing Events Used in PWM Generator 675
29-3 Timing Events Priority When PWM Timer Increments 676
IN
29-4 Timing Events Priority when PWM Timer Decrements
29-5 Dead Time Generator Switches Control Fields
676
685
29-6 Typical Dead Time Generator Operating Modes 685
30-1 Configuration Update 754
IM
31-1 Counter Mode. Positive Edge of Input Pulse Signal. Control Signal in Low State 774
31-2 Counter Mode. Positive Edge of Input Pulse Signal. Control Signal in High State 774
31-3 Counter Mode. Negative Edge of Input Pulse Signal. Control Signal in Low State 774
31-4 Counter Mode. Negative Edge of Input Pulse Signal. Control Signal in High State 774
EL
PR

List of Figures
List of Figures
1-1 ULP Coprocessor Overview 25
1-2 ULP Coprocessor Diagram 26
1-3 Programming Workflow 27
1-4 ULP Sleep and Wakeup Sequence 28
1-5 Control of ULP Program Execution 29
1-6 ULP-FSM Instruction Format 30
1-7 Instruction Type — ALU for Operations Among Registers 30
1-8 Instruction Type — ALU for Operations with Immediate Value 31
1-9 Instruction Type — ALU for Operations with Stage Count Register 32
RY
1-10 Instruction Type - ST 32
1-11 Instruction Type - Offset in Automatic Storage Mode (ST-OFFSET) 33
1-12 Instruction Type - Data Storage in Automatic Storage Mode (ST-AUTO-DATA) 33
1-13 Data Structure of RTC_SLOW_MEM[Rdst + Offset] 34
1-14 Instruction Type - Data Storage in Manual Storage Mode 34
A
1-15 Instruction Type - LD 35
1-16 Instruction Type - JUMP 36
1-17 Instruction Type - JUMPR 36
1-18 Instruction Type - JUMPS
1-19 Instruction Type - HALT
IN 37
38
1-20 Instruction Type - WAKE 38
1-21 Instruction Type - WAIT 38
1-22 Instruction Type - TSENS 39
IM
1-23 Instruction Type - ADC 39
1-24 Instruction Type - REG_RD 40
1-25 Instruction Type - REG_WR 41
1-26 Standard R-type Instruction Format 43
EL
1-27 Interrupt Instruction - getq rd, qs 43

1-28 Interrupt Instruction - setq qd,rs 44
1-29 Interrupt Instruction - retirq 44
1-30 Interrupt Instruction — Maskirq rd rs 44
1-31 I2C Read Operation 47
PR
1-32 I2C Write Operation 48

2-1 Modules with GDMA Feature and GDMA Channels 74
2-2 GDMA Engine Architecture 75
2-3 Structure of a Linked List 76
2-4 Channel Buffer 78
2-5 Relationship among Linked Lists 79
2-6 Dividing External RAM into Areas 81
3-1 System Structure and Address Mapping 115
3-2 Cache Structure 120
3-3 Peripherals/modules that can work with GDMA 122
4-1 Shift Register Circuit (output of first 32 bytes) 133
4-2 Shift Register Circuit (output of last 12 bytes) 133

List of Figures
5-1 Architecture of IO MUX, RTC IO MUX, and GPIO Matrix 186

5-2 Internal Structure of a Pad 187
5-3 GPIO Input Synchronized on APB Clock Rising Edge or on Falling Edge 188
5-4 Filter Timing of GPIO Input Signals 188
6-1 Reset Levels 238
6-2 Clock Structure 240
8-1 Interrupt Matrix Structure 248
9-1 System Timer Structure 274
9-2 System Timer Alarms 275
10-1 Timer Units within Groups 294
10-2 Timer Group Architecture 295
RY
11-1 Watchdog Timers Overview 312
11-2 Watchdog Timers in ESP32-S3 314
11-3 Super Watchdog Controller Structure 317
12-1 XTAL32K Watchdog Timer 319
17-1 HMAC SHA-256 Padding Diagram 383
17-2 HMAC Structure Schematic Diagram 383
A
18-1 Software Preparations and Hardware Working Process 394
19-1 External Memory Encryption and Decryption Operation Settings 402
20-1 XTAL_CLK Pulse Width 412
21-1 Noise Source
22-1 UART Structure
IN 413
416
22-2 UART Controllers Sharing RAM 418
22-3 UART Controllers Division 419
IM
22-4 The Timing Diagram of Weak UART Signals Along Falling Edges 420
22-5 Structure of UART Data Frame 421
22-6 AT_CMD Character Structure 421
22-7 Driver Control Diagram in RS485 Mode 422
22-8 The Timing Diagram of Encoding and Decoding in SIR mode 423
EL
22-9 IrDA Encoding and Decoding Diagram 424

22-10 Hardware Flow Control Diagram 425
22-11 Connection between Hardware Flow Control Signals 425
22-12 Data Transfer in GDMA Mode 427
22-13 UART Programming Procedures 431
PR
23-1 I2C Master Architecture 476

23-2 I2C Slave Architecture 476
23-3 I2C Protocol Timing (Cited from Fig.31 in The I2C-bus specification Version 2.1) 477
23-4 I2C Timing Parameters (Cited from Table 5 in The I2C-bus specification Version 2.1) 478
23-5 I2C Timing Diagram 481
23-6 Structure of I2C Command Registers 483
23-7 I2Cmaster Writing to I2Cslave with a 7-bit Address 486
23-8 I2Cmaster Writing to a Slave with a 10-bit Address 488
23-9 I2Cmaster Writing to I2Cslave with Two 7-bit Addresses 490
23-10 I2Cmaster Writing to I2Cslave with a 7-bit Address in Multiple Sequences 492
23-11 I2Cmaster Reading I2Cslave with a 7-bit Address 494
23-12 I2Cmaster Reading I2Cslave with a 10-bit Address 496

List of Figures
23-13 I2Cmaster Reading N Bytes of Data from addrM of I2Cslave with a 7-bit Address 498
23-14 I2Cmaster Reading I2Cslave with a 7-bit Address in Segments 501
24-1 Bit Fields in Data Frames and Remote Frames 529
24-2 Fields of an Error Frame 531
24-3 Fields of an Overload Frame 532
24-4 The Fields within an Interframe Space 534
24-5 Layout of a Bit 535
24-6 TWAI Overview Diagram 537
24-7 Acceptance Filter 546
24-8 Single Filter Mode 547
24-9 Dual Filter Mode 548
RY
24-10 Error State Transition 548
24-11 Positions of Arbitration Lost Bits 551
25-1 OTG_FS System Architecture 567
25-2 OTG_FS Register Layout 568
25-3 Host Mode FIFOs 570
25-4 Device Mode FIFOs 571
A
25-5 OTG_FS Interrupt Hierarchy 572
25-6 Scatter/Gather DMA Descriptor List 573
25-7 A-Device SRP 578
25-8 B-Device SRP
25-9 A-Device HNP
IN 578
579
25-10 B-Device HNP 580
26-1 USB Serial/JTAG High Level Diagram 583
IM
26-2 USB Serial/JTAG Block Diagram 584
26-3 USB Serial/JTAG and USB-OTG Internal/External PHY Routing Diagram 585
26-4 JTAG Routing Diagram 586
27-1 SD/MMC Controller Topology 607
27-2 SD/MMC Controller External Interface Signals 608
EL
27-3 SDIO Host Block Diagram 609

27-4 Command Path State Machine 610
27-5 Data Transmit State Machine 611
27-6 Data Receive State Machine 611
27-7 Descriptor Chain 613
PR
27-8 The Structure of a Linked List 614

27-9 Clock Phase Selection 618
28-1 LED PWM Architecture 648
28-2 LED PWM Generator Diagram 649
28-3 Frequency Division When LEDC_CLK_DIV_TIMERx is a Non-Integer Value 650
28-4 LED_PWM Output Signal Diagram 652
28-5 Output Signal Diagram of Fading Duty Cycle 652
29-1 MCPWM Module Overview 663
29-2 Prescaler Submodule 665
29-3 Timer Submodule 665
29-4 Operator Submodule 666
29-5 Fault Detection Submodule 668

List of Figures
29-6 Capture Submodule 668

29-7 Count-Up Mode Waveform 669
29-8 Count-Down Mode Waveforms 670
29-9 Count-Up-Down Mode Waveforms, Count-Down at Synchronization Event 670
29-10 Count-Up-Down Mode Waveforms, Count-Up at Synchronization Event 670
29-11 UTEP and UTEZ Generation in Count-Up Mode 671
29-12 DTEP and DTEZ Generation in Count-Down Mode 672
29-13 DTEP and UTEZ Generation in Count-Up-Down Mode 672
29-14 Submodules Inside the PWM Operator 674
29-15 Symmetrical Waveform in Count-Up-Down Mode 677
29-16 Count-Up, Single Edge Asymmetric Waveform, with Independent Modulation on PWMxA and
RY
PWMxB — Active High 678
29-17 Count-Up, Pulse Placement Asymmetric Waveform with Independent Modulation on PWMxA 679
29-18 Count-Up-Down, Dual Edge Symmetric Waveform, with Independent Modulation on PWMxA and
PWMxB — Active High 680
29-19 Count-Up-Down, Dual Edge Symmetric Waveform, with Independent Modulation on PWMxA and
PWMxB — Complementary 681
A
29-20 Example of an NCI Software-Force Event on PWMxA 682
29-21 Example of a CNTU Software-Force Event on PWMxB 683
29-22 Options for Setting up the Dead Time Generator Submodule 685
IN
29-23 Active High Complementary (AHC) Dead Time Waveforms
29-24 Active Low Complementary (ALC) Dead Time Waveforms
686
686
29-25 Active High (AH) Dead Time Waveforms 687
29-26 Active Low (AL) Dead Time Waveforms 687
IM
29-27 Example of Waveforms Showing PWM Carrier Action 688
29-28 Example of the First Pulse and the Subsequent Sustaining Pulses of the PWM Carrier Submodule 689
29-29 Possible Duty Cycle Settings for Sustaining Pulses in the PWM Carrier Submodule 690
30-1 RMT Architecture 748
30-2 Format of Pulse Code in RAM 749
EL
31-1 PCNT Block Diagram 772

31-2 PCNT Unit Architecture 773
31-3 Channel 0 Up Counting Diagram 775
31-4 Channel 0 Down Counting Diagram 776
31-5 Two Channels Up Counting Diagram 776
PR

1 ULP Coprocessor (ULP-FSM, ULP-RISC-V)
1 ULP Coprocessor (ULPFSM, ULPRISCV)
1.1 Overview
The ULP coprocessor is an ultra-low-power processor that remains powered on when the chip is in Deep-sleep
(see Chapter 7 Low-Power Management (RTC_CNTL) [to be added later]). Hence, users can store in RTC memory
a program for the ULP coprocessor to access RTC peripherals, internal sensors, and RTC registers during
Deep-sleep.
In power-sensitive scenarios, the main CPU goes to sleep mode to lower power consumption. Meanwhile, the
coprocessor is woken up by ULP timer, and then monitors the external environment or interacts with the external
RY
circuit by controlling peripherals such as RTC GPIO, RTC I2C, SAR ADC, or temperature sensor (TSENS). The
coprocessor wakes the main CPU up once a wakeup condition is reached.
ESP32-S3
A
Enable by ULP or Main CPU
Enable with
RTC GPIO
ULP
Timer
Wakeup
IN ULP
Coprocessor
Wakeup Main
CPU
RTC GPIO
RTC I2C
TOUCH
TSENS
ADC
IM
Monitor/Control
EL
Figure 11. ULP Coprocessor Overview
ESP32-S3 has two ULP coprocessors, with one based on RISC-V instruction set architecture (ULP-RISC-V) and
the other on finite state machine (ULP-FSM). Users can choose between the two coprocessors depending on
their needs.
PR
1.2 Features
• Access up to 8 KB of SRAM RTC slow memory for instructions and data
• Clocked with 17.5 MHz RTC_FAST_CLK
• Support working in normal mode and in monitor mode
• Wake up the CPU or send an interrupt to the CPU
• Access peripherals, internal sensors and RTC registers
ULP-FSM and ULP-RISC-V can not be used simultaneously. Users can only choose one of them as the ULP
coprocessor of ESP32-S3. The differences between the two coprocessors are shown in the table below.

Table 11. Comparison of the Two Coprocessors
ULP Coprocessors
Feature
ULPFSM ULPRISCV
Memory (RTC Slow Memory) 8 KB
Work Clock Frequency 17.5 MHz
Wakeup Source ULP Timer
Assist the main CPU to complete some tasks
Normal Mode
after the chip is woken up.
Work Mode
Retrieve data from sensors to monitor
Monitor Mode
environment, when the chip is in sleep.
RY
ADC1/ADC2
RTC I2C
Control Low-Power Peripherals RTC GPIO
Touch Sensors
Temperature Sensor
Architecture Programmable FSM RISC-V
A
Development Special instruction set Standard C compiler
ULP coprocessor can access the modules in RTC domain via RTC registers. In many cases the ULP
IN
coprocessor can be a good supplement to, or replacement of, the main CPU, especially for power-sensitive
applications. Figure 1-2 shows the overall layout of ESP32-S3 coprocessor.
IM
EL
PR
Figure 12. ULP Coprocessor Diagram
1.3 Programming Workflow

The ULP-RISC-V is intended for programming using C language. The program in C is then compiled to

RV32IMC standard instruction code. The ULP-FSM is using custom instructions normally not supported by
high-level programming language. Users develop their programs using ULP-FSM instructions (see Section
1.5.2).
A RY
Figure 13. Programming Workflow
IN
1.4 ULP Coprocessor Sleep and Weakup Workflow
ULP coprocessor is designed to operate independently of the CPU, while the CPU is either in sleep or
IM
running.
In a typical power-saving scenario, the chip goes to Deep-sleep mode to lower power consumption. Before
setting the chip to sleep mode, users should complete the following operations.
1. Flash the program to be executed by ULP coprocessor into RTC slow memory.
EL
2. Select the working ULP coprocessor by configuring RTC_CNTL_COCPU_SEL.
• 0: select ULP-RISC-V
• 1: select ULP-FSM
PR
3. Set sleep cycles for the timer by configuring RTC_CNTL_ULP_CP_TIMER_1_REG.
4. Enable the timer by software or by RTC GPIO;
• By software: set RTC_CNTL_ULP_CP_SLP_TIMER_EN.
• By RTC GPIO: set RTC_CNTL_ULP_CP_GPIO_WAKEUP_ENA.
5. Set the system into sleep mode.
When the system is in Deep-sleep mode:
1. The timer periodically sets the low-power controller (see Chapter 7 Low-Power Management (RTC_CNTL) [to
be added later]) to Monitor mode and then wakes up the coprocessor.
2. Coprocessor executes some necessary operations, such as monitoring external environment via
low-power sensors.

3. After the operations are finished, the system goes back to Deep-sleep mode.
4. ULP coprocessor goes back to halt mode and waits for next wakeup.
In monitor mode, ULP coprocessor is woken up and goes to halt as shown in Figure 1-4.
RY
Figure 14. ULP Sleep and Wakeup Sequence
1. Enable the timer and the timer starts counting.
A
2. The timer expires and wakes up the ULP coprocessor. ULP coprocessor starts running and executes the
program flashed in RTC slow memory.
IN
3. ULP coprocessor goes to halt and the timer starts counting again.
• Put ULP-RISC-V into HALT: set RTC_CNTL_COCPU_DONE.
• Put ULP-FSM into HALT: execute HALT instruction.

IM
4. Disable the timer by ULP program or by software. ULP coprocessor exits from monitor mode.
• Disabled by software: clear RTC_CNTL_ULP_CP_SLP_TIMER_EN.
• Disabled by RTC GPIO: clear RTC_CNTL_ULP_CP_GPIO_WAKEUP_ENA and set

RTC_CNTL_ULP_CP
EL
_GPIO_WAKEUP_CLR.
Note:
• If the timer is enabled by software (RTC GPIO), it should be disabled by software (RTC GPIO).
• Before setting ULP-RISC-V to HALT, users should configure RTC_CNTL_COCPU_DONE first, therefore, it
PR
is recommended to end the flashed program with the following pattern:
– Set RTC_CNTL_COCPU_DONE to end the operation of ULP-RISC-V and put it into halt;
– Set RTC_CNTL_COCPU_SHUT_RESET_EN to reset ULP-RISC-V.
Enough time is reserved for the ULP-RISC-V to complete the operations above before it goes to halt.
Figure 1-5 shows the relationship between the signals and register bits.

A RY
Figure 15. Control of ULP Program Execution
IN
1.5 ULPFSM
1.5.1 Features
IM
ULP-FSM is a programmable finite state machine that can work while the main CPU is in Deep-sleep. ULP-FSM
supports instructions for complex logic and arithmetic operations, and also provides dedicated instructions for
RTC controllers or peripherals. ULP-FSM can access up to 8 KB of SRAM RTC slow memory (accessible by the
CPU) for instructions and data. Hence, such memory is usually used to store instructions and share data
between the ULP coprocessor and the CPU. ULP-FSM can be stopped by running HALT instruction.
EL
ULP-FSM has the following features.
• Provides four 16-bit general-purpose registers (R0, R1, R2, and R3) for manipulating data and accessing
memory.
• Provides one 8-bit stage count register (Stage_cnt) which can be manipulated by ALU and used in JUMP
PR
instructions.
• Supports built-in instructions specially for direct control of low-power peripherals, such as SAR ADC and
temperature sensor.
1.5.2 Instruction Set

ULP-FSM supports the following instructions.
• ALU: perform arithmetic and logic operations
• LD, ST, REG_RD and REG_WR: load and store data
• JUMP: jump to a certain address

• WAIT/HALT: manage program execution
• WAKE: wake up CPU or communicate with CPU
• TSENS and ADC: take measurements
Figure 1-6 shows the format of ULP-FSM instructions.
s
nd
e
od
ra
pC
pe
O
O
31 28 27 0
Figure 16. ULPFSM Instruction Format
RY
An instruction, which has one OpCode, can perform various operations, depending on the setting of Operands
bits. A good example is the ALU instruction, which is able to perform 10 arithmetic and logic operations; or the
JUMP instruction, which may be conditional or unconditional, absolute or relative.
Each instruction has a fixed width of 32 bits. A series of instructions can make a program be executed by the
A
coprocessor. The execution flow inside the program uses 32-bit addressing. The program is stored in a
dedicated region called Slow Memory, which is visible to the main CPU under an address range of 0x5000_0000
IN
to 0x5000_1FFF (8 KB).
1.5.2.1 ALU Perform Arithmetic and Logic Operations
ALU (Arithmetic and Logic Unit) performs arithmetic and logic operations on values stored in ULP coprocessor
IM
registers, and on immediate values stored in the instruction itself. The following operations are supported.
• Arithmetic: ADD and SUB
• Logic: AND and OR
• Bit shifting: LSH and RSH

EL
• Moving data to register: MOVE
• PC register operations - STAGE_RST, STAGE_INC, and STAGE_DEC
The ALU instruction, which has one OpCode (7), can perform various arithmetic and logic operations, depending
PR
on the setting of the instruction bits [27:21].
Operations Among Registers

l
se
1
U_
st
rc
rc
Rd
Rs
Rs
AL
31 28 27 26 25 24 21 20 6 5 4 3 2 1 0
7 0
Figure 17. Instruction Type — ALU for Operations Among Registers
When bits [27:26] of the instruction in Figure 1-7 are set to 0, ALU performs operations on the data stored in
ULP-FSM registers R[0-3]. The types of operations depend on the setting of the instruction bits ALU_sel[24:21]
presented in Table 1-2.

Operand Description - see Figure 1-7

Rdst Register R[0-3], destination
Rsrc1 Register R[0-3], source
ALU_sel ALU operation selection, see Table 1-2
ALU_sel Instruction Operation Description

0 ADD Rdst = Rsrc1 + Rsrc2 Add to register
1 SUB Rdst = Rsrc1 - Rsrc2 Subtract from register
2 AND Rdst = Rsrc1 & Rsrc2 Logical AND of two operands
3 OR Rdst = Rsrc1 | Rsrc2 Logical OR of two operands
RY
4 MOVE Rdst = Rsrc1 Move to register
5 LSH Rdst = Rsrc1 <<�Rsrc2 Logical shift left
6 RSH Rdst = Rsrc1 >>�Rsrc2 Logical shift right
Table 12. ALU Operations Among Registers
Note:
A
• ADD or SUB operations can be used to set or clear the overflow flag in ALU.
• All ALU operations can be used to set or clear the zero flag in ALU.
Operations with Immediate Value

IN
l
se
1
U_
st
rc
m
AL
Rd
Rs
Im
31 28 27 26 25 24 21 20 19 4 3 2 1 0
IM
7 1
Figure 18. Instruction Type — ALU for Operations with Immediate Value
EL
When bits [27:26] of the instruction in Figure 1-8 are set to 1, ALU performs operations using register R[0-3] and
the immediate value stored in instruction bits [19:4]. The types of operations depend on the setting of the
instruction bits ALU_sel[24:21] presented in Table 1-3.
PR

Imm 16-bit signed immediate value
ALU_sel ALU operation selection, see Table 1-3
Note:
• ADD or SUB operations can be used to set or clear the overflow flag in ALU.
• All ALU operations can be used to set or clear the zero flag in ALU.
Operations with Stage Count Register

l
se
U_
m
AL
Im
31 28 27 26 25 24 21 20 12 11 4 3 0
7 2


0 ADD Rdst = Rsrc1 + Imm Add to register
1 SUB Rdst = Rsrc1 - Imm Subtract from register
2 AND Rdst = Rsrc1 & Imm Logical AND of two operands
3 OR Rdst = Rsrc1 | Imm Logical OR of two operands
4 MOVE Rdst = Imm Move to register
5 LSH Rdst = Rsrc1 <<�Imm Logical shift left
6 RSH Rdst = Rsrc1 >>�Imm Logical shift right
Table 13. ALU Operations with Immediate Value
Figure 19. Instruction Type — ALU for Operations with Stage Count Register
RY
ALU is also able to increment or decrement by a given value, or reset the 8-bit register Stage_cnt. To do so, bits
[27:26] of instruction in Figure 1-9 should be set to 2. The type of operation depends on the setting of the
instruction bits ALU_sel[24:21] presented in Table 1-9. The Stage_cnt is a separate register and is not a part of
A
the instruction in Figure 1-9.
Imm 8-bit signed immediate value
ALU_sel
Stage_cnt
ALU operation selection, see Table 1-4
IN
Stage count register, a 8-bit separate register used to store variables, such as loop index

IM
0 STAGE_INC Stage_cnt = Stage_cnt + Imm Increment stage count register
1 STAGE_DEC Stage_cnt = Stage_cnt - Imm Decrement stage count register
2 STAGE_RST Stage_cnt = 0 Reset stage count register
Table 14. ALU Operations with Stage Count Register

EL
Note: This instruction is mainly used with JUMPS instruction based on the stage count register to form a stage
count for-loop. For the usage, please refer to the following pseudocode:
STAGE_RST // clear stage count register

STAGE_INC // stage count register ++
PR
{...} // loop body, containing n instructions

JUMPS (step = n, cond = 0, threshold = m) // If the value of stage count register is less than m, then jump to
STAGE_INC, otherwise jump out of the loop. By such way, a cumulative for-loop with threshold m is implemented.
1.5.2.2 ST – Store Data in Memory

fs n
r_ et
of ul_e
to
ay
w t_s
au
r
w
pe
et
e
st
an
el
rc
r_
fs
up
lab
Rd
Rs
m
w
of
31 28 27 26 25 24 21 20 10 9 8 7 6 5 4 3 2 1 0
Figure 110. Instruction Type ST


Rdst Register R[0-3], address of the destination, expressed in 32-bit words
Rsrc Register R[0-3], 16-bit value to store
label Data label, 2-bit user defined unsigned value
upper 0: write the low half-word; 1: write the high half-word
wr_way 0: write the full-word; 1: with the label; 3: without the label
offset 11-bit signed value, expressed in 32-bit words
wr_auto Enable automatic storage mode
offset_set Offset enable bit.
0: Do not configure the offset for automatic storage mode.
1: Configure the offset for automatic storage mode.
RY
manul_en Enable manual storage mode
Automatic Storage Mode
et
fs
of
31 28 27 25 24 21 20 10 9 0
6 3
A
Figure 111. Instruction Type Offset in Automatic Storage Mode (STOFFSET)

IN
offset Initial address offset, 11-bit signed value, expressed in 32-bit words ay
w
st
el
rc
r_
IM
lab
Rd
Rs
w
31 28 27 25 24 9 8 7 6 5 4 3 2 1 0
6 1
Figure 112. Instruction Type Data Storage in Automatic Storage Mode (STAUTODATA)
EL
Operand Description - See Figure 1-12

PR
wr_way 0: write the full-word; 1: with the label; 3: without the label
Description
This mode is used to access continuous addresses. Before using this mode for the first time, please configure
the initial address using ST-OFFSET instruction. Executing the instruction ST-AUTO-DATA will store the 16-bit
data in Rsrc into the memory address Rdst + Offset, see Table 1-5. Write_cnt here indicates the times of the
instruction ST-AUTO-DATA executed.

wr_way write_cnt Store Data Operation

0 * Mem [Rdst + Offset]{31:0} = {PC[10:0],3’b0,Label[1:0],Rsrc[15:0]} Write full-word, including
the pointer and the data
1 odd Mem [Rdst + Offset]{15:0} = {Label[1:0],Rsrc[13:0]} Store the data with label
in the low half-word
1 even Mem [Rdst + Offset]{31:16} = {Label[1:0],Rscr[13:0]} Store the data with label
in the high half-word
3 odd Mem [Rdst + Offset]{15:0} = Rsrc[15:0]} Store the data without label
3 even Mem [Rdst + Offset]{31:16} = Rsrc[15:0] Store the data without label
RY
Table 15. Data Storage Type Automatic Storage Mode
The full-word written to RTC memory is built as follows:
rc
n
Rs
io
at
of
rm
s
A nt
fo
e
in
el
nt
PC
lab
co
31 21 20 18 17 16 15 0
0
IN
Figure 113. Data Structure of RTC_SLOW_MEM[Rdst + Offset]
IM
Bits Description - See Figure 1-13
bits [15:0] store the content of Rsrc
bits [17:16] data label, 2-bit user defined unsigned value
bits [20:18] 3’b0 by default
bits [31:21] hold the PC of current instruction, expressed in 32-bit words
EL
Note:
• When full-word is written, the offset will be automatically incremented by 1 after each ST-AUTO-DATA
execution.
• When half-word is written (low half-word first), the offset will be automatically incremented by 1 after twice
PR
ST-AUTO-DATA execution.
• This instruction can only access 32-bit memory words.
• The “Mem” written is the RTC_SLOW_MEM memory. Address 0, as seen by the ULP coprocessor,
corresponds to address 0x50000000, as seen by the main CPU.
Manual Storage Mode

ay
r
w
pe
et
st
el
rc
r_
fs
up
lab
Rd
Rs
w
of
31 28 27 25 24 21 20 10 9 8 7 6 5 4 3 2 1 0
6 4
Figure 114. Instruction Type Data Storage in Manual Storage Mode


upper 0: Write the low half-word; 1: write the high half-word
wr_way 0: Write the full-word; 1: with the label; 3: without the label
offset 11-bit signed value, expressed in 32-bit words
Description
Manual storage mode is mainly used for storing data into discontinuous addresses. Each instruction needs a
storage address and offset. The detailed storage methods are shown in Table 1-6.
RY
wr_way upper Data Operation
0 * Mem [Rdst + Offset]{31:0} = {PC[10:0],3’b0, Label[1:0],Rsrc[15:0]} Write full-word, including
the pointer and the data
1 0 Mem [Rdst + Offset]{15:0} = {Label[1:0],Rsrc[13:0]} Store the data with label
1 1 Mem [Rdst + Offset]{31:16} = {Label[1:0],Rsrc[13:0]} Store the data with label
A
3 0 Mem [Rdst + Offset]{15:0} = Rsrc[15:0] Store the data without label
3 1
IN
Mem [Rdst + Offset]{31:16} = Rsrc[15:0] Store the data without label
Table 16. Data Storage Manual Storage Mode

IM
1.5.2.3 LD – Load Data from Memory
r
pe
up
et
st
rc
_
fs
Rd
Rs
rd
of
EL
31 28 27 26 21 20 10 9 4 3 2 1 0
13
Figure 115. Instruction Type LD

PR

Rsrc Register R[0-3], address of destination memory, expressed in 32-bit words
Offset 11-bit signed value, expressed in 32-bit words
rd_upper Choose which half-word to read:
0 - read the high half-word
1 - read the low half-word
Description
This instruction loads the low or high 16-bit half-word, depending on rd_upper, from memory with address Rsrc +
offset into the destination register Rdst:
Rdst[15:0] = Mem[Rsrc + Offset]

Note:
• This instruction can only access 32-bit memory words.
• The “Mem” loaded is the RTC_SLOW_MEM memory. Address 0, as seen by the ULP coprocessor,
corresponds to address 0x50000000, as seen by the main CPU.
1.5.2.4 JUMP – Jump to an Absolute Address
dr
Ad
e
st
m
p
Rd
Se
Ty
Im
31 28 27 26 25 24 22 21 20 13 12 2 1 0
8 1
RY
Figure 116. Instruction Type JUMP

Rdst Register R[0-3], containing address to jump to (expressed in 32-bit words)
A
ImmAddr 11-bit address, expressed in 32-bit words
Sel Select the address to jump to:
0 - jump to the address stored in ImmAddr
Type
1 - jump to the address stored in Rdst
Jump type:
IN
0 - make an unconditional jump
1 - jump only if the last ALU operation has set zero flag
IM
2 - jump only if the last ALU operation has set overflow flag
Note:
All jump addresses are expressed in 32-bit words.
Description
EL
The instruction executes a jump to a specified address. The jump can be either unconditional or based on the
ALU flag.
1.5.2.5 JUMPR – Jump to a Relative Address (Conditional upon R0)

ld
PR
sho
nd
ep
re
Co
St
Th
31 28 27 26 25 18 17 16 15 0
8 0
Figure 117. Instruction Type JUMPR


Threshold Threshold value for condition (see Cond below) to jump
Cond Condition to jump:
0 - jump if R0 < Threshold
1 - jump if R0 > Threshold
2 - jump if R0 = Threshold
Step Relative shift from current position, expressed in 32-bit words:
if Step[7] = 0, then PC = PC + Step[6:0]
if Step[7] = 1, then PC = PC - Step[6:0]
Note:
All jump addresses are expressed in 32-bit words.
RY
Description
The instruction executes a jump to a relative address, if the condition is true. The condition is the result of
comparing the R0 register value and the Threshold value.
1.5.2.6 JUMPS – Jump to a Relative Address (Conditional upon Stage Count Regis
A
ter)
ld
ho
IN
s
nd
ep
re
Co
St
31 28 27 26 25 18 17 16 15 Th 0
8 2
Figure 118. Instruction Type JUMPS

IM

Threshold Threshold value for condition (see Cond below) to jump
Cond Condition to jump:
EL
1X - jump if Stage_cnt <= Threshold

00 - jump if Stage_cnt < Threshold
01 - jump if Stage_cnt >= Threshold
Step Relative shift from current position, expressed in 32-bit words:
if Step[7] = 0, then PC = PC + Step[6:0]
PR
if Step[7] = 1, then PC = PC - Step[6:0]

Note:
• For more information about the stage count register, please refer to Section 1.5.2.1.
• All jump addresses are expresses in 32-bit words.
Description
The instruction executes a jump to a relative address if the condition is true. The condition itself is the result of
comparing the value of Stage_cnt (stage count register) and the Threshold value.

1.5.2.7 HALT – End the Program
31 28 27 0
11
Figure 119. Instruction Type HALT
Description
The instruction ends the operation of the ULP-FSM and puts it into power-down mode.
Note:
After executing this instruction, the ULP coprocessor wakeup timer gets started.
RY
1.5.2.8 WAKE – Wake up the Chip
31 28 27 26 25 1 0
9 0 1’b1
A
Figure 120. Instruction Type WAKE
Description
IN
This instruction sends an interrupt from the ULP-FSM to the RTC controller.
• If the chip is in Deep-sleep mode, and the ULP wakeup timer is enabled, the above-mentioned interrupt will
wake up the chip.
IM
• If the chip is not in Deep-sleep mode, and the ULP interrupt bit RTC_CNTL_ULP_CP_INT_ENA is set in
register RTC_CNTL_INT_ENA_REG, an RTC interrupt will be triggered.
1.5.2.9 WAIT – Wait for a Number of Cycles

EL
s
cle
Cy
31 28 27 16 15 0
4
PR
Figure 121. Instruction Type WAIT

Cycles The number of cycles to wait
Description
The instruction will delay the ULP-FSM for a given number of cycles.

1.5.2.10 TSENS – Take Measurement with Temperature Sensor
y
ela
_D
ait
ts
Rd
W
31 28 27 16 15 2 1 0
10
Figure 122. Instruction Type TSENS

Rdst Destination Register R[0-3], results will be stored in this register.
RY
Wait_Delay Number of cycles used to perform the measurement.
Description
Increasing the measurement cycles Wait_Delay helps improve the accuracy and optimize the result. The
instruction performs measurement via temperature sensor and stores the result into a general purpose
register.
A
1.5.2.11 ADC – Take Measurement with ADC IN
ux
M
r_
st
l
Sa
Rd
Se
31 28 27 7 6 5 2 1 0
5
IM
Figure 123. Instruction Type ADC

Rdst Destination Register R[0-3], results will be stored in this register.
EL
Sar_Mux Enable SAR ADC channel. Channel No. is [Sar_Mux - 1]. For more information, see Chapter
6 On-Chip Sensors and Analog Signal Processing [to be added later].
Sel Select ADC. 0: select SAR ADC1; 1: select SAR ADC2, see Table 1-7.
Table 17. Input Signals Measured Using the ADC Instruction

PR
Pad/Signal/GPIO Sar_Mux ADC Selection (Sel)

GPIO1 1
GPIO2 2
GPIO3 3
GPIO4 4
GPIO5 5
Sel = 0, select SAR ADC1
GPIO6 6
GPIO7 7
GPIO8 8
GPIO9 9
GPIO10 10

Pad/Signal/GPIO Sar_Mux ADC Selection�Sel�

GPIO11 1
GPIO12 2
GPIO13 3
GPIO14 4
XTAL_32k_P 5
XTAL_32k_N 6
GPIO17 7
GPIO18 8
GPIO19 9
GPIO20 10
RY
1.5.2.12 REG_RD – Read from Peripheral Register
gh
dr
w
Ad
Lo
Hi
31 28 27 23 22 18 17 10 9 0
A
Figure 124. Instruction Type REG_RD

Addr
Low
IN
Peripheral register address, in 32-bit words
Register start bit number
High Register end bit number
Description
IM
The instruction reads up to 16 bits from a peripheral register into a general-purpose register:
R0 = REG[Addr][High:Low]
In case of more than 16 bits being requested, i.e. High - Low + 1 > 16, then the instruction will return
[Low+15:Low].
EL
Note:
• This instruction can access registers in RTC_CNTL, RTC_IO, SENS, and RTC_I2C peripherals. Address of
the register, as seen from the ULP coprocessor (addr_ulp), can be calculated from the address of the same
register on the main bus (addr_bus), as follows:
PR
addr_ulp = (addr_bus - DR_REG_RTCCNTL_BASE)/4

• The addr_ulp is expressed in 32-bit words (not in bytes), and value 0 maps onto the
DR_REG_RTCCNTL_BASE (as seen from the main CPU). Thus, 10 bits of address cover a 4096-byte
range of peripheral register space, including regions DR_REG_RTCCNTL_BASE (0x6000800),
DR_REG_RTCIO_BASE (0x60008400), DR_REG_SENS_BASE (0x60008800), and
DR_REG_RTC_I2C_BASE (0x60008C00). For more information about address mapping, see Section 1.8.
1.5.2.13 REG_WR – Write to Peripheral Register

gh
dr
ta
w
Da
Ad
Lo
Hi
31 28 27 23 22 18 17 10 9 0

Figure 125. Instruction Type REG_WR

Addr Register address, expressed in 32-bit words
Data Value to write, 8 bits
Low Register start bit number
High Register end bit number
Description
This instruction writes up to 8 bits from an immediate data value into a peripheral register.
RY
REG[Addr][High:Low] = Data
If more than 8 bits are requested, i.e. High - Low + 1 > 8, then the instruction will pad with zeros the bits above
the eighth bit.
Note:
A
See notes regarding addr_ulp in Section 1.5.2.12.
1.6 ULPRISCV
1.6.1 Features
IN
• Support RV32IMC instruction set
IM
• Thirty-two 32-bit general-purpose registers
• 32-bit multiplier and divider
• Support for interrupts

EL
1.6.2 Multiplier and Divider

ULP-RISC-V has an independent multiplication and division unit. The efficiency of multiplication and division
instructions is shown in the following table.
Table 18. Instruction Efficiency

PR
Operation Instruction Execution Cycle Instruction Description

Multiply two 32-bit integers and return the lower 32-bit of
MUL 34
the result
Multiply two 32-bit signed integers and return the higher
MULH 66
32-bit of the result
Multiply
Multiply two 32-bit unsigned integers and return the
MULHU 66
higher 32-bit of the result
Multiply a 32-bit signed integer with a unsigned integer
MULHSU 66
and return the higher 32-bit of the result

Operation Instruction Execution Cycle Instruction Description

Divide a 32-bit integer by a 32-bit integer and return the
DIV 34
quotient
Divide a 32-bit unsigned integer by a 32-bit unsigned in-
DIVU 34
teger and return the quotient
Divide
Divide a 32-bit signed integer by a 32-bit signed integer
REM 34
and return the remainder
Divide a 32-bit unsigned integer by a 32-bit unsigned in-
REMU 34
teger and return the remainder
RY
1.6.3 ULPRISCV Interrupts
1.6.3.1 Introduction
The interrupt controller of ULP-RISC-V is implemented by using a customized instruction set, instead of RISC-V
Privileged ISA specification, aiming to reduce the size of ULP-RISC-V.
A
1.6.3.2 Interrupt Controller
ULP-RISC-V has 32 interrupt sources, but only four of them are available in the real design, as shown in the table
below, including:
IN
• internal sources: INT 0 ~ INT 2, triggered by internal interrupt events.
• external source: INT 31, triggered by the peripheral interrupts of ESP32-S3.

IM
Type IRQ Triggered by
Internal 0 Internal timer interrupt
Internal 1 EBREAK/ECALL or Illegal Instruction
Internal 2 BUS Error (Unaligned Memory Access)
EL
External 31 RTC peripheral interrupts
Table 19. ULPRISCV Interrupt Sources
Note:
PR
If illegal instruction interrupt or bus error interrupt is disabled, ULP-RISC-V goes to HALT when the two errors
occur.
ULP-RISC-V provides four 32-bit interrupt registers, Q0 ~ Q3, to handle interrupt service routine (ISR). Table 1-10
shows the function of each register.

Register Function
Store the returned address. If the interrupt instruction is a
Q0
compressed one, the lowest bit of this register will be set.
Bitmap. If the corresponding bit of an interrupt is set, this
Q1
interrupt will trigger its ISR.
Q2 Reserved. An option for ISR to store data.
Q3 Reserved. An option for ISR to store data.
Table 110. ULPRISCV Interrupt Registers

Note:
• If more than one bits in Q1 are set, all the corresponding interrupts will call the same ISR. For such reason,
RY
users need to program ISR to check the interrupt number and execute corresponding program.
• After ULP-RISC-V is reset, all the interrupts are disabled.
1.6.3.3 Interrupt Instructions
All these interrupt instructions are standard R-type instructions, with the same OpCode of custom0 (0001011).
A
Figure 1-26 shows the format of standard R-type instructions. Note the fields funct3 (f3) and rs2 are ignored in
these instructions. IN
e
od
t7
pC
ct
nc
O
rd
fu
rs
rs
fu
31 25 24 20 19 15 14 12 11 7 6 0
IM
Figure 126. Standard Rtype Instruction Format
Instruction: getq rd,qs

EL
This instruction copies the value of Qx into a general purpose register rd.
e
od
pC
2
qs
O
rd
f3
f7
rs
31 25 24 20 19 15 14 12 11 7 6 0
0000000 −−−−− 000XX −−− XXXXX 0001011

PR
Figure 127. Interrupt Instruction getq rd, qs

rd Target general purpose register, holds the value of interrupt register specified by qs.
qs Address of interrupt register Qx.
f7 Interrupt instruction number.
Instruction: setq qd,rs
This instruction copies the value of general purpose register rs to Qx.

e
od
pC
2
qd
O
f3
f7
rs
rs
31 25 24 20 19 15 14 12 11 7 6 0
0000001 −−−−− XXXXX −−− 000XXX 0001011

Figure 128. Interrupt Instruction setq qd,rs

qd Target interrupt register
rs Source general purpose register, stores the value to be written to interrupt register.
Instruction: retirq
This instruction copies the value of Q0 to CPU PC, and enables interrupt again.
e
od
RY pC
2
O
rd
f3
f7
rs
rs
31 25 24 20 19 15 14 12 11 7 6 0
0000010 −−−−− 00000 −−− 00000 0001011
Figure 129. Interrupt Instruction retirq
A
Instruction: maskirq rd,rs

IN
This instruction copies the value of Q1 to the register rd, and copies the value of register rs to Q1.
de
o
pC
2
O
rd
f3
f7
rs
rs
IM
31 25 24 20 19 15 14 12 11 7 6 0
0000011 −−−−− XXXXX −−− XXXXX 0001011
Figure 130. Interrupt Instruction — Maskirq rd rs

EL
rd Target general purpose register, stores current value of register Q1.

rs Source general purpose register, stores the value to be written to Q1.
1.6.3.4 RTC Peripheral Interrupts

PR
The interrupts from some sensors, software, and RTC I2C can be routed to ULP-RISC-V. To enable the
interrupts, please set the register SENS_SAR_COCPU_INT_ENA_REG, see Table 1-11.

Enable bit Interrupt Description

Triggered when the touch sensor completes
0 TOUCH_DONE_INT
the scan of a channel
Triggered when the touch pad is released
1 TOUCH_INACTIVE_INT
Triggered when the touch pad is touched
2 TOUCH_ACTIVE_INT
Triggered when SAR ADC1 completes the
3 SARADC1_DONE_INT
conversion one time
Triggered when SAR ADC2 completes the
4 SARADC2_DONE_INT
conversion one time
Triggered when the temperature sensor
5 TSENS_DONE_INT
completes the dump of its data
RY
Triggered when ULP-RISC-V powers on
6 RISCV_START_INT
and starts working
Triggered by software
7 SW_INT
Triggered by timeout of Super Watchdog
8 SWD_INT
(SWD)
Triggered by touch pad sampling timeout
A
9 TOUCH_TIME_OUT_INT
Triggered when touch pad completes an
10 TOUCH_APPROACH_LOOP_DONE_INT
APPROACH sampling
Triggered when touch pad completes the
11 TOUCH_SCAN_DONE_INT
IN scan of the final channel
Table 111. ULPRISCV Interrupt List

IM
Note:
• Besides the above-mentioned interrupts, ULP-RISC-V can also handle the interrupt from RTC_IO by simply
configuring RTC_IO as input mode. Users can configure RTCIO_GPIO_PINn_INT_TYPE to select the
interrupt trigger modes, but only level trigger modes are available. For more details about RTC_IO
configuration, see Chapter 5 IO MUX and GPIO Matrix (GPIO, IO MUX).
EL
• The interrupt from RTC_IO can be cleared by releasing RTC_IO and its source can be read from the register
RTCIO_RTC_GPIO_STATUS_REG.
• The SW_INT interrupt is generated by configuring the register RTC_CNTL_COCPU_SW_INT_TRIGGER.
• For the information about RTC I2C interrupts, please refer to Section 1.7.4.
PR
1.7 RTC I2C Controller

ULP coprocessor reads from or writes to external I2C slave devices via RTC I2C controller.
1.7.1 Connecting RTC I2C Signals

SDA and SCL signals can be mapped onto two out of the four GPIO pins, which are identified in Table RTC_MUX
Pad List in Chapter 5 IO MUX and GPIO Matrix (GPIO, IO MUX), using the register
RTCIO_SAR_I2C_IO_REG.

1.7.2 Configuring RTC I2C

Before ULP coprocessor can communicate using I2C instruction, RTC I2C need to be configured. Configuration
is performed by writing certain timing parameters into the RTC I2C registers. This can be done by the program
running on the main CPU, or by the ULP coprocessor itself.
Note:
The timing parameters are configured in cycles of RTC_FAST_CLK running at 17.5 MHz.
1. Set the low and high SCL half-periods by configuring RTC_I2C_SCL_LOW_PERIOD_REG and
RTC_I2C_SCL
RY
_HIGH_PERIOD_REG in RTC_FAST_CLK cycles (e.g. RTC_I2C_SCL_LOW_PERIOD_REG = 40, RTC_I2C_
SCL_HIGH_PERIOD_REG = 40 for 100 kHz frequency).
2. Set the number of cycles between the SDA switch and the falling edge of SCL by using
RTC_I2C_SDA_DUTY
_REG in RTC_FAST_CLK (e.g. RTC_I2C_SDA_DUTY_REG = 16).
A
3. Set the waiting time after the START signal by using RTC_I2C_SCL_START_PERIOD_REG (e.g. RTC_I2C
_SCL_START_PERIOD = 30).
4. Set the waiting time before the END signal by using RTC_I2C_SCL_STOP_PERIOD_REG (e.g. RTC_I2C_
SCL_STOP_PERIOD = 44).
IN
5. Set the transaction timeout by using RTC_I2C_TIME_OUT_REG (e.g. RTC_I2C_TIME_OUT_REG = 200).
6. Configure the RTC I2C controller into master mode by setting the bit RTC_I2C_MS_MODE in
IM
RTC_I2C_CTRL
_REG.
7. Write the address(es) of external slave(s) to SENS_I2C_SLAVE_ADDRn (n: 0-7). Up to eight slave
addresses can be pre-programmed this way. One of these addresses can then be selected for each
transaction as part of the RTC I2C instruction.
EL
Once RTC I2C is configured, the main CPU or the ULP coprocessor can communicate with the external I2C
devices.
1.7.3 Using RTC I2C

PR
1.7.3.1 Instruction Format
The format of RTC I2C instruction is consistent with that of I2C0/I2C1, see Section I2C CMD Controller in
Chapter 23 I2C Controller (I2C). The only difference is that RTC I2C provides fixed instructions for different
operations, as follows:
• Command 0 ~ Command 1: specifically for I2C write operation
• Command 2 ~ Command 6: specifically for I2C read operation
Note: All slave addresses are expressed in 7 bits.

1.7.3.2 I2C_RD I2C Read Workflow
Preparation for RTC I2C read:
• Configure the instruction list of RTC I2C (see Section CMD_Controller in Chapter 23 I2C Controller (I2C)),
including instruction order, instruction code, read data number (byte_num), and other information.
• Configure the slave register address by setting the register SENS_SAR_I2C_CTRL[18:11].
• Start RTC I2C transmission by setting SENS_SAR_I2C_START_FORCE and SENS_SAR_I2C_START.
• When an RTC_I2C_RX_DATA_INT interrupt is received, transfer the read data stored in RTC_I2C_RDATA to
SRAM RTC slow memory, or use the data directly.
RY
The I2C_RD instruction performs the following operations (see Figure 1-31):
1. Master generates a START signal.
2. Master sends slave address, with r/w bit set to 0 (“write”). Slave address is obtained from
SENS_I2C_SLAVE_ADDRn.
3. Slave generates ACK.
A
4. Master sends slave register address.
6. Master generates a repeated START (RSTART) signal.

IN
7. Master sends slave address, with r/w bit set to 1 (“read”).
8. Slave sends one byte of data.

IM
9. Master checks whether the number of transmitted bytes reaches the number set by the current instruction
(byte_num). If yes, master jumps out of the read instruction and sends an NACK signal. Otherwise master
repeats Step 8 and waits for the slave to send the next byte.
10. Master generates a STOP signal and stops reading.

EL
1 2 3 4 5 6 7 8 9 10
RSTRT
START
NACK
STOP
Master Slave Address W Reg Address Slave Address R

ACK
ACK
Slave Data(n)
PR
Figure 131. I2C Read Operation
Note:
The RTC I2C peripheral samples the SDA signals on the falling edge of SCL. If the slave changes SDA in less
than 0.38 ms, the master may receive incorrect data.
1.7.3.3 I2C_WR I2C Write Workflow
Preparation for RTC I2C write:
• Configure RTC I2C instruction list, including instruction order, instruction code, and the data to be written in
byte (byte_num). See the configuration of I2C0/I2C1 in Section CMD_Controller in Chapter 23 I2C
Controller (I2C).

• Configure the slave register address by setting the register SENS_SAR_I2C_CTRL[18:11], and the data to
be transmitted in SENS_SAR_I2C_CTRL[26:19].
• Set SENS_SAR_I2C_START_FORCE and SENS_SAR_I2C_START to start the transmission.
• Update the next data to be transmitted in SENS_SAR_I2C_CTRL[26:19], each time when an

RTC_I2C_TX_DATA_INT interrupt is received.
The I2C_WR instruction performs the following operations, see Figure 1-32.
1. Master generates a START signal.
2. Master sends slave address, with r/w bit set to 0 (“write”). Slave address is obtained from
SENS_I2C_SLAVE_ADDRn.
RY
4. Master sends slave register address.
6. Master generates a repeated START (RSTART) signal.
A
7. Master sends slave address, with r/w bit set to 0 (“write”).
8. Master sends one byte of data. IN

9. Slave generates ACK. Master checks whether the number of transmitted bytes reaches the number set by
the current instruction (byte_num). If yes, master jumps out of the write instruction and starts the next
instruction. Otherwise the master repeats Step 8 and sends the next byte.
10. Master generates a STOP signal and stops the transmission.

IM
1 2 3 4 5 6 7 8 9 10
RSTRT
START
STOP
Master Slave Address W Reg Address Slave Address W Data(n)
ACK
ACK
ACK
Slave
EL
Figure 132. I2C Write Operation
1.7.3.4 Detecting Error Conditions

PR
Applications can query specific bits in the RTC_I2C_INT_ST_REG register to check if the transaction is
successful. To enable checking for specific communication events, their corresponding bits should be set in
register RTC_I2C_INT_ENA_REG. Note that the bit map is shifted by 1. If a specific communication event is
detected and its corresponding bit in register RTC_I2C_INT_ST_REG is set, the event can then be cleared using
register RTC_I2C_INT_CLR_REG.
1.7.4 RTC I2C Interrupts

• RTC_I2C_SLAVE_TRAN_COMP_INT: Triggered when the slave finishes the transaction.
• RTC_I2C_ARBITRATION_LOST_INT: Triggered when the master loses control of the bus.
• RTC_I2C_MASTER_TRAN_COMP_INT: Triggered when the master completes the transaction.
• RTC_I2C_TRANS_COMPLETE_INT: Triggered when a STOP signal is detected.

• RTC_I2C_TIME_OUT_INT: Triggered by time out event.
• RTC_I2C_ACK_ERR_INT: Triggered by ACK error.
• RTC_I2C_RX_DATA_INT: Triggered when data is received.
• RTC_I2C_TX_DATA_INT: Triggered when data is transmitted.
• RTC_I2C_DETECT_START_INT: Triggered when a START signal is detected.
1.8 Address Mapping

Table 1-12 shows the address mapping and available base registers for the peripherals accessible by ULP
coprocessors.
RY
Table 112. Address Mapping
Peripheral(s) Base Register Main Bus Address ULPFSM Base ULPRISCV Base
RTC Control DR_REG_RTCCNTL_BASE 0x60008000 0x8000 0x8000
RTC GPIO DR_REG_RTC_IO_BASE 0x60008400 0x8400 0xA400
A
ADC, Touch, TSENS DR_REG_SENS_BASE 0x60008800 0x8800 0xC800
RTC I2C DR_REG_RTC_I2C_BASE IN 0x60008C00 0x8C00 0xEC00
To find more information about registers for these peripherals, please check the following chapters.
Table 113. Description of Registers for Peripherals Accessible by ULP Coprocessors

IM
Registers Available for Peripherals Described in Which Chapter
Registers for RTC Control Chapter 7 Low-Power Management (RTC_CNTL) [to be added later]
Registers for RTC GPIO Chapter 5 IO MUX and GPIO Matrix (GPIO, IO MUX)
Registers for ARC, Touch, TSENS Chapter 6 On-Chip Sensors and Analog Signal Processing [to be
added later]
EL
Registers for RTC I2C Section 1.9 Register Summary in this chapter
1.9 Register Summary

The following registers are used in ULP coprocessor:
PR
• ULP (ALWAYS_ON) registers: not reset due to power down of RTC_PERI domain. See Chapter 7
Low-Power Management (RTC_CNTL) [to be added later].
• ULP (RTC_PERI) registers: reset due to power down of RTC_PERI domain. See Chapter 7 Low-Power
Management (RTC_CNTL) [to be added later].
• RTC I2C registers: I2C related registers, including RTC I2C (RTC_PERI) and RTC I2C (I2C) registers.
1.9.1 ULP (ALWAYS_ON) Register Summary

The addresses in this section are relative to low-power management base address provided in Table 3-4 in
Chapter 3 System and Memory.

Name Description Address Access

ULP Timer Registers
RTC_CNTL_ULP_CP_TIMER_REG Configure the timer 0x00F8 varies
RTC_CNTL_ULP_CP_TIMER_1_REG Configure sleep cycle of the timer 0x0130 R/W
ULPFSM Register
RTC_CNTL_ULP_CP_CTRL_REG ULP-FSM configuration register 0x00FC R/W
ULPRISCV Register
RTC_CNTL_COCPU_CTRL_REG ULP-RISC-V configuration register 0x0100 varies
1.9.2 ULP (RTC_PERI) Register Summary
RY

ULPRISCV Registers
SENS_ SAR_COCPU_INT_RAW_REG Interrupt raw bit of ULP-RISC-V 0x00E8 RO
A
SENS_SAR_COCPU_INT_ENA_REG Interrupt enable bit of ULP-RISC-V 0x00EC R/W
SENS_SAR_COCPU_INT_ST_REG Interrupt status bit of ULP-RISC-V 0x00F0 RO
SENS_SAR_COCPU_INT_CLR_REG Interrupt clear bit of ULP-RISC-V 0x00F4 WO
IN
1.9.3 RTC I2C (RTC_PERI) Register Summary
The addresses in this section are relative to low-power management base address + 0x0800 provided in Table
IM
3-4 in Chapter 3 System and Memory.

RTC I2C Controller Register
SENS_SAR_I2C_CTRL_REG Configure RTC I2C transmission 0x0058 R/W
EL
RTC I2C Slave Address Registers

SENS_SAR_SLAVE_ADDR1_REG Configure slave addresses 0-1 of RTC I2C 0x0040 R/W
SENS_SAR_SLAVE_ADDR4_REG Configure slave addresses 6-7 of RTC I2C 0x004C R/W
PR
1.9.4 RTC I2C (I2C) Register Summary

The addresses in this section are relative to low-power management base address + 0x0C00 provided in Table

RTC I2C Signal Setting Registers
RTC_I2C_SCL_LOW_REG Configure the low level width of SCL 0x0000 R/W
RTC_I2C_SCL_HIGH_REG Configure the high level width of SCL 0x0014 R/W
RTC_I2C_SDA_DUTY_REG Configure the SDA hold time after a negative 0x0018 R/W
SCL edge


RTC_I2C_SCL_START_PERIOD_REG Configure the delay between the SDA and SCL 0x001C R/W
negative edge for a start condition
RTC_I2C_SCL_STOP_PERIOD_REG Configure the delay between SDA and SCL pos- 0x0020 R/W
itive edge for a stop condition
RTC I2C Control Registers
RTC_I2C_CTRL_REG Transmission setting 0x0004 R/W
RTC_I2C_STATUS_REG RTC I2C status 0x0008 RO
RTC_I2C_TO_REG Configure RTC I2C timeout 0x000C R/W
RTC_I2C_SLAVE_ADDR_REG Configure slave address 0x0010 R/W
RTC I2C Interrupt Registers
RY
RTC_I2C_INT_CLR_REG Clear RTC I2C interrupt 0x0024 WO
RTC_I2C_INT_RAW_REG RTC I2C raw interrupt 0x0028 RO
RTC_I2C_INT_ST_REG RTC I2C interrupt status 0x002C RO
RTC_I2C_INT_ENA_REG Enable RTC I2C interrupt 0x0030 R/W
RTC I2C Status Register
A
RTC_I2C_DATA_REG RTC I2C read data 0x0034 varies
RTC I2C Command Registers
RTC_I2C_CMD0_REG RTC I2C Command 0 0x0038 varies
RTC_I2C_CMD1_REG
RTC_I2C_CMD2_REG
IN
RTC I2C Command 1
RTC I2C Command 2
0x003C
0x0040
varies
varies
IM
RTC_I2C_CMD5_REG RTC I2C Command 5 0x004C varies
EL

PR

Version register
RTC_I2C_DATE_REG Version control register 0x00FC R/W
1.10 Registers
1.10.1 ULP (ALWAYS_ON) Registers

Register 1.1. RTC_CNTL_ULP_CP_TIMER_REG (0x00F8)
A
P_ R
EN
EU _CL
O AK N
AK P
U
E
G _W R_
_W E
P_ IO E
_C GP TIM
T
NI
LP P_ P_
_I
PI
PC
_U _C SL
TL LP P_
P_
CN L_U _C
_C
C_ T LP
P
UL
RT CN L_U
L_
C_ NT
T
d)
CN
ve
RT _C
er
C_
C
s
RT
RT
(re
31 30 29 28 11 10 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
RTC_CNTL_ULP_CP_PC_INIT ULP coprocessor PC initial address. (R/W)
RTC_CNTL_ULP_CP_GPIO_WAKEUP_ENA Enable the option of ULP coprocessor woken up by

RTC GPIO. (R/W)
RTC_CNTL_ULP_CP_GPIO_WAKEUP_CLR Disable the option of ULP coprocessor woken up by
A
RTC GPIO. (WO)
RTC_CNTL_ULP_CP_SLP_TIMER_EN ULP coprocessor timer enable bit. 0: Disable hardware

timer; 1: Enable hardware timer. (R/W)
IN
Register 1.2. RTC_CNTL_ULP_CP_TIMER_1_REG (0x0130)
IM
LE
YC
_C
LP
_S
ER
IM
_T
CP
P_
EL
UL
T L_
)
ed
CN
rv
C_
se
RT
(re
31 8 7 0
200 0 0 0 0 0 0 0 0 Reset
PR
RTC_CNTL_ULP_CP_TIMER_SLP_CYCLE Set sleep cycles for ULP coprocessor timer. (R/W)

Register 1.3. RTC_CNTL_ULP_CP_CTRL_REG (0x00FC)
P
TO
T_
CL T AR
_C RE E P
P_ SE _ST
LP P_ RC TO
FO
_U _C FO T_
TL LP P_ AR
K_
CN L_U _C ST
C_ NT LP P_
RT _C L_U P_C
C NT L
RT C L_U
C_ NT
d)
ve
R T _C
er
C
s
RT
(re
31 30 29 28 27 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
RTC_CNTL_ULP_CP_CLK_FO ULP-FSM clock force on. (R/W)
RTC_CNTL_ULP_CP_RESET ULP-FSM clock software reset. (R/W)
RTC_CNTL_ULP_CP_FORCE_START_TOP Write 1 to start ULP-FSM by software. (R/W)
RTC_CNTL_ULP_CP_START_TOP Write 1 to start ULP-FSM. (R/W)
A
IN
IM
EL
PR

Register 1.4. RTC_CNTL_COCPU_CTRL_REG (0x0100)
S
DI
N
ER
T_
IS
N
_E
_E
_D
SE
G
TR
E
IG
ET
LK
RC
RE
IN
TL OC U_D NE _TR
ES
_C
2_
2_
U_ L O F
_R
FO
_2
CN L_C CP DO NT
T_
T_
CP S _
O U_ NE
UT
UT
AR
AR
K_
C_ NT O U_ _I
HU
RT _C L_C CP SW
_C P O
SH
SH
CL
E
ST
ST
_S
C NT O U_
U_
U_
U_
U_
U
RT _C L_C CP
CP
CP
CP
CP
CP
C NT O
O
RT _C L_C
_C
_C
_C
_C
_C
TL
TL
TL
TL
TL
C NT
)
ed
CN
CN
CN
CN
CN
RT _C
rv
C_
C_
C_
C_
C_
se
C
RT
RT
RT
RT
RT
RT
(re
31 27 26 25 24 23 22 21 14 13 12 7 6 1 0
0 0 0 0 0 0 0 0 1 0 40 0 16 8 0 Reset
RY
RTC_CNTL_COCPU_CLK_FO ULP-RISC-V clock force on. (R/W)
RTC_CNTL_COCPU_START_2_RESET_DIS Time from ULP-RISC-V startup to pull down reset.

(R/W)
RTC_CNTL_COCPU_START_2_INTR_EN Time from ULP-RISC-V startup to send out
A
RISCV_START_INT interrupt. (R/W)
RTC_CNTL_COCPU_SHUT Shut down ULP-RISC-V. (R/W) IN

RTC_CNTL_COCPU_SHUT_2_CLK_DIS Time from shut down ULP-RISC-V to disable clock. (R/W)
RTC_CNTL_COCPU_SHUT_RESET_EN This bit is used to reset ULP-RISC-V. (R/W)

IM
RTC_CNTL_COCPU_SEL 0: select ULP-RISC-V; 1: select ULP-FSM. (R/W)
RTC_CNTL_COCPU_DONE_FORCE 0: select ULP-FSM DONE signal; 1: select ULP-RISC-V

DONE signal. (R/W)
RTC_CNTL_COCPU_DONE DONE signal. Write 1 to this bit, ULP-RISC-V will go to HALT and the
EL
timer starts counting. (R/W)
RTC_CNTL_COCPU_SW_INT_TRIGGER Trigger ULP-RISC-V register interrupt. (WO)

PR
1.10.2 ULP (RTC_PERI) Registers


Register 1.5. SENS_ SAR_COCPU_INT_RAW_REG (0x00E8)
W
RA
T_
IN
E_
W N
N O U_ AR _R W IN OP W
RA DO
SE _C CP ST NT RA T_ LO RA
T_ _
NS O U_ _I T_ OU H_ T_
A W
SE S_C CP SW _IN IME AC _IN
_I NT RA
RA W
N O U_ D T O NE
NE E_I T_
U_ UC H_ INT AW
H_ ACT IVE W
W
NT _R
DO IV _IN
SE S_C CP SW H_ PPR DO
T A
_C PU TO D _IN W
NS CO U_ RA IN AW
R
TO H_ AC _R
_
N O U_ UC A N_
O _T U C1 T_
NS OC U_ RA 2 A
SE _C CP SA DC _R
SE S_C CP TS T_ AW
SA S_ _R
SE S_C CP TO H_ CA
CP O C _
NS O U_ EN INT
N O U_ UC S
SE S_C CP TO H_
UC IN
N O U_ UC
SE _C CP TO
NS O U_
SE S_C CP
CP
N O
)
ed
SE S_C
SE _
rv
RY
se
N
SE
(re
31 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SENS_COCPU_TOUCH_DONE_INT_RAW TOUCH_DONE_INT interrupt raw bit. (RO)
SENS_COCPU_TOUCH_INACTIVE_INT_RAW TOUCH_INACTIVE_INT interrupt raw bit. (RO)
A
SENS_COCPU_TOUCH_ACTIVE_INT_RAW TOUCH_ACTIVE_INT interrupt raw bit. (RO)
SENS_COCPU_SARADC1_INT_RAW SARADC1_DONE_INT interrupt raw bit. (RO)
SENS_COCPU_SARADC2_INT_RAW SARADC2_DONE_INT interrupt raw bit. (RO)

IN
SENS_COCPU_TSENS_INT_RAW TSENS_DONE_INT interrupt raw bit. (RO)
IM
SENS_COCPU_START_INT_RAW RISCV_START_INT interrupt raw bit. (RO)
SENS_COCPU_SW_INT_RAW SW_INT interrupt raw bit. (RO)
SENS_COCPU_SWD_INT_RAW SWD_INT interrupt raw bit. (RO)
SENS_COCPU_TOUCH_TIMEOUT_INT_RAW TOUCH_TIME_OUT interrupt raw bit. (RO)

EL
SENS_COCPU_TOUCH_APPROACH_LOOP_DONE_INT_RAW TOUCH_APPROACH_LOOP_DONE_INT
interrupt raw bit. (RO)
SENS_COCPU_TOUCH_SCAN_DONE_INT_RAW TOUCH_SCAN_DONE_INT interrupt raw bit.

(RO)
PR

Register 1.6. SENS_SAR_COCPU_INT_ENA_REG (0x00EC)
A
EN
T_
IN
E_
A N
EN DO
N O U_ AR _E A IN OP A
SE _C CP ST NT EN T_ LO EN
T_ _
NT _E A
_I NT EN
NA A
N
N O U_ D T O NE
NE E_I T_
U_ UC H_ NT NA
UC IN TIV NA
DO IV IN
_E
H_ ACT E_
E
TO H_ AC _E
NS OC U_ RA 2_ NA
NS O U_ RA INT NA
N O U_ UC A N_
O _T UC 1 T_
C E
SE _C P SA S_ _E
SE S_C CP TS T_ NA
_C PU O DC IN
SE S_C CP TO H_ CA
_ I
NS O U_ EN INT
N O U_ UC S
SE S_C CP TO H_
D
N O U_ UC
SE _C CP TO
SE C P A S
T
CP O
NS O U_
SE S_C CP
C
C
N O
)
ed
SE S_C
_
rv
RY
se
N
SE
(re
31 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SENS_COCPU_TOUCH_DONE_INT_ENA TOUCH_DONE_INT interrupt enable bit. (R/W)
SENS_COCPU_TOUCH_INACTIVE_INT_ENA TOUCH_INACTIVE_INT interrupt enable bit. (R/W)
A
SENS_COCPU_TOUCH_ACTIVE_INT_ENA TOUCH_ACTIVE_INT interrupt enable bit. (R/W)
SENS_COCPU_SARADC1_INT_ENA SARADC1_DONE_INT interrupt enable bit. (R/W)

IN
SENS_COCPU_SARADC2_INT_ENA SARADC2_DONE_INT interrupt enable bit. (R/W)
SENS_COCPU_TSENS_INT_ENA TSENS_DONE_INT interrupt enable bit. (R/W)

IM
SENS_COCPU_START_INT_ENA RISCV_START_INT interrupt enable bit. (R/W)
SENS_COCPU_SW_INT_ENA SW_INT interrupt enable bit. (R/W)
SENS_COCPU_SWD_INT_ENA SWD_INT interrupt enable bit. (R/W)
SENS_COCPU_TOUCH_TIMEOUT_INT_ENA TOUCH_TIME_OUT interrupt enable bit. (R/W)

EL
SENS_COCPU_TOUCH_APPROACH_LOOP_DONE_INT_ENA TOUCH_APPROACH_LOOP_DONE_INT
interrupt enable bit. (R/W)
SENS_COCPU_TOUCH_SCAN_DONE_INT_ENA TOUCH_SCAN_DONE_INT interrupt enable bit.

(R/W)
PR

Register 1.7. SENS_SAR_COCPU_INT_ST_REG (0x00F0)
T
_S
NT
_I
NE
ST DO
SE _C CP ST NT ST T_ LO ST
T_ P_
T
IN O
T _S
_I E_ ST
_S T
N O U_ D T O NE
NE TIV T_
NT IN
DO AC IN
U_ OU H_ NT T
UC H_ TIV T
H_ IN E_
_I S
TO C AC _S
N O U_ UC A N_
O U_ UC 1 T_
NS O U_ RA 2_ T
NS O U_ RA INT T
SE _C P SA DC _S
SE _C P SA S_ _S
_C CP TO DC IN
SE S_C CP TO H_ CA
SE S_C CP TS T_ T
NS O U_ EN INT
N O U_ AR _S
N O U_ UC S
SE S_C CP TO H_
N O U_ UC
SE _C CP TO
CP T
NS O U_
SE S_C CP
C
C
N O
)
ed
SE S_C
rv
se
RY
SE
(re
31 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SENS_COCPU_TOUCH_DONE_INT_ST TOUCH_DONE_INT interrupt status bit. (RO)
SENS_COCPU_TOUCH_INACTIVE_INT_ST TOUCH_INACTIVE_INT interrupt status bit. (RO)
A
SENS_COCPU_TOUCH_ACTIVE_INT_ST TOUCH_ACTIVE_INT interrupt status bit. (RO)
SENS_COCPU_SARADC1_INT_ST SARADC1_DONE_INT interrupt status bit. (RO)
SENS_COCPU_SARADC2_INT_ST SARADC2_DONE_INT interrupt status bit. (RO)

IN
SENS_COCPU_TSENS_INT_ST TSENS_DONE_INT interrupt status bit. (RO)
SENS_COCPU_START_INT_ST RISCV_START_INT interrupt status bit. (RO)

IM
SENS_COCPU_SW_INT_ST SW_INT interrupt status bit. (RO)
SENS_COCPU_SWD_INT_ST SWD_INT interrupt status bit. (RO)
SENS_COCPU_TOUCH_TIMEOUT_INT_ST TOUCH_TIME_OUT interrupt status bit. (RO)

EL
SENS_COCPU_TOUCH_APPROACH_LOOP_DONE_INT_ST TOUCH_APPROACH_LOOP_DONE_INT
interrupt status bit. (RO)
SENS_COCPU_TOUCH_SCAN_DONE_INT_ST TOUCH_SCAN_DONE_INT interrupt status bit.

(RO)
PR

Register 1.8. SENS_SAR_COCPU_INT_CLR_REG (0x00F4)
R
CL
T_
IN
E_
R N
CL DO
N O U_ AR _C R IN OP R
SE _C CP ST NT CL T_ LO CL
T_ _
NT _C R
_I NT CL
LR
N O U_ D T O NE
NE E_I T_
LR
U_ UC H_ NT LR
UC IN TIV LR
DO IV IN
_C
C
TO H_ AC _C
H_ ACT E_
NS OC U_ RA 2_ LR
NS O U_ RA INT LR
N O U_ UC A N_
O _T UC 1 T_
C C
SE _C P SA S_ _C
SE S_C CP TS T_ LR
_C PU O DC IN
SE S_C CP TO H_ CA
_ I
NS O U_ EN INT
N O U_ UC S
SE S_C CP TO H_
D
N O U_ UC
SE _C CP TO
SE C P A S
T
CP O
NS O U_
SE S_C CP
C
C
N O
)
ed
SE S_C
_
rv
RY
se
N
SE
(re
31 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SENS_COCPU_TOUCH_DONE_INT_CLR TOUCH_DONE_INT interrupt clear bit. (WO)
SENS_COCPU_TOUCH_INACTIVE_INT_CLR TOUCH_INACTIVE_INT interrupt clear bit. (WO)
A
SENS_COCPU_TOUCH_ACTIVE_INT_CLR TOUCH_ACTIVE_INT interrupt clear bit. (WO)
SENS_COCPU_SARADC1_INT_CLR SARADC1_DONE_INT interrupt clear bit. (WO)
SENS_COCPU_SARADC2_INT_CLR SARADC2_DONE_INT interrupt clear bit. (WO)

IN
SENS_COCPU_TSENS_INT_CLR TSENS_DONE_INT interrupt clear bit. (WO)
IM
SENS_COCPU_START_INT_CLR RISCV_START_INT interrupt clear bit. (WO)
SENS_COCPU_SW_INT_CLR SW_INT interrupt clear bit. (WO)
SENS_COCPU_SWD_INT_CLR SWD_INT interrupt clear bit. (WO)
SENS_COCPU_TOUCH_TIMEOUT_INT_CLR TOUCH_TIME_OUT interrupt clear bit. (WO)

EL
SENS_COCPU_TOUCH_APPROACH_LOOP_DONE_INT_CLR TOUCH_APPROACH_LOOP_DONE_INT
interrupt clear bit. (WO)
SENS_COCPU_TOUCH_SCAN_DONE_INT_CLR TOUCH_SCAN_DONE_INT interrupt clear bit.

(WO)
PR
1.10.3 RTC I2C (RTC_PERI) Registers

The addresses in this section are relative to low-power management base address + 0x0800 provided in Table

Register 1.9. SENS_SAR_I2C_CTRL_REG (0x0058)
C E
RT OR
TA _F
_S RT
RL
2C A
CT
_I _ST
C_
AR 2C
I2
_S _I
R_
NS AR
SA
)
ed
SE _S
_
rv
NS
NS
se
SE
SE
(re
31 30 29 28 27 0
0 0 0 0 0 Reset
SENS_SAR_I2C_CTRL RTC I2C control data; active only when SENS_SAR_I2C_START_FORCE =
RY
1. (R/W)
SENS_SAR_I2C_START Start RTC I2C; active only when SENS_SAR_I2C_START_FORCE = 1.

(R/W)
SENS_SAR_I2C_START_FORCE 0: RTC I2C started by FSM; 1: RTC I2C started by software. (R/W)
A
Register 1.10. SENS_SAR_SLAVE_ADDR1_REG (0x0040)
IN R0
R1
DD
DD
_A
_A
E
E
AV
AV
SL
SL
C_
C_
d)
2
e
_I
_I
rv
NS
NS
IM
se
SE
SE
(re
31 22 21 11 10 0
0 0 0 0 0 0 0 0 0 0 0x0 0x0 Reset
SENS_I2C_SLAVE_ADDR1 RTC I2C slave address 1. (R/W)

EL

PR
R2
R3
DD
DD
_A
_A
VE
E
AV
LA
SL
_S
C_
2C
)
ed
I2
_I
S_
rv
NS
se
N
SE
SE
(re
31 22 21 11 10 0
0 0 0 0 0 0 0 0 0 0 0x0 0x0 Reset

R4
R5
DD
DD
_A
_A
E
VE
AV
LA
L
_S
S
C_
2C
d)
2
ve
_I
_I
NS
NS
er
s
SE
SE
(re
31 22 21 11 10 0
0 0 0 0 0 0 0 0 0 0 0x0 0x0 Reset
RY
Register 1.13. SENS_SAR_SLAVE_ADDR4_REG (0x004C)
R6
R7
DD
DD
A
_A
_A
E
E
AV
AV
SL
SL
C_
C_
d)
I2
ve
_I
S_
NS
r
se
N
IN
SE
SE
(re
31 22 21 11 10 0
0 0 0 0 0 0 0 0 0 0 0x0 0x0 Reset

IM
1.10.4 RTC I2C (I2C) Registers

EL
The addresses in this section are relative to low-power management base address + 0x0C00 provided in Table
Register 1.14. RTC_I2C_SCL_LOW_REG (0x0000)

PR
D
O I
ER
_P
W
LO
L_
SC
C_
)
ed
I2
rv
C_
se
RT
(re
31 20 19 0
0 0 0 0 0 0 0 0 0 0 0 0 0x100 Reset
RTC_I2C_SCL_LOW_PERIOD This register is used to configure how many clock cycles SCL remains
low. (R/W)

Register 1.15. RTC_I2C_SCL_HIGH_REG (0x0014)
D
IO
P ER
H_
IG
_H
S CL
C_
d)
ve
I2
er
C_
s
RT
(re
31 20 19 0
0 0 0 0 0 0 0 0 0 0 0 0 0x100 Reset
RTC_I2C_SCL_HIGH_PERIOD This register is used to configure how many cycles SCL remains high.
(R/W)
RY
Register 1.16. RTC_I2C_SDA_DUTY_REG (0x0018)
UM
_N
A _S
DA
_D
UTY
)
ed
C
I2
rv
C_
IN
se
RT
(re
31 20 19 0
0 0 0 0 0 0 0 0 0 0 0 0 0x010 Reset
RTC_I2C_SDA_DUTY_NUM The number of clock cycles between the SDA switch and the falling
IM
edge of SCL. (R/W)
Register 1.17. RTC_I2C_SCL_START_PERIOD_REG (0x001C)

EL
D
O
RI
PE
T_
AR
ST
L_
SC
C_
ed)
I2
rv
PR
C_
se
RT
(re
31 20 19 0
0 0 0 0 0 0 0 0 0 0 0 0 8 Reset
RTC_I2C_SCL_START_PERIOD Number of clock cycles to wait after generating a start condition.

(R/W)

Register 1.18. RTC_I2C_SCL_STOP_PERIOD_REG (0x0020)
D
O
RI
PE
P_
TO
_S
CL
_S
d)
2C
ve
I
er
C_
s
RT
(re
31 20 19 0
0 0 0 0 0 0 0 0 0 0 0 0 8 Reset
RTC_I2C_SCL_STOP_PERIOD Number of clock cycles to wait before generating a stop condition.

(R/W)
RY
Register 1.19. RTC_I2C_CTRL_REG (0x0004)
N
_E
UT
E_ T
A
E
RC _OU
AT
O
C C_ AN FI T
C_ L_ E T
C_ C_ _M STA T
RT _I2 TR SB_ IRS
I2 SC OD R
_G
RT _I2 MS S_ RS
FO E
A_ RC
LK
C C_ L F
RT _I2 TX_ SB_
_C
SD FO
CT T
C_ SE
RL
C C_ _L
I2 RE
RT _I2 RX
IN
C_ C_
C C_
C d)
)
ed
RT rve
RT _I2
RT _I2
rv
se
se
C
RT
(re
(re
31 30 29 28 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
IM
RTC_I2C_SDA_FORCE_OUT SDA output mode. 0: open drain; 1: push pull. (R/W)
RTC_I2C_SCL_FORCE_OUT SCL output mode. 0: open drain; 1: push pull. (R/W)
RTC_I2C_MS_MODE Set this bit to configure RTC I2C as a master. (R/W)

EL
RTC_I2C_TRANS_START Set this bit to 1, RTC I2C starts sending data. (R/W)
RTC_I2C_TX_LSB_FIRST This bit is used to control the sending mode. 0: send data from the most
significant bit; 1: send data from the least significant bit. (R/W)
RTC_I2C_RX_LSB_FIRST This bit is used to control the storage mode for received data. 0: receive
PR
data from the most significant bit; 1: receive data from the least significant bit. (R/W)
RTC_I2C_CTRL_CLK_GATE_EN RTC I2C controller clock gate. (R/W)
RTC_I2C_RESET RTC I2C software reset. (R/W)

Register 1.20. RTC_I2C_STATUS_REG (0x0008)
D
SE
C_ C_ B_ SY ES
RT I2 BU _A S
RT _I2 AR BU DR
C_ C_ AVE AN
K_ RW
T
C C_ S_ D
C
C_ AV S
RT _I2 SL _TR
NT
I2 SL LO
RE
AC _ E
_C
C _ E T
C_ OP
RT I2 Y B
C_
C_ C_
d)
C
ve
I2
RT I2
er
C_
s
RT
RT
(re
31 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RTC_I2C_ACK_REC The received ACK value. 0: ACK; 1: NACK. (RO)
RY
RTC_I2C_SLAVE_RW 0: master writes to slave; 1: master reads from slave. (RO)
RTC_I2C_ARB_LOST When the RTC I2C loses control of SCL line, the register changes to 1. (RO)
RTC_I2C_BUS_BUSY 0: RTC I2C bus is in idle state; 1: RTC I2C bus is busy transferring data. (RO)
A
RTC_I2C_SLAVE_ADDRESSED When the address sent by the master matches the address of the
slave, then this bit will be set. (RO)
RTC_I2C_BYTE_TRANS This field changes to 1 when one byte is transferred. (RO)
RTC_I2C_OP_CNT Indicate which operation is working. (RO)

IN
IM
Register 1.21. RTC_I2C_TIMEOUT_REG (0x000C)
UT
EO
M
TI
C_
ed)
I2
rv
C_
se
EL
RT
(re
31 20 19 0
0 0 0 0 0 0 0 0 0 0 0 0 0x10000 Reset
RTC_I2C_TIMEOUT Timeout threshold. (R/W)

PR
Register 1.22. RTC_I2C_SLAVE_ADDR_REG (0x0010)

EN
T_
BI
10
R_
DD
_A
d)
2C
e
rv
I
C_
se
RT
(re
31 30 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RTC_I2C_ADDR_10BIT_EN This field is used to enable the slave 10-bit addressing mode. (R/W)

Register 1.23. RTC_I2C_INT_CLR_REG (0x0024)
T_ C LR
P_ N _C
CL LR
_C OS P_ LR
M T_I NT
AN _L M _C
R
IN T_
R
I
RT _I2 TIM ER INT LR CL
TR N CO T
E_ TIO N_ _IN
C C_ K_ _ C T_
AV A A TE
RT I2C A S_C T_ LR
RT _I2 AC ATA NT_ _IN
C_ RB R_ P R
RT _I2 TR OU INT LR
M L
SL ITR TR LE
C_ _ N _I C
C_ _ ST O C
C C_ E R_ _C
C C_ _D _I T
O
RT _I2 RX ATA TAR
N
C C_ D _S
T
RT _I2 TX_ CT
E
C C_ TE
A
RT I2 DE
M
A
C_ C_
d)
C
ve
RT _I2
I2
er
C
s
RT
(re
31 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
RTC_I2C_SLAVE_TRAN_COMP_INT_CLR RTC_I2C_SLAVE_TRAN_COMP_INT interrupt clear bit.
(WO)
RTC_I2C_ARBITRATION_LOST_INT_CLR RTC_I2C_ARBITRATION_LOST_INT interrupt clear bit.

(WO)
A
RTC_I2C_MASTER_TRAN_COMP_INT_CLR RTC_I2C_MASTER_TRAN_COMP_INT interrupt
clear bit. (WO)
RTC_I2C_TRANS_COMPLETE_INT_CLR RTC_I2C_TRANS_COMPLETE_INT interrupt clear bit.

(WO)
IN
RTC_I2C_TIMEOUT_INT_CLR RTC_I2C_TIMEOUT_INT interrupt clear bit. (WO)
RTC_I2C_ACK_ERR_INT_CLR RTC_I2C_ACK_ERR_INT interrupt clear bit. (WO)

IM
RTC_I2C_RX_DATA_INT_CLR RTC_I2C_RX_DATA_INT interrupt clear bit. (WO)
RTC_I2C_TX_DATA_INT_CLR RTC_I2C_TX_DATA_INT interrupt clear bit. (WO)
RTC_I2C_DETECT_START_INT_CLR RTC_I2C_DETECT_START_INT interrupt clear bit. (WO)

EL
PR

Register 1.24. RTC_I2C_INT_RAW_REG (0x0028)
T_ R AW
RA AW
_C OS P_ AW
P_ N _R
M T_I NT
W
AN _L M _R
W
IN T_
I
RT _I2 TIM ER INT AW RA
TR N CO T
E_ TIO N_ _IN
C C_ K_ _ R T_
RT I2C A S_C T_ AW
AV A A TE
C_ RB R_ P W
RT _I2 TR OU INT AW
M A
SL ITR TR LE
C_ _ N _I R
C_ _ ST O R
C C_ E R_ _R
C C_ _D _I T
O
RT _I2 RX ATA TAR
N
C C_ D _S
T
RT _I2 TX_ CT
E
C C_ TE
A
RT _I2 DE
M
A
C C_
)
ed
C
RT _I2
I2
rv
se
C
RT
(re
31 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
RTC_I2C_SLAVE_TRAN_COMP_INT_RAW RTC_I2C_SLAVE_TRAN_COMP_INT interrupt raw bit.
(RO)
RTC_I2C_ARBITRATION_LOST_INT_RAW RTC_I2C_ARBITRATION_LOST_INT interrupt raw bit.

(RO)
A
RTC_I2C_MASTER_TRAN_COMP_INT_RAW RTC_I2C_MASTER_TRAN_COMP_INT interrupt raw
bit. (RO) IN
RTC_I2C_TRANS_COMPLETE_INT_RAW RTC_I2C_TRANS_COMPLETE_INT interrupt raw bit.
(RO)
RTC_I2C_TIMEOUT_INT_RAW RTC_I2C_TIMEOUT_INT interrupt raw bit. (RO)
RTC_I2C_ACK_ERR_INT_RAW RTC_I2C_ACK_ERR_INT interrupt raw bit. (RO)

IM
RTC_I2C_RX_DATA_INT_RAW RTC_I2C_RX_DATA_INT interrupt raw bit. (RO)
RTC_I2C_TX_DATA_INT_RAW RTC_I2C_TX_DATA_INT interrupt raw bit. (RO)
RTC_I2C_DETECT_START_INT_RAW RTC_I2C_DETECT_START_INT interrupt raw bit. (RO)

EL
PR

Register 1.25. RTC_I2C_INT_ST_REG (0x002C)
IN T_ T
P_ N _S
S T
_C OS P_ T
M T_I NT
T_ S
AN _L M _S
T
I
TR N CO T
RT _I2 TIM ER INT T ST
E_ TIO N_ _IN
C C_ K_ _ S T_
AV A A TE
RT I2C A S_C T_ T
M T
RT _I2 TR OU INT T
SL ITR TR LE
C_ C_ AN T_I _S
C_ _ ST O S
C C_ E R_ _S
C C_ _D _I T
O
RT _I2 RX ATA TAR
C_ RB R_ P
N
C C_ D _S
RT _I2 TX_ CT
E
C C_ TE
RT I2 DE
M
A
C_ C_
d)
ve
RT _I2
I2
er
C
s
RT
(re
31 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
RTC_I2C_SLAVE_TRAN_COMP_INT_ST RTC_I2C_SLAVE_TRAN_COMP_INT interrupt status bit.
(RO)
RTC_I2C_ARBITRATION_LOST_INT_ST RTC_I2C_ARBITRATION_LOST_INT interrupt status bit.

(RO)
A
RTC_I2C_MASTER_TRAN_COMP_INT_ST RTC_I2C_MASTER_TRAN_COMP_INT interrupt status
bit. (RO)
RTC_I2C_TRANS_COMPLETE_INT_ST RTC_I2C_TRANS_COMPLETE_INT interrupt status bit.

(RO)
IN
RTC_I2C_TIMEOUT_INT_ST RTC_I2C_TIMEOUT_INT interrupt status bit. (RO)
RTC_I2C_ACK_ERR_INT_ST RTC_I2C_ACK_ERR_INT interrupt status bit. (RO)

IM
RTC_I2C_RX_DATA_INT_ST RTC_I2C_RX_DATA_INT interrupt status bit. (RO)
RTC_I2C_TX_DATA_INT_ST RTC_I2C_TX_DATA_INT interrupt status bit. (RO)
RTC_I2C_DETECT_START_INT_ST RTC_I2C_DETECT_START_INT interrupt status bit. (RO)

EL
PR

Register 1.26. RTC_I2C_INT_ENA_REG (0x0030)
T_ EN A
IN T_ N
EN A
P_ N _E
_C OS P_ NA
M T_I NT
AN _L M _E
A
A
I
RT _I2 TIM ER INT NA EN
TR N CO T
E_ TIO N_ _IN
C C_ K_ _ E T_
AV A A TE
RT I2C A S_C T_ NA
C_ RB R_ P A
RT _I2 TR OU INT NA
C_ _ ST O EN
SL ITR TR LE
C_ _ N _I E
C C_ E R_ _E
C C_ _D _I T
O
RT _I2 RX ATA TAR
M
N
C C_ D _S
T
RT _I2 TX_ CT
E
C C_ TE
A
RT _I2 DE
M
A
C C_
)
ed
C
RT _I2
I2
rv
se
C
RT
(re
31 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
RTC_I2C_SLAVE_TRAN_COMP_INT_ENA RTC_I2C_SLAVE_TRAN_COMP_INT interrupt enable
bit. (R/W)
RTC_I2C_ARBITRATION_LOST_INT_ENA RTC_I2C_ARBITRATION_LOST_INT interrupt enable bit.

(R/W)
A
RTC_I2C_MASTER_TRAN_COMP_INT_ENA RTC_I2C_MASTER_TRAN_COMP_INT interrupt en-
able bit. (R/W)
RTC_I2C_TRANS_COMPLETE_INT_ENA RTC_I2C_TRANS_COMPLETE_INT interrupt enable bit.

(R/W)
IN
RTC_I2C_TIMEOUT_INT_ENA RTC_I2C_TIMEOUT_INT interrupt enable bit. (R/W)
RTC_I2C_ACK_ERR_INT_ENA RTC_I2C_ACK_ERR_INT interrupt enable bit. (R/W)

IM
RTC_I2C_RX_DATA_INT_ENA RTC_I2C_RX_DATA_INT interrupt enable bit. (R/W)
RTC_I2C_TX_DATA_INT_ENA RTC_I2C_TX_DATA_INT interrupt enable bit. (R/W)
RTC_I2C_DETECT_START_INT_ENA RTC_I2C_DETECT_START_INT interrupt enable bit. (R/W)

EL
Register 1.27. RTC_I2C_DATA_REG (0x0034)

TA
DA
PR
X_
_T
A
E
NE
AT
AV
DO
RD
SL
C_
C_
C_
)
ed
I2
I2
I2
rv
C_
C_
C_
se
RT
RT
RT
(re
31 30 16 15 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 0x0 Reset
RTC_I2C_RDATA Data received. (RO)
RTC_I2C_SLAVE_TX_DATA The data sent by slave. (R/W)
RTC_I2C_DONE RTC I2C transmission is done. (RO)

Register 1.28. RTC_I2C_CMD0_REG (0x0038)
NE
O
_D
D0
D0
AN
AN
M
M
M
M
O
CO
_C
C_
)
ed
C
I2
I2
v
er
C_
C_
s
RT
RT
(re
31 30 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x903 Reset
RTC_I2C_COMMAND0 Content of command 0. For more information, please refer to the register
I2C_COMD0_REG in Chapter I2C Controller. (R/W)
RY
RTC_I2C_COMMAND0_DONE When command 0 is done, this bit changes to 1. (RO)
Register 1.29. RTC_I2C_CMD1_REG (0x003C)
A
NE
O
_D
D1
D1
AN
AN
IN
M
M
M
M
CO
O
_C
C_
)
ed
C
I2
I2
rv
C_
C_
se
RT
RT
(re
31 30 14 13 0
IM
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x1901 Reset

EL

NE
O
PR _D
D2
D2
AN
AN
M
M
M
M
O
CO
_C
C_
d )
2C
ve
I2
I
r
C_
C_
se
RT
RT
(re
31 30 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x902 Reset

NE
O
_D
D3
D3
AN
AN
M
M
M
M
O
CO
_C
C_
)
ed
C
I2
I2
v
er
C_
C_
s
RT
RT
(re
31 30 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x101 Reset
RY
A
NE
O
_D
D4
D4
AN
AN
IN
M
M
M
M
CO
O
_C
C_
)
ed
C
I2
I2
rv
C_
C_
se
RT
RT
(re
31 30 14 13 0
IM
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x901 Reset

EL

NE
O
PR _D
D5
D5
AN
AN
M
M
M
M
O
CO
_C
C_
d )
2C
ve
I2
I
r
C_
C_
se
RT
RT
(re
31 30 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x1701 Reset

NE
O
_D
D6
D6
AN
AN
M
M
M
M
O
CO
_C
C_
)
ed
C
I2
I2
v
er
C_
C_
s
RT
RT
(re
31 30 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x1901 Reset
RY
A
NE
O
_D
D7
D7
AN
AN
IN
M
M
M
M
CO
O
_C
C_
)
ed
C
I2
I2
rv
C_
C_
se
RT
RT
(re
31 30 14 13 0
IM
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x904 Reset

EL

NE
O
PR _D
D8
D8
AN
AN
M
M
M
M
O
CO
_C
C_
d )
2C
ve
I2
I
r
C_
C_
se
RT
RT
(re
31 30 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x1901 Reset

NE
O
_D
D9
D9
AN
AN
M
M
M
M
O
CO
_C
C_
)
ed
C
I2
I2
v
er
C_
C_
s
RT
RT
(re
31 30 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x903 Reset
RY
A
NE
DO
0_
0
D1
D1
AN
AN
IN
M
M
M
M
CO
O
_C
C_
)
ed
C
I2
I2
rv
C_
C_
se
RT
RT
(re
31 30 14 13 0
IM
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x101 Reset

EL

NE
PR 1_
DO
1
D1
D1
AN
AN
M
M
M
M
CO
O
_C
C_
)
ed
2C
I2
rv
I
C_
C_
se
RT
RT
(re
31 30 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x901 Reset

NE
DO
2_
2
D1
D1
AN
AN
M
M
M
M
O
CO
_C
C_
d)
C
ve
I2
I2
er
C_
C_
s
RT
RT
(re
31 30 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x1701 Reset
RY
A
NE
DO
3_
3
D1
D1
IN
AN
AN
M
M
M
M
O
CO
_C
C_
)
ed
C
I2
I2
rv
C_
C_
se
RT
RT
(re
31 30 14 13 0
IM
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x1901 Reset

EL

NE
PR 4_
DO
4
D1
D1
AN
AN
M
M
M
M
O
CO
_C
C_
d)
2C
I2
rv
I
C_
C_
se
RT
RT
(re
31 30 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x00 Reset

NE
DO
5_
5
D1
D1
AN
AN
M
M
M
M
O
CO
_C
C_
d)
C
ve
I2
I2
er
C_
C_
s
RT
RT
(re
31 30 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x00 Reset
RY
Register 1.44. RTC_I2C_DATE_REG (0x00FC)
A
TE
DA
C_
d)
ve
I2
r
C_
se
IN RT
(re
31 28 27 0
0 0 0 0 0x1905310 Reset
RTC_I2C_DATE Version control register (R/W)

IM
EL
PR

2 GDMA Controller (GDMA)
2.1 Overview
General Direct Memory Access (GDMA) is a feature that allows peripheral-to-memory, memory-to-peripheral, and
memory-to-memory data transfer at a high speed. The CPU is not involved in the GDMA transfer, and therefore it
becomes more efficient with less workload.
The GDMA controller in ESP32-S3 has ten independent channels, i.e. five transmit channels and five receive
channels. These ten channels are shared by peripherals with GDMA feature, namely SPI2, SPI3, UHCI0, I2S0,
I2S1, LCD/CAM, AES, SHA, ADC, and RMT. You can assign the ten channels to any of these peripherals. Every
RY
channel supports access to internal RAM or external RAM.
The GDMA controller uses fixed-priority and round-robin channel arbitration schemes to manage peripherals’
needs for bandwidth.
A
IN
IM
EL
Figure 21. Modules with GDMA Feature and GDMA Channels

PR
2.2 Features
The GDMA controller has the following features:
• AHB bus architecture
• Programmable length of data to be transferred in bytes
• Linked list of descriptors
• INCR burst transfer when accessing internal RAM
• Access to an address space of 480 KB at most in internal RAM
• Access to an address spacee of 32 MB at most in external RAM

• Five transmit channels and five receive channels
• Access to internal and external RAM supported by every channel
• Software-configurable selection of peripheral requesting its service supported by every channel
• Fixed channel priority and round-robin channel arbitration
2.3 Architecture
In ESP32-S3, all modules that need high-speed data transfer support GDMA. The GDMA controller and CPU
data bus have access to the same address space in internal and external RAM. Figure 2-2 shows the basic
architecture of the GDMA engine.
A RY
IN
Figure 22. GDMA Engine Architecture
IM
The GDMA controller has ten independent channels, i.e. five transmit channels and five receive channels. Every
channel can be connected to different peripherals. In other words, channels are general-purpose, shared by
peripherals.
EL
The GDMA engine has two independent AHB bus referred to as AHB_BUS1 and AHB_BUS2 respectively.
AHB_BUS1 is used to read data from or write data to internal RAM, whereas AHB_BUS2 is used to read data
from or write data to external RAM. For available address range of RAM, please see Chapter 3 System and
Memory.
PR
Software can use the GDMA engine through linked lists. These linked lists, stored in internal RAM, consist of
outlinkn and inlinkn, where n indicates the channel number (ranging from 0 to 4). The GDMA controller reads an
outlinkn (i.e. a linked list of transmit descriptors) from internal RAM and transmits data in corresponding RAM
according to the outlinkn, or reads an inlinkn (i.e. a linked list of receive descriptors) and stores received data into
specific address space in RAM according to the inlinkn.


2.4.1 Linked List
RY
Figure 23. Structure of a Linked List
Figure 2-3 shows the structure of a linked list. An outlink and an inlink have the same structure. A linked list is
A
formed by one or more descriptors, and each descriptor consists of three words. Linked lists should be in
internal RAM for the GDMA engine to be able to use them. The meaning of each field is as follows:
IN
• Owner (DW0) [31]: Specifies who is allowed to access the buffer that this descriptor points to.
1’b0: CPU can access the buffer;
1’b1: The GDMA controller can access the buffer.
When the GDMA controller stops using the buffer, this bit in a transmit descriptor is automatically cleared by
hardware, and this bit in a receive descriptor is automatically cleared by hardware only if
IM
GDMA_OUT_AUTO_WRBACK_CHn is set to 1. When software loads a linked list, this bit should be set to
1.
Note: GDMA_OUT is the prefix of transmit channel registers, and GDMA_IN is the prefix of receive channel
registers.
EL
• suc_eof (DW0) [30]: Specifies whether this descriptor is the last descriptor in the list.
1’b0: This descriptor is not the last one;
1’b1: This descriptor is the last one.
Software clears suc_eof bit in receive descriptors. When a frame or packet has been received, this bit in
the last receive descriptor is set by hardware, and this bit in the last transmit descriptor is set by software.
PR
• Reserved (DW0) [29]: Reserved. Value of this bit does not matter.
• err_eof (DW0) [28]: Specifies whether the received data have errors.
This bit is used only when UHCI0 uses GDMA to receive data. When an error is detected in the received
frame or packet, this bit in the receive descriptor is set to 1 by hardware.
• Reserved (DW0) [27:24]: Reserved.
• Length (DW0) [23:12]: Specifies the number of valid bytes in the buffer that this descriptor points to. This
field in a transmit descriptor is written by software and indicates how many bytes can be read from the
buffer; this field in a receive descriptor is written by hardware automatically and indicates how many valid
bytes have been stored into the buffer.
• Size (DW0) [11:0]: Specifies the size of the buffer that this descriptor points to.

• Buffer address pointer (DW1): Address of the buffer.
• Next descriptor address (DW2): Address of the next descriptor. If the current descriptor is the last one
(suc_eof = 1), this value is 0. This field can only point to internal RAM.
If the length of data received is smaller than the size of the buffer, the GDMA controller will not use available
space of the buffer in the next transaction.
2.4.2 PeripheraltoMemory and MemorytoPeripheral Data Transfer

The GDMA controller can transfer data from memory to peripheral (transmit) and from peripheral to memory
(receive). A transmit channel transfers data in the specified memory location to a peripheral’s transmitter via an
outlinkn, whereas a receive channel transfers data received by a peripheral to the specified memory location via
RY
an inlinkn.
Every transmit and receive channel can be connected to any peripheral with GDMA feature. Table 2-1 illustrates
how to select the peripheral to be connected via registers. When a channel is connected to a peripheral, the rest
channels can not be connected to that peripheral. All transmit and receive channels support access to internal
and external RAM. For details, please refer to Section 2.4.8 and Section 2.4.9.
A
Table 21. Selecting Peripherals via Register Configuration
GDMA_PERI_IN_SEL_CHn
GDMA_PERI_OUT_SEL_CHn
0
IN Peripheral
SPI2
1 SPI3
2 UHCI0
IM
3 I2S0
4 I2S1
5 LCD/CAM
6 AES
7 SHA
EL
8 ADC
9 RMT
2.4.3 MemorytoMemory Data Transfer

PR
The GDMA controller also allows memory-to-memory data transfer. Such data transfer can be enabled by setting
GDMA_MEM_TRANS_EN_CHn, which connects the output of transmit channel n to the input of receive channel
n. Note that a transmit channel is only connected to the receive channel with the same number (n).
As every transmit and receive channel can be used to access internal and external RAM, there are four data
transfer modes:
• from internal RAM to internal RAM
• from internal RAM to external RAM
• from external RAM to internal RAM
• from external RAM to external RAM

2.4.4 Channel Buffer

Every transmit and receive channel contains FIFOs at three levels, i.e. L1FIFO, L2FIFO, and L3FIFO. As Figure
2-4 shows, L1FIFO is close to the memory, L3FIFO is close to peripherals, and L2FIFO falls in between L1FIFO
and L3FIFO. L1FIFO, L2FIFO and L3FIFO have fixed depth: 24, 128, and 16 bytes, respectively.
RY
Figure 24. Channel Buffer
2.4.5 Enabling GDMA
A
Software uses the GDMA controller through linked lists. When the GDMA controller receives data, software loads
an inlink, configures GDMA_INLINK_ADDR_CHn field with address of the first receive descriptor, and sets
GDMA_INLINK_START_CHn bit to enable GDMA. When the GDMA controller transmits data, software loads an
IN
outlink, prepares data to be transmitted, configures GDMA_OUTLINK_ADDR_CHn field with address of the first
transmit descriptor, and sets GDMA_OUTLINK_START_CHn bit to enable GDMA. GDMA_INLINK_START_CHn
bit and GDMA_OUTLINK_START_CHn bit are cleared automatically by hardware.
In some cases, you may want to append more descriptors to a DMA transfer that is already started. Naively, it
IM
would seem to be possible to do this by clearing the EOF bit of the final descriptor in the existing list and setting
its next descriptor address pointer field (DW2) to the first descriptor of the to-be-added list. However, this
strategy fails if the existing DMA transfer is almost or entirely finished. Instead, the GDMA engine has specialized
logic to make sure a DMA transfer can be continued or restarted: if it is still ongoing, it will make sure to take the
EL
appended descriptors into account; if the transfer has already finished, it will restart with the new descriptors.
This is implemented in the Restart function.
When using the Restart function, software needs to rewrite the address of the first descriptor in the new list to
DW2 of the last descriptor in the loaded list, and set GDMA_INLINK_RESTART_CHn bit or
GDMA_OUTLINK_RESTART_CHn bit (these two bits are cleared automatically by hardware). As shown in Figure
PR
2-5, by doing so hardware can obtain the address of the first descriptor in the new list when reading the last
descriptor in the loaded list, and then read the new list.

Figure 25. Relationship among Linked Lists
RY
2.4.6 Linked List Reading Process
Once configured and enabled by software, the GDMA controller starts to read the linked list from internal RAM.
The GDMA performs checks on descriptors in the linked list. Only if the descriptors pass the checks, will the
corresponding GDMA channel transfer data. If the descriptors fail any of the checks, hardware will trigger
A
descriptor error interrupt (either GDMA_IN_DSCR_ERR_CHn_INT or GDMA_OUT_DSCR_ERR_CHn_INT), and
the channel will halt. IN
The checks performed on descriptors are:
• Owner bit check when GDMA_IN_CHECK_OWNER_CHn or GDMA_OUT_CHECK_OWNER_CHn is set to

1. If the owner bit is 0, the buffer is accessed by the CPU. In this case, the owner bit fails the check. The
owner bit will not be checked if GDMA_IN_CHECK_OWNER_CHn or GDMA_OUT_CHECK_OWNER_CHn
IM
is 0;
• Buffer address pointer (DW1) check. If the buffer address pointer points to 0x3FC88000 ~ 0x3FCFFFFF or
0x3C000000 ~ 0x3DFFFFFF (please refer to Section 2.4.8), it passes the check.
After software detects a descriptor error interrupt, it must reset the corresponding channel, and enable GDMA by
EL
setting GDMA_OUTLINK_START_CHn or GDMA_INLINK_START_CHn bit.
Note: The third word (DW2) in a descriptor can only point to a location in internal RAM, given that the third word
points to the next descriptor to use and that all descriptors must be in internal memory.
2.4.7 EOF
PR
The GDMA controller uses EOF (end of frame) flags to indicate the end of data frame or packet
transmission.
Before the GDMA controller transmits data, GDMA_OUT_TOTAL_EOF_CHn_INT_ENA bit should be set to enable
GDMA_OUT_TOTAL_EOF_CHn_INT interrupt. If data in the buffer pointed by the last descriptor (with EOF) have
been transmitted, a GDMA_OUT_TOTAL_EOF_CHn_INT interrupt is generated.
Before the GDMA controller receives data, GDMA_IN_SUC_EOF_CHn_INT_ENA bit should be set to enable
GDMA_IN_SUC_EOF_CHn_INT interrupt. If a data frame or packet has been received successfully, a
GDMA_IN_SUC_EOF_CHn_INT interrupt is generated. In addition, when GDMA channel is connected to UHCI0,
the GDMA controller also supports GDMA_IN_ERR_CHn_EOF_INT interrupt. This interrupt is enabled by setting
GDMA_IN_ERR_EOF_CHn_INT_ENA bit, and it indicates that a data frame or packet has been received with
errors.

When detecting a GDMA_OUT_TOTAL_EOF_CHn_INT or a GDMA_IN_SUC_EOF_CHn_INT interrupt, software

can record the value of GDMA_OUT_EOF_DES_ADDR_CHn or GDMA_IN_SUC_EOF_DES_ADDR_CHn field, i.e.
address of the last descriptor. Therefore, software can tell which descriptors have been used and reclaim
them.
Note: In this chapter, EOF of transmit descriptors refers to suc_eof, while EOF of receive descriptors refers to
both suc_eof and err_eof.
2.4.8 Accessing Internal RAM

Any transmit and receive channels of GDMA can access 0x3FC88000 ~ 0x3FCFFFFF in internal RAM. To
improve data transfer efficiency, GDMA can send data in burst mode, which is disabled by default. This mode is
RY
enabled for receive channels by setting GDMA_IN_DATA_BURST_EN_CHn, and enabled for transmit channels
by setting GDMA_OUT_DATA_BURST_EN_CHn.
Table 22. Descriptor Field Alignment Requirements for Accessing Internal RAM
Inlink/Outlink Burst Mode Size Length Buffer Address Pointer

0 — — —
A
Inlink
1 Word-aligned — Word-aligned
0 — — —
Outlink
1 — — —
IN
Table 2-2 lists the requirements for descriptor field alignment when GDMA accesses internal RAM.
When burst mode is disabled, size, length, and buffer address pointer in both transmit and receive descriptors do
IM
not need to be word-aligned. That is to say, GDMA can read data of specified length (1 ~ 4095 bytes) from any
start addresses in the accessible address range, or write received data of the specified length (1 ~ 4095 bytes) to
any contiguous addresses in the accessible address range.
When burst mode is enabled, size, length, and buffer address pointer in transmit descriptors are also not
EL
necessarily word-aligned. However, size and buffer address pointer in receive descriptors except length should
be word-aligned.
2.4.9 Accessing External RAM

Any transmit and receive channels of GDMA can access 0x3C000000 ~ 0x3DFFFFFF in external RAM. GDMA
PR
can send data only in burst mode. The number of data bytes to transfer in one burst is defined as block size.
Block size can be 16 bytes, 32 bytes or 64 bytes, configured via GDMA_IN_EXT_MEM_BK_SIZE_CHn for
transmit channels and GDMA_OUT_EXT_MEM_BK_SIZE_CHn for receive channels.
Table 23. Descriptor Field Alignment Requirements for Accessing External RAM
Inlink/Outlink Size Length Buffer Address Pointer

Inlink Block-aligned — Block-aligned
Outlink — — —
Table 2-3 lists the requirements for descriptor field alignment when GDMA accesses internal RAM. Size, length,
and buffer address pointer in transmit descriptors do not need to be aligned. However, size and buffer address
pointer in receive descriptors except length should be aligned with block size. Table 2-4 illustrates the value of

GDMA_IN_EXT_MEM_BK_SIZE_CHn or GDMA_OUT_EXT_MEM_BK_SIZE_CHn bit when fields in linked list

descriptors are 16-byte, 32-byte and 64-byte aligned respectively.
Table 24. Relationship Between Configuration Register, Block Size and Alignment
GDMA_IN_EXT_MEM_BK_SIZE_CHn or Block Size Alignment

GDMA_OUT_EXT_MEM_BK_SIZE_CHn
0 16 bytes 16-byte aligned
RY
Note: For receive descriptors, if the data length received are not aligned with block size, GDMA will pad the data
received with 0 until they are aligned to initiate burst transfer. You can read the length field in receive descriptors
to obtain the length of valid data received.
2.4.10 External RAM Access Permissions

GDMA in ESP32-S3 has a permission control module for access to external RAM. As Figure 2-6 shows, the
A
permission control module divided the 32 MB external RAM into four areas through three configurable
boundaries, namely boundary 0, boundary 1, and boundary 2.
IN
• Area 0: 0x3C000000 ~ boundary 0 (include 0x3C000000 but exclude boundary 0)
• Area 1: boundary 0 ~ boundary 1 (include boundary 0 but exclude boundary 1)
• Area 2: boundary 1 ~ boundary 2 (include boundary 1 but exclude boundary 2)

IM
• Area 3: boundary 2 ~ 0x3DFFFFFF (include boundary 0)
Boundary 0, 1, and 2 are configured via PMS_EDMA_BOUNDARY_0, PMS_EDMA_BOUNDARY_1, and

PMS_EDMA_BOUNDARY_2, respectively. For details about these fields, please refer to Chapter 4 Permission
Control (PMS) [to be added later]. The unit of these fields is 4 KB. For example, if PMS_EDMA_BOUNDARY_0 is
0x80, the address of boundary 0 should be 0x3C000000 + 0x80 * 4 KB = 3c080000, in which 0x3C000000 is
EL
the starting address of accessible external RAM.

PR
Figure 26. Dividing External RAM into Areas
All peripherals with GDMA feature (i.e. SPI2, SPI3, UHCI0, I2S0, I2S1, LCD/CAM, AES, SHA, ADC, and RMT) do
not have access permissions for Area 0 and Area 3, but their permissions for Area 1 and Area 2 can be
independently managed. The permission control module contains registers to manage such access permissions
for Area 1 and Area 2. For example, the PMS_EDMA_PMS_SPI2_ATTR1 field configures SPI2’s permissions to

read and write Area 1. Specifically, when bit 0 of this field is 1, SPI2 is granted read permission; when bit 1 of this
field is 1, SPI2 is granted write permission. Likewise, the PMS_EDMA_PMS_SPI2_ATTR2 field configures SPI2’s
permissions to read and write Area 2.
Access violations are logged and can trigger the GDMA_ETXMEN_REJECT_INT interrupt. You can check the
address where the address violation occurs, the peripheral involved, channel number and read or write attribute
via GDMA_ETXMEM_REJECT_ADDR, GDMA_ETXMEN_REJECT_PERI_NUM,
GDMA_ETXMEN_REJECT_CHANNEL_NUM, and GDMA_ETXMEM_REJECT_ATTR respectively.
2.4.11 Seamless Access to Internal and External RAM

In some application scenarios, a data frame or packet contains data from both internal RAM and external RAM.
RY
To ensure real-time data processing, GDMA is designed in such a way that some descriptors in the linked list can
be used to access internal RAM, while the other descriptors in the same linked list can be used to access
external RAM. This design allows seamless access to internal and external RAM.
2.4.12 Arbitration
To ensure timely response to peripherals running at a high speed with low latency (such as SPI, LCD/CAM), the
A
GDMA controller implements a fixed-priority channel arbitration scheme. That is to say, each channel can be
assigned a priority from 0 ~ 9. The larger the number, the higher the priority, and the more timely the response.
IN
When several channels are assigned the same priority, the GDMA controller adopts a round-robin arbitration
scheme.
Please note that the overall throughput of peripherals with GDMA feature cannot exceed the maximum
bandwidth of the GDMA, so that requests from low-priority peripherals can be responded to.
IM
2.4.13 Bandwidth
2.4.13.1 Bandwidth to Access Internal RAM
As an AHB master, the GDMA controller accesses memory via the AHB bus. When accessing internal RAM,
EL
GDMA competes for the AHB bus with other AHB masters such as Bluetooth, Wi-Fi, and USB OTG. Without
regard to these AHB masters, the total bandwidth supported by GDMA to access internal RAM is calculated
as:
All channels to access internal RAM in burst mode: 8/5*fhclk MB/s;
All channels to acess internal RAM not in burst mode: 4/3*fhclk MB/s;
PR
where fhclk is the frequency of AHB clock fixed at 80 MHz. The total bandwidth according to formulas above is
listed in Table 2-5:
Table 25. Total Bandwidth Supported by GDMA to Access Internal RAM
fpclk All Channels NOT in Burst Mode All Channels in Burst Mode
80 MHz 106.6 MB/s 128 MB/s
Please note that since the GDMA controller transfers data via linked list descriptors, the data transfer volume
includes the number of bytes these descriptors have. The transfer efficiency corresponding to one descriptor is
length/(length + 12), where length is the field in the descriptor, and 12 is the number of bytes a descriptor has.
Therefore, applications with multiple linked list descriptors should increase length of each descriptor for higher

transfer efficiency, which can be 99.7% at most.
When allocating bandwidth to a peripheral, software can estimate the bandwidth occupied by this peripheral
according to:
T ∗ (length + 12)/length
where T stands for the throughput of this peripheral.
2.5 GDMA Interrupts

• GDMA_OUT_TOTAL_EOF_CHn_INT: Triggered when all data corresponding to a linked list (including
multiple descriptors) have been sent via transmit channel n.
RY
• GDMA_IN_DSCR_EMPTY_CHn_INT: Triggered when the size of the buffer pointed by receive descriptors is
smaller than the length of data to be received via receive channel n.
• GDMA_OUT_DSCR_ERR_CHn_INT: Triggered when an error is detected in a transmit descriptor on

transmit channel n.
• GDMA_IN_DSCR_ERR_CHn_INT: Triggered when an error is detected in a receive descriptor on receive
A
channel n.
• GDMA_OUT_EOF_CHn_INT: Triggered when EOF in a transmit descriptor is 1 and data corresponding to

this descriptor have been sent via transmit channel n. If GDMA_OUT_EOF_MODE_CHn is 0, this interrupt
IN
will be triggered when the last byte of data corresponding to this descriptor enters GDMA’s transmit
channel; if GDMA_OUT_EOF_MODE_CHn is 1, this interrupt is triggered when the last byte of data is taken
from GDMA’s transmit channel.
IM
• GDMA_OUT_DONE_CHn_INT: Triggered when all data corresponding to a transmit descriptor have been
sent via transmit channel n.
• GDMA_IN_ERR_EOF_CHn_INT: Triggered when an error is detected in the data frame or packet received
via receive channel n. This interrupt is used only for UHCI0 peripheral (UART0 or UART1).
EL
• GDMA_IN_SUC_EOF_CHn_INT: Triggered when a data frame or packet has been received via receive
channel n.
• GDMA_IN_DONE_CHn_INT: Triggered when all data corresponding to a receive descriptor have been
received via receive channel n.
PR
2.6 Programming Procedures

2.6.1 Programming Procedures for GDMA’s Transmit Channel
To transmit data, GDMA’s transmit channel should be configured by software as follows:
1. Set GDMA_OUT_RST_CHn first to 1 and then to 0, to reset the state machine of GDMA’s transmit channel
and FIFO pointer;
2. Load an outlink, and configure GDMA_OUTLINK_ADDR_CHn with address of the first transmit descriptor;
3. Configure GDMA_PERI_OUT_SEL_CHn with the value corresponding to the peripheral to be connected, as

shown in Table 2-1;
4. Set GDMA_OUTLINK_START_CHn to enable GDMA’s transmit channel for data transfer;

5. Configure and enable the corresponding peripheral (SPI2, SPI3, UHCI0 (UART0, UART1, or UART2), I2S0,
I2S1, AES, SHA, and ADC). See details in individual chapters of these peripherals;
6. Wait for GDMA_OUT_EOF_CHn_INT interrupt, which indicates the completion of data transfer.
2.6.2 Programming Procedures for GDMA’s Receive Channel

To receive data, GDMA’s receive channel should be configured by software as follows:
1. Set GDMA_IN_RST_CHn first to 1 and then to 0, to reset the state machine of GDMA’s receive channel and
FIFO pointer;
2. Load an inlink, and configure GDMA_INLINK_ADDR_CHn with address of the first receive descriptor;
RY
3. Configure GDMA_PERI_IN_SEL_CHn with the value corresponding to the peripheral to be connected, as
shown in Table 2-1;
4. Set GDMA_INLINK_START_CHn to enable GDMA’s receive channel for data transfer;
5. Configure and enable the corresponding peripheral (SPI2, SPI3, UHCI0 (UART0, UART1, or UART2), I2S0,
I2S1, AES, SHA, and ADC). See details in individual chapters of these peripherals;
A
6. Wait for GDMA_IN_SUC_EOF_CHn_INT interrupt, which indicates that a data frame or packet has been
received. IN
2.6.3 Programming Procedures for MemorytoMemory Transfer
To transfer data from one memory location to another, GDMA should be configured by software as follows:
1. Set GDMA_OUT_RST_CHn first to 1 and then to 0, to reset the state machine of GDMA’s transmit channel
IM
and FIFO pointer;
2. Set GDMA_IN_RST_CHn first to 1 and then to 0, to reset the state machine of GDMA’s receive channel and
FIFO pointer;
3. Load an outlink, and configure GDMA_OUTLINK_ADDR_CHn with address of the first transmit descriptor;
EL
4. Load an inlink, and configure GDMA_INLINK_ADDR_CHn with address of the first receive descriptor;
5. Set GDMA_MEM_TRANS_EN_CHn to enable memory-to-memory transfer;
6. Set GDMA_OUTLINK_START_CHn to enable GDMA’s transmit channel for data transfer;

PR
7. Set GDMA_INLINK_START_CHn to enable GDMA’s receive channel for data transfer;
8. Wait for GDMA_IN_SUC_EOF_CHn_INT interrupt, which indicates that which indicates that a data
transaction has been completed.


The addresses in this section are relative to GDMA base address provided in Table 3-4 in Chapter 3 System and
Memory.

Configuration Registers
GDMA_IN_CONF0_CH0_REG Configuration register 0 of RX channel 0 0x0000 R/W
GDMA_IN_POP_CH0_REG Pop control register of RX channel 0 0x001C varies
Link descriptor configuration and control
GDMA_IN_LINK_CH0_REG 0x0020 varies
register of RX channel 0
RY
GDMA_OUT_CONF0_CH0_REG Configuration register 0 of TX channel 0 0x0060 R/W
GDMA_OUT_PUSH_CH0_REG Push control register of RX channel 0 0x007C varies
GDMA_OUT_LINK_CH0_REG 0x0080 varies
register of TX channel 0
A
GDMA_IN_CONF0_CH1_REG Configuration register 0 of RX channel 1 0x00C0 R/W
GDMA_IN_CONF1_CH1_REG Configuration register 1 of RX channel 1 0x00C4 R/W
GDMA_IN_POP_CH1_REG Pop control register of RX channel 1 0x00DC varies
GDMA_IN_LINK_CH1_REG
IN
0x00E0 varies

IM
EL

GDMA_IN_LINK_CH2_REG 0x01A0 varies
GDMA_OUT_CONF0_CH2_REG Configuration register 0 of TX channel 2 0x01E0 R/W
GDMA_OUT_CONF1_CH2_REG Configuration register 1 of TX channel 2 0x01E4 R/W
PR
GDMA_OUT_PUSH_CH2_REG Push control register of RX channel 2 0x01FC varies

GDMA_OUT_CONF0_CH3_REG Configuration register 0 of TX channel 3 0x02A0 R/W
GDMA_OUT_CONF1_CH3_REG Configuration register 1 of TX channel 3 0x02A4 R/W
GDMA_OUT_PUSH_CH3_REG Push control register of RX channel 3 0x02BC varies


GDMA_OUT_LINK_CH3_REG 0x02C0 varies
RY
GDMA_PD_CONF_REG reserved 0x03C4 R/W
GDMA_MISC_CONF_REG Miscellaneous register 0x03C8 R/W
Interrupt Registers
A
GDMA_IN_INT_RAW_CH0_REG Raw status interrupt of RX channel 0 0x0008 R/WTC/SS
GDMA_IN_INT_ST_CH0_REG Masked interrupt of RX channel 0 0x000C RO
GDMA_IN_INT_ENA_CH0_REG Interrupt enable bits of RX channel 0 0x0010 R/W
GDMA_IN_INT_CLR_CH0_REG
GDMA_OUT_INT_RAW_CH0_REG
IN
Interrupt clear bits of RX channel 0
Raw status interrupt of TX channel 0
0x0014
0x0068
WT
R/WTC/SS
GDMA_OUT_INT_ST_CH0_REG Masked interrupt of TX channel 0 0x006C RO
GDMA_OUT_INT_ENA_CH0_REG Interrupt enable bits of TX channel 0 0x0070 R/W
IM
GDMA_OUT_INT_CLR_CH0_REG Interrupt clear bits of TX channel 0 0x0074 WT
GDMA_IN_INT_RAW_CH1_REG Raw status interrupt of RX channel 1 0x00C8 R/WTC/SS
GDMA_IN_INT_ST_CH1_REG Masked interrupt of RX channel 1 0x00CC RO
GDMA_IN_INT_ENA_CH1_REG Interrupt enable bits of RX channel 1 0x00D0 R/W
GDMA_IN_INT_CLR_CH1_REG Interrupt clear bits of RX channel 1 0x00D4 WT
EL
GDMA_OUT_INT_RAW_CH1_REG Raw status interrupt of TX channel 1 0x0128 R/WTC/SS

PR

GDMA_IN_INT_CLR_CH2_REG Interrupt clear bits of RX channel 2 0x0194 WT
GDMA_OUT_INT_RAW_CH2_REG Raw status interrupt of TX channel 2 0x01E8 R/WTC/SS
GDMA_OUT_INT_ST_CH2_REG Masked interrupt of TX channel 2 0x01EC RO
GDMA_OUT_INT_ENA_CH2_REG Interrupt enable bits of TX channel 2 0x01F0 R/W
GDMA_OUT_INT_CLR_CH2_REG Interrupt clear bits of TX channel 2 0x01F4 WT


GDMA_OUT_INT_RAW_CH3_REG Raw status interrupt of TX channel 3 0x02A8 R/WTC/SS
GDMA_OUT_INT_ST_CH3_REG Masked interrupt of TX channel 3 0x02AC RO
GDMA_OUT_INT_ENA_CH3_REG Interrupt enable bits of TX channel 3 0x02B0 R/W
GDMA_OUT_INT_CLR_CH3_REG Interrupt clear bits of TX channel 3 0x02B4 WT
GDMA_OUT_INT_RAW_CH4_REG Raw status interrupt of TX channel 4 0x0368 R/WTC/SS
RY
Raw interrupt status of external RAM
0x03FC R/WTC/SS
GDMA_EXTMEM_REJECT_INT_RAW_REG permission
Masked interrupt status of external RAM
GDMA_EXTMEM_REJECT_INT_ST_REG 0x0400 RO
A
permission
Interrupt enable bits of external RAM
0x0404 R/W
GDMA_EXTMEM_REJECT_INT_ENA_REG permission
GDMA_EXTMEM_REJECT_INT_CLR_REG
IN
Interrupt clear bits of external RAM
permission
0x0408 WT
Status Registers
GDMA_INFIFO_STATUS_CH0_REG Receive FIFO status of RX channel 0 0x0018 RO
IM
GDMA_IN_STATE_CH0_REG Receive status of RX channel 0 0x0024 RO
GDMA_IN_SUC_EOF_DES_ADDR_CH0 Inlink descriptor address when EOF
0x0028 RO
_REG occurs of RX channel 0
GDMA_IN_ERR_EOF_DES_ADDR_CH0 Inlink descriptor address when errors
0x002C RO
_REG occur of RX channel 0
EL
Current inlink descriptor address of RX

GDMA_IN_DSCR_CH0_REG 0x0030 RO
channel 0
The last inlink descriptor address of RX
GDMA_IN_DSCR_BF0_CH0_REG 0x0034 RO
channel 0
The second-to-last inlink descriptor
PR
address of RX channel 0
GDMA_OUTFIFO_STATUS_CH0_REG Transmit FIFO status of TX channel 0 0x0078 RO
GDMA_OUT_STATE_CH0_REG Transmit status of TX channel 0 0x0084 RO
Outlink descriptor address when EOF
0x0088 RO
GDMA_OUT_EOF_DES_ADDR_CH0_REG occurs of TX channel 0
GDMA_OUT_EOF_BFR_DES_ADDR_CH0 The last outlink descriptor address when
0x008C RO
_REG EOF occurs of TX channel 0
Current inlink descriptor address of TX
GDMA_OUT_DSCR_CH0_REG 0x0090 RO
channel 0
The last inlink descriptor address of TX
GDMA_OUT_DSCR_BF0_CH0_REG 0x0094 RO
channel 0


address of TX channel 0
GDMA_INFIFO_STATUS_CH1_REG Receive FIFO status of RX channel 1 0x00D8 RO
GDMA_IN_STATE_CH1_REG Receive status of RX channel 1 0x00E4 RO
0x00E8 RO
0x00EC RO
GDMA_IN_DSCR_CH1_REG 0x00F0 RO
channel 1
RY
GDMA_IN_DSCR_BF0_CH1_REG 0x00F4 RO
channel 1
GDMA_IN_DSCR_BF1_CH1_REG 0x00F8 RO
A
0x0148 RO
GDMA_OUT_EOF_BFR_DES_ADDR_CH1
_REG
IN
The last outlink descriptor address when
EOF occurs of TX channel 1
0x014C RO

channel 1
IM
channel 1
EL
GDMA_IN_STATE_CH2_REG Receive status of RX channel 2 0x01A4 RO

0x01A8 RO
0x01AC RO
PR

GDMA_IN_DSCR_CH2_REG 0x01B0 RO
channel 2
GDMA_IN_DSCR_BF0_CH2_REG 0x01B4 RO
channel 2
GDMA_IN_DSCR_BF1_CH2_REG 0x01B8 RO
GDMA_OUTFIFO_STATUS_CH2_REG Transmit FIFO status of TX channel 2 0x01F8 RO
0x0208 RO
0x020C RO


channel 2
channel 2
0x0268 RO
RY
0x026C RO
channel 3
channel 3
A
GDMA_OUTFIFO_STATUS_CH3_REG
GDMA_OUT_STATE_CH3_REG
IN
Transmit FIFO status of TX channel 3
Transmit status of TX channel 3
0x02B8
0x02C4
RO
RO
0x02C8 RO
IM
0x02CC RO
GDMA_OUT_DSCR_CH3_REG 0x02D0 RO
channel 3
GDMA_OUT_DSCR_BF0_CH3_REG 0x02D4 RO
EL
channel 3
GDMA_OUT_DSCR_BF1_CH3_REG 0x02D8 RO
PR

0x0328 RO
0x032C RO
channel 4
channel 4


0x0388 RO
0x038C RO
channel 4
channel 4
RY
Priority Registers
GDMA_IN_PRI_CH0_REG Priority register of RX channel 0 0x0044 R/W
GDMA_OUT_PRI_CH0_REG Priority register of TX channel 0 0x00A4 R/W
GDMA_OUT_PRI_CH1_REG Priority register of TX channel 1 0x0164 R/W
A
GDMA_IN_PRI_CH2_REG Priority register of RX channel 2 0x01C4 R/W
GDMA_OUT_PRI_CH2_REG Priority register of TX channel 2 0x0224 R/W
GDMA_OUT_PRI_CH3_REG
GDMA_IN_PRI_CH4_REG
IN
Priority register of TX channel 3
Priority register of RX channel 4
0x02E4
0x0344
R/W
R/W
GDMA_OUT_PRI_CH4_REG Priority register of TX channel 4 0x03A4 R/W
Peripheral Selection Registers
IM
GDMA_IN_PERI_SEL_CH0_REG Peripheral selection of RX channel 0 0x0048 R/W
GDMA_OUT_PERI_SEL_CH0_REG Peripheral selection of TX channel 0 0x00A8 R/W
GDMA_OUT_PERI_SEL_CH1_REG Peripheral selection of TX channel 1 0x0168 R/W
GDMA_IN_PERI_SEL_CH2_REG Peripheral selection of RX channel 2 0x01C8 R/W
EL
GDMA_OUT_PERI_SEL_CH2_REG Peripheral selection of TX channel 2 0x0228 R/W

GDMA_OUT_PERI_SEL_CH3_REG Peripheral selection of TX channel 3 0x02E8 R/W
GDMA_OUT_PERI_SEL_CH4_REG Peripheral selection of TX channel 4 0x03A8 R/W
PR
Permission Status Registers

External RAM address where access
GDMA_EXTMEM_REJECT_ADDR_REG 0x03F4 RO
violation occurs
Status of external RAM where access
GDMA_EXTMEM_REJECT_ST_REG 0x03F8 RO
violation occurs
Version Register
GDMA_DATE_REG Version control register 0x040C R/W

2.8 Registers
The addresses in this section are relative to GDMA base address provided in Table 3-4 in Chapter 3 System and
Memory.
Register 2.1. GDMA_IN_CONF0_CHn_REG (n: 04) (0x0000+192*n)
_C ST EN H0
H0 H0
ST _TE T_ _C
H0 _C _C
IN O UR T_ 0
A_ _LO _B RS CH
_R P S EN
DM IN C U N_
G A_ DS _B _E
DM IN T NS
G A_ _DA RA
A
R
DM IN _T
A_ EM
d)
DM _M
ve
RY A
r
DM
se
(re
G
G
G
31 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
GDMA_IN_RST_CHn This bit is used to reset GDMA channel 0 RX FSM and RX FIFO pointer. (R/W)
GDMA_IN_LOOP_TEST_CHn Reserved. (R/W)
A
GDMA_INDSCR_BURST_EN_CHn Set this bit to 1 to enable INCR burst transfer for RX channel 0
reading link descriptor when accessing internal RAM. (R/W)
IN
GDMA_IN_DATA_BURST_EN_CHn Set this bit to 1 to enable INCR burst transfer for RX channel 0
receiving data when accessing internal RAM. (R/W)
GDMA_MEM_TRANS_EN_CHn Set this bit 1 to enable automatic transmitting data from memory to
IM
memory via GDMA. (R/W)
EL
PR

Register 2.2. GDMA_IN_CONF1_CHn_REG (n: 04) (0x0004+192*n)
H0
R_ H0
_C
RS
NE _C
0
CH
E
TH
_O _SIZ
L_
UL
K
HE M_B
_F
FO
E
CK
M
FI
A_ XT_
IN
A_
_C
DM _E
DM
IN
IN
d)
ve
A_
A_
er
DM
DM
s
(re
G
31 15 14 13 12 11 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0xc Reset
RY
GDMA_DMA_INFIFO_FULL_THRS_CHn This register is used to generate the
GDMA_INFIFO_FULL_WM_INT interrupt when RX channel 0 received byte number in RX
FIFO is up to the value of the register. (R/W)
GDMA_IN_CHECK_OWNER_CHn Set this bit to enable checking the owner attribute of the link de-
scriptor. (R/W)
A
GDMA_IN_EXT_MEM_BK_SIZE_CHn Block size of RX channel 0 when GDMA access external
RAM. 0: 16 bytes; 1: 32 bytes; 2: 64 bytes; 3: Reserved. (R/W) IN
Register 2.3. GDMA_IN_POP_CHn_REG (n: 04) (0x001C+192*n)
0
CH
IM
0
CH
A_
P_
AT
O
D
_R
_P
O
FO
IF
FI
F
IN
IN
)
ed
A_
A_
rv
DM
DM
se
(re
31 13 12 11 0
EL
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x800 Reset
GDMA_INFIFO_RDATA_CHn This register stores the data popping from GDMA FIFO (intended for
debugging). (RO)
GDMA_INFIFO_POP_CHn Set this bit to pop data from GDMA FIFO (intended for debugging).
PR
(R/W/SC)

Register 2.4. GDMA_IN_LINK_CHn_REG (n: 04) (0x0020+192*n)
H0
_A P_ H0 0
NK TO _C H
_C
LI S T C
0
O 0
A_ LIN ST AR 0
ET
IN K_ AR T_
CH
UT CH
DM IN K S H
_R
G A_ LIN RE _C
R_
_ K
T
DD
DM IN K R
G A_ LIN PA
_A
_
_
DM IN K
NK
G A_ LIN
LI
DM _IN
IN
)
ed
A_
rv
A
DM
DM
se
(re
G
G
G
31 25 24 23 22 21 20 19 0
0 0 0 0 0 0 0 1 0 0 0 1 0x000 Reset
GDMA_INLINK_ADDR_CHn This register stores the 20 least significant bits of the first inlink descrip-
RY
tor’s address. (R/W)
GDMA_INLINK_AUTO_RET_CHn Set this bit to return to current inlink descriptor’s address, when
there are some errors in current receiving data. (R/W)
GDMA_INLINK_STOP_CHn Set this bit to stop GDMA’s receive channel from receiving data.
(R/W/SC)
A
GDMA_INLINK_START_CHn Set this bit to enable GDMA’s receive channel for data transfer.
(R/W/SC)
IN
GDMA_INLINK_RESTART_CHn Set this bit to mount a new inlink descriptor. (R/W/SC)
GDMA_INLINK_PARK_CHn 1: the inlink descriptor’s FSM is in idle state; 0: the inlink descriptor’s
FSM is working. (RO)
IM
EL
PR

Register 2.5. GDMA_OUT_CONF0_CHn_REG (n: 04) (0x0060+192*n)
O LO _ E_ N_ 0
_R P RB H0 H0
H0 0
A_ UT_ UTO OD _E _CH
H0 _C CH
UT O W C C
DM O A M S N
_C ST K_
G A_ T_ F_ UR _E
ST _TE AC
T
T
DM O E _B S
G A_ T_ CR UR
B
DM O S _
G A_ TD TA
O
U A
DM O D
G A_ T_
U
U
U
)
DM O
ed
G A_
rv
DM
se
(re
G
31 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 Reset
GDMA_OUT_RST_CHn This bit is used to reset GDMA channel 0 TX FSM and TX FIFO pointer. (R/W)
RY
GDMA_OUT_LOOP_TEST_CHn Reserved. (R/W)
GDMA_OUT_AUTO_WRBACK_CHn Set this bit to enable automatic outlink-writeback when all the
data in TX FIFO has been transmitted. (R/W)
A
GDMA_OUT_EOF_MODE_CHn EOF flag generation mode when transmitting data. 1: EOF flag for
TX channel 0 is generated when data need to transmit has been popped from FIFO in GDMA.
(R/W)
IN
GDMA_OUTDSCR_BURST_EN_CHn Set this bit to 1 to enable INCR burst transfer for TX channel
0 reading link descriptor when accessing internal RAM. (R/W)
GDMA_OUT_DATA_BURST_EN_CHn Set this bit to 1 to enable INCR burst transfer for TX channel
IM
0 transmitting data when accessing internal RAM. (R/W)
Register 2.6. GDMA_OUT_CONF1_CHn_REG (n: 04) (0x0064+192*n)

EL
R_ H0
NE _C
0
CH
E
_O _SIZ
K
HE M_B
W
E
CK
M
T_
A_ _EX
_C
PR
UT
UT
d)
)
O
ed
e
A_
rv
rv
DM
DM
se
se
(re
(re
G
31 15 14 13 12 11 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
GDMA_OUT_CHECK_OWNER_CHn Set this bit to enable checking the owner attribute of the link
descriptor. (R/W)
GDMA_OUT_EXT_MEM_BK_SIZE_CHn Block size of TX channel 0 when GDMA access external

RAM. 0: 16 bytes; 1: 32 bytes; 2: 64 bytes; 3: Reserved. (R/W)

Register 2.7. GDMA_OUT_PUSH_CHn_REG (n: 04) (0x007C+192*n)
0
CH
H0
_C
_
TA
SH
DA
U
_W
_P
FO
OF
FI
FI
UT
UT
)
O
ed
A_
A_
rv
DM
DM
se
(re
G
31 10 9 8 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
GDMA_OUTFIFO_WDATA_CHn This register stores the data that need to be pushed into GDMA
RY
FIFO. (R/W)
GDMA_OUTFIFO_PUSH_CHn Set this bit to push data into GDMA FIFO. (R/W/SC)
Register 2.8. GDMA_OUT_LINK_CHn_REG (n: 04) (0x0080+192*n)
A
TO _C H0
_S RT _C
P_ H0
H0
0
LI _S TA 0
CH
UT K S H
NK TA RT
_C
O IN RE _C
DR
A_ TL K_ RK
IN
D
DM O IN A
G A_ TL K_P
_A
NK
DM O IN
LI
G A_ TL
UT
U
U
U
d)
DM _O
O
e
A_
rv
A
DM
DM
se
(re
G
G
31 24 23 22 21 20 19 0
IM
0 0 0 0 0 0 0 0 1 0 0 0 0x000 Reset
GDMA_OUTLINK_ADDR_CHn This register stores the 20 least significant bits of the first outlink de-
scriptor’s address. (R/W)
EL
GDMA_OUTLINK_STOP_CHn Set this bit to stop GDMA’s transmit channel from transferring data.
(R/W/SC)
GDMA_OUTLINK_START_CHn Set this bit to enable GDMA’s transmit channel for data transfer.
(R/W/SC)
GDMA_OUTLINK_RESTART_CHn Set this bit to restart a new outlink from the last address.
PR
(R/W/SC)
GDMA_OUTLINK_PARK_CHn 1: the outlink descriptor’s FSM is in idle state; 0: the outlink descrip-
tor’s FSM is working. (RO)

Register 2.9. GDMA_PD_CONF_REG (0x03C4)
RC PU
PD
O E_
E_
RA _F _FO
_F C
M OR
A_ AM LK
DM _R _C
A_ MA AM
DM D R
G A_ A_
M
)
)
DM D
ed
ed
G A_
rv
rv
DM
se
se
(re
(re
G
31 7 6 5 4 3 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 Reset
GDMA_DMA_RAM_FORCE_PD Set this bit to force power down GDMA internal memory. (R/W)
RY
GDMA_DMA_RAM_FORCE_PU Set this bit to force power up GDMA internal memory. (R/W)
GDMA_DMA_RAM_CLK_FO 1: Force to open the clock and bypass the gate-clock when accessing
the RAM in GDMA; 0: A gate-clock will be used when accessing the RAM in GDMA. (R/W)
A
Register 2.10. GDMA_MISC_CONF_REG (0x03C8)
_I ER
ER
IN
ST XT
NT
_R T_E
AH _ DIS
BM RS
A_ HBM RI_
N
DM A P
DM d E
G A_ B_
G rve K_
R
se CL
d)
)
DM A
ve
(re A_
G A_
r
DM
se
(re
G
IM
31 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
GDMA_AHBM_RST_INTER Set this bit, then clear this bit to reset the internal AHB FSM. (R/W)
GDMA_AHBM_RST_EXTER Set this bit, then clear this bit to reset the external AHB FSM. (R/W)
EL
GDMA_ARB_PRI_DIS Set this bit to disable priority arbitration function. (R/W)
GDMA_CLK_EN 1: Force clock on for registers; 0: Support clock only when application writes reg-
isters. (R/W)
PR

Register 2.11. GDMA_IN_INT_RAW_CHn_REG (n: 04) (0x0008+192*n)
O O H0 _IN T_ W
_C CH INT _R AW
_D _E _C 0 IN RA
H0 0_ _R AW
NE F_ _ T R
AW W
IN UC OF CH 0_ T_
_I INT AW
_R RA
A_ _S _E R_ CH _IN
NT _
DM IN R ER Y 0
G A_ _ER R_ PT CH
_
_
DM IN C EM M
G A_ _DS R_ _W
DM IN C LL
G A_ _DS FU
_
DM IN O
G A_ FIF
DM IN
)
ed
G A_
v
er
DM
s
(re
G
31 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
GDMA_IN_DONE_CHn_INT_RAW The raw interrupt bit turns to high level when the last data pointed
by one inlink descriptor has been received for RX channel 0. (R/WTC/SS)
GDMA_IN_SUC_EOF_CHn_INT_RAW The raw interrupt bit turns to high level when the last data
pointed by one inlink descriptor has been received for RX channel 0. For UHCI0, the raw interrupt
bit turns to high level when the last data pointed by one inlink descriptor has been received and no
A
data error is detected for RX channel 0. (R/WTC/SS)
GDMA_IN_ERR_EOF_CHn_INT_RAW The raw interrupt bit turns to high level when data error is
IN
detected only in the case that the peripheral is UHCI0 for RX channel 0. For other peripherals, this
raw interrupt is reserved. (R/WTC/SS)
GDMA_IN_DSCR_ERR_CHn_INT_RAW The raw interrupt bit turns to high level when detecting inlink
descriptor error, including owner error, the second and third word error of inlink descriptor for RX
IM
channel 0. (R/WTC/SS)
GDMA_IN_DSCR_EMPTY_CHn_INT_RAW The raw interrupt bit turns to high level when RX FIFO
pointed by inlink is full and receiving data is not completed, but there is no more inlink for RX
EL
GDMA_INFIFO_FULL_WM_CHn_INT_RAW The raw interrupt bit turns to high level when received
data byte number is up to threshold configured by GDMA_DMA_INFIFO_FULL_THRS_CH0 in RX
FIFO of RX channel 0. (R/WTC/SS)
PR

Register 2.12. GDMA_IN_INT_ST_CHn_REG (n: 04) (0x000C+192*n)
_D _E _C 0 IN ST
_C CH INT _ST T
NE F_ _ T S
IN UC OF CH 0_ T_
O O H0 _IN T_
_S ST
A_ _S _E R_ CH _IN
_I INT T
H0 0_ _S
NT _
DM IN R ER Y 0
T
G A_ _ER R_ PT CH
_
_
DM IN C EM M
G A_ _DS R_ _W
DM IN C LL
G A_ _DS FU
_
DM IN O
G A_ FIF
DM IN
)
ed
G A_
v
er
DM
s
(re
G
31 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
GDMA_IN_DONE_CHn_INT_ST The raw interrupt status bit for the GDMA_IN_DONE_CH_INT inter-
rupt. (RO)
GDMA_IN_SUC_EOF_CHn_INT_ST The raw interrupt status bit for the

GDMA_IN_SUC_EOF_CH_INT interrupt. (RO)
GDMA_IN_ERR_EOF_CHn_INT_ST The raw interrupt status bit for the
A
GDMA_IN_ERR_EOF_CH_INT interrupt. (RO)
GDMA_IN_DSCR_ERR_CHn_INT_ST The raw interrupt status bit for the

GDMA_IN_DSCR_ERR_CH_INT interrupt. (RO)
GDMA_IN_DSCR_EMPTY_CHn_INT_ST The
IN raw interrupt status bit for the
GDMA_IN_DSCR_EMPTY_CH_INT interrupt. (RO)
IM
GDMA_INFIFO_FULL_WM_CHn_INT_ST The raw interrupt status bit for the
GDMA_INFIFO_FULL_WM_CH_INT interrupt. (RO)
EL
PR

Register 2.13. GDMA_IN_INT_ENA_CHn_REG (n: 04) (0x0010+192*n)
O O H0 _IN T_ A
_C CH INT _EN NA
_D _E _C 0 IN EN
H0 0_ _E A
NE F_ _ T E
IN UC OF CH 0_ T_
NA A
_I INT NA
_E EN
A_ _S _E R_ CH _IN
NT _
DM IN R ER Y 0
G A_ _ER R_ PT CH
_
_
DM IN C EM M
G A_ _DS R_ _W
DM IN C LL
G A_ _DS FU
_
DM IN O
G A_ FIF
DM IN
)
ed
G A_
rv
DM
se
(re
G
31 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
GDMA_IN_DONE_CHn_INT_ENA The interrupt enable bit for the GDMA_IN_DONE_CH_INT inter-
rupt. (R/W)
GDMA_IN_SUC_EOF_CHn_INT_ENA The interrupt enable bit for the GDMA_IN_SUC_EOF_CH_INT

interrupt. (R/W)
A
GDMA_IN_ERR_EOF_CHn_INT_ENA The interrupt enable bit for the GDMA_IN_ERR_EOF_CH_INT
interrupt. (R/W)
GDMA_IN_DSCR_ERR_CHn_INT_ENA The interrupt enable bit for the

GDMA_IN_DSCR_ERR_CH_INT interrupt. (R/W)
IN
GDMA_IN_DSCR_EMPTY_CHn_INT_ENA The interrupt enable bit for the
GDMA_IN_DSCR_EMPTY_CH_INT interrupt. (R/W)
IM
GDMA_INFIFO_FULL_WM_CHn_INT_ENA The interrupt enable bit for the
GDMA_INFIFO_FULL_WM_CH_INT interrupt. (R/W)
EL
PR

Register 2.14. GDMA_IN_INT_CLR_CHn_REG (n: 04) (0x0014+192*n)
_C CH INT _C LR LR
NE F_ _ T C _C
O O H0 _IN T_ NT
_D _E _C 0 IN _I
H0 0_ _C LR
IN UC OF CH 0_ H0
LR R
_I INT LR
_C CL
A_ _S _E R_ CH _C
NT _
DM IN R ER Y M
G A_ _ER R_ PT _W
L
_
DM IN C EM L
G A_ _DS R_ FU
_
DM IN C O
G A_ _DS FIF
DM IN IN
G A_ A_
M
)
DM D
ed
G A_
v
er
DM
s
(re
G
31 6 5 4 3 2 1 0
RY
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
GDMA_IN_DONE_CHn_INT_CLR Set this bit to clear the GDMA_IN_DONE_CH_INT interrupt. (WT)
GDMA_IN_SUC_EOF_CHn_INT_CLR Set this bit to clear the GDMA_IN_SUC_EOF_CH_INT inter-

rupt. (WT)
GDMA_IN_ERR_EOF_CHn_INT_CLR Set this bit to clear the GDMA_IN_ERR_EOF_CH_INT inter-
A
rupt. (WT)
GDMA_IN_DSCR_ERR_CHn_INT_CLR Set this bit to clear the GDMA_IN_DSCR_ERR_CH_INT in-

terrupt. (WT)
IN
GDMA_IN_DSCR_EMPTY_CHn_INT_CLR Set this bit to clear the
GDMA_IN_DSCR_EMPTY_CH_INT interrupt. (WT)
IM
GDMA_DMA_INFIFO_FULL_WM_CHn_INT_CLR Set this bit to clear the
GDMA_INFIFO_FULL_WM_CH_INT interrupt. (WT)
EL
PR

Register 2.15. GDMA_OUT_INT_RAW_CHn_REG (n: 04) (0x0068+192*n)
H0 _R NT AW
W
_I AW _RA
_C INT 0_I _R
AW
T
O H0 _C _IN
_R
_D _C R H0
NT
NE _ H
UT F ER C
O EO R_ F_
A_ UT_ SC EO
_
DM O D L
G A_ T_ TA
U O
DM O T
G A_ T_
U
)
DM O
ed
G A_
rv
DM
se
(re
G
31 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
GDMA_OUT_DONE_CHn_INT_RAW The raw interrupt bit turns to high level when the last data
pointed by one outlink descriptor has been transmitted to peripherals for TX channel 0. (R/WTC/SS)
GDMA_OUT_EOF_CHn_INT_RAW The raw interrupt bit turns to high level when the last data pointed
by one outlink descriptor has been read from memory for TX channel 0. (R/WTC/SS)
A
GDMA_OUT_DSCR_ERR_CHn_INT_RAW The raw interrupt bit turns to high level when detecting
outlink descriptor error, including owner error, the second and third word error of outlink descriptor
for TX channel 0. (R/WTC/SS)
IN
GDMA_OUT_TOTAL_EOF_CHn_INT_RAW The raw interrupt bit turns to high level when data cor-
responding a outlink (includes one link descriptor or few link descriptors) is transmitted out for TX
IM
EL
PR

Register 2.16. GDMA_OUT_INT_ST_CHn_REG (n: 04) (0x006C+192*n)
H0 _S NT T
_I T _ST
_C INT 0_I _S
T
O H0 _C _IN
T
_S
_D _C R H0
NT
NE _ H
UT F ER C
O EO R_ F_
A_ UT_ SC EO
_
DM O D L
G A_ T_ TA
U O
DM O T
G A_ T_
U
d)
DM O
ve
G A_
er
DM
s
(re
G
31 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
GDMA_OUT_DONE_CHn_INT_ST The raw interrupt status bit for the GDMA_OUT_DONE_CH_INT
interrupt. (RO)
GDMA_OUT_EOF_CHn_INT_ST The raw interrupt status bit for the GDMA_OUT_EOF_CH_INT in-
terrupt. (RO)
GDMA_OUT_DSCR_ERR_CHn_INT_ST The raw interrupt status bit for the
A
GDMA_OUT_DSCR_ERR_CH_INT interrupt. (RO)
GDMA_OUT_TOTAL_EOF_CHn_INT_ST The raw interrupt status bit for the

GDMA_OUT_TOTAL_EOF_CH_INT interrupt. (RO)
IN
Register 2.17. GDMA_OUT_INT_ENA_CHn_REG (n: 04) (0x0070+192*n)
IM
H0 _E NT NA
A
_I NA _EN
_C INT 0_I _E
T
NA
O H0 _C _IN
_E
_D _C R H0
NT
NE _ H
UT F ER C
O EO R_ F_
A_ UT_ SC EO
_
DM O D L
EL
G A_ T_ TA
U O
DM O T
G A_ T_
U
d)
DM O
ve
G A_
r
DM
se
(re
31 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
PR
GDMA_OUT_DONE_CHn_INT_ENA The interrupt enable bit for the GDMA_OUT_DONE_CH_INT in-

terrupt. (R/W)
GDMA_OUT_EOF_CHn_INT_ENA The interrupt enable bit for the GDMA_OUT_EOF_CH_INT inter-

rupt. (R/W)
GDMA_OUT_DSCR_ERR_CHn_INT_ENA The interrupt enable bit for the

GDMA_OUT_DSCR_ERR_CH_INT interrupt. (R/W)
GDMA_OUT_TOTAL_EOF_CHn_INT_ENA The interrupt enable bit for the

GDMA_OUT_TOTAL_EOF_CH_INT interrupt. (R/W)

Register 2.18. GDMA_OUT_INT_CLR_CHn_REG (n: 04) (0x0074+192*n)
H0 _C NT LR
LR
_C INT 0_I _C
_I LR _C
T
LR
O H0 _C _IN
_C
_D _C R H0
NT
NE _ H
UT F ER C
O EO R_ F_
A_ UT_ SC EO
_
DM O D L
G A_ T_ TA
O
DM O T
G A_ T_
U
U
d)
DM _O
ve
A
er
DM
s
(re
G
G
31 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
GDMA_OUT_DONE_CHn_INT_CLR Set this bit to clear the GDMA_OUT_DONE_CH_INT interrupt.
(WT)
GDMA_OUT_EOF_CHn_INT_CLR Set this bit to clear the GDMA_OUT_EOF_CH_INT interrupt. (WT)
GDMA_OUT_DSCR_ERR_CHn_INT_CLR Set this bit to clear the GDMA_OUT_DSCR_ERR_CH_INT
A
interrupt. (WT)
GDMA_OUT_TOTAL_EOF_CHn_INT_CLR Set this bit to clear the

GDMA_OUT_TOTAL_EOF_CH_INT interrupt. (WT)
IN
Register 2.19. GDMA_EXTMEM_REJECT_INT_RAW_REG (0x03FC)
IM
AW
_R
NT
_I
CT
JE
E
_R
EM
EL
TM
EX
)
ed
A_
rv
DM
se
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
PR
GDMA_EXTMEM_REJECT_INT_RAW The raw interrupt bit turns to high level when accessing ex-
ternal RAM is rejected by permission control. (R/WTC/SS)

Register 2.20. GDMA_EXTMEM_REJECT_INT_ST_REG (0x0400)
ST
T_
IN
T_
EC
EJ
_R
EM
TM
EX
d)
ve
A_
r
DM
se
(re
G
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
GDMA_EXTMEM_REJECT_INT_ST The raw interrupt status bit for the
RY
GDMA_EXTMEM_REJECT_INT interrupt. (RO)
Register 2.21. GDMA_EXTMEM_REJECT_INT_ENA_REG (0x0404)
A
NA
_E
NT
_I
CT
JE
E
_R
IN
EM
TM
EX
d )
ve
A_
er
DM
s
(re
G
31 1 0
IM
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
GDMA_EXTMEM_REJECT_INT_ENA The interrupt enable bit for the

GDMA_EXTMEM_REJECT_INT interrupt. (R/W)
EL
Register 2.22. GDMA_EXTMEM_REJECT_INT_CLR_REG (0x0408)
R
CL
T_
IN
T_
EC
PR
EJ
_R
EM
TM
EX
e d)
A_
rv
DM
se
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
GDMA_EXTMEM_REJECT_INT_CLR Set this bit to clear the GDMA_EXTMEM_REJECT_INT inter-

rupt. (WT)

Register 2.23. GDMA_INFIFO_STATUS_CHn_REG (n: 04) (0x0018+192*n)
DM IN O P _ H0
_F PTY _C 0
_C H0
H
A_ FIF FU TY_ H0
UL _ H0
H0
H0
H0
H0
G A_ FIF EM _L3 _C
FI EM _L _C
L1 C
L_ L1_
C
DM IN O LL L3
IN O_ LL L2
_C
_C
_C
2
G A_ FIF FU Y_
L3
L2
L1
_ T
T_
DM IN O P
NT
NT
G A_ FIF EM
N
_C
_C
_C
_
_
FO
FO
FO
DM IN O
FO
G A_ IF
FI
FI
FI
F
IN
IN
IN
DM IN
)
ed
re rved
re rved
re rved
re rved
ed
A_
A_
A_
G A_
rv
rv
DM
DM
DM
DM
se
e
se
se
se
se
s
(re
G
re
31 29 28 27 26 25 24 23 19 18 12 11 6 5 4 3 2 1 0
0 0 0 0 1 1 1 1 0 0 0 1 1 1 0 1 0 Reset
GDMA_INFIFO_FULL_L1_CHn L1 RX FIFO full signal for RX channel 0. (RO)
RY
GDMA_INFIFO_EMPTY_L1_CHn L1 RX FIFO empty signal for RX channel 0. (RO)
A
GDMA_INFIFO_CNT_L1_CHn The register stores the byte number of the data in L1 RX FIFO for RX
channel 0. (RO)
IN
channel 0. (RO)
IM
channel 0. (RO)
EL
Register 2.24. GDMA_IN_STATE_CHn_REG (n: 04) (0x0024+192*n)

0
CH
R_
DD
_A
CR
DS
K_
PR
N
LI
IN
)
ed
ed
ed
A_
rv
rv
DM
se
er
se
s
(re
G
re
re
31 23 22 20 19 18 17 0
0 0 0 0 0 0 0 0 0 0 0 0 Reset
GDMA_INLINK_DSCR_ADDR_CHn This register stores the current inlink descriptor’s address. (RO)

Register 2.25. GDMA_IN_SUC_EOF_DES_ADDR_CHn_REG (n: 04) (0x0028+192*n)
0
_CH
DR
AD
S_
DE
F_
O
_E
UC
_S
IN
A_
DM
G
31 0
0x000000 Reset
RY
GDMA_IN_SUC_EOF_DES_ADDR_CHn This register stores the address of the inlink descriptor
when the EOF bit in this descriptor is 1. (RO)
Register 2.26. GDMA_IN_ERR_EOF_DES_ADDR_CHn_REG (n: 04) (0x002C+192*n)
A DR
_C
H0
D
_A
IN ES
D
F_
EO
R_
R
_E
IN
A_
DM
G
IM
31 0
0x000000 Reset
GDMA_IN_ERR_EOF_DES_ADDR_CHn This register stores the address of the inlink descriptor

when there are some errors in current receiving data. Only used when peripheral is UHCI0. (RO)
EL
Register 2.27. GDMA_IN_DSCR_CHn_REG (n: 04) (0x0030+192*n)

0
CH
R_
PR
SC
_D
NK
LI
IN
A_
DM
G
31 0
0 Reset
GDMA_INLINK_DSCR_CHn The address of the current inlink descriptor x. (RO)

Register 2.28. GDMA_IN_DSCR_BF0_CHn_REG (n: 04) (0x0034+192*n)
0
CH
F0_
_B
CR
_ DS
NK
LI
IN
A_
DM
G
31 0
0 Reset
GDMA_INLINK_DSCR_BF0_CHn The address of the last inlink descriptor x-1. (RO)
RY
Register 2.29. GDMA_IN_DSCR_BF1_CHn_REG (n: 04) (0x0038+192*n)
0
CH
1_
F
A
_B
CR
DS
K_
LIN
IN
A_
IN
DM
G
31 0
0 Reset
GDMA_INLINK_DSCR_BF1_CHn The address of the second-to-last inlink descriptor x-2. (RO)

IM
EL
PR

Register 2.30. GDMA_OUTFIFO_STATUS_CHn_REG (n: 04) (0x0078+192*n)
DE _2B 3_ 0
1B 3_ 0
3_ 0
0
UN ER B_L CH
R_ _L CH
_L CH
CH
N_ D 3 3_
AI UN R_ _L
A_ UTF O_ PT _C H0
_F PTY _C 0
_C H0
EM IN_ DE 4B
H
O IF FU Y_ H0
UL _ H0
H0
0
DM O IF M L C
FI _EM _L 2_C
L1 C
_R A UN R_
CH
CH
CH
G A_ TF O_E LL_ L3_
L_ 1_
UT EM _ DE
UT O LL L
L
3_
2_
1_
2
DM O IF U Y_
O R AIN N
_L
_L
_L
A_ UT_ EM _U
G A_ TF O_F PT
NT
NT
NT
N
DM O IF M
DM O R I
_C
_C
_C
G A_ T_ MA
G A_ TF O_E
FO
FO
FO
FO
U E
DM O IF
DM O R
FI
FI
FI
G A_ TF
G A_ T_
UT
UT
UT
U
U
U
U
U
)
DM _O
DM _O
ed
A_
A_
A_
rv
A
DM
DM
DM
DM
DM
se
(re
G
G
G
G
31 27 26 25 24 23 22 18 17 11 10 6 5 4 3 2 1 0
0 0 0 0 0 1 1 1 1 0 0 0 1 0 1 0 1 0 Reset
RY
GDMA_OUTFIFO_FULL_L1_CHn L1 TX FIFO full signal for TX channel 0. (RO)
GDMA_OUTFIFO_EMPTY_L1_CHn L1 TX FIFO empty signal for TX channel 0. (RO)
A

IN
GDMA_OUTFIFO_CNT_L1_CHn The register stores the byte number of the data in L1 TX FIFO for
TX channel 0. (RO)
IM
TX channel 0. (RO)
TX channel 0. (RO)
EL
GDMA_OUT_REMAIN_UNDER_1B_L3_CHn Reserved. (RO)

PR

Register 2.31. GDMA_OUT_STATE_CHn_REG (n: 04) (0x0084+192*n)
H0
_C
H0
DR
_C
D
E
_A
AT
0
CR
H
ST
_C
DS
R_
E
AT
K_
SC
ST
IN
_D
L
_
UT
UT
UT
)
O
ed
A_
A_
A_
rv
DM
DM
DM
se
(re
G
31 23 22 20 19 18 17 0
0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
GDMA_OUTLINK_DSCR_ADDR_CHn This register stores the current outlink descriptor’s address.
(RO)
GDMA_OUT_DSCR_STATE_CHn Reserved. (RO)
GDMA_OUT_STATE_CHn Reserved. (RO)
A
Register 2.32. GDMA_OUT_EOF_DES_ADDR_CHn_REG (n: 04) (0x0088+192*n)
IN 0
CH
R_
DD
_A
ES
D
F_
O
_E
IM G
DM
A_
O
UT
31 0
0x000000 Reset
EL
GDMA_OUT_EOF_DES_ADDR_CHn This register stores the address of the outlink descriptor when
the EOF bit in this descriptor is 1. (RO)
PR

Register 2.33. GDMA_OUT_EOF_BFR_DES_ADDR_CHn_REG (n: 04) (0x008C+192*n)
0
CH
R_
DD
_A
ES
_D
BFR
F_
EO
_
UT
O
A_
DM
G
31 0
0x000000 Reset
RY
GDMA_OUT_EOF_BFR_DES_ADDR_CHn This register stores the address of the outlink descriptor
before the last outlink descriptor. (RO)
Register 2.34. GDMA_OUT_DSCR_CHn_REG (n: 04) (0x0090+192*n)
A
H0
_C
CR
DS
IN A_
O
UT
LI
NK_
DM
G
31 0
IM
0 Reset
GDMA_OUTLINK_DSCR_CHn The address of the current outlink descriptor y. (RO)

EL
Register 2.35. GDMA_OUT_DSCR_BF0_CHn_REG (n: 04) (0x0094+192*n)

0
CH
0_
BF
R_
SC
_D
NK
PR
LI
UT
O
A_
DM
G
31 0
0 Reset
GDMA_OUTLINK_DSCR_BF0_CHn The address of the last outlink descriptor y-1. (RO)

Register 2.36. GDMA_OUT_DSCR_BF1_CHn_REG (n: 04) (0x0098+192*n)
H0
_C
F1
_B
CR
_DS
NK
LI
UT
O
A_
DM
G
31 0
0 Reset
GDMA_OUTLINK_DSCR_BF1_CHn The address of the second-to-last inlink descriptor x-2. (RO)
RY
Register 2.37. GDMA_IN_PRI_CHn_REG (n: 04) (0x0044+192*n)
H0
_C
RI
A
_P
RX
)
ed
A_
rv
DM
se
(re
G
31
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
IN
0 0 0 0 0 0 0 0 0 0 0 0
4
0
3
0
0
Reset
GDMA_RX_PRI_CHn The priority of RX channel 0. The larger of the value, the higher of the priority.
(R/W)
IM
Register 2.38. GDMA_OUT_PRI_CHn_REG (n: 04) (0x00A4+192*n)
H0
EL
_C
RI
_P
TX
)
ed
A_
rv
DM
se
(re
31 4 3 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
PR
GDMA_TX_PRI_CHn The priority of TX channel 0. The larger of the value, the higher of the priority.
(R/W)

Register 2.39. GDMA_IN_PERI_SEL_CHn_REG (n: 04) (0x0048+192*n)
0
CH
EL_
_S
_IN
RI
PE
)
ed
A_
rv
DM
se
(re
G
31 6 5 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x3f Reset
GDMA_PERI_IN_SEL_CHn This register is used to select peripheral for RX channel 0. 0: SPI2; 1:

SPI3; 2: UHCI0; 3: I2S0; 4: I2S1; 5: LCD_CAM; 6: AES; 7: SHA; 8: ADC_DAC; 9: RMT. (R/W)
RY
Register 2.40. GDMA_OUT_PERI_SEL_CHn_REG (n: 04) (0x00A8+192*n)
H0
_C
EL
A
_S
UT
_O
RI
PE
ed)
A_
rv
DM
se
IN
(re
G
31 6 5 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x3f Reset
GDMA_PERI_OUT_SEL_CHn This register is used to select peripheral for TX channel 0. 0: SPI2; 1:

IM
SPI3; 2: UHCI0; 3: I2S0; 4: I2S1; 5: LCD_CAM; 6: AES; 7: SHA; 8: ADC_DAC; 9: RMT. (R/W)
Register 2.41. GDMA_EXTMEM_REJECT_ADDR_REG (0x03F4)

EL
DR
AD
T_
EC
EJ
_R
EM
TM
EX
A_
PR
DM
G
31 0
0 Reset
GDMA_EXTMEM_REJECT_ADDR This register store the first address rejected by permission control
when accessing external RAM. (RO)

Register 2.42. GDMA_EXTMEM_REJECT_ST_REG (0x03F8)
UM
_N
UM
EL
NN
_N
RR
RI
A
CH
PE
AT
T_
T_
T_
EC
EC
EC
EJ
EJ
EJ
_R
_R
_R
EM
EM
EM
TM
TM
TM
EX
EX
EX
d)
ve
A_
A_
A_
r
DM
DM
DM
se
(re
G
31 12 11 6 5 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
GDMA_EXTMEM_REJECT_ATRR Read or write attribute of the rejected access. Bit 0: if this bit is
1, the rejected access is READ. Bit 1: if this bit is 1, the rejected access is WRITE. (RO)
GDMA_EXTMEM_REJECT_CHANNEL_NUM This field indicates the channel used for the rejected
access. (RO)
A
GDMA_EXTMEM_REJECT_PERI_NUM This bit indicates the peripheral whose access was re-
jected. (RO) IN
Register 2.43. GDMA_DATE_REG (0x040C)
TE
DA
IM G
A_
DM
31 0
0x2101180 Reset
GDMA_DATE This is the version control register. (R/W)

EL
PR

3 System and Memory
3 System and Memory
3.1 Overview
The ESP32-S3 is a dual-core system with two Harvard Architecture Xtensa® LX7 CPUs. All internal memory,
external memory, and peripherals are located on the CPU buses.
3.2 Features
• Address Space
– 848 KB of internal memory address space accessed from the instruction bus
RY
– 560 KB of internal memory address space accessed from the data bus
– 836 KB of peripheral address space
– 32 MB of external memory virtual address space accessed from the instruction bus
– 32 MB external memory virtual address space accessed from the data bus
A
– 480 KB of internal DMA address space
– 32 MB of external DMA address space
• Internal Memory
IN
– 384 KB Internal ROM
– 512 KB Internal SRAM

IM
– 8 KB RTC FAST Memory
– 8 KB RTC SLOW Memory
• External Memory
EL
– Supports up to 1 GB external flash
– Supports up to 1 GB external RAM
• Peripheral Space
– 45 modules/peripherals in total
PR
• GDMA
– 11 GDMA-supported modules/peripherals
Figure 3-1 illustrates the system structure and address mapping.

3 System and Memory
A RY
IN
IM
EL
Figure 31. System Structure and Address Mapping
Note:
• The address space with gray background is not available to users.

PR
• The memory or peripheral marked with a red pentagram can be accessed by the ULP co-processor.
• The range of addresses available in the address space may be larger than the actual available memory of a particular
type.

3.3.1 Address Mapping
The system contains two Harvard Architecture Xtensa® LX7 CPUs, and both can access the same range of
address space.
Addresses below 0x4000_0000 are accessed using the data bus. Addresses in the range of 0x4000_0000 ~

3 System and Memory
0x4FFF_FFFF are accessed using the instruction bus. Addresses over and including 0x5000_0000 are shared by
both data bus and instruction bus.
Both data bus and instruction bus are little-endian. The CPU can access data via the data bus using single-byte,
double-byte, 4-byte and 16-byte alignment. The CPU can also access data via the instruction bus, but only in
4-byte aligned manner; non-aligned data access will cause a CPU exception.
The CPU can:
• directly access the internal memory via both data bus and instruction bus;
• directly access the external memory which is mapped into the address space via cache;
• directly access modules/peripherals via data bus.
RY
Table 3-1 lists the address ranges on the data bus and instruction bus and their corresponding target
memory.
Some internal and external memory can be accessed via both data bus and instruction bus. In such cases, the
CPU can access the same memory using multiple addresses.
Table 31. Address Mapping
A
Boundary Address
Bus Type Size Target
Low Address High Address
Data bus
0x0000_0000
0x3C00_0000
IN 0x3BFF_FFFF
0x3DFF_FFFF 32 MB
Reserved
External memory
0x3E00_0000 0x3FC8_7FFF Reserved
Data bus 0x3FC8_8000 0x3FCF_FFFF 480 KB Internal memory
IM
0x3FD0_0000 0x3FEF_FFFF Reserved
Data bus 0x3FF0_0000 0x3FF1_FFFF 128 KB Internal memory
0x3FF2_0000 0x3FFF_FFFF Reserved
Instruction bus 0x4000_0000 0x4005_FFFF 384 KB Internal memory
EL
0x4006_0000 0x4036_FFFF Reserved

Instruction bus 0x4037_0000 0x403D_FFFF 448 KB Internal memory
0x403E_0000 0x41FF_FFFF Reserved
Instruction bus 0x4200_0000 0x43FF_FFFF 32 MB External memory
0x4400_0000 0x4FFF_FFFF Reserved
PR
Data/Instruction 0x5000_0000 0x5000_1FFF 8 KB Internal memory

bus
0x5000_2000 0x5FFF_FFFF Reserved
Data/Instruction 0x6000_0000 0x600D_0FFF 836 KB Peripherals
bus
0x600D_1000 0x600F_DFFF Reserved
0x600F_E000 0x600F_FFFF 8 KB Internal memory
0x6010_0000 0xFFFF_FFFF Reserved
3.3.2 Internal Memory

The ESP32-S3 consists of the following three types of internal memory:

3 System and Memory
• Internal ROM (384 KB): The internal ROM is a read-only memory and cannot be programmed. Internal
ROM contains the ROM code (software instructions and some software read-only data) of some low level
system software.
• Internal SRAM (512 KB): The Internal Static RAM (SRAM) is a volatile memory that can be quickly accessed
by the CPU (generally within a single CPU clock cycle).
– A part of the SRAM can be configured to operate as a cache for external memory access, which
cannot be accessed by CPU in such case.
– Some parts of the SRAM can only be accessed via the CPU’s instruction bus.
– Some parts of the SRAM can only be accessed via the CPU’s data bus.
RY
– Some parts of the SRAM can be accessed via both the CPU’s instruction bus and the CPU’s data bus.
• RTC Memory (16 KB): The RTC (Real Time Clock) memory implemented as Static RAM (SRAM) and thus is
volatile. However, RTC memory has the added feature of being persistent throughout deep sleep (i.e., the
RTC memory retains its values throughout deep sleep).
– RTC FAST Memory (8 KB): RTC FAST memory can only be accessed by the CPU, and cannot be
A
accessed by the ULP co-processor. It is generally used to store instructions and data that needs to
persist across a deep sleep.
– RTC SLOW Memory (8 KB): The RTC SLOW memory can be accessed by both the CPU and the ULP
IN
co-processor, and thus is generally used to store instructions and share data between the CPU and
the ULP co-processor.
Based on the three different types of internal memory described above, the internal memory of the ESP32-S3 is
IM
split into four segments: Internal ROM (384 KB), Internal SRAM (512 KB), RTC FAST Memory (8 KB) and RTC
SLOW Memory (8 KB). However, within each segment, there may be different bus access restrictions (e.g., some
parts of the segment may only be accessible by the CPU’s instruction bus). Therefore, some segments are also
further divided down into parts. Table 3-2 describes each part of internal memory and their address ranges on
the data bus and/or instruction bus.
EL
Table 32. Internal Memory Address Mapping
Boundary Address
Bus Type Size (KB) Target
0x3FF0_0000 0x3FF1_FFFF 128 Internal ROM 1
PR
0x3FC8_0000 0x3FCE_FFFF 416 Internal SRAM 1

Data bus
0x3FCF_0000 0x3FCF_FFFF 64 Internal SRAM 2
0x4000_0000 0x4003_FFFF 256 Internal ROM 0
0x4004_0000 0x4005_FFFF 128 Internal ROM 1
Instruction bus 0x4037_0000 0x4037_7FFF 32 Internal SRAM 0
0x4037_8000 0x403D_FFFF 416 Internal SRAM 1
0x5000_0000 0x5000_1FFF 8 RTC SLOW Memory
Data/Instruction bus
0x600F_E000 0x600F_FFFF 8 RTC FAST Memory

3 System and Memory
Note:
All of the internal memories are managed by Permission Control module. An internal memory can only be accessed
when it is allowed by Permission Control, then the internal memory can be available to the CPU. For more information
about Permission Control, please refer to Chapter 4 Permission Control (PMS) [to be added later].
1. Internal ROM 0
Internal ROM 0 is a 256 KB, read-only memory space, addressed by the CPU only through the instruction bus,
as shown in Table 3-2.
2. Internal ROM 1
Internal ROM 1 is a 128 KB, read-only memory space, addressed by the CPU through the instruction bus via
RY
0x4004_0000 ~ 0x4005_FFFF or through the data bus via 0x3FF0_0000 ~ 0x3FF1_FFFF in the same order, as
shown in Table 3-2.
This means, for example, address 0x4005_0000 and 0x3FF0_0000 correspond to the same word, 0x4005_0004
and 0x3FF0_0004 correspond to the same word, 0x4005_0008 and 0x3FF0_0008 correspond to the same
word, etc (same below).
A
3. Internal SRAM 0
Internal SRAM 0 is a 32 KB, read-and-write memory space, addressed by the CPU through the instruction bus,
as shown in Table 3-2.
IN
A 16 KB or the total 32 KB of this memory space can be configured as instruction cache (ICache) to store
instructions or read-only data of the external memory. In this case, the occupied memory space cannot be
accessed by the CPU, while the remaining can still can be accessed by the CPU.
IM
4. Internal SRAM 1
Internal SRAM 1 is a 416 KB, read-and-write memory space, addressed by the CPU through the data bus or
instruction bus in the same order, as shown in Table 3-2.
EL
The total 416 KB memory space comprises multiple 8 KB and 16 KB memory (sub-memory) blocks. A memory
block (up to 16 KB) can be used as a Trace Memory, in which case this block can still be accessed by the
CPU.
5. Internal SRAM 2
Internal SRAM 2 is a 64 KB, read-and-write memory space, addressed by the CPU through the data bus, as
PR
shown in Table 3-2.
A 32 KB or the total 64 KB can be configured as data cache (DCache) to cache data of the external memory. The
space used as DCache cannot be accessed by the CPU, while the remaining space can still be accessed by the
CPU.
6. RTC FAST Memory
RTC FAST Memory is a 8 KB, read-and-write SRAM, addressed by the CPU through the data/instruction bus via
the shared address 0x600F_E000 ~ 0x600F_FFFF, as described in Table 3-2.
7. RTC SLOW Memory
RTC SLOW Memory is a 8 KB, read-and-write SRAM, addressed by the CPU through the data/instruction bus
via shared address 0x5000_E000 ~ 0x5001_FFFF, as described in Table 3-2.

3 System and Memory
RTC SLOW Memory can also be used as a peripheral addressable to the CPU via 0x6002_1000 ~
0x6002_2FFF.
3.3.3 External Memory

ESP32-S3 supports SPI, Dual SPI, Quad SPI, Octal SPI, QPI, and OPI interfaces that allow connection to
external flash and RAM. It also supports hardware encryption and decryption based on XTS_AES algorithm to
protect users’ programs and data in the external flash and RAM.
3.3.3.1 External Memory Address Mapping
The CPU accesses the external memory via the cache. According to information inside the MMU (Memory
RY
Management Unit), the cache maps the CPU’s instruction/data bus address into a physical address of the
external flash and RAM. Due to this address mapping, ESP32-S3 can address up to 1 GB external flash and 1
GB external RAM.
Using the cache, ESP32-S3 is able to support the following address space mappings at a time:
• Up to 32 MB instruction bus address space can be mapped to the external flash or RAM as individual 64
A
KB blocks via the ICache. 4-byte aligned reads and fetches are supported.
• Up to 32 MB data bus address space can be mapped to the external RAM as individual 64 KB blocks via
IN
the DCache. Single-byte, double-byte, 4-byte, 16-byte aligned reads and writes are supported. This
address space can also be mapped to the external flash or RAM for read operations only.
Table 3-3 lists the mapping between the cache and the corresponding address ranges on the data bus and
instruction bus.
IM
Table 33. External Memory Address Mapping
Boundary Address
Bus Type Size (MB) Target
Data bus 0x3C00_0000 0x3DFF_FFFF 32 DCache
EL
Instruction bus 0x4200_0000 0x43FF_FFFF 32 ICache
Note:
Only if the CPU obtains permission for accessing the external memory, can it be responded for memory access.
PR
For more detailed information about permission control, please refer to Chapter 4 Permission Control (PMS) [to be
added later].
3.3.3.2 Cache
As shown in Figure 3-2, ESP32-S3 has a dual-core-shared ICache and DCache structure, which allows prompt
response upon simultaneous requests from the instruction bus and data bus. Some internal memory space can
be used as cache (see Internal SRAM 0 and Internal SRAM 2 in Section 3.3.2).
When the instruction bus of two cores initiate a request on ICache simultaneously, the arbiter determines which
core gets the access to the ICache first; when the data bus of two cores initiate a request on DCache
simultaneously, the arbiter determines which gets the access to the DCache first. When a cache miss occurs, the

3 System and Memory
cache controller will initiate a request to the external memory. When ICache and DCache initiate requests on the
external memory simultaneously, the arbiter determines which gets the access to the external memory first. The
size of ICache can be configured to 16 KB or 32 KB, while its block size can be configured to 16 B or 32 B.
When an ICache is configured to 32 KB, its block cannot be 16 B. The size of DCache can be configured to 32
KB or 64 KB, while its block size can be configured to 16 B, 32 B or 64 B. When a DCache is configured to 64
KB, its block cannot be 16 B.
A RY
IN
Figure 32. Cache Structure
3.3.3.3 Cache Operations

IM
ESP32-S3 caches support the following operations:
1. WriteBack: This operation is used to clear the dirty bits in dirty blocks and update the new data to the
external memory. After the write-back operation finished, both the external memory and the cache are
bearing the new data. The CPU can then read/write the data directly from the cache. Only DCache has this
EL
function.
If the data in the cache is newer than the one stored in the external memory, then the new data will be
considered as a dirty block. The cache tracks these dirty blocks through their dirty bits. When the dirty bits
of a data are cleared, the cache will consider the data as new.
2. Clean: This operation is used to clear dirty bits in the dirty block, without updating data to the external
PR
memory. After the clean operation finish, there will still be old data stored in the external memory, while the
cache keeps the new one (but the cache does not know about this). The CPU can then read/write the data
directly from the cache. Only DCache has this function.
3. Invalidate: This operation is used to remove valid data in the cache. Even if the data is a dirty block
mentioned above, it will not be updated to the external memory. But for the non-dirty data, it will be only
stored in the external memory after this operation. The CPU needs to access the external memory in order
to read/write this data. As for the dirty blocks, they will be totally lost with only old data in the external
memory after this operation. There are two types of invalidate operation: automatic invalidation
(Auto-Invalidate) and manual invalidation (Manual-Invalidate). Manual-Invalidate is performed only on data in
the specified area in the cache, while Auto-Invalidate is performed on all data in the cache. Both ICache
and DCache have this function.

3 System and Memory
4. Preload: This operation is to load instructions and data into the cache in advance. The minimum unit of
preload-operation is one block. There are two types of preload-operation: manual preload
(Manual-Preload) and automatic preload (Auto-Preload). Manual-Preload means that the hardware
prefetches a piece of continuous data according to the virtual address specified by the software.
Auto-Preload means the hardware prefetches a piece of continuous data according to the current address
where the cache hits or misses (depending on configuration). Both ICache and DCache have this function.
5. Lock/Unlock: The lock operation is used to prevent the data in the cache from being easily replaced.
There are two types of lock: prelock and manual lock. When prelock is enabled, the cache locks the data
in the specified area when filling the missing data to cache memory, while the data outside the specified
area will not be locked. When manual lock is enabled, the cache checks the data that is already in the
cache memory and locks the data only if it falls in the specified area, and leaves the data outside the
RY
specified area unlocked. When there are missing data, the cache will replace the data in the unlocked way
first, so the data in the locked way is always stored in the cache and will not be replaced. But when all
ways within the cache are locked, the cache will replace data, as if it was not locked. Unlocking is the
reverse of locking, except that it only can be done manually. Both ICache and DCache have this function.
Please note that the writing-back, cleaning and Manual-Invalidate operations will only work on the unlocked
A
data. If you expect to perform such operations on the locked data, please unlock them first.
3.3.4 GDMA Address Space

IN
The GDMA (General Direct Memory Access) peripheral in ESP32-S3 can provide DMA (Direct Memory Access)
services including:
• Data transfers between different locations of internal memory;

IM
• Data transfers between internal memory and external memory;
• Data transfers between different locations of external memory.
GDMA uses the same addresses as the CPU’s data bus to access Internal SRAM 1 and Internal SRAM 2.
Specifically, GDMA uses address range 0x3FC8_8000 ~ 0x3FCE_FFFF to access Internal SRAM 1 and
EL
0x3FCF_0000 ~ 0x3FCF_FFFF to access Internal SRAM 2. Note that GDMA cannot access the internal memory
occupied by cache.
In addition, GDMA can access the external memory (only RAM) via the same address as CPU accessing DCache
(0x3C00_0000 ~ 0x3DFF_FFFF). When DCache and GDMA access the external memory simultaneously, the
software needs to make sure the data is consistent.
PR
Besides, some peripherals/modules of the ESP32-S3 can work together with GDMA. In these cases, GDMA can
provide the following powerful services for them:
• Data transfers between modules/peripherals and internal memory;
• Data transfers between modules/peripherals and external memory.
There are 11 peripherals/modules that can work together with GDMA. As shown in Figure 3-3, these 11 vertical
lines in turn correspond to these 11 peripherals/modules with GDMA function, the horizontal line represents a
certain channel of GDMA (can be any channel), and the intersection of the vertical line and the horizontal line
indicates that a peripheral/module has the ability to access the corresponding channel of GDMA. If there are
multiple intersections on the same line, it means that these peripherals/modules cannot enable the GDMA
function at the same time.

3 System and Memory
RY
Figure 33. Peripherals/modules that can work with GDMA
A
These peripherals/modules can access any memory available to GDMA. For more information, please refer to
Chapter 2 GDMA Controller (GDMA). IN
Note:
When accessing a memory via GDMA, a corresponding access permission is needed, otherwise this access may
fail. For more information about permission control, please refer to Chapter 4 Permission Control (PMS) [to be added
later].
IM
3.3.5 Modules/Peripherals
The CPU can access modules/peripherals via 0x6000_0000 ~ 0x600D_0FFF shared by the data/instruction
EL
bus.
3.3.5.1 Module/Peripheral Address Mapping
Table 3-4 lists all the modules/peripherals and their respective address ranges. Note that the address space of
specific modules/peripherals is defined by ”Boundary Address” (including both Low Address and High
PR
Address).
Table 34. Module/Peripheral Address Mapping
Boundary Address
Target Size (KB) Notes
UART Controller 0 0x6000_0000 0x6000_0FFF 4
Reserved 0x6000_1000 0x6000_1FFF
SPI Controller 1 0x6000_2000 0x6000_2FFF 4
GPIO 0x6000_4000 0x6000_4FFF 4
Cont’d on next page

3 System and Memory
Table 34 – cont’d from previous page

Boundary Address
eFuse Controller 0x6000_7000 0x6000_7FFF 4
Low-Power Management 0x6000_8000 0x6000_8FFF 4
IO MUX 0x6000_9000 0x6000_9FFF 4
Reserved 0x6000_A000 0x6000_EFFF
I2S Controller 0 0x6000_F000 0x6000_FFFF 4
UART Controller 1 0x6001_0000 0x6001_0FFF 4
I2C Controller 0 0x6001_3000 0x6001_3FFF 4
RY
UHCI0 0x6001_4000 0x6001_4FFF 4
Remote Control Peripheral 0x6001_6000 0x6001_6FFF 4
Pulse Count Controller 0x6001_7000 0x6001_7FFF 4
A
LED PWM Controller 0x6001_9000 0x6001_9FFF 4
Reserved 0x6001_A000 0x6001_DFFF
Motor Control PWM 0 0x6001_E000 0x6001_EFFF 4
Timer Group 0
Timer Group 1
IN
0x6001_F000
0x6002_0000
0x6001_FFFF
0x6002_0FFF
4
4
RTC SLOW Memory 0x6002_1000 0x6002_2FFF 8
System Timer 0x6002_3000 0x6002_3FFF 4
IM
APB Controller 0x6002_6000 0x6002_6FFF 4
I2C Controller 1 0x6002_7000 0x6002_7FFF 4
SD/MMC Host Controller 0x6002_8000 0x6002_8FFF 4
EL
Reserved 0x6002_9000 0x6002_AFFF

Two-wire Automotive Interface 0x6002_B000 0x6002_BFFF 4
Motor Control PWM 1 0x6002_C000 0x6002_CFFF 4
I2S Controller 1 0x6002_D000 0x6002_DFFF 4
UART controller 2 0x6002_E000 0x6002_EFFF 4
PR
Reserved 0x6002_F000 0x6003_7FFF

USB Serial/JTAG Controller 0x6003_8000 0x6003_8FFF 4
USB External Control registers 0x6003_9000 0x6003_9FFF 4 1
AES Accelerator 0x6003_A000 0x6003_AFFF 4
SHA Accelerator 0x6003_B000 0x6003_BFFF 4
RSA Accelerator 0x6003_C000 0x6003_CFFF 4
Digital Signature 0x6003_D000 0x6003_DFFF 4
HMAC Accelerator 0x6003_E000 0x6003_EFFF 4
GDMA Controller 0x6003_F000 0x6003_FFFF 4
ADC Controller 0x6004_0000 0x6004_0FFF 4
Camera-LCD Controller 0x6004_1000 0x6004_1FFF 4

3 System and Memory

Boundary Address
Reserved 0x6004_2000 0x6007_FFFF
USB core registers 0x6008_0000 0x600B_FFFF 256 1
System Registers 0x600C_0000 0x600C_0FFF 4
Sensitive Register 0x600C_1000 0x600C_1FFF 4
Interrupt Matrix 0x600C_2000 0x600C_2FFF 4
Reserved 0x600C_3000 0x600C_3FFF
Configure Cache 0x600C_4000 0x600C_BFFF 32
External Memory Encryption and 0x600C_C000 0x600C_CFFF 4
RY
Decryption
Reserved 0x600C_D000 0x600C_DFFF
Debug Assist 0x600C_E000 0x600C_EFFF 4
Reserved 0x600C_F000 0x600C_FFFF
World Controller 0x600D_0000 0x600D_0FFF 4
A
Note: IN
1. The address space in this module/peripheral is not continuous.
2. The CPU needs to obtain the access permission to a certain module/peripheral when initiating a request to access
it, otherwise it may fail. For more information of permission control, please see Chapter 4 Permission Control (PMS)
[to be added later].
IM
EL
PR

4 eFuse Controller
4 eFuse Controller
4.1 Overview
The ESP32-S3 contains a 4096-bit eFuse to store parameters. These parameters are burned and read by an
eFuse controller. Once an eFuse bit is programmed to 1, it can never be reverted to 0. The eFuse controller
programs individual bits of parameters in eFuse according to users configurations. Some of these parameters
can be read by users using the eFuse controller. If read-protection for some data is not enabled, that data is
readable from outside the chip. If read-protection is enabled, that data can not be read from outside the chip. In
all cases, however, some keys stored in eFuse can still be used internally by hardware cryptography modules
such as Digital Signature, HMAC, etc., without exposing this data to the outside world.
RY
4.2 Features
• 4096 bits in total, with 1566 bits available for users
• One-time programmable storage
A
• Configurable write protection
• Configurable read protection

IN
• Various hardware encoding schemes protect against data corruption

IM
4.3.1 Structure
The eFuse data is organized in 11 blocks (BLOCK0 ~ BLOCK10). BLOCK0 has 640 bits in totall. BLOCK1 has
288 bits and each block of BLOCK2 ~ 10 has 352 bits.
BLOCK0, which holds most parameters, has 25 bits that are readable but useless to users (the details are
EL
showed in Section 4.3.2), and 29 further bits are reserved for future use.
Table 4-1 lists all the parameters in BLOCK0 and their offsets, bit widths, as well as information on whether they
can be used by hardware, which bits are write-protected, and corresponding descriptions.
The EFUSE_WR_DIS parameter is used to disable the writing of other parameters, while EFUSE_RD_DIS is
PR
used to disable users from reading BLOCK4 ~ BLOCK10. For more information on these two parameters, please
see Section 4.3.1.1 and Section 4.3.1.2.

Espressif Systems
4 eFuse Controller
Table 41. Parameters in eFuse BLOCK0
ProgrammingProtection
Bit Accessible
Parameters by EFUSE_WR_DIS Description
PR
Width by Hardware
Bit Number
EFUSE_WR_DIS 32 Y N/A Disable writing of individual eFuses.

EFUSE_RD_DIS 7 Y 0 Disable users from reading eFuse blocks BLOCK4 ~ 10.
EFUSE_DIS_ICACHE 1 Y 2 Disable ICache.
EFUSE_DIS_DCACHE 1 Y 2 Disable DCache.
EL
EFUSE_DIS_DOWNLOAD_ICACHE 1 Y 2 Disable ICache in Download mode.
EFUSE_DIS_DOWNLOAD_DCACHE 1 Y 2 Disable DCache in Download mode.
EFUSE_DIS_FORCE_DOWNLOAD 1 Y 2 Disable chip from force-entering Download mode.
EFUSE_DIS_USB_OTG 1 Y 2 Disable USB OTG.

EFUSE_DIS_TWAI 1 Y 2 Disable TWAI Controller.
IM
EFUSE_DIS_APP_CPU 1 Y 2 Disable APP CPU.
Disable JTAG by programming odd number of bits. If JTAG is dis-
126
EFUSE_SOFT_DIS_JTAG 3 Y 31
abled by this way, users can re-enable JTAG via HMAC peripheral.
EFUSE_DIS_PAD_JTAG 1 Y 2 Hardware Disable JTAG permanently.
EFUSE_DIS_DOWNLOAD_ MANUAL_ENCRYPT 1 Y 2 Disable flash encryption in Download boot mode.
IN
EFUSE_USB_EXCHG_PINS 1 Y 30 Swap USB D+/D- pins.
EFUSE_EXT_PHY_ENABLE 1 N 30 Enable external USB PHY.
EFUSE_VDD_SPI_XPD 1 Y 3 Power up the VDD_SPI regulator if EFUSE_VDD_SPI_FORCE is 1.
ESP32-S3 TRM (Pre-release v0.3)
Select voltage for VDD_SPI if VDD_SPI_FORCE is 1. 0: connect

EFUSE_VDD_SPI_TIEH 1 Y 3
A
VDD_SPI to 1.8 V LDO; 1: connect VDD_SPI to VDD_RTC_IO.
Set to use EFUSE_VDD_SPI_XPD and EFUSE_VDD_SPI_TIEH to
EFUSE_VDD_SPI_FORCE 1 Y 3
configure VDD_SPI LDO.
RY
EFUSE_WDT_DELAY_SEL 2 Y 3 Select RTC WDT timeout threshold.
Enable SPI boot encryption and decryption. This feature is enabled
EFUSE_SPI_BOOT_CRYPT_CNT 3 Y 4 when an odd number of bits is set in this parameter, otherwise it is
disabled.
Espressif Systems
4 eFuse Controller
Bit Accessible
Width by Hardware
PR
Bit Number
EFUSE_SECURE_BOOT_KEY_ REVOKE0 1 N 5 Revoke the first secure boot key when enabled.
EFUSE_SECURE_BOOT_KEY_ REVOKE1 1 N 6 Revoke the second secure boot key when enabled.
EFUSE_SECURE_BOOT_KEY_ REVOKE2 1 N 7 Revoke the third secure boot key when enabled.
EFUSE_KEY_PURPOSE_0 4 Y 8 Key0 purpose, see Table 4-2.
EL

EFUSE_SECURE_BOOT_EN 1 N 15 Enable secure boot.
IM
EFUSE_SECURE_BOOT_AGG
1 N 16 Enable aggressive Secure boot key revocation mode.
127
RESSIVE_REVOKE
EFUSE_DIS_USB_JTAG 1 Y 2 Set to disable the function of usb_serial_jtag that switch usb to jtag.
EFUSE_DIS_USB_SERIAL_JTAG 1 Y 2 Set to disable usb_serial_jtag module.
Enable selection between usb_to_jtag or pad_to_jtag through
IN
EFUSE_STRAP_JTAG_SEL 1 Y 2
GPIO3. 0: pad_to_jtag; 1: usb_to_jtag.
Select internal/external PHY for USB OTG and usb_serial_jtag. 0:
EFUSE_USB_PHY_SEL 1 Y 2 internal PHY for usb_serial_jtag, external PHY for USB OTG; 1: in-
ternal PHY for USB OTG, external PHY for usb_serial_jtag.
A
Configure flash startup delay after SoC being powered up (the unit
EFUSE_FLASH_TPUW 4 N 18
is ms/2). When the value is 15, delay will be 7.5 ms.
EFUSE_DIS_DOWNLOAD_MODE 1 N 18 Disable all download boot modes.
RY
EFUSE_DIS_LEGACY_SPI_BOOT 1 N 18 Disable Legacy SPI boot mode.
Select UART channel for printing boot information. 0: UART0; 1:
EFUSE_UART_PRINT_CHANNEL 1 N 18
UART1.
Espressif Systems
4 eFuse Controller
Bit Accessible
Width by Hardware
PR
Bit Number
Set ECC mode for SPI flash. 0: 16-to-18-byte mode; 1: 16-to-17-

EFUSE_FLASH_ECC_MODE 1 N 18
byte mode.
Disable the USB OTG download feature in UART download boot
EFUSE_DIS_USB_DOWNLOAD_ MODE 1 N 18
mode.
EFUSE_ENABLE_SECURITY_ DOWNLOAD 1 N 18 Enable UART secure download mode (read/write flash only).
EL
Set UART boot message output mode. 2’b00: Force print; 2’b01:
EFUSE_UART_PRINT_CONTROL 2 N 18 Low-level print, controlled by GPIO46; 2’b10: High-level print, con-
trolled by GPIO46; 2’b11: Print force disabled.
Select power for GPIO33 ~ GPIO37. 0: VDD3P3_CPU; 1:

EFUSE_PIN_POWER_SELECTION 1 N 18
VDD_SPI.
IM
EFUSE_FLASH_TYPE 1 N 18 Flash type. 0: 4 data lines; 1: 8 data lines.
128
EFUSE_FLASH_PAGE_SIZE 2 N 18 Set the page size of flash.

EFUSE_FLASH_ECC_EN 1 N 18 Enable ECC function in Flash boot mode.
Force ROM code to send an SPI flash resume command during SPI
EFUSE_FORCE_SEND_RESUME 1 N 18
boot.
IN
EFUSE_SECURE_VERSION 16 N 18 Secure version (used by ESP-IDF anti-rollback feature).
1: Use BLOCK0 to check error record registers; 0: disable error
EFUSE_ERR_RST_ENABLE 1 N 19
register check.
A RY
4 eFuse Controller
Table 4-2 lists all key purpose and their values. Setting the eFuse parameter EFUSE_KEY_PURPOSE_n declares
the purpose of KEYn (n: 0 ~ 5).
Table 42. Secure Key Purpose Values
Key
Purpose Purposes
Values
0 User purposes
1 Reserved
2 XTS_AES_256_KEY_1 (flash/SRAM encryption and decryption)
3 XTS_AES_256_KEY_2 (flash/SRAM encryption and decryption)
RY
4 XTS_AES_128_KEY (flash/SRAM encryption and decryption)
5 HMAC Downstream mode
6 JTAG in HMAC Downstream mode
7 Digital Signature peripheral in HMAC Downstream mode
8 HMAC Upstream mode
A
9 SECURE_BOOT_DIGEST0 (secure boot key digest)
IN
Table 4-3 provides the details of parameters in BLOCK1 ~ BLOCK10.
IM
EL
PR

Espressif Systems
4 eFuse Controller
Table 43. Parameters in BLOCK1 to BLOCK10
Write Protection Read Protection

Accessible
BLOCK Parameters Bit Width by EFUSE_WR_DIS by EFUSE_RD_DIS Description
PR
by Hardware
Bit Number Bit Number
BLOCK1 EFUSE_MAC 48 N 20 N/A MAC address

EFUSE_SPI_PAD_ [0:5] N 20 N/A CLK
CONFIGURE [6:11] N 20 N/A Q (D1)
[12:17] N 20 N/A D (D0)
[18:23] N 20 N/A CS
EL
[24:29] N 20 N/A HD (D3)
[30:35] N 20 N/A WP (D2)
[36:41] N 20 N/A DQS

[42:47] N 20 N/A D4
[48:53] N 20 N/A D5
IM
[54:59] N 20 N/A D6
130
[60:65] N 20 N/A D7
EFUSE_WAFER_VERSION [0:2] N 20 N/A System data
EFUSE_PKG_VERSION [0:2] N 20 N/A System data
IN
EFUSE_SYS_DATA_PART0 72 N 20 N/A System data
BLOCK2 EFUSE_OPTIONAL_UNIQUE_ID 128 N 20 N/A System data
EFUSE_SYS_DATA_PART1 128 N 21 N/A System data
BLOCK2 EFUSE_SYS_DATA_PART1 256 N 21 N/A System data

BLOCK3 EFUSE_USR_DATA 256 N 22 N/A User data
A
BLOCK4 EFUSE_KEY0_DATA 256 Y 23 0 KEY0 or user data
RY
Espressif Systems
4 eFuse Controller
Write Protection Read Protection
Accessible
BLOCK Parameters Bit Width by EFUSE_WR_DIS by EFUSE_RD_DIS Description
by Hardware
PR
Bit Number Bit Number
BLOCK10 EFUSE_SYS_DATA_PART2 256 N 29 6 System data
EL
IM
131
IN
A RY
4 eFuse Controller
Among these blocks, BLOCK4 ~ 9 store KEY0 ~ 5, respectively. Up to six 256-bit keys can be written into eFuse.
Whenever a key is written, its purpose value should also be written (see table 4-2). For example, when a key for
the JTAG function in HMAC Downstream mode is written to KEY3 (i.e., BLOCK7), its key purpose value 6 should
also be written to EFUSE_KEY_PURPOSE_3.
BLOCK1 ~ BLOCK10 use the RS coding scheme, so there are some restrictions on writing to these parameters.
For more detailed information, please refer to Section 4.3.1.3 and 4.3.2.
4.3.1.1 EFUSE_WR_DIS
Parameter EFUSE_WR_DIS determines whether individual eFuse parameters are write-protected. After
EFUSE_WR_DIS has been programmed, execute an eFuse read operation to let the new values take effect (see
RY
Section 4.3.3).
Column “Write Protection by EFUSE_WR_DIS Bit Number” in Table 4-1 and Table 4-3 list the specific bits in
EFUSE_WR_DIS that disable writing.
When the write protection bit of a parameter is set to 0, it means that this parameter is not write-protected and
can be programmed.
A
Setting the write protection bit of a parameter to 1 enables write-protection for it and none of its bits can be
modified afterwards. Non-programmed bits always remain 0 while programmed bits always remain 1.
IN
4.3.1.2 EFUSE_RD_DIS
Only the eFuse blocks BLOCK4 ~ BLOCK10 can be individually read protected to prevent any access from
outside the chip, as shown in column “Read Protection by EFUSE_RD_DIS Bit Number” of Table 4-3. After
IM
EFUSE_RD_DIS has been programmed, execute an eFuse read operation to let the new values take effect (see
Section 4.3.3).
If a bit in EFUSE_RD_DIS is 0, then the eFuse block can be read by users; if a bit in EFUSE_RD_DIS is 1, then the
parameter controlled by this bit is user read protected.
EL
Other parameters that are not in BLOCK4 ~ BLOCK10 can always be read by users.
When BLOCK4 ~ BLOCK10 are set to be read-protected, the data in these blocks are not readable by users, but
they can still be used internally by hardware cryptography modules, if the EFUSE_KEY_PURPOSE_n bit is set
accordingly.
PR
4.3.1.3 Data Storage
According to the different types of eFuse bits, eFuse controller use two hardware encoding schemes to protect
eFuse bits from corruption.
All BLOCK0 parameters except for EFUSE_WR_DIS are stored with four backups, meaning each bit is stored
four times. This scheme is transparent to the user. This encoding scheme is invisible for users.
BLOCK1 ~ BLOCK10 store key data and some parameters and use RS (44, 32) coding scheme that supports up
to 6 bytes of automatic error correction. The primitive polynomial of RS (44, 32) is
p(x) = x8 + x4 + x3 + x2 + 1.
The shift register circuit shown in Figure 4-1 and 4-2 processes 32 data bytes using RS (44, 32). This coding
scheme encodes 32 bytes of data into 44 bytes:

4 eFuse Controller
RY
Figure 41. Shift Register Circuit (output of first 32 bytes)
A
IN
IM
Figure 42. Shift Register Circuit (output of last 12 bytes)
• Bytes [0:31] are the data bytes itself
• Bytes [32:43] are the encoded parity bytes stored in 8-bit flip-flops DFF1, DFF2, ..., DFF12 (gf_mul_n,
EL
where n is an integer, is the result of multiplying a byte of data ...)
After that, the hardware burns into eFuse the 44-byte codeword consisting of the data bytes followed by the
parity bytes.
When the eFuse block is read back, the eFuse controller automatically decodes the codeword and applies error
PR
correction if needed.
Because the RS check codes are generated on the entire 256-bit eFuse block, each block can only be written
once.
4.3.2 Programming of Parameters

The eFuse controller can only program eFuse parameters of one block at a time. BLOCK0 ~ BLOCK10 share the
same address range to store the parameters to be programmed. Configure parameter EFUSE_BLK_NUM to
indicate which block should be programmed.
Before programming, make sure the eFuse programming voltage VDDQ is configured correctly as described in
Section 4.3.4.
Programming BLOCK0

4 eFuse Controller
When EFUSE_BLK_NUM is set to 0, BLOCK0 will be programmed. Register EFUSE_PGM_DATA0_REG stores

EFUSE_WR_DIS. Registers EFUSE_PGM_DATA1_REG ~ EFUSE_PGM_DATA5_REG store the information of
parameters to be programmed. Note that 25 bits are readable but useless to users and must always be set to 0
in the programming registers. The specific bits are:
• EFUSE_PGM_DATA1_REG[27:31]
RY
• EFUSE_PGM_DATA4_REG[30]
Data in registers EFUSE_PGM_DATA6_REG ~ EFUSE_PGM_DATA7_REG and

EFUSE_PGM_CHECK_VALUE0_REG ~ EFUSE_PGM_CHECK_VALUE2_REG are ignored when programming
BLOCK0.
Programming BLOCK1
A
When EFUSE_BLK_NUM is set to 1, registers EFUSE_PGM_DATA0_REG ~ EFUSE_PGM_DATA5_REG store the
BLOCK1 parameters to be programmed. Registers EFUSE_PGM_CHECK_VALUE0_REG ~
IN
EFUSE_PGM_DATA2_REG store the corresponding RS check codes. Data in registers
EFUSE_PGM_DATA6_REG ~ EFUSE_PGM_DATA7_REG is ignored when programming BLOCK1, and the RS
check codes will be calculated with these bits all treated as 0.
Programming BLOCK2 ~ 10
IM
When EFUSE_BLK_NUM is set to 2 ~ 10, registers EFUSE_PGM_DATA0_REG ~ EFUSE_PGM_DATA7_REG
store the parameters to be programmed to this block. Registers
EFUSE_PGM_CHECK_VALUE0_REG ~ EFUSE_PGM_CHECK_VALUE2_REG store the corresponding RS check
codes.
EL
Programming process
The process of programming parameters is as follows:
1. Write the block number to EFUSE_BLK_NUM to determine the block to be programmed.
2. Write parameters to be programmed to registers EFUSE_PGM_DATA0_REG ~ EFUSE_PGM_DATA7_REG

PR
and the corresponding checksum values to

EFUSE_PGM_CHECK_VALUE0_REG ~ EFUSE_PGM_CHECK_VALUE2_REG.
3. Configure the field EFUSE_OP_CODE of register EFUSE_CONF_REG to 0x5A5A.
4. Configure the field EFUSE_PGM_CMD of register EFUSE_CMD_REG to 1.
5. Poll register EFUSE_CMD_REG until it is 0x0, or wait for a PGM_DONE interrupt. For more information on
how to identify a PGM_DONE interrupt, please see the end of Section 4.3.3.
6. In order to avoid programming content leakage, please clear the parameters in EFUSE_PGM_DATA0_REG
~ EFUSE_PGM_DATA7_REG and
EFUSE_PGM_CHECK_VALUE0_REG ~ EFUSE_PGM_CHECK_VALUE2_REG.
7. Trigger an eFuse read operation (see Section 4.3.3) to update eFuse registers with the new values.

4 eFuse Controller
8. Check error record registers. If the values read in error record registers are not 0, the programming process
should be performed again following above steps 1 ~ 7. Please check the following error record registers
for different eFuse blocks:
• BLOCK0: EFUSE_RD_REPEAT_ERR0_REG ~ EFUSE_RD_REPEAT_ERR4_REG
• BLOCK1: EFUSE_RD_RS_ERR0_REG[2:0], EFUSE_RD_RS_ERR0_REG[7]
RY
• BLOCK9: EFUSE_RD_RS_ERR1_REG[2:0], EFUSE_RD_RS_ERR1_REG[2:0][7]
A
• BLOCK10: EFUSE_RD_RS_ERR1_REG[2:0][6:4]
Limitations
IN
In BLOCK0, each bit can be programmed separately. However, we recommend to minimize programming cycles
and program all the bits of a parameter in one programming action. In addition, after all parameters controlled by
a certain bit of EFUSE_WR_DIS are programmed, that bit should be immediately programmed. The
programming of parameters controlled by a certain bit of EFUSE_WR_DIS, and the programming of the bit itself
IM
can even be completed at the same time. Repeated programming of already programmed bits is strictly
forbidden, otherwise, programming errors will occur.
BLOCK1 cannot be programmed by users as it has been programmed at manufacturing.
BLOCK2 ~ 10 can only be programmed once. Repeated programming is not allowed.

EL
4.3.3 User Read of Parameters

Users cannot read eFuse bits directly. The eFuse Controller hardware reads all eFuse bits and stores the results
to their corresponding registers in its memory space. Then, users can read eFuse bits by reading the registers
PR
that start with EFUSE_RD_. Details are provided in Table 4-4.
Table 44. Registers Information
BLOCK Read Registers Registers When Programming This Block

0 EFUSE_RD_WR_DIS_REG EFUSE_PGM_DATA0_REG
0 EFUSE_RD_REPEAT_DATA0 ~ 4_REG EFUSE_PGM_DATA1 ~ 5_REG
1 EFUSE_RD_MAC_SPI_SYS_0 ~ 5_REG EFUSE_PGM_DATA0 ~ 5_REG
2 EFUSE_RD_SYS_PART1_0 ~ 7_REG EFUSE_PGM_DATA0 ~ 7_REG
3 EFUSE_RD_USR_DATA0 ~ 7_REG EFUSE_PGM_DATA0 ~ 7_REG
4~9 EFUSE_RD_KEYn_DATA0 ~ 7_REG (n: 0 ~ 5) EFUSE_PGM_DATA0 ~ 7_REG
10 EFUSE_RD_SYS_PART2_0 ~ 7_REG EFUSE_PGM_DATA0 ~ 7_REG

4 eFuse Controller
Updating eFuse read registers
The eFuse Controller reads internal eFuses to update corresponding registers. This read operation happens on
system reset and can also be triggered manually by users as needed (e.g., if new eFuse values have been
programmed). The process of triggering a read operation by users is as follows:
1. Configure the field EFUSE_OP_CODE in register EFUSE_CONF_REG to 0x5AA5.
2. Configure the field EFUSE_READ_CMD in register EFUSE_CMD_REG to 1.
3. Poll register EFUSE_CMD_REG until it is 0x0, or wait for a READ_DONE interrupt. Information on how to
identify a READ_DONE interrupt is provided below in this section.
4. users reads the values of each parameter from memory.
RY
The eFuse read registers will hold all values until the next read operation.
Error detection
Error record registers allow users to detect if there are any inconsistencies in the stored backup eFuse
parameters.
A
Registers EFUSE_RD_REPEAT_ERR0 ~ 3_REG indicate if there are any errors of programmed parameters
(except for EFUSE_WR_DIS) in BLOCK0 (value 1 indicates an error is detected, and the bit becomes invalid;
value 0 indicates no error).
IN
Registers EFUSE_RD_RS_ERR0 ~ 1_REG store the number of corrected bytes as well as the result of RS
decoding during eFuse reading BLOCK1 ~ BLOCK10.
The values of above registers will be updated every time after the eFuse read registers have been updated.
IM
Identifying the completion of a program/read operation
The methods to identify the completion of a program/read operation are described below. Please note that bit 1
corresponds to a program operation, and bit 0 corresponds to a read operation.
• Method one:
EL
1. Poll bit 1/0 in register EFUSE_INT_RAW_REG until it becomes 1, which represents the completion of a
program/read operation.
• Method two:
1. Set bit 1/0 in register EFUSE_INT_ENA_REG to 1 to enable the eFuse Controller to post a
PR
PGM_DONE or READ_DONE interrupt.
2. Configure the Interrupt Matrix to enable the CPU to respond to eFuse interrupt signals, see Chapter 8
Interrupt Matrix (INTERRUPT).
3. Wait for the PGM/READ_DONE interrupt.
4. Set bit 1/0 in register EFUSE_INT_CLR_REG to 1 to clear the PGM/READ_DONE interrupt.
Note
When eFuse controller updating its registers, it will use EFUSE_PGM_DATAn_REG (n=0�1�..,7) again to store
data. So please do not write important data into these registers before this updating process initiated.

4 eFuse Controller
During the chip boot process, eFuse controller will update eFuse data into registers which can be accessed by
users automatically. You can get programmed eFuse data by reading corresponding registers. Thus, it is no need
to update eFuse read registers in such case.
4.3.4 eFuse VDDQ Timing

The eFuse Controller operates with 20 MHz, one cycle is 50 ns, and its programming voltage VDDQ should be
configured as follows:
• EFUSE_DAC_NUM (store the rising period of VDDQ): The default value of VDDQ is 2.5 V and the voltage
increases by 0.01 V in each clock cycle. Thus, the default value of this parameter is 255;
• EFUSE_DAC_CLK_DIV (the clock divisor of VDDQ): The clock period to program VDDQ should be larger
RY
than 1 µs;
• EFUSE_PWR_ON_NUM (the power-up time for VDDQ): The programming voltage should be stabilized after
this time, which means the value of this parameter should be configured to exceed the value of
EFUSE_DAC_CLK_DIV multiply by EFUSE_DAC_NUM;
• EFUSE_PWR_OFF_NUM (the power-out time for VDDQ): The value of this parameter should be larger than
A
10 µs.
Table 45. Configuration of Default VDDQ Timing Parameters
EFUSE_DAC_NUM EFUSE_DAC_CLK_DIV
IN EFUSE_PWR_ON_NUM EFUSE_PWR_OFF_NUM
0xFF 0x28 0x3000 0x190

IM
4.3.5 The Use of Parameters by Hardware Modules
Some hardware modules are directly connected to the eFuse peripheral in order to use the parameters listed in
Table 4-1 and Table 4-3, specifically those marked with “Y” in columns “Accessible by Hardware”. Users cannot
intervene in this process.
EL
4.3.6 Interrupts
• PGM_DONE interrupt: Triggered when eFuse programming has finished. Set
EFUSE_PGM_DONE_INT_ENA to enable this interrupt;
• READ_DONE interrupt: Triggered when eFuse reading has finished. Set EFUSE_READ_DONE_INT_ENA to
PR
enable this interrupt.

4 eFuse Controller

The addresses in this section are relative to eFuse Controller base address provided in Table 3-4 in Chapter 3
System and Memory.
07

PGM Data Register
EFUSE_PGM_DATA0_REG Register 0 that stores data to be programmed 0x0000 R/W
RY
EFUSE_PGM_DATA3_REG Register 3 that stores data to be programmed 0x000C R/W
EFUSE_PGM_DATA7_REG Register 7 that stores data to be programmed 0x001C R/W
EFUSE_PGM_CHECK_VALUE0_REG Register 0 that stores the RS code to be pro- 0x0020 R/W
A
grammed
EFUSE_PGM_CHECK_VALUE1_REG Register 1 that stores the RS code to be pro- 0x0024 R/W
grammed
EFUSE_PGM_CHECK_VALUE2_REG
grammed
IN
Register 2 that stores the RS code to be pro- 0x0028 R/W
Read Data Register

EFUSE_RD_WR_DIS_REG BLOCK0 data register 0 0x002C RO
IM
EFUSE_RD_REPEAT_DATA0_REG BLOCK0 data register 1 0x0030 RO
EFUSE_RD_REPEAT_DATA3_REG BLOCK0 data register 4 0x003C RO
EL

EFUSE_RD_MAC_SPI_SYS_0_REG BLOCK1 data register 0 0x0044 RO
EFUSE_RD_MAC_SPI_SYS_2_REG BLOCK1 data register 2 0x004C RO
PR

EFUSE_RD_SYS_PART1_DATA0_REG Register 0 of BLOCK2 (system) 0x005C RO
EFUSE_RD_SYS_PART1_DATA1_REG Register 1 of BLOCK2 (system) 0x0060 RO
EFUSE_RD_USR_DATA0_REG Register 0 of BLOCK3 (user) 0x007C RO
EFUSE_RD_USR_DATA1_REG Register 1 of BLOCK3 (user) 0x0080 RO

4 eFuse Controller

EFUSE_RD_USR_DATA4_REG Register 4 of BLOCK3 (user) 0x008C RO
EFUSE_RD_KEY0_DATA0_REG Register 0 of BLOCK4 (KEY0) 0x009C RO
EFUSE_RD_KEY0_DATA1_REG Register 1 of BLOCK4 (KEY0) 0x00A0 RO
RY
EFUSE_RD_KEY0_DATA4_REG Register 4 of BLOCK4 (KEY0) 0x00AC RO
EFUSE_RD_KEY0_DATA5_REG Register 5 of BLOCK4 (KEY0) 0x00B0 RO
EFUSE_RD_KEY1_DATA0_REG Register 0 of BLOCK5 (KEY1) 0x00BC RO
A
EFUSE_RD_KEY1_DATA1_REG Register 1 of BLOCK5 (KEY1) 0x00C0 RO
EFUSE_RD_KEY1_DATA4_REG
EFUSE_RD_KEY1_DATA5_REG
IN
Register 4 of BLOCK5 (KEY1)
Register 5 of BLOCK5 (KEY1)
0x00CC
0x00D0
RO
RO
EFUSE_RD_KEY1_DATA6_REG Register 6 of BLOCK5 (KEY1) 0x00D4 RO
EFUSE_RD_KEY1_DATA7_REG Register 7 of BLOCK5 (KEY1) 0x00D8 RO
IM
EFUSE_RD_KEY2_DATA0_REG Register 0 of BLOCK6 (KEY2) 0x00DC RO
EFUSE_RD_KEY2_DATA1_REG Register 1 of BLOCK6 (KEY2) 0x00E0 RO
EFUSE_RD_KEY2_DATA4_REG Register 4 of BLOCK6 (KEY2) 0x00EC RO
EL
EFUSE_RD_KEY2_DATA5_REG Register 5 of BLOCK6 (KEY2) 0x00F0 RO

EFUSE_RD_KEY3_DATA0_REG Register 0 of BLOCK7 (KEY3) 0x00FC RO
EFUSE_RD_KEY3_DATA1_REG Register 1 of BLOCK7 (KEY3) 0x0100 RO
PR


4 eFuse Controller

RY
A
EFUSE_RD_SYS_PART2_DATA7_REG
Report Register
IN
Register 7 of BLOCK10 (system) 0x0178 RO
EFUSE_RD_REPEAT_ERR0_REG Programming error record register 0 of BLOCK0 0x017C RO

EFUSE_RD_REPEAT_ERR1_REG Programming error record register 1 of BLOCK0 0x0180 RO
IM
EFUSE_RD_RS_ERR0_REG Programming error record register 0 of BLOCK1 0x01C0 RO
~ 10
EL
EFUSE_RD_RS_ERR1_REG Programming error record register 1 of BLOCK1 0x01C4 RO

~ 10
Configuration Register
EFUSE_CLK_REG eFuse clock configuration register 0x01C8 R/W
EFUSE_CONF_REG eFuse operation mode configuration register 0x01CC R/W
PR
EFUSE_CMD_REG eFuse command register 0x01D4 varies

EFUSE_DAC_CONF_REG Controls the eFuse programming voltage 0x01E8 R/W
EFUSE_RD_TIM_CONF_REG Configures read timing parameters 0x01EC R/W
EFUSE_WR_TIM_CONF1_REG Configuration register 1 of eFuse programming 0x01F4 R/W
timing parameters
EFUSE_WR_TIM_CONF2_REG Configuration register 2 of eFuse programming 0x01F8 R/W
timing parameters
Status Register
EFUSE_STATUS_REG eFuse status register 0x01D0 RO
Interrupt Register
EFUSE_INT_RAW_REG eFuse raw interrupt register 0x01D8 R/WC/SS

4 eFuse Controller

EFUSE_INT_ST_REG eFuse interrupt status register 0x01DC RO
EFUSE_INT_ENA_REG eFuse interrupt enable register 0x01E0 R/W
EFUSE_INT_CLR_REG eFuse interrupt clear register 0x01E4 WO
Version Register
EFUSE_DATE_REG Version control register 0x01FC R/W
A RY
IN
IM
EL
PR

4 eFuse Controller
4.5 Registers
The addresses in this section are relative to eFuse Controller base address provided in Table 3-4 in Chapter 3
System and Memory.
Register 4.1. EFUSE_PGM_DATA0_REG (0x0000)
0
A_
AT
_D
M
PG
E_
US
EF
31 0
RY
0x000000 Reset
EFUSE_PGM_DATA_0 The content of the 0th 32-bit data to be programmed. (R/W)
A
1
A_
AT
_D
IN E_
PG
M
US
EF
31 0
0x000000 Reset
IM
EFUSE_PGM_DATA_1 The content of the first 32-bit data to be programmed. (R/W)

EL
2
A_
AT
_D
M
PG
E_
US
EF
PR
31 0
0x000000 Reset
EFUSE_PGM_DATA_2 The content of the second 32-bit data to be programmed. (R/W)

4 eFuse Controller
Register 4.4. EFUSE_PGM_DATA3_REG (0x000C)
3
A_
AT
_D
M
PG
E_
US
EF
31 0
0x000000 Reset
EFUSE_PGM_DATA_3 The content of the 3rd 32-bit data to be programmed. (R/W)
RY
4
A_
AT
_D
M
PG
E_
US
A
EF
31 0
0x000000
IN Reset

IM
5
A_
AT
_D
M
PG
E_
US
EF
EL
31 0
0x000000 Reset

PR

6
A_
AT
_D
M
PG
E_
US
EF
31 0
0x000000 Reset

4 eFuse Controller
Register 4.8. EFUSE_PGM_DATA7_REG (0x001C)
7
A_
AT
_D
M
PG
E_
US
EF
31 0
0x000000 Reset
RY
Register 4.9. EFUSE_PGM_CHECK_VALUE0_REG (0x0020)
_0
TA
DA
S_
_R
M
PG
E_
A
US
EF
31 0
0x000000 Reset
IN
EFUSE_PGM_RS_DATA_0 The content of the 0th 32-bit RS code to be programmed. (R/W)
IM
_1
TA
DA
S_
_R
M
G
EL
_P
SE
U
EF
31 0
0x000000 Reset
EFUSE_PGM_RS_DATA_1 The content of the first 32-bit RS code to be programmed. (R/W)

PR

4 eFuse Controller
2
A_
AT
_D
S
_R
M
PG
E_
US
EF
31 0
0x000000 Reset
EFUSE_PGM_RS_DATA_2 The content of the second 32-bit RS code to be programmed. (R/W)
RY
Register 4.12. EFUSE_RD_WR_DIS_REG (0x002C)
S
DI
R_
W
E_
US
EF
A
31 0
0x000000
IN Reset
EFUSE_WR_DIS Disable programming of individual eFuses. (RO)

IM
EL
PR

4 eFuse Controller
Register 4.13. EFUSE_RD_REPEAT_DATA0_REG (0x0030)
T
YP
CR
EN
L_
AC E
HE
UA
IC H
E_ S_I AC OA DC D
RP CA HE D_ AC
US DI DC L D_ OA
AN
EF SE_ IS_ WN OA NL
AG _M
D3
S
G LE
U D DO L W
IN
JT D
AG
CH AB
VE
EF SE_ IS_ WN DO
D_ OA
_P
EF SE_ IS_ RC G
EF E_ S_ AI U
ER
JT
EX EN
U D FO OT
U D DO E_
US DI W P
PA NL
_R E
EF E_ S_ P_C
_
T4 CH
ES
B_ Y_
EF SE_ IS_ B_
IS
S_ W
_D
US PH
DI O
IS
U D US
US DI AP
E_ S_D
_D
FT
E_ T_
EF E_ S_
SO
RD
US EX
US DI
US DI
d)
)
ed
EF SE_
EF E_
E_
EF E_
E_
ve
rv
US
US
US
US
er
se
U
s
EF
EF
EF
EF
EF
(re
(re
31 27 26 25 24 21 20 19 18 16 15 14 13 12 11 10 9 8 7 6 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 0 0 0 0 0 0 0 0 0 0x0 Reset
RY
EFUSE_RD_DIS This bit be set to disable users reading from BlOCK4 ~ 10. (RO)
EFUSE_RPT4_RESERVED3 Reserved (used four backups method). (RO)
EFUSE_DIS_ICACHE This bit be set to disable Icache. (RO)
A
EFUSE_DIS_DCACHE This bit be set to disable Dcache. (RO)
EFUSE_DIS_DOWNLOAD_ICACHE This bit be set to disable Icache in download mode

IN
(boot_mode[3:0] is 0, 1, 2, 3, 6, 7). (RO)
EFUSE_DIS_DOWNLOAD_DCACHE This bit be set to disable Dcache in download mode (

boot_mode[3:0] is 0, 1, 2, 3, 6, 7). (RO)
EFUSE_DIS_FORCE_DOWNLOAD This bit be set to disable the function that forces chip into down-
IM
load mode. (RO)
EFUSE_DIS_USB_OTG This bit be set to disable USB OTG function. (RO)
EFUSE_DIS_TWAI This bit be set to disable TWAI function. (RO)

EL
EFUSE_DIS_APP_CPU This bit be set to disable app cpu. (RO)
EFUSE_SOFT_DIS_JTAG These bits be set (odd number of bits set to 1 means disable) to disable
JTAG with soft-disable method so that users can re-enable JTAG by HMAC module again. (RO)
EFUSE_DIS_PAD_JTAG This bit be set to disable JTAG permanently. (RO)

PR
EFUSE_DIS_DOWNLOAD_MANUAL_ENCRYPT This bit be set to disable flash encryption when in

download boot modes. (RO)
EFUSE_USB_EXCHG_PINS This bit be set to swap USB D+ and D- pins. (RO)
EFUSE_EXT_PHY_ENABLE This bit be set to enable external PHY. (RO)

4 eFuse Controller
Y_ VO E2
VO E1
0
KE
KE RE K
RE K
T_ _ O
O EY V
O _K RE
T
CN
_B OT EY_
T_
RE BO _K
_1
_0
EL
YP
SP TIE E
D_ I_ RC
CU E_ OT
SE
SE
_S
CR
I_ H
D
SE R O
VD SP O
O
XP
AY
T_
E_ CU _B
E_ D_ I_F
P
RP
EL
UR
O
E
US VD SP
PU
_D
US SE R
_P
B
EF SE_ ECU
EF SE_ D_
Y_
DT
I_
EY
U VD
SP
KE
)
K
U S
ed
ed
E_
E_
EF E_
E_
E_
EF SE_
rv
rv
US
US
US
US
US
se
se
U
EF
EF
EF
EF
EF
EF
(re
(re
31 28 27 24 23 22 21 20 18 17 16 15 7 6 5 4 3 0
0x0 0x0 0 0 0 0x0 0x0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
EFUSE_VDD_SPI_XPD This bit be set to means SPI regulator power up. (RO)
EFUSE_VDD_SPI_TIEH SPI regulator output is short connected to VDD3P3_RTC_IO. (RO)
EFUSE_VDD_SPI_FORCE This bit be set to force using the parameters in eFuse to configure
VDD_SPI. (RO)
A
EFUSE_WDT_DELAY_SEL Selects RTC watchdog timeout threshold, in unit of slow clock cycle. 00:
40000, 01: 80000, 10: 160000, 11:320000. (RO) IN
EFUSE_SPI_BOOT_CRYPT_CNT This bit be set to enable SPI boot encrypt/decrypt. Odd number
of 1: enable. even number of 1: disable. (RO)
EFUSE_SECURE_BOOT_KEY_REVOKE0 This bit be set to revoke first secure boot key. (RO)
EFUSE_SECURE_BOOT_KEY_REVOKE1 This bit be set to revoke second secure boot key. (RO)
IM
EFUSE_SECURE_BOOT_KEY_REVOKE2 This bit be set to revoke third secure boot key. (RO)
EFUSE_KEY_PURPOSE_0 Purpose of Key0. (RO)

EL
PR

4 eFuse Controller
KE
VO
RE
E_
IV
SS
E
NS
EN RE
AG
SE
T_ G
CU E_ G JT
O G
_D
D0
SE R JTA L_
US SE US SE EL
O A
_5
_4
_3
_2
_
US ST PH TCH
E_ CU B_ RIA
VE
EF E_ S_ B_ _S
_B OT
SE
SE
SE
SE
EF SE_ IS_ _JT EL
W
ER
US DI US AG
RE BO
O
U D P S
LI
PU
RP
RP
RP
RP
EF E_ RA Y_
ES
_G
_T
PU
PU
PU
PU
_R
ER
SH
EF E_ B_
T4
Y_
Y_
Y_
Y_
W
A
PO
US US
RP
KE
KE
KE
KE
FL
E_
E_
EF SE_
E_
E_
E_
E_
E_
US
US
US
US
US
US
US
U
EF
EF
EF
EF
EF
EF
EF
EF
31 28 27 26 25 24 23 22 21 20 19 16 15 12 11 8 7 4 3 0
RY
0x0 0x0 0 0 0 0 0 0 0x0 0x0 0x0 0x0 0x0 Reset
A
EFUSE_RPT4_RESERVED0 Reserved (used four backups method). (RO)
EFUSE_SECURE_BOOT_EN This bit be set to enable secure boot. (RO)

IN
EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE This bit be set to enable aggressive revoke of
secure boot keys. (RO)
IM
EFUSE_DIS_USB_JTAG This bit be set to disable USB OTG function that can be switched to JTAG
interface. (RO)
EFUSE_DIS_USB_SERIAL_JTAG This bit be set to disable usb_serial_jtag function. (RO)
EFUSE_STRAP_JTAG_SEL This bit be set to enable selection between usb_to_jtag and pad_to_jtag
EL
through strapping GPIO3 when both reg_dis_usb_jtag and reg_dis_pad_jtag are equal to 0. (RO)
EFUSE_USB_PHY_SEL This bit is used to switch internal PHY and external PHY for USB OTG and
USB Serial/JTAG. 0: internal PHY is assigned to USB Serial/JTAG while external PHY is assigned
to USB OTG. 1: internal PHY is assigned to USB OTG while external PHY is assigned to USB
PR
Serial/JTAG. (RO)
EFUSE_POWER_GLITCH_DSENSE Sample delay configuration of power glitch. (RO)
EFUSE_FLASH_TPUW Configures flash waiting time after power-up, in unit of ms. If the value is
less than 15, the waiting time is the configurable value. Otherwise, the waiting time is twice the
configurable value. (RO)

4 eFuse Controller
Register 4.16. EFUSE_RD_REPEAT_DATA3_REG (0x003C)
O D
S_ GA _C E M OA
DE
DI E NT D D_ L
E_ S_L RI MO OA WN
CO ION
_M OT
DE
L
O I_B L
E
US DI _P C_ L O
RO
NL P NE
M
AD O
O
CT
H_ _EN SU
EF E_ RT EC WN Y_
W Y_S AN
NT
EN
E
N
TC E
LE
US UA H_ DO IT
C RE
IZ
LI BL
DO C H
H_
EF SE_ AS B_ UR
EF SE_ T_P _SE
_S
SI
FL _EC D_
G A
_
ER
U FL US EC
ER EN
EF E_ AB NT
H EN
R
G
PO P
_V
EF _UA WE
EF SE_ IS_ E_S

W T_
PA
US N_ TY
RI
AS _S
RE
PO RS
PI H_
EF _FL CE
U D L
CU
E_ R_
AS
E_ AS
R
E R
US EN
US FO
US ER
SE
US FL
EF SE_
E_
EF SE_
E_
EF SE_
E
US
US
U
U
EF
EF
EF
EF
EF
31 30 29 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0x00 0 0 0x0 0 0 0x0 0 0 0 0 0 0 Reset
RY
EFUSE_DIS_DOWNLOAD_MODE This bit be set to disable download mode (boot_mode[3:0] = 0,
1, 2, 3, 6, 7). (RO)
EFUSE_DIS_LEGACY_SPI_BOOT This bit be set to disable Legacy SPI boot mode (boot_mode[3:0]
= 4). (RO)
A
EFUSE_UART_PRINT_CHANNEL This bit be set to select the default UART print channel. 0: UART0.
1: UART1. (RO)
EFUSE_FLASH_ECC_MODE This bit be set to enable ECC mode in ROM, 0: Enable Flash ECC
IN
16-to-18 byte mode in ROM. 1: Use 16-to-17 byte mode in ROM. (RO)
EFUSE_DIS_USB_DOWNLOAD_MODE This bit be set to disable UART download mode through

USB. (RO)
IM
EFUSE_ENABLE_SECURITY_DOWNLOAD This bit be set to enable secure UART download mode.
(RO)
EFUSE_UART_PRINT_CONTROL This bit be set for the default UART boot message output mode.
00: Enabled. 01: Enabled when GPIO46 is low at reset. 10: Enabled when GPIO46 is high at
EL
reset. 11:disabled. (RO)
EFUSE_PIN_POWER_SELECTION GPIO33 ~ GPIO37 power supply selection while ROM code is

executed. 0: VDD3P3_CPU. 1: VDD_SPI. (RO)
EFUSE_FLASH_TYPE Set the maximum data lines of SPI flash. 0: four lines. 1: eight lines. (RO)
PR
EFUSE_FLASH_PAGE_SIZE Set Flash page size, 0: 256 Byte; 1: 512 Byte; 2: 1 KB; 3: 2 KB. (RO)
EFUSE_FLASH_ECC_EN This bit be set to enable ECC for flash boot. (RO)
EFUSE_FORCE_SEND_RESUME This bit be set to force ROM code to send a resume command
during SPI boot. (RO)
EFUSE_SECURE_VERSION Secure version (used by ESP-IDF anti-rollback feature). (RO)
EFUSE_POWERGLITCH_EN This bit be set to enable power glitch function. (RO)
EFUSE_ERR_RST_ENABLE 1: use BLOCK0 to check error record registers; 0: disable such

check.(RO)

4 eFuse Controller
D2
VE
ER
ES
_R
T4
RP
)
ed
E_
rv
US
se
EF
(re
31 24 23 0
0 0 0 0 0 0 0 0 0x0000 Reset
EFUSE_RPT4_RESERVED2 Reserved (used for four backups method). (RO)
RY
Register 4.18. EFUSE_RD_MAC_SPI_SYS_0_REG (0x0044)
_0
AC
M
E_
US
EF
A
31 0
0x000000
IN Reset
EFUSE_MAC_0 Stores the low 32 bits of MAC address. (RO)

IM O
NF
_0
_C
D
_1
PA
AC
I_
SP
M
E_
E_
EL US
US
EF
EF
31 16 15 0
0x00 0x00 Reset
EFUSE_MAC_1 Stores the high 16 bits of MAC address. (RO)

PR
EFUSE_SPI_PAD_CONF_0 Stores the first part of SPI_PAD_CONF. (RO)

4 eFuse Controller
Register 4.20. EFUSE_RD_MAC_SPI_SYS_2_REG (0x004C)
_1
NF
O
_C
AD
_P
PI
E _S
US
EF
31 0
0x000000 Reset
EFUSE_SPI_PAD_CONF_1 Stores the second part of SPI_PAD_CONF. (RO)
RY
_0
T0
_2
N
O
AR
NF
N
SI
O
_P
O
ER
SI
_C
TA
_V
ER
D
DA
ER
PA
_V
A
S_
AF
G
I_
PK
SP
SY
W
E_
E_
E_
E_
US
US
US
US
EF
EF
EF
EF
31 24 23 21 20 18 17 0
0x0 0x0 0x0

IN 0x000 Reset
EFUSE_SPI_PAD_CONF_2 Stores the second part of SPI_PAD_CONF. (RO)
EFUSE_WAFER_VERSION Stores wafer version information. (RO)

IM
EFUSE_PKG_VERSION Stores package version information. (RO)
EFUSE_SYS_DATA_PART0_0 Stores the bits 0~7 of the first part of system data. (RO)
EL

_1
R T0
PA
_
TA
PR
DA
S_
SY
E_
US
EF
31 0
0x000000 Reset

4 eFuse Controller
_2
T0
AR
_P
TA
DA
S_
SY
E_
US
EF
31 0
0x000000 Reset
RY
Register 4.24. EFUSE_RD_SYS_PART1_DATA0_REG (0x005C)
0
D_
_I
UE
IQ
UN
A
L_
NA
IO
PT
O
E_
US
IN
EF
31 0
0x000000 Reset
EFUSE_OPTIONAL_UNIQUE_ID_0 Stores the bits 0~31 of the optional unique id information. (RO)
IM
Register 4.25. EFUSE_RD_SYS_PART1_DATA1_REG (0x0060)

1
EL
D_
_I
UE
Q
NI
U
L_
NA
IO
PT
O
E_
US
EF
PR
31 0
0x000000 Reset

4 eFuse Controller
2
D_
_I
UE
Q
NI
_U
L
NA
IO
PT
O
E_
US
EF
31 0
0x000000 Reset
RY
3
D_
_I
UE
A
Q
UNI
L_
NA
IO
PT
O
IN E_
US
EF
31 0
0x000000 Reset
IM
EFUSE_OPTIONAL_UNIQUE_ID_3 Stores the bits 96~127 of the optional unique id information.
(RO)

EL
_0
R T1
_ PA
TA
DA
S_
SY
E_
PR
US
EF
31 0
0x000000 Reset
EFUSE_SYS_DATA_PART1_0 Stores the first 32 bits of the second part of system data. (RO)

4 eFuse Controller
_1
T1
AR
_P
TA
DA
S_
SY
E_
US
EF
31 0
0x000000 Reset
EFUSE_SYS_DATA_PART1_1 Stores the second 32 bits of the seconde part of system data. (RO)
RY
_2
RT1
PA
A_
AT
A
D
S_
SY
E_
US
EF
31
IN
0x000000
0
Reset
EFUSE_SYS_DATA_PART1_2 Stores the third 32 bits of the second part of system data. (RO)
IM
_3
RT1
EL
PA
_
TA
DA
S_
SY
E_
US
EF
31 0
PR
0x000000 Reset
EFUSE_SYS_DATA_PART1_3 Stores the fourth 32 bits of the second part of system data. (RO)

4 eFuse Controller
Register 4.32. EFUSE_RD_USR_DATA0_REG (0x007C)
0
TA
DA
R_
US
E_
US
EF
31 0
0x000000 Reset
EFUSE_USR_DATA0 Stores the bits [0:31] of BLOCK3 (user). (RO)
RY
Register 4.33. EFUSE_RD_USR_DATA1_REG (0x0080)
1
TA
DA
R_
US
E_
US
EF
A
31 0
0x000000 Reset
IN

IM
2
TA
DA
R_
US
E_
US
EF
EL
31 0
0x000000 Reset

PR

3
TA
DA
R_
US
E_
US
EF
31 0
0x000000 Reset

4 eFuse Controller
Register 4.36. EFUSE_RD_USR_DATA4_REG (0x008C)
4
TA
DA
R_
US
E_
US
EF
31 0
0x000000 Reset
RY
5
TA
DA
R_
US
E_
US
EF
A
31 0
0x000000 Reset
IN

IM
6
TA
DA
R_
US
E_
US
EF
EL
31 0
0x000000 Reset

PR

7
TA
DA
R_
US
E_
US
EF
31 0
0x000000 Reset

4 eFuse Controller
Register 4.40. EFUSE_RD_KEY0_DATA0_REG (0x009C)
A0
AT
_D
Y0
KE
E_
US
EF
31 0
0x000000 Reset
EFUSE_KEY0_DATA0 Stores the first 32 bits of KEY0. (RO)
RY
Register 4.41. EFUSE_RD_KEY0_DATA1_REG (0x00A0)
A1
AT
_D
Y0
KE
E_
US
EF
A
31 0
0x000000
IN Reset
EFUSE_KEY0_DATA1 Stores the second 32 bits of KEY0. (RO)

IM
A2
AT
_D
Y0
KE
E_
US
EF
EL
31 0
0x000000 Reset
EFUSE_KEY0_DATA2 Stores the third 32 bits of KEY0. (RO)

PR

A3
AT
_D
Y0
KE
E_
US
EF
31 0
0x000000 Reset
EFUSE_KEY0_DATA3 Stores the fourth 32 bits of KEY0. (RO)

4 eFuse Controller
Register 4.44. EFUSE_RD_KEY0_DATA4_REG (0x00AC)
A4
AT
_D
Y0
KE
E_
US
EF
31 0
0x000000 Reset
EFUSE_KEY0_DATA4 Stores the fifth 32 bits of KEY0. (RO)
RY
Register 4.45. EFUSE_RD_KEY0_DATA5_REG (0x00B0)
A5
AT
_D
Y0
KE
E_
US
EF
A
31 0
0x000000
IN Reset
EFUSE_KEY0_DATA5 Stores the sixth 32 bits of KEY0. (RO)

IM
A6
AT
_D
Y0
KE
E_
US
EF
EL
31 0
0x000000 Reset
EFUSE_KEY0_DATA6 Stores the seventh 32 bits of KEY0. (RO)

PR

A7
AT
_D
Y0
KE
E_
US
EF
31 0
0x000000 Reset
EFUSE_KEY0_DATA7 Stores the eighth 32 bits of KEY0. (RO)

4 eFuse Controller
Register 4.48. EFUSE_RD_KEY1_DATA0_REG (0x00BC)
A0
AT
_D
Y1
KE
E_
US
EF
31 0
0x000000 Reset
RY
Register 4.49. EFUSE_RD_KEY1_DATA1_REG (0x00C0)
A1
AT
_D
Y1
KE
E_
US
EF
A
31 0
0x000000
IN Reset

IM
A2
AT
_D
Y1
KE
E_
US
EF
EL
31 0
0x000000 Reset

PR

A3
AT
_D
Y1
KE
E_
US
EF
31 0
0x000000 Reset

4 eFuse Controller
Register 4.52. EFUSE_RD_KEY1_DATA4_REG (0x00CC)
A4
AT
_D
Y1
KE
E_
US
EF
31 0
0x000000 Reset
RY
Register 4.53. EFUSE_RD_KEY1_DATA5_REG (0x00D0)
A5
AT
_D
Y1
KE
E_
US
EF
A
31 0
0x000000
IN Reset

IM
A6
AT
_D
Y1
KE
E_
US
EF
EL
31 0
0x000000 Reset

PR

A7
AT
_D
Y1
KE
E_
US
EF
31 0
0x000000 Reset

4 eFuse Controller
Register 4.56. EFUSE_RD_KEY2_DATA0_REG (0x00DC)
A0
AT
_D
Y2
KE
E_
US
EF
31 0
0x000000 Reset
RY
Register 4.57. EFUSE_RD_KEY2_DATA1_REG (0x00E0)
A1
AT
_D
Y2
KE
E_
US
EF
A
31 0
0x000000
IN Reset

IM
A2
AT
_D
Y2
KE
E_
US
EF
EL
31 0
0x000000 Reset

PR

A3
AT
_D
Y2
KE
E_
US
EF
31 0
0x000000 Reset

4 eFuse Controller
Register 4.60. EFUSE_RD_KEY2_DATA4_REG (0x00EC)
A4
AT
_D
Y2
KE
E_
US
EF
31 0
0x000000 Reset
RY
Register 4.61. EFUSE_RD_KEY2_DATA5_REG (0x00F0)
A5
AT
_D
Y2
KE
E_
US
EF
A
31 0
0x000000
IN Reset

IM
A6
AT
_D
Y2
KE
E_
US
EF
EL
31 0
0x000000 Reset

PR

A7
AT
_D
Y2
KE
E_
US
EF
31 0
0x000000 Reset

4 eFuse Controller
Register 4.64. EFUSE_RD_KEY3_DATA0_REG (0x00FC)
A0
AT
_D
Y3
KE
E_
US
EF
31 0
0x000000 Reset
RY
Register 4.65. EFUSE_RD_KEY3_DATA1_REG (0x0100)
A1
AT
_D
Y3
KE
E_
US
EF
A
31 0
0x000000
IN Reset

IM
A2
AT
_D
Y3
KE
E_
US
EF
EL
31 0
0x000000 Reset

PR

A3
AT
_D
Y3
KE
E_
US
EF
31 0
0x000000 Reset

4 eFuse Controller
A4
AT
_D
Y3
KE
E_
US
EF
31 0
0x000000 Reset
RY
A5
AT
_D
Y3
KE
E_
US
EF
A
31 0
0x000000
IN Reset

IM
A6
AT
_D
Y3
KE
E_
US
EF
EL
31 0
0x000000 Reset

PR

A7
AT
_D
Y3
KE
E_
US
EF
31 0
0x000000 Reset

4 eFuse Controller
A0
AT
_D
Y4
KE
E_
US
EF
31 0
0x000000 Reset
RY
A1
AT
_D
Y4
KE
E_
US
EF
A
31 0
0x000000
IN Reset

IM
A2
AT
_D
Y4
KE
E_
US
EF
EL
31 0
0x000000 Reset

PR

A3
AT
_D
Y4
KE
E_
US
EF
31 0
0x000000 Reset

4 eFuse Controller
A4
AT
_D
Y4
KE
E_
US
EF
31 0
0x000000 Reset
RY
A5
AT
_D
Y4
KE
E_
US
EF
A
31 0
0x000000
IN Reset

IM
A6
AT
_D
Y4
KE
E_
US
EF
EL
31 0
0x000000 Reset

PR

A7
AT
_D
Y4
KE
E_
US
EF
31 0
0x000000 Reset

4 eFuse Controller
A0
AT
_D
Y5
KE
E_
US
EF
31 0
0x000000 Reset
RY
A1
AT
_D
Y5
KE
E_
US
EF
A
31 0
0x000000
IN Reset

IM
A2
AT
_D
Y5
KE
E_
US
EF
EL
31 0
0x000000 Reset

PR

A3
AT
_D
Y5
KE
E_
US
EF
31 0
0x000000 Reset

4 eFuse Controller
A4
AT
_D
Y5
KE
E_
US
EF
31 0
0x000000 Reset
RY
A5
AT
_D
Y5
KE
E_
US
EF
A
31 0
0x000000
IN Reset

IM
A6
AT
_D
Y5
KE
E_
US
EF
EL
31 0
0x000000 Reset

PR

A7
AT
_D
Y5
KE
E_
US
EF
31 0
0x000000 Reset

4 eFuse Controller
_0
T2
AR
_P
TA
DA
S_
SY
E_
US
EF
31 0
0x000000 Reset
EFUSE_SYS_DATA_PART2_0 Stores the first 32 bits of the third part of system data. (RO)
RY
_1
RT2
PA
A_
AT
A
D
S_
SY
E_
US
EF
31
IN
0x000000
0
Reset
EFUSE_SYS_DATA_PART2_1 Stores the second 32 bits of the third part of system data. (RO)
IM
_2
RT2
EL
PA
_
TA
DA
S_
SY
E_
US
EF
31 0
PR
0x000000 Reset
EFUSE_SYS_DATA_PART2_2 Stores the third 32 bits of the third part of system data. (RO)

4 eFuse Controller
_3
T2
AR
_P
TA
DA
S_
SY
E_
US
EF
31 0
0x000000 Reset
EFUSE_SYS_DATA_PART2_3 Stores the fourth 32 bits of the third part of system data. (RO)
RY
_4
RT2
PA
A_
AT
A
D
S_
SY
E_
US
EF
31
IN
0x000000
0
Reset
EFUSE_SYS_DATA_PART2_4 Stores the fifth 32 bits of the third part of system data. (RO)
IM
_5
RT2
EL
PA
_
TA
DA
S_
SY
E_
US
EF
31 0
PR
0x000000 Reset
EFUSE_SYS_DATA_PART2_5 Stores the sixth 32 bits of the third part of system data. (RO)

4 eFuse Controller
_6
T2
AR
_P
TA
DA
S_
SY
E_
US
EF
31 0
0x000000 Reset
EFUSE_SYS_DATA_PART2_6 Stores the seventh 32 bits of the third part of system data. (RO)
RY
_7
T2
R
PA
A_
AT
A
D
S_
SY
E_
US
EF
31
IN
0x000000
0
Reset
EFUSE_SYS_DATA_PART2_7 Stores the eighth 32 bits of the third part of system data. (RO)
IM
EL
PR

4 eFuse Controller
Register 4.96. EFUSE_RD_REPEAT_ERR0_REG (0x017C)
RR
_E
PT
RY
NC
_E R
RR
C_ _E R HE ER
S_ C _ IC H R
_E
DI CA HE D_ AC ER
RT HE ER AC E_
R
AL
E_ S_I AC OA DC D_
ER
RR U
R
S_ R
US DI DC L D_ OA
_E AN
T_
ER
IN R
RR
_P _E
EF SE_ IS_ WN OA NL
O
AG _M
EF SE_ IS_ WN DO R
EF E_ S_ B_ R R
O
_E
G LE
U D DO E_ ER
US DI US ER ER
U D DO L W
RA RR
_B
JT D
AG
CH AB
EF SE_ IS_ RC G_
D_ OA
EF E_ _ I_ _
M
U
JT
EX EN
U D FO OT
RR
US DI TW P
PA NL
EF E_ S_ P_C
_
B_ Y_
IS
_E
S_ W
A
_D
US PH
DI O
IS
US DI AP
E_ S_D
_D
FT
E_ T_
EF E_ _ S
S
SO
RD
US EX
US DI
US DI
d)
)
ed
EF SE_
EF E_
E_
EF E_
E_
ve
rv
US
US
US
US
er
se
U
s
EF
EF
EF
EF
EF
(re
(re
31 27 26 25 24 21 20 19 18 16 15 14 13 12 11 10 9 8 7 6 0
RY
0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 0 0 0 0 0 0 0 0 0 0x0 Reset
EFUSE_RD_DIS_ERR Any bits in this field set to 1 indicate a programming error to corresponding
eFuse bit. (RO)
EFUSE_DIS_RTC_RAM_BOOT_ERR Any bits in this field set to 1 indicate a programming error to
A
corresponding eFuse bit. (RO)
EFUSE_DIS_ICACHE_ERR Any bits in this field set to 1 indicate a programming error to correspond-
ing eFuse bit. (RO)
IN
EFUSE_DIS_DCACHE_ERR Any bits in this field set to 1 indicate a programming error to correspond-
ing eFuse bit. (RO)
EFUSE_DIS_DOWNLOAD_ICACHE_ERR Any bits in this field set to 1 indicate a programming error

IM
to corresponding eFuse bit. (RO)
EFUSE_DIS_DOWNLOAD_DCACHE_ERR Any bits in this field set to 1 indicate a programming error

EFUSE_DIS_FORCE_DOWNLOAD_ERR Any bits in this field set to 1 indicate a programming error

EL
EFUSE_DIS_USB_OTG_ERR Any bits in this field set to 1 indicate a programming error to corre-
sponding eFuse bit. (RO)
EFUSE_DIS_TWAI_ERR Any bits in this field set to 1 indicate a programming error to corresponding
PR
eFuse bit. (RO)
EFUSE_DIS_APP_CPU_ERR Any bits in this field set to 1 indicate a programming error to corre-
EFUSE_SOFT_DIS_JTAG_ERR Any bits in this field set to 1 indicate a programming error to corre-
EFUSE_DIS_PAD_JTAG_ERR Any bits in this field set to 1 indicate a programming error to corre-
Continued on the next page...

4 eFuse Controller
Register 4.96. EFUSE_RD_REPEAT_ERR0_REG (0x017C)
Continued from the previous page...
EFUSE_DIS_DOWNLOAD_MANUAL_ENCRYPT_ERR Any bits in this field set to 1 indicate a pro-

gramming error to corresponding eFuse bit. (RO)
EFUSE_USB_EXCHG_PINS_ERR Any bits in this field set to 1 indicate a programming error to cor-
responding eFuse bit. (RO)
EFUSE_EXT_PHY_ENABLE_ERR Any bits in this field set to 1 indicate a programming error to cor-
A RY
IN
IM
EL
PR

4 eFuse Controller
Register 4.97. EFUSE_RD_REPEAT_ERR1_REG (0x0180)
VO E1_ R
0_ R
R
RE K ER
KE ER
ER
Y_ VO E2_
RR
KE RE K
T_ _ O
E
O EY V
T_
O _K RE
RR
RR
RR
CN
XP E R
_B OT EY_
I_ H_ ER
_E
_E
_E
D_ RR
T_
R
RE BO _K
SP TIE E_
ER
_1
_0
EL
YP
D_ I_ RC
CU E_ OT
SE
SE
_S
CR
SE R O
VD SP O
PO
PO
AY
T_
E_ CU _B
E_ D_ I_F
EL
UR
UR
O
E
US VD SP
O
_D
US SE R
_P
_P
B
EF E_ CU
EF SE_ D_
DT
I_
EY
EY
U VD
SP
US SE
)
_K
_K
ed
ed
EF E_
E_
E_
EF SE_
E
SE
rv
rv
US
US
US
US
se
se
U
U
EF
EF
EF
EF
EF
EF
(re
(re
31 28 27 24 23 22 21 20 18 17 16 15 7 6 5 4 3 0
0x0 0x0 0 0 0 0x0 0x0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
EFUSE_VDD_SPI_XPD_ERR Any bits in this field set to 1 indicate a programming error to corre-
EFUSE_VDD_SPI_TIEH_ERR Any bits in this field set to 1 indicate a programming error to corre-
A
EFUSE_VDD_SPI_FORCE_ERR Any bits in this field set to 1 indicate a programming error to corre-
sponding eFuse bit. (RO) IN
EFUSE_WDT_DELAY_SEL_ERR Any bits in this field set to 1 indicate a programming error to corre-
EFUSE_SPI_BOOT_CRYPT_CNT_ERR Any bits in this field set to 1 indicate a programming error to

IM
EFUSE_SECURE_BOOT_KEY_REVOKE0_ERR Any bits in this field set to 1 indicate a programming
error to corresponding eFuse bit. (RO)

EL

EFUSE_KEY_PURPOSE_0_ERR Any bits in this field set to 1 indicate a programming error to corre-
PR

4 eFuse Controller
RR
_E
KE
O
EV
_R
R
RR IVE
ER
R
_B OT R _ER
E_
_E SS
NS
EN E
R
SE R JTA L_ R
RE BO _ER AG
RR
RR
RR
RR
R
ER
E_ CU B_ RIA _ER
SE
T_ G
CU E_ G JT
EF E_ S_ B_ _S R
_E
_E
_E
_E
_
O G
RR
_D
D0
US DI US AG ER
US SE US SE EL
O _A
_5
_4
_3
_2
US ST PH TCH
_E
VE
EF SE_ IS_ _JT EL_
SE
SE
SE
SE
W
ER
O
U D P S
LI
PU
RP
RP
RP
RP
EF E_ RA Y_
ES
_G
_T
PU
PU
PU
PU
_R
ER
SH
EF SE_ SB_
T4
Y_
Y_
Y_
Y_
W
LA
EF _PO
RP
KE
KE
KE
KE
U U
_F
EF E_
E_
E_
E_
E_
E_
E
SE
US
US
US
US
US
US
US
U
EF
EF
EF
EF
EF
EF
EF
RY
31 28 27 26 25 24 23 22 21 20 19 16 15 12 11 8 7 4 3 0
0x0 0x0 0 0 0 0x0 0 0 0x0 0x0 0x0 0x0 0x0 Reset
A
IN
IM
EFUSE_RPT4_RESERVED0_ERR Any bits in this field set to 1 indicate a programming error to cor-
EFUSE_SECURE_BOOT_EN_ERR Any bits in this field set to 1 indicate a programming error to

EL
EFUSE_SECURE_BOOT_AGGRESSIVE_REVOKE_ERR Any bits in this field set to 1 indicate a pro-

gramming error to corresponding eFuse bit. (RO)
EFUSE_DIS_USB_JTAG_ERR Any bits in this field set to 1 indicate a programming error to corre-
PR
EFUSE_DIS_USB_SERIAL_JTAG_ERR Any bits in this field set to 1 indicate a programming error to

EFUSE_STRAP_JTAG_SEL_ERR Any bits in this field set to 1 indicate a programming error to cor-
EFUSE_USB_PHY_SEL_ERR Any bits in this field set to 1 indicate a programming error to corre-
EFUSE_POWER_GLITCH_DSENSE_ERR Any bits in this field set to 1 indicate a programming error

EFUSE_FLASH_TPUW_ERR Any bits in this field set to 1 indicate a programming error to corre-

4 eFuse Controller
ER R
W Y_S AN R E_ _ER
R
DO C H ER OD D
S_ GA _C E_ M OA
RO RR
DE R
RR
US DI _P C_ L O R
_M OT RR
RR
DI E NT D D_ L
O _ER
ER
_E
E_ S_L RI MO OA WN
_E
AD O E
R _E
L_
O I_B L_
CO ION
RR
R_ RR R
RR
EN RR
_E ME
NL P NE
ER
D
_E
_S R
CT
E
H_ _E
H_ _EN SU
EF SE_ ART EC WN Y_
_
NT
N_
E
TC D1
LE
U U H_ DO IT
C RE
IZ
IO
EF SE_ AS B_ UR
SE
G VE
EF _UA WE _E
RS
FL _EC D_
_
U FL US EC
ER ER
O E
EF SE_ AB INT
H EN
VE
P
LI
EF SE_ IS_ E_S

W ES
PA
_P Y
E_
AS _S
U EN PR
T
PO _R
PI H_
UR
EF _FL CE
U D L
_
RT
E_ T4
AS
E_ AS
E R
EC
N
US RP
US FO
US FL
_S
EF SE_
EF SE_
E_
EF SE_
EF E_
E
E
US
US
US
US
U
U
EF
EF
EF
EF
EF
31 30 29 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
RY
0 0 0x00 0 0 0x0 0 0 0x0 0 0 0 0 0 0 Reset
EFUSE_DIS_DOWNLOAD_MODE_ERR Any bits in this field set to 1 indicate a programming error

EFUSE_DIS_LEGACY_SPI_BOOT_ERR Any bits in this field set to 1 indicate a programming error

A
EFUSE_UART_PRINT_CHANNEL_ERR Any bits in this field set to 1 indicate a programming error
IN
EFUSE_FLASH_ECC_MODE_ERR Any bits in this field set to 1 indicate a programming error to
EFUSE_DIS_USB_DOWNLOAD_MODE_ERR Any bits in this field set to 1 indicate a programming

IM
EFUSE_ENABLE_SECURITY_DOWNLOAD_ERR Any bits in this field set to 1 indicate a program-

ming error to corresponding eFuse bit. (RO)
EFUSE_UART_PRINT_CONTROL_ERR Any bits in this field set to 1 indicate a programming error

EL
EFUSE_PIN_POWER_SELECTION_ERR Any bits in this field set to 1 indicate a programming error

EFUSE_FLASH_TYPE_ERR Any bits in this field set to 1 indicate a programming error to correspond-
PR
ing eFuse bit. (RO)
EFUSE_FLASH_PAGE_SIZE_ERR Any bits in this field set to 1 indicate a programming error to cor-
EFUSE_FLASH_ECC_EN_ERR Any bits in this field set to 1 indicate a programming error to corre-
EFUSE_FORCE_SEND_RESUME_ERR Any bits in this field set to 1 indicate a programming error to


4 eFuse Controller
EFUSE_SECURE_VERSION_ERR Any bits in this field set to 1 indicate a programming error to cor-
EFUSE_POWERGLITCH_EN_ERR Any bits in this field set to 1 indicate a programming error to

EFUSE_RPT4_RESERVED1_ERR Reserved. (RO)
RY
RR
_E
D2
VE
ER
ES
A RP
T4
_R
d)
E_
e
rv
US
se
EF
(re
31
0 0 0 0 0 0 0
24
0
23
IN 0x0000
0
Reset
EFUSE_RPT4_RESERVED2_ERR Any bits in this field set to 1 indicate a programming error to cor-
IM
EL
PR

4 eFuse Controller
Register 4.101. EFUSE_RD_RS_ERR0_REG (0x01C0)
UM
UM
_N
L
_N
AI
RR
UM
_F
UM
UM
UM
RR
L
_E
L
U
NU
AI
M
AI
_N
_N
_N
_N
_N
M
_E
_F
_8
_F
T1
R_
_8
TA
TA
RR
RR
RR
RR
L
IL
T1
PI
AI
AI
AI
R
ER
PI
FA
_S
DA
DA
AR
PA
_E
_E
_E
_F
_F
_F
_S
2_
0_
1_
AC
R_
R_
Y3
Y4
Y2
Y3
Y1
Y0
_P
S_
AC
EY
EY
EY
_M
US
US
YS
KE
KE
KE
KE
KE
KE
SY
M
)
_K
_K
_K
ed
SE
_S
E_
E_
E_
E_
E_
E_
E_
E_
E_
E_
E
rv
US
US
US
US
US
US
US
US
US
US
SE
US
US
US
FU
se
FU
EE
EF
EF
EF
EF
EF
EF
EF
EF
EF
EF
EF
EF
EF
(re
31 30 28 27 26 24 23 22 20 19 18 16 15 14 12 11 10 8 7 6 4 3 2 0
0 0x0 0 0x0 0 0x0 0 0x0 0 0x0 0 0x0 0 0x0 0 0x0 Reset
EFUSE_MAC_SPI_8M_ERR_NUM The value of this field means the number of error bytes during
RY
programming Block1. (RO)
EFUSE_SYS_PART1_NUM The value of this field means the number of error bytes during program-
ming Block2. (RO)
EFUSE_MAC_SPI_8M_FAIL 0: Means no failure and that the data of MAC_SPI_8M is reliable 1:

Means that programming data of MAC_SPI_8M failed and the number of error bytes is over 6.
A
(RO)
EFUSE_USR_DATA_ERR_NUM The value of this field means the number of error bytes during pro-
gramming Block3. (RO)
IN
EFUSE_SYS_PART1_FAIL 0: Means no failure and that the data of system part1 is reliable 1: Means
that programming data of system part1 failed and the number of error bytes is over 6. (RO)
IM
EFUSE_KEY0_ERR_NUM The value of this field means the number of error bytes during program-
ming Block4. (RO)
EFUSE_USR_DATA_FAIL 0: Means no failure and that the user data is reliable 1: Means that pro-
gramming user data failed and the number of error bytes is over 6. (RO)
EL
ming Block5. (RO)
EFUSE_KEY0_FAIL 0: Means no failure and that the data of key0 is reliable 1: Means that program-
ming key0 failed and the number of error bytes is over 6. (RO)
PR
ming Block6. (RO)
ming Block7. (RO)

4 eFuse Controller
ming Block8. (RO)
RY
UM
_N
RR
UM
A
_E
_N
T2
RR
L
L
AI
AI
R
PA
_E
_F
_F
Y5
Y4
Y5
S_
KE
KE
KE
)
_S
d
E_
E_
E_
ve
SE
IN
US
US
US
er
U
s
EF
EF
EF
EF
(re
31 8 7 6 4 3 2 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 0 0x0 Reset
IM
ming Block9. (RO)
EFUSE_KEY4_FAIL 0: Means no failure and that the data of KEY4 is reliable 1: Means that program-
ming data of KEY4 failed and the number of error bytes is over 6. (RO)
EL
EFUSE_SYS_PART2_ERR_NUM The value of this field means the number of error bytes during pro-
gramming Block10. (RO)
EFUSE_KEY5_FAIL 0: Means no failure and that the data of KEY5 is reliable 1: Means that program-
ming data of KEY5 failed and the number of error bytes is over 6. (RO)
PR

4 eFuse Controller
Register 4.103. EFUSE_CLK_REG (0x01C8)
_F E_O PU
PD
O N
EM C _
E_
M OR CE
RC
E_ _F OR
U S LK _F
EF _C M
E_ EM ME
EN
US M E_
EF SE_ US
K_
CL
U EF
)
)
ed
ed
E_
EF SE_
rv
rv
US
se
se
U
EF
EF
(re
(re
31 17 16 15 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 Reset
EFUSE_EFUSE_MEM_FORCE_PD This bit be set to force eFuse SRAM into power-saving mode.
RY
(R/W)
EFUSE_MEM_CLK_FORCE_ON Set this bit to force on activate clock signal of eFuse SRAM. (R/W)
EFUSE_EFUSE_MEM_FORCE_PU This bit be set to force eFuse SRAM into working mode. (R/W)
EFUSE_CLK_EN Set this bit and force to enable clock signal of eFuse memory. (R/W)
A
Register 4.104. EFUSE_CONF_REG (0x01CC)
IN
DE
CO
P_
O
d)
E_
e
rv
US
se
EF
(re
IM
31 16 15 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x00 Reset
EFUSE_OP_CODE 0x5A5A: Operate programming command 0x5AA5: Operate read command.

(R/W)
EL
Register 4.105. EFUSE_CMD_REG (0x01D4)

D
AD MD
M
M
PR
_C
NU
RE _C
K_
E_ M
US PG
BL
d)
E_
EF SE_
e
rv
US
se
U
EF
EF
(re
31 6 5 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 0 0 Reset
EFUSE_READ_CMD This bit be set to send read command. (R/WS/SC)
EFUSE_PGM_CMD This bit be set to send programming command. (R/WS/SC)
EFUSE_BLK_NUM The index of the block to be programmed. Value 0 ~ 10 corresponds to block

number 0 ~ 10, respectively. (R/W)

4 eFuse Controller
Register 4.106. EFUSE_DAC_CONF_REG (0x01E8)
IV
_D
M
LK
NU
R
_C
CL
C_
AC
E_
A
O
d)
)
_D
_D
ed
E_
ve
E
rv
US
US
US
er
se
s
EF
EF
EF
(re
(re
31 18 17 16 9 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 255 0 28 Reset
EFUSE_DAC_CLK_DIV Controls the division factor of the clock for the programming voltage. (R/W)
EFUSE_DAC_NUM Controls the rising period of the programming voltage. (R/W)
RY
EFUSE_OE_CLR Reduces the power supply of the programming voltage. (R/W)
Register 4.107. EFUSE_RD_TIM_CONF_REG (0x01EC)
A
UM
N
T_
NI
_I
AD
RE
)
ed
IN
E_
rv
US
se
EF
(re
31 24 23 0
0x12 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
IM
EFUSE_READ_INIT_NUM Configures the initial read time of eFuse. (R/W)
Register 4.108. EFUSE_WR_TIME_CONF1_REG (0x01F4)

EL
M
NU
N_
O
R_
W
d)
)
_P
ed
e
SE
rv
rv
se
se
U
EF
(re
(re
31 24 23 8 7 0
PR
0 0 0 0 0 0 0 0 0x2880 0 0 0 0 0 0 0 0 Reset
EFUSE_PWR_ON_NUM Configures the power up time for VDDQ. (R/W)

4 eFuse Controller
Register 4.109. EFUSE_WR_TIM_CONF2_REG (0x01F8)
UM
_N
FF
O
R_
PW
d)
E_
ve
US
er
s
EF
(re
31 16 15 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x190 Reset
EFUSE_PWR_OFF_NUM Configures the power off time for VDDQ. (R/W)
RY
Register 4.110. EFUSE_STATUS_REG (0x01D0)
T
CN
R_
_ ER
AT
E
PE
AT
A
RE
ST
d)
)
ed
E_
E_
ve
rv
US
US
r
se
se
EF
EF
(re
(re
31 18 17 10 9 4 3 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0
IN 0x0 0 0 0 0 0 0 0x0 Reset
EFUSE_STATE Indicates the state of the eFuse state machine. (RO)
EFUSE_REPEAT_ERR_CNT Indicates the number of error bits during programming BLOCK0. (RO)
IM
Register 4.111. EFUSE_INT_RAW_REG (0x01D8)
AW
NT W
EL
_I RA
_R
NE _
O INT
_D E_
AD ON
RE _D
E_ M
US PG
d)
EF SE_
e
rv
se
U
EF
(re
PR
31 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
EFUSE_READ_DONE_INT_RAW The raw bit signal for read_done interrupt. (R/WC/SS)
EFUSE_PGM_DONE_INT_RAW The raw bit signal for pgm_done interrupt. (R/WC/SS)

4 eFuse Controller
Register 4.112. EFUSE_INT_ST_REG (0x01DC)
T
_I ST
_S
NE _
NT
O INT
_D E_
AD ON
RE _D
E_ M
US PG
)
ed
EF SE_
v
er
U
s
EF
(re
31 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
EFUSE_READ_DONE_INT_ST The status signal for read_done interrupt. (RO)
RY
EFUSE_PGM_DONE_INT_ST The status signal for pgm_done interrupt. (RO)
Register 4.113. EFUSE_INT_ENA_REG (0x01E0)
NA
NT A
A
_I EN
_E
NE _
O INT
_D E_
AD ON
RE _D
E_ M
IN
US PG
d)
EF SE_
e
rv
se
U
EF
(re
31 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
IM
EFUSE_READ_DONE_INT_ENA Set this bit to enable read_done interrupt. (R/W)
EFUSE_PGM_DONE_INT_ENA Set this bit to enable pgm_done interrupt. (R/W)

EL
Register 4.114. EFUSE_INT_CLR_REG (0x01E4)
LR
NT R
_I CL
_C
NE _
O INT
_D E_
AD ON
RE _D
PR
E_ M
US PG
)
ed
EF SE_
rv
se
U
EF
(re
31 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
EFUSE_READ_DONE_INT_CLR The clear signal for read_done interrupt. (WO)
EFUSE_PGM_DONE_INT_CLR The clear signal for pgm_done interrupt. (WO)

4 eFuse Controller
Register 4.115. EFUSE_DATE_REG (0x01FC)
TE
DA
)
ed
E_
rv
US
se
EF
(re
31 28 27 0
0 0 0 0 0x2003310 Reset
EFUSE_DATE Stores eFuse version. (R/W)
A RY
IN
IM
EL
PR

5 IO MUX and GPIO Matrix (GPIO, IO MUX)
5.1 Overview
The ESP32-S3 chip features 45 physical GPIO pins. Each pin can be used as a general-purpose I/O, or be
connected to an internal peripheral signal. Through GPIO matrix, IO MUX, and RTC IO MUX, peripheral input
signals can be from any GPIO pin, and peripheral output signals can be routed to any GPIO pin. Together these
modules provide highly configurable I/O.
Note that the 45 GPIO pins are numbered from 0 ~ 21 and 26 ~ 48. All these pins can be configured either
as input or output.
RY
5.2 Features
GPIO Matrix Features
• A full-switching matrix between the peripheral input/output signals and the GPIO pins.
• 175 digital peripheral input signals can be sourced from the input of any GPIO pins.
A
• The output of any GPIO pins can be from any of the 184 digital peripheral output signals.
• Supports signal synchronization for peripheral inputs based on APB clock bus.
• Provides input signal filter.

IN
• Supports sigma delta modulated output.
• Supports GPIO simple input and output.

IM
IO MUX Features
• Provides one configuration register IO_MUX_GPIOn_REG for each GPIO pin. The pin can be configured to
– perform GPIO function routed by GPIO matrix;

EL
– or perform direct connection bypassing GPIO matrix.
• Supports some high-speed digital signals (SPI, JTAG, UART) bypassing GPIO matrix for better
high-frequency digital performance. In this case, IO MUX is used to connect these pins directly to
peripherals.
PR
RTC IO MUX Features
• Controls low power feature of 22 RTC GPIO pins.
• Controls analog functions of 22 RTC GPIO pins.
• Redirects 22 RTC input/output signals to RTC system.
5.3 Architectural Overview

Figure 5-1 shows in details how IO MUX, RTC IO MUX, and GPIO matrix route signals from pins to peripherals,
and from peripherals to pins.

A RY
IN
IM
Figure 51. Architecture of IO MUX, RTC IO MUX, and GPIO Matrix
1. Only part of peripheral input signals (marked “yes” in column “Direct input through IO MUX” in Table 5-2)
EL
can bypass GPIO matrix. The other input signals can only be routed to peripherals via GPIO matrix.
2. There are only 45 inputs from GPIO SYNC to GPIO matrix, since ESP32-S3 provides 45 GPIO pins in total.
3. The pins supplied by VDD3P3_CPU or by VDD3P3_RTC are controlled by the signals: IE, OE, WPU, and
WPD.
PR
4. Only part of peripheral outputs (marked “yes” in column “Direct output through IO MUX” in Table 5-2) can
be routed to pins bypassing GPIO matrix.
5. There are only 45 outputs (GPIO pin X: 0 ~ 21, 26 ~ 48) from GPIO matrix to IO MUX.
Figure 5-2 shows the internal structure of a pad, which is an electrical interface between the chip logic and the
GPIO pin. The structure is applicable to all 45 GPIO pins and can be controlled using IE, OE, WPU, and WPD
signals.

RY
Figure 52. Internal Structure of a Pad
Note:
A
• IE: input enable
IN
• OE: output enable
• WPU: internal weak pull-up

IM
• WPD: internal weak pull-down
• Bonding pad: a terminal point of the chip logic used to make a physical connection from the chip die to GPIO pin
in the chip package.
EL
5.4 Peripheral Input via GPIO Matrix

5.4.1 Overview
To receive a peripheral input signal via GPIO matrix, the matrix is configured to source the peripheral input signal
PR
from one of the 45 GPIOs (0 ~ 21, 26 ~ 48), see Table 5-2. Meanwhile, register corresponding to the peripheral
signal should be set to receive input signal via GPIO matrix.
5.4.2 Signal Synchronization

When signals are directed from pins using the GPIO matrix, the signals will be synchronized to the APB bus clock
by the GPIO SYNC hardware, then go to GPIO matrix. This synchronization applies to all GPIO matrix signals but
does not apply when using the IO MUX, see Figure 5-1.

RY
Figure 53. GPIO Input Synchronized on APB Clock Rising Edge or on Falling Edge
A
Figure 5-3 shows the functionality of GPIO SYNC. In the figure, negative sync and positive sync mean GPIO input
IN
is synchronized on APB clock falling edge and on APB clock rising edge, respectively.
5.4.3 Functional Description

To read GPIO pin X1 into peripheral signal Y, follow the steps below:
IM
1. Configure register GPIO_FUNCy_IN_SEL_CFG_REG corresponding to peripheral signal Y in GPIO matrix:
• Set GPIO_SIGy_IN_SEL to enable peripheral signal input via GPIO matrix.
• Set GPIO_FUNCy_IN_SEL to the desired GPIO pin, i.e. X here.

EL
Note that some peripheral signals have no valid GPIO_SIGy_IN_SEL bit, namely, these peripherals can only
receive input signals via GPIO matrix.
2. Optionally enable the filter for pin input signals by setting the register IO_MUX_FILTER_EN. Only the signals
with a valid width of more than two APB clock cycles can be sampled, see Figure 5-4.
PR
Figure 54. Filter Timing of GPIO Input Signals
3. Synchronize GPIO input. To do so, please set GPIO_PINx_REG corresponding to GPIO pin X as follows:
• Set GPIO_PINx_SYNC1_BYPASS to enable input signal synchronized on rising edge or on falling edge
in the first clock, see Figure 5-3.

• Set GPIO_PINx_SYNC2_BYPASS to enable input signal synchronized on rising edge or on falling edge
in the second clock, see Figure 5-3.
4. Configure IO MUX register to enable pin input. For this end, please set IO_MUX_X_REG corresponding to
GPIO pin x as follows:
• Set IO_MUX_FUN_IE to enable input2 .
• Set or clear IO_MUX_FUN_WPU and IO_MUX_FUN_WPD, as desired, to enable or disable pull-up

and pull-down resistors.
For example, to connect RMT channel 0 input signal3 (rmt_sig_in0, signal index 81) to GPIO40, please follow the
steps below. Note that GPIO40 is also named as MTDO pin.
RY
1. Set GPIO_SIG81_IN_SEL in register GPIO_FUNC81_IN_SEL_CFG_REG to enable peripheral signal input
via GPIO matrix.
2. Set GPIO_FUNC81_IN_SEL in register GPIO_FUNC81_IN_SEL_CFG_REG to 40, i.e. select GPIO40.
3. Set IO_MUX_FUN_IE in register IO_MUX_GPIO40_REG to enable pin input.
A
Note:
1. One pin input can be connected to multiple peripheral input signals.
2. The input signal can be inverted by configuring GPIO_FUNCy_IN_INV_SEL.

IN
3. It is possible to have a peripheral read a constantly low or constantly high input value without connecting this input
to a pin. This can be done by selecting a special GPIO_FUNCy_IN_SEL input, instead of a GPIO number:
• When GPIO_FUNCy_IN_SEL is set to 0x3C, input signal is always 0.
• When GPIO_FUNCy_IN_SEL is set to 0x38, input signal is always 1.
IM
5.4.4 Simple GPIO Input

GPIO_IN_REG/GPIO_IN1_REG holds the input values of each GPIO pin. The input value of any GPIO pin can be
EL
read at any time without configuring GPIO matrix for a particular peripheral signal. However, it is necessary to
enable pin input by setting IO_MUX_FUN_IE in register IO_MUX_x_REG corresponding to pin X, as described in
Section 5.4.2.
5.5 Peripheral Output via GPIO Matrix

PR
5.5.1 Overview
To output a signal from a peripheral via GPIO matrix, the matrix is configured to route peripheral output signals
(only signals with a name assigned in the column ”Output signal” in Table 5-2) to one of the 45 GPIOs (0 ~ 21, 26
~ 48).
The output signal is routed from the peripheral into GPIO matrix and then into IO MUX. IO MUX must be
configured to set the chosen pin to GPIO function. This enables the output GPIO signal to be connected to the
pin.
Note:
There is a range of peripheral output signals (208 ~ 212 in Table 5-2) which are not connected to any peripheral, but to the

input signals (208 ~ 212) directly. These can be used to input a signal from one GPIO pin and output directly to another
GPIO pin.

Some of the 256 output signals (signals with a name assigned in the column ”Output signal” in Table 5-2) can be
set to go through GPIO matrix into IO MUX and then to a pin. Figure 5-1 illustrates the configuration.
To output peripheral signal Y to a particular GPIO pin X1 , 2

, follow these steps:
1. Configure GPIO_FUNCx_OUT_SEL_CFG_REG and GPIO_ENABLE_REG[x] corresponding to GPIO pin X in

GPIO matrix. Recommended operation: use corresponding W1TS (write 1 to set) and W1TC (write 1 to
clear) registers to set or clear GPIO_ENABLE_REG.
RY
• Set the GPIO_FUNCx_OUT_SEL field in register GPIO_FUNCx_OUT_SEL_CFG_REG to the index of
the desired peripheral output signal Y.
• If the signal should always be enabled as an output, set the bit GPIO_FUNCx_OEN_SEL in register
GPIO_FUNCx_OUT_SEL_CFG_REG and the bit in register GPIO_ENABLE/ENABLE1_W1TS_REG,
corresponding to GPIO pin X. To have the output enable signal decided by internal logic (for example,
A
the SPIQ_oe in column “Output enable signal when GPIO_FUNCn_OEN_SEL = 0” in Table 5-2), clear
the bit GPIO_FUNCx_OEN_SEL instead.
• Set the corresponding bit in register GPIO_ENABLE/ENABLE1_W1TC_REG to disable the output

from the GPIO pin.
IN
2. For an open drain output, set the bit GPIO_PINx_PAD_DRIVER in register GPIO_PINx_REG corresponding
to GPIO pin X.
IM
3. Configure IO MUX register to enable output via GPIO matrix. Set the IO_MUX_x_REG corresponding to
GPIO pin X as follows:
• Set the field IO_MUX_MCU_SEL to desired IO MUX function corresponding to GPIO pin X. This is
Function 1 (GPIO function), numeric value 1, for all pins.
EL
• Set the field IO_MUX_FUN_DRV to the desired value for output strength (0 ~ 3). The higher the driver
strength, the more current can be sourced/sunk from the pin.
– 0: ~5 mA
– 1: ~10 mA
PR
– 2: ~20 mA (default value)
– 3: ~40 mA
• If using open drain mode, set/clear IO_MUX_FUN_WPU and IO_MUX_FUN_WPD to enable/disable

the internal pull-up/pull-down resistors.
Note:
1. The output signal from a single peripheral can be sent to multiple pins simultaneously.
2. The output signal can be inverted by setting GPIO_FUNCx_OUT_INV_SEL.

5.5.3 Simple GPIO Output

GPIO matrix can also be used for simple GPIO output. This can be done as below:
• Set GPIO matrix GPIO_FUNCn_OUT_SEL with a special peripheral index 256 (0x100);
• Set the corresponding bit in GPIO_OUT_REG[31:0] or GPIO_OUT1_REG[21:0] to the desired GPIO output
value.
Note:
• GPIO_OUT_REG[21:0] and GPIO_OUT_REG[31:26] correspond to GPIO0 ~ 21 and GPIO26 ~ 31, respectively.

GPIO_OUT_REG[25:22] are invalid.
• GPIO_OUT1_REG[16:0] correspond to GPIO32 ~ 48, and GPIO_OUT1_REG[21:17] are invalid.
RY
• Recommended operation: use corresponding W1TS and W1TC registers, such as GPIO_OUT_W1TS/GPIO_OUT_
W1TC to set or clear the registers GPIO_OUT_REG/GPIO_OUT1_REG.
5.5.4 Sigma Delta Modulated Output
A
5.5.4.1 Functional Description
Eight out of the 256 peripheral outputs (index: 93 ~ 100 in Table 5-2) support 1-bit second-order sigma delta
IN
modulation. By default output is enabled for these eight channels. This Sigma Delta modulator can also output
PDM (pulse density modulation) signal with configurable duty cycle. The transfer function is:
H(z) = X(z)z−1 + E(z)(1-z−1 )2

IM
E(z) is quantization error and X(z) is the input.
This modulator supports scaling down of APB_CLK by divider 1 ~ 256:
• Set GPIO_FUNCTION_CLK_EN to enable the modulator clock.

EL
• Configure GPIO_SDn_PRESCALE (n is 0 ~ 7 for eight channels).
After scaling, the clock cycle is equal to one pulse output cycle from the modulator.
GPIO_SDn_IN is a signed number with a range of [-128, 127] and is used to control the duty cycle 1 of PDM
output signal.
PR
• GPIO_SDn_IN = -128, the duty cycle of the output signal is 0%.
• GPIO_SDn_IN = 0, the duty cycle of the output signal is near 50%.
• GPIO_SDn_IN = 127, the duty cycle of the output signal is close to 100%.
The formula for calculating PDM signal duty cycle is shown as below:
GP IO_SDn_IN + 128
Duty_Cycle =
256
Note:
For PDM signals, duty cycle refers to the percentage of high level cycles to the whole statistical period (several pulse

cycles, for example 256 pulse cycles).
5.5.4.2 SDM Configuration
The configuration of SDM is shown below:
• Route one of SDM outputs to a pin via GPIO matrix, see Section 5.5.2.
• Enable the modulator clock by setting GPIO_FUNCTION_CLK_EN.
• Configure the divider value by setting GPIO_SDn_PRESCALE.
• Configure the duty cycle of SDM output signal by setting GPIO_SDn_IN.
RY
5.6 Direct Input and Output via IO MUX
5.6.1 Overview
Some high-speed signals (SPI and JTAG) can bypass GPIO matrix for better high-frequency digital performance.
A
In this case, IO MUX is used to connect these pins directly to the peripherals.
This option is less flexible than routing signals via GPIO matrix, as the IO MUX register for each GPIO pin can only
select from a limited number of functions, but high-frequency digital performance can be improved.

IN
Two registers must be configured in order to bypass GPIO matrix for peripheral input signals:
IM
1. IO_MUX_MCU_SEL for the GPIO pin must be set to the required pin function. For the list of pin functions,
please refer to Section 5.12.
2. Clear GPIO_SIGn_IN_SEL to route the input directly to the peripheral.
To bypass GPIO matrix for peripheral output signals, IO_MUX_MCU_SEL for the GPIO pin must be set to the
EL
required pin function. For the list of pin functions, please refer to Section 5.12.
Note:
Not all signals can be connected to peripheral via IO MUX. Some input/output signals can only be connected to peripheral
via GPIO matrix.
PR
5.7 RTC IO MUX for Low Power and Analog Input/Output

5.7.1 Overview
ESP32-S3 provides 22 GPIO pins with low power capabilities (RTC) and analog functions, which are handled by
the RTC subsystem of ESP32-S3. IO MUX and GPIO matrix are not used for these functions, rather, RTC IO
MUX is used to redirect 22 RTC input/output signals to the RTC subsystem.
When configured as RTC GPIOs, the output pins can still retain the output level value when the chip is in
Deep-sleep mode, and the input pins can wake up the chip from Deep-sleep.

5.7.2 Low Power Capabilities

The pins with RTC functions are controlled by RTC_IO_TOUCH/RTC_PADn_MUX_SEL bit in register
RTC_IO_
TOUCH/RTC_PADn_REG. By default all bits in these registers are set to 0, routing all input/output signals via IO
MUX.
If RTC_IO_TOUCH/RTC_PADn_MUX_SEL is set to 1, then input/output signals to and from that pin is routed to
the RTC subsystem. In this mode, RTC_IO_TOUCH/RTC_PADn_REG is used to control RTC low power pins.
Note that RTC_IO_TOUCH/RTC_PADn_REG applies the RTC GPIO pin numbering, not the GPIO pin numbering.
See Table 5-4 for RTC functions of RTC IO MUX pins.
RY
5.7.3 Analog Functions
When the pin is used for analog purpose, make sure this pin is left floating by configuring the register
RTC_IO_TOUCH
/RTC_PADn_REG. By such way, external analog signal is connected to internal analog signal via GPIO pin. The
configuration is as follows:
A
• Set RTC_IO_TOUCH/RTC_PADn_MUX_SEL, to select RTC IO MUX to route input and output signals.
• Clear RTC_IO_TOUCH/RTC_PADn_FUN_IE, RTC_IO_TOUCH/RTC_PADn_

IN
FUN_RUE, and RTC_IO_TOUCH/RTC_PADn_FUN_RDE, to set this pin floating.
• Configure RTC_IO_TOUCH/RTC_PADn_FUN_SEL to 0, to enable analog function 0.
• Write 1 to RTC_GPIO_ENABLE_W1TC, to clear output enable.

IM
See Table 5-5 for analog functions of RTC IO MUX pins.
5.8 Pin Functions in Lightsleep

Pins may provide different functions when ESP32-S3 is in Light-sleep mode. If IO_MUX_SLP_SEL in register
EL
IO_MUX_n_REG for a GPIO pin is set to 1, a different set of bits will be used to control the pin when the chip is in
Light-sleep mode.
Table 51. Bits Used to Control IO MUX Functions in Lightsleep Mode
Normal Execution Lightsleep Mode

IO MUX Functions
PR
OR IO_MUX_SLP_SEL = 0 AND IO_MUX_SLP_SEL = 1

Output Drive Strength IO_MUX_FUN_DRV IO_MUX_FUN_DRV
Pull-up Resistor IO_MUX_FUN_WPU IO_MUX_MCU_WPU
Pull-down Resistor IO_MUX_FUN_WPD IO_MUX_MCU_WPD
∗
Output Enable OEN_SEL from GPIO matrix IO_MUX_MCU_OE
Note:
If IO_MUX_SLP_SEL is set to 0, pin functions remain the same in both normal execution and Light-sleep mode. Please
refer to Section 5.5.2 for how to enable output in normal execution.

5.9 Pin Hold Feature

Each GPIO pin (including the RTC pins) has an individual hold function controlled by an RTC register. When the
pin is set to hold, the state is latched at that moment and will not change no matter how the internal signals
change or how the IO MUX/GPIO configuration is modified. Users can use the hold function for the pins to retain
the pin state through a core reset and system reset triggered by watchdog time-out or Deep-sleep events.
Note:
• For digital pins, to maintain pin input/output status in Deep-sleep mode, users can set RTC_CNTL_DG_PAD_
FORCE_UNHOLD to 0 before powering down. For RTC pins, the input and output values are controlled by the
corresponding bits of register RTC_CNTL_PAD_HOLD_REG, and users can set it to 1 to hold the value or set it to
RY
0 to unhold the value.
• To disable the hold function after the chip is woken up, users can set RTC_CNTL_DG_PAD_FORCE_UNHOLD to
1. To maintain the hold function of the pin, users can set the corresponding bit in register RTC_CNTL_PAD_
HOLD_REG to 1.
A
5.10 Power Supply and Management of GPIO Pins
5.10.1 Power Supply of GPIO Pins
IN
For more information on the power supply for GPIO pins, please refer to Pin Definition in ESP32-S3
Datasheet.
IM
5.10.2 Power Supply Management
Each ESP32-S3 pin is connected to one of the three different power domains.
• VDD3P3_RTC: the input power supply for both RTC and CPU
• VDD3P3_CPU: the input power supply for CPU

EL
• VDD_SPI: configurable input/output power supply
VDD_SPI can be configured to use an internal LDO. The LDO input and output both are 1.8 V. If the LDO is not
enabled, VDD_SPI is connected directly to the same power supply as VDD3P3_RTC.
The VDD_SPI configuration is determined by the value of strapping pin GPIO45, or can be overriden by eFuse
PR
and/or register settings. See ESP32-S3 Datasheet sections Power Scheme and Strapping Pins for more
details.
Note that GPIO33 ~ GPIO37 can be powered either by VDD_SPI or VDD3P3_CPU.
5.11 Peripheral Signals via GPIO Matrix

Table 5-2 shows the peripheral input/output signals via GPIO matrix.
Please pay attention to the configuration of the bit GPIO_FUNCn_OEN_SEL:
• GPIO_FUNCn_OEN_SEL = 1: the output enable is controlled by the corresponding bit n of

GPIO_ENABLE_REG:
– GPIO_ENABLE_REG = 0: output is disabled;

– GPIO_ENABLE_REG = 1: output is enabled;
• GPIO_FUNCn_OEN_SEL = 0: use the output enable signal from peripheral, for example SPIQ_oe in the
column “Output enable signal when GPIO_FUNCn_OEN_SEL = 0” of Table 5-2. Note that the signals such
as SPIQ_oe can be 1 (1’d1) or 0 (1’d0), depending on the configuration of corresponding peripherals. If it’s
1’d1 in the “Output enable signal when GPIO_FUNCn_OEN_SEL = 0”, it indicates that once the register
GPIO_FUNCn_OEN_SEL is cleared, the output signal is always enabled by default.
Note:
Signals are numbered consecutively, but not all signals are valid.
• Only the signals with a name assigned in the column ”Input signal” in Table 5-2 are valid input signals.
• Only the signals with a name assigned in the column ”Output signal” in Table 5-2 are valid output signals.
A RY
IN
IM
EL
PR

Espressif Systems

Table 52. Peripheral Signals via GPIO Matrix
Direct Direct
Signal Default Output enable signal when
Input Signal Input via Output Signal Output via
PR
No. value GPIO_FUNCn_OEN_SEL = 0
IO MUX IO MUX
0 SPIQ_in 0 yes SPIQ_out SPIQ_oe yes
1 SPID_in 0 yes SPID_out SPID_oe yes
2 SPIHD_in 0 yes SPIHD_out SPIHD_oe yes
3 SPIWP_in 0 yes SPIWP_out SPIWP_oe yes
EL
4 - - - SPICLK_out_mux SPICLK_oe yes
5 - - - SPICS0_out SPICS0_oe yes
6 - - - SPICS1_out SPICS1_oe yes
7 SPID4_in 0 yes SPID4_out SPID4_oe yes

IM
196

11 SPIDQS_in 0 yes SPIDQS_out SPIDQS_oe yes
12 U0RXD_in 0 yes U0TXD_out 1’d1 yes
13 U0CTS_in 0 yes U0RTS_out 1’d1 yes
IN
14 U0DSR_in 0 no U0DTR_out 1’d1 no
15 U1RXD_in 0 yes U1TXD_out 1’d1 yes
16 U1CTS_in 0 yes U1RTS_out 1’d1 yes
A
18 U2RXD_in 0 no U2TXD_out 1’d1 no
19 U2CTS_in 0 no U2RTS_out 1’d1 no
RY
21 I2S1_MCLK_in 0 no I2S1_MCLK_out 1’d1 no
22 I2S0O_BCK_in 0 no I2S0O_BCK_out 1’d1 no
23 I2S0_MCLK_in 0 no I2S0_MCLK_out 1’d1 no
24 I2S0O_WS_in 0 no I2S0O_WS_out 1’d1 no
Espressif Systems

Direct Direct
IO MUX IO MUX
PR
25 I2S0I_SD_in 0 no I2S0O_SD_out 1’d1 no
26 I2S0I_BCK_in 0 no I2S0I_BCK_out 1’d1 no
27 I2S0I_WS_in 0 no I2S0I_WS_out 1’d1 no
28 I2S1O_BCK_in 0 no I2S1O_BCK_out 1’d1 no
29 I2S1O_WS_in 0 no I2S1O_WS_out 1’d1 no
30 I2S1I_SD_in 0 no I2S1O_SD_out 1’d1 no
EL
31 I2S1I_BCK_in 0 no I2S1I_BCK_out 1’d1 no
32 I2S1I_WS_in 0 no I2S1I_WS_out 1’d1 no
33 pcnt_sig_ch0_in0 0 no - 1’d1 no
34 pcnt_sig_ch1_in0 0 no - 1’d1 no
35 pcnt_ctrl_ch0_in0 0 no - 1’d1 -
IM
197
37 pcnt_sig_ch0_in1 0 no - 1’d1 -
IN
A
RY
49 - - - - 1’d1 -
50 - - - - 1’d1 -
51 I2S0I_SD1_in 0 no - 1’d1 -
Espressif Systems

Direct Direct
IO MUX IO MUX
PR
52 I2S0I_SD2_in 0 no - 1’d1 -
53 I2S0I_SD3_in 0 no - 1’d1 -
54 Core1_gpio_in7 0 no Core1_gpio_out7 1’d1 no
55 - - - - 1’d1 -
56 - - - - 1’d1 -
57 - - - - 1’d1 -
EL
58 usb_otg_iddig_in 0 no - 1’d1 -
59 usb_otg_avalid_in 0 no - 1’d1 -
60 usb_srp_bvalid_in 0 no usb_otg_idpullup 1’d1 no

61 usb_otg_vbusvalid_in 0 no usb_otg_dppulldown 1’d1 no
62 usb_srp_sessend_in 0 no usb_otg_dmpulldown 1’d1 no
IM
63 - - - usb_otg_drvvbus 1’d1 no
198
64 - - - usb_srp_chrgvbus 1’d1 no
65 - - - usb_srp_dischrgvbus 1’d1 no
66 SPI3_CLK_in 0 no SPI3_CLK_out_mux SPI3_CLK_oe no
IN
67 SPI3_Q_in 0 no SPI3_Q_out SPI3_Q_oe no
68 SPI3_D_in 0 no SPI3_D_out SPI3_D_oe no
69 SPI3_HD_in 0 no SPI3_HD_out SPI3_HD_oe no
70 SPI3_WP_in 0 no SPI3_WP_out SPI3_WP_oe no

71 SPI3_CS0_in 0 no SPI3_CS0_out SPI3_CS0_oe no
A
72 - - - SPI3_CS1_out SPI3_CS1_oe no
73 ext_adc_start 0 no ledc_ls_sig_out0 1’d1 no
RY
74 - - - ledc_ls_sig_out1 1’d1 no
Espressif Systems

Direct Direct
IO MUX IO MUX
PR
81 rmt_sig_in0 0 no rmt_sig_out0 1’d1 no
EL
85 - - - - 1’d1 -
86 - - - - 1’d1 -
87 - - - - 1’d1 -
88 - - - - 1’d1 -
89 I2CEXT0_SCL_in 1 no I2CEXT0_SCL_out I2CEXT0_SCL_oe no
IM
90 I2CEXT0_SDA_in 1 no I2CEXT0_SDA_out I2CEXT0_SDA_oe no
199
91 I2CEXT1_SCL_in 1 no I2CEXT1_SCL_out I2CEXT1_SCL_oe no

92 I2CEXT1_SDA_in 1 no I2CEXT1_SDA_out I2CEXT1_SDA_oe no
93 - - - gpio_sd0_out 1’d1 no
IN
A
RY
101 FSPICLK_in 0 yes FSPICLK_out_mux FSPICLK_oe yes
102 FSPIQ_in 0 yes FSPIQ_out FSPIQ_oe yes
103 FSPID_in 0 yes FSPID_out FSPID_oe yes
104 FSPIHD_in 0 yes FSPIHD_out FSPIHD_oe yes
105 FSPIWP_in 0 yes FSPIWP_out FSPIWP_oe yes
Espressif Systems

Direct Direct
IO MUX IO MUX
PR
106 FSPIIO4_in 0 yes FSPIIO4_out FSPIIO4_oe yes
110 FSPICS0_in 0 yes FSPICS0_out FSPICS0_oe yes
111 - - - FSPICS1_out FSPICS1_oe no
EL

116 twai_rx 1 no twai_tx 1’d1 no
IM
117 - - - twai_bus_off_on 1’d1 no
200
118 - - - twai_clkout 1’d1 no

119 - - - SUBSPICLK_out_mux SUBSPICLK_oe no
120 SUBSPIQ_in 0 yes SUBSPIQ_out SUBSPIQ_oe yes
IN
121 SUBSPID_in 0 yes SUBSPID_out SUBSPID_oe yes
122 SUBSPIHD_in 0 yes SUBSPIHD_out SUBSPIHD_oe yes
123 SUBSPIWP_in 0 yes SUBSPIWP_out SUBSPIWP_oe yes
124 - - - SUBSPICS0_out SUBSPICS0_oe yes

125 - - - SUBSPICS1_out SUBSPICS1_oe yes
A
126 - - - FSPIDQS_out FSPIDQS_oe yes
127 - - - SPI3_CS2_out SPI3_CS2_oe no
RY
128 - - - I2S0O_SD1_out 1’d1 no
132 - - - LCD_CS 1’d1 no
Espressif Systems

Direct Direct
IO MUX IO MUX
PR
133 CAM_DATA_in0 0 no LCD_DATA_out0 1’d1 no
EL

IM
201

IN
149 CAM_PCLK 0 no CAM_CLK 1’d1 no
150 CAM_H_ENABLE 0 no LCD_H_ENABLE 1’d1 no
151 CAM_H_SYNC 0 no LCD_H_SYNC 1’d1 no

152 CAM_V_SYNC 0 no LCD_V_SYNC 1’d1 no
A
153 - - - LCD_DC 1’d1 no
154 - - - LCD_PCLK 1’d1 no
RY
155 SUBSPID4_in 0 yes SUBSPID4_out SUBSPID4_oe no
159 SUBSPIDQS_in 0 yes SUBSPIDQS_out SUBSPIDQS_oe no
Espressif Systems

Direct Direct
IO MUX IO MUX
PR
160 pwm0_sync0_in 0 no pwm0_out0a 1’d1 no
161 pwm0_sync1_in 0 no pwm0_out0b 1’d1 no
163 pwm0_f0_in 0 no pwm0_out1b 1’d1 no
164 pwm0_f1_in 0 no pwm0_out2a 1’d1 no
165 pwm0_f2_in 0 no pwm0_out2b 1’d1 no
EL
166 pwm0_cap0_in 0 no pwm1_out0a 1’d1 no
167 pwm0_cap1_in 0 no pwm1_out0b 1’d1 no
168 pwm0_cap2_in 0 no pwm1_out1a 1’d1 no

IM
202
172 pwm1_f0_in 0 no sdhost_cclk_out_1 1’d1 no

173 pwm1_f1_in 0 no sdhost_cclk_out_2 1’d1 no
174 pwm1_f2_in 0 no sdhost_rst_n_1 1’d1 no
IN
175 pwm1_cap0_in 0 no sdhost_rst_n_2 1’d1 no
sd-
176 pwm1_cap1_in 0 no 1’d1 no
host_ccmd_od_pullup_en_n
177 pwm1_cap2_in 0 no sdio_tohost_int_out 1’d1 no

178 sdhost_ccmd_in_1 1 no sdhost_ccmd_out_1 sdhost_ccmd_out_en_1 no
A
179 sdhost_ccmd_in_2 1 no sdhost_ccmd_out_2 sdhost_ccmd_out_en_2 no
180 sdhost_cdata_in_10 1 no sdhost_cdata_out_10 sdhost_cdata_out_en_10 no
RY
Espressif Systems

Direct Direct
IO MUX IO MUX
PR
188 - - - - 1’d1 -
189 - - - - 1’d1 -
190 - - - - 1’d1 -
191 - - - - 1’d1 -
EL
192 sdhost_data_strobe_1 0 no - 1’d1 -
193 sdhost_data_strobe_2 0 no - 1’d1 -
194 sdhost_card_detect_n_1 0 no - 1’d1 -

195 sdhost_card_detect_n_2 0 no - 1’d1 -
196 sdhost_card_write_prt_1 0 no - 1’d1 -
IM
197 sdhost_card_write_prt_2 0 no - 1’d1 -
203
198 sdhost_card_int_n_1 0 no - 1’d1 -

199 sdhost_card_int_n_2 0 no - 1’d1 -
200 - - - - 1’d1 no
IN
201 - - - - 1’d1 no
202 - - - - 1’d1 no
203 - - - - 1’d1 no
204 - - - - 1’d1 no
205 - - - - 1’d1 no
A
206 - - - - 1’d1 no
207 - - - - 1’d1 no
RY
208 sig_in_func_208 0 no sig_in_func208 1’d1 no
Espressif Systems

Direct Direct
IO MUX IO MUX
PR
EL
221 pro_alonegpio_in0 0 no pro_alonegpio_out0 1’d1 no

IM
204

IN
229 - - - - 1’d1 -
230 - - - - 1’d1 -
231 - - - - 1’d1 -
232 - - - - 1’d1 -
A
233 - - - - 1’d1 -
234 - - - - 1’d1 -
RY
235 - - - - 1’d1 -
236 - - - - 1’d1 -
237 - - - - 1’d1 -
238 - - - - 1’d1 -
239 - - - - 1’d1 -
Espressif Systems

Direct Direct
IO MUX IO MUX
PR
240 - - - - 1’d1 -
241 - - - - 1’d1 -
242 - - - - 1’d1 -
243 - - - - 1’d1 -
244 - - - - 1’d1 -
245 - - - - 1’d1 -
EL
246 - - - - 1’d1 -
247 - - - - 1’d1 -
248 - - - - 1’d1 -
249 - - - - 1’d1 -
250 - - - - 1’d1 -
IM
251 usb_jtag_tdo_bridge 0 no usb_jtag_trst 1’d1 no
205

IN
A RY
5.12 IO MUX Function List

Table 5-3 shows the IO MUX functions of each GPIO pin.
Table 53. IO MUX Pin Functions
GPIO Pin Name Function 0 Function 1 Function 2 Function 3 Function 4 DRV RST Notes
0 GPIO0 GPIO0 GPIO0 - - - 2 3 R
RY
8 GPIO8 GPIO8 GPIO8 - SUBSPICS1 - 2 0 R
9 GPIO9 GPIO9 GPIO9 - SUBSPIHD FSPIHD 2 1 R
A
10 GPIO10 GPIO10 GPIO10 FSPIIO4 SUBSPICS0 FSPICS0 2 1 R
11 GPIO11 GPIO11 GPIO11 FSPIIO5 SUBSPID FSPID 2 1 R
12 GPIO12 GPIO12 GPIO12 FSPIIO6 SUBSPICLK FSPICLK 2 1 R
13
14
GPIO13
GPIO14
GPIO13
GPIO14
GPIO13
GPIO14
IN FSPIIO7
FSPIDQS
SUBSPIQ
SUBSPIWP
FSPIQ
FSPIWP
2
2
1
1
R
R
15 XTAL_32K_P GPIO15 GPIO15 U0RTS - - 2 0 R
16 XTAL_32K_N GPIO16 GPIO16 U0CTS - - 2 0 R
IM
17 GPIO17 GPIO17 GPIO17 U1TXD - - 2 1 R
18 GPIO18 GPIO18 GPIO18 U1RXD CLK_OUT3 - 2 1 R
19 GPIO19 GPIO19 GPIO19 U1RTS CLK_OUT2 - 2 0 R
20 GPIO20 GPIO20 GPIO20 U1CTS CLK_OUT1 - 2 0 R
21 GPIO21 GPIO21 GPIO21 - - - 2 0 R
EL
26 SPICS1 SPICS1 GPIO26 - - - 2 3 -

27 SPIHD SPIHD GPIO27 - - - 3 3 -
28 SPIWP SPIWP GPIO28 - - - 3 3 -
29 SPICS0 SPICS0 GPIO29 - - - 3 3 -
30 SPICLK SPICLK GPIO30 - - - 3 3 -
PR
31 SPIQ SPIQ GPIO31 - - - 3 3 -

32 SPID SPID GPIO32 - - - 3 3 -
33 GPIO33 GPIO33 GPIO33 FSPIHD SUBSPIHD SPIIO4 2 1 -
34 GPIO34 GPIO34 GPIO34 FSPICS0 SUBSPICS0 SPIIO5 2 1 -
35 GPIO35 GPIO35 GPIO35 FSPID SUBSPID SPIIO6 2 1 -
36 GPIO36 GPIO36 GPIO36 FSPICLK SUBSPICLK SPIIO7 2 1 -
37 GPIO37 GPIO37 GPIO37 FSPIQ SUBSPIQ SPIDQS 2 1 -
38 GPIO38 GPIO38 GPIO38 FSPIWP SUBSPIWP - 2 1 -
39 MTCK MTCK GPIO39 CLK_OUT3 SUBSPICS1 - 2 1* -
40 MTDO MTDO GPIO40 CLK_OUT2 - - 2 1 -
41 MTDI MTDI GPIO41 CLK_OUT1 - - 2 1 -
42 MTMS MTMS GPIO42 - - - 2 1 -

GPIO Pin Name Function 0 Function 1 Function 2 Function 3 Function 4 DRV RST Notes
43 U0TXD U0TXD GPIO43 CLK_OUT1 - - 2 4 -
44 U0RXD U0RXD GPIO44 CLK_OUT2 - - 2 3 -
45 GPIO45 GPIO45 GPIO45 - - - 2 2 -
46 GPIO46 GPIO46 GPIO46 - - - 2 2 -
47 SPICLK_P SPICLK_DIFF GPIO47 SUBSPICLK_P_DIFF - - 2 1 -
48 SPICLK_N SPICLK_DIFF GPIO48 SUBSPICLK_N_DIFF - - 2 1 -
Drive Strength
“DRV” column shows the drive strength of each pin after reset:
RY
• 0 - Drive current = ~5 mA
A
Reset Configurations
“RST” column shows the default configuration of each pin after reset:
• 0 - IE = 0 (input disabled)
IN
• 1 - IE = 1 (input enabled)
• 2 - IE = 1, WPD = 1 (input enabled, pull-down resistor enabled)

IM
• 3 - IE = 1, WPU = 1 (input enabled, pull-up resistor enabled)
• 4 - OE = 1, WPU = 1 (output enabled, pull-up resistor enabled)
• 1* - If EFUSE_DIS_JTAG = 1, the pin MTCK is left floating after reset, i.e. IE = 1. If EFUSE_DIS_JTAG = 0,
the pin MTCK is connected to internal pull-up resistor, i.e. IE = 1, WPU = 1.
EL
Note:
• R - Pin has RTC/analog functions via RTC IO MUX.
Please refer to Appendix A – ESP32-S3 Pin Lists in ESP32-S3 Datasheet for more details.
PR
5.13 RTC IO MUX Pin List

Table 5-4 shows the RTC pins, their corresponding GPIO pins and RTC functions.
Table 54. RTC Functions of RTC IO MUX Pins
RTC Function
RTC GPIO Num GPIO Num Pin Name
0 1 2 3
0 0 GPIO0 RTC_GPIO0 - - sar_i2c_scl_0a
1 1 GPIO1 RTC_GPIO1 - - sar_i2c_sda_0a
2 2 GPIO2 RTC_GPIO2 - - sar_i2c_scl_1a
3 3 GPIO3 RTC_GPIO3 - - sar_i2c_sda_1a


RTC Function
0 1 2 3
4 4 GPIO4 RTC_GPIO4 - - -
10 10 GPIO10 RTC_GPIO10 - - -
11 11 GPIO11 RTC_GPIO11 - - -
RY
12 12 GPIO12 RTC_GPIO12 - - -
13 13 GPIO13 RTC_GPIO13 - - -
14 14 GPIO14 RTC_GPIO14 - - -
15 15 XTAL_32K_P RTC_GPIO15 - - -
16 16 XTAL_32K_N RTC_GPIO16 - - -
A
17 17 GPIO17 RTC_GPIO17 - - -
18 18 GPIO18 RTC_GPIO18 - - -
19 19 GPIO19 RTC_GPIO19 - - -
20
21
20
21
GPIO20
GPIO21
IN RTC_GPIO20
RTC_GPIO21
-
-
-
-
-
-
a
For more information on the configuration of sar_i2c_xx, see Section RTC I2C Controller in
Chapter 1 ULP Coprocessor (ULP-FSM, ULP-RISC-V).
IM
Table 5-5 shows the RTC pins, their corresponding GPIO pins and analog functions.
Table 55. Analog Functions of RTC IO MUX Pins

EL
Analog Function
0 1
0 0 GPIO0 - -
1 1 GPIO1 TOUCH1 ADC1_CH0
PR


Analog Function
0 1
15 15 XTAL_32K_P XTAL_32K_P ADC2_CH4
16 16 XTAL_32K_N XTAL_32K_N ADC2_CH5
17 17 GPIO17 - ADC2_CH6
18 18 GPIO18 - ADC2_CH7
19 19 GPIO19 USB_D- ADC2_CH8
20 20 GPIO20 USB_D+ ADC2_CH9
21 21 GPIO21 - -
RY
5.14.1 GPIO Matrix Register Summary
The addresses in this section are relative to the GPIO base address provided in Table 3-4 in Chapter 3 System
and Memory.
A
GPIO Configuration Registers
GPIO_BT_SELECT_REG GPIO bit select register 0x0000 R/W
GPIO_OUT_REG
GPIO_OUT_W1TS_REG
IN
GPIO0 ~ 31 output register
GPIO0 ~ 31 output bit set register
0x0004
0x0008
R/W
WO
GPIO_OUT_W1TC_REG GPIO0 ~ 31 output bit clear register 0x000C WO
GPIO_OUT1_REG GPIO32 ~ 48 output register 0x0010 R/W
IM
GPIO_OUT1_W1TS_REG GPIO32 ~ 48 output bit set register 0x0014 WO
GPIO_OUT1_W1TC_REG GPIO32 ~ 48 output bit clear register 0x0018 WO
GPIO_SDIO_SELECT_REG GPIO SDIO selection register 0x001C R/W
GPIO_ENABLE_REG GPIO0 ~ 31 output enable register 0x0020 R/W
EL
GPIO_ENABLE_W1TS_REG GPIO0 ~ 31 output enable bit set register 0x0024 WO

GPIO_ENABLE_W1TC_REG GPIO0 ~ 31 output enable bit clear register 0x0028 WO
GPIO_ENABLE1_REG GPIO32 ~ 48 output enable register 0x002C R/W
GPIO_ENABLE1_W1TS_REG GPIO32 ~ 48 output enable bit set register 0x0030 WO
GPIO_ENABLE1_W1TC_REG GPIO32 ~ 48 output enable bit clear register 0x0034 WO
PR
GPIO_STRAP_REG Strapping pin value register 0x0038 RO

GPIO_IN_REG GPIO0 ~ 31 input register 0x003C RO
GPIO_IN1_REG GPIO32 ~ 48 input register 0x0040 RO
GPIO_PIN0_REG Configuration for GPIO pin 0 0x0074 R/W
GPIO_PIN2_REG Configuration for GPIO pin 2 0x007C R/W
... ... ... ...
GPIO_PIN46_REG Configuration for GPIO pin 46 0x012C R/W
GPIO_FUNC0_IN_SEL_CFG_REG Peripheral function 0 input selection register 0x0154 R/W


GPIO_FUNC2_IN_SEL_CFG_REG Peripheral function 2 input selection register 0x015C R/W
... ... ... ...
GPIO_FUNC254_IN_SEL_CFG_REG Peripheral function 254 input selection register 0x054C R/W
GPIO_FUNC0_OUT_SEL_CFG_REG Peripheral output selection for GPIO0 0x0554 R/W
GPIO_FUNC2_OUT_SEL_CFG_REG Peripheral output selection for GPIO2 0x055C R/W
... ... ... ...
RY
GPIO_CLOCK_GATE_REG GPIO clock gating register 0x062C R/W
Interrupt Status Registers
GPIO_STATUS_REG GPIO0 ~ 31 interrupt status register 0x0044 R/W
GPIO_STATUS1_REG GPIO32 ~ 48 interrupt status register 0x0050 R/W
A
GPIO_CPU_INT_REG GPIO0 ~ 31 CPU interrupt status register 0x005C RO
GPIO_CPU_NMI_INT_REG GPIO0 ~ 31 CPU non-maskable interrupt status 0x0060 RO
register
GPIO_CPU_INT1_REG
GPIO_CPU_NMI_INT1_REG
IN
GPIO32 ~ 48 CPU interrupt status register
GPIO32 ~ 48 CPU non-maskable interrupt sta-
0x0068
0x006C
RO
RO
tus register
Interrupt Configuration Registers
IM
GPIO_STATUS_W1TS_REG GPIO0 ~ 31 interrupt status bit set register 0x0048 WO
GPIO_STATUS_W1TC_REG GPIO0 ~ 31 interrupt status bit clear register 0x004C WO
GPIO_STATUS1_W1TS_REG GPIO32 ~ 48 interrupt status bit set register 0x0054 WO
GPIO_STATUS1_W1TC_REG GPIO32 ~ 48 interrupt status bit clear register 0x0058 WO
GPIO Interrupt Source Registers
EL
GPIO_STATUS_NEXT_REG GPIO0 ~ 31 interrupt source register 0x014C RO

GPIO_STATUS_NEXT1_REG GPIO32 ~ 48 interrupt source register 0x0150 RO
Version Register
GPIO_DATE_REG Version control register 0x06FC R/W
PR
5.14.2 IO MUX Register Summary

The addresses in this section are relative to the IO MUX base address provided in Table 3-4 in Chapter 3 System
and Memory.

IO_MUX_PIN_CTRL Clock output configuration register 0x0000 R/W
IO_MUX_GPIO0_REG Configuration register for pin GPIO0 0x0004 R/W
IO_MUX_GPIO2_REG Configuration register for pin GPIO2 0x000C R/W


RY
IO_MUX_GPIO15_REG Configuration register for pad XTAL_32K_P 0x0040 R/W
IO_MUX_GPIO16_REG Configuration register for pad XTAL_32K_N 0x0044 R/W
IO_MUX_GPIO17_REG Configuration register for pad DAC_1 0x0048 R/W
IO_MUX_GPIO18_REG Configuration register for pad DAC_2 0x004C R/W
A
IO_MUX_GPIO26_REG Configuration register for pad SPICS1 0x006C R/W
IO_MUX_GPIO27_REG
IO_MUX_GPIO28_REG
IN
Configuration register for pad SPIHD
Configuration register for pad SPIWP
0x0070
0x0074
R/W
R/W
IO_MUX_GPIO29_REG Configuration register for pad SPICS0 0x0078 R/W
IO_MUX_GPIO30_REG Configuration register for pad SPICLK 0x007C R/W
IM
IO_MUX_GPIO31_REG Configuration register for pad SPIQ 0x0080 R/W
IO_MUX_GPIO32_REG Configuration register for pad SPID 0x0084 R/W
EL

IO_MUX_GPIO39_REG Configuration register for pad MTCK 0x00A0 R/W
IO_MUX_GPIO40_REG Configuration register for pad MTDO 0x00A4 R/W
PR
IO_MUX_GPIO41_REG Configuration register for pad MTDI 0x00A8 R/W

IO_MUX_GPIO42_REG Configuration register for pad MTMS 0x00AC R/W
IO_MUX_GPIO43_REG Configuration register for pad U0TXD 0x00B0 R/W
IO_MUX_GPIO44_REG Configuration register for pad U0RXD 0x00B4 R/W
IO_MUX_GPIO45_REG Configuration register for pin GPIO45 0x00B8 R/W
IO_MUX_GPIO46_REG Configuration register for pin GPIO46 0x00BC R/W
IO_MUX_GPIO47_REG Configuration register for pin GPIO47 0x00C0 R/W
IO_MUX_GPIO48_REG Configuration register for pin GPIO48 0x00C4 R/W

5.14.3 SDM Output Register Summary

The addresses in this section are relative to (GPIO base address provided in Table 3-4 in Chapter 3 System and
Memory + 0x0F00).

GPIO_SIGMADELTA0_REG Duty Cycle Configure Register of SDM0 0x0000 R/W
GPIO_SIGMADELTA3_REG Duty Cycle Configure Register of SDM3 0x000C R/W
RY
GPIO_SIGMADELTA7_REG Duty Cycle Configure Register of SDM7 0x001C R/W
GPIO_SIGMADELTA_CG_REG Clock Gating Configure Register 0x0020 R/W
GPIO_SIGMADELTA_MISC_REG MISC Register 0x0024 R/W
A
GPIO_SIGMADELTA_VERSION_REG Version Control Register 0x0028 R/W
5.14.4 RTC IO MUX Register Summary

IN
The addresses in this section are relative to (Low-Power Management base address provided in Table 3-4 in
Chapter 3 System and Memory + 0x0400).

IM
GPIO configuration/data registers
RTC_GPIO_OUT_REG RTC GPIO output register 0x0000 R/W
RTC_GPIO_OUT_W1TS_REG RTC GPIO output bit set register 0x0004 WO
RTC_GPIO_OUT_W1TC_REG RTC GPIO output bit clear register 0x0008 WO
EL
RTC_GPIO_ENABLE_REG RTC GPIO output enable register 0x000C R/W

RTC_GPIO_ENABLE_W1TS_REG RTC GPIO output enable bit set register 0x0010 WO
RTC_GPIO_ENABLE_W1TC_REG RTC GPIO output enable bit clear register 0x0014 WO
RTC_GPIO_STATUS_REG RTC GPIO interrupt status register 0x0018 R/W
RTC_GPIO_STATUS_W1TS_REG RTC GPIO interrupt status bit set register 0x001C WO
PR
RTC_GPIO_STATUS_W1TC_REG RTC GPIO interrupt status bit clear register 0x0020 WO

RTC_GPIO_IN_REG RTC GPIO input register 0x0024 RO
RTC_GPIO_PIN0_REG RTC configuration for pin 0 0x0028 R/W
RTC_GPIO_PIN1_REG RTC configuration for pin 1 0x002C R/W


RY
GPIO RTC function configuration registers
RTC_IO_TOUCH_PAD0_REG Touch pin 0 configuration register 0x0084 R/W
A
RTC_IO_TOUCH_PAD2_REG Touch pin 2 configuration register 0x008C R/W
RTC_IO_TOUCH_PAD5_REG
RTC_IO_TOUCH_PAD6_REG
IN
Touch pin 5 configuration register
Touch pin 6 configuration register
0x0098
0x009C
R/W
R/W
RTC_IO_TOUCH_PAD7_REG Touch pin 7 configuration register 0x00A0 R/W
IM
RTC_IO_TOUCH_PAD10_REG Touch pin 10 configuration register 0x00AC R/W
RTC_IO_TOUCH_PAD11_REG Touch pin 11 configuration register 0x00B0 R/W
EL
RTC_IO_TOUCH_PAD14_REG Touch pin 14 configuration register 0x00BC R/W

RTC_IO_XTAL_32P_PAD_REG 32 kHz crystal P-pin configuration register 0x00C0 R/W
RTC_IO_XTAL_32N_PAD_REG 32 kHz crystal N-pin configuration register 0x00C4 R/W
RTC_IO_RTC_PAD17_REG RTC pin 17 configuration register 0x00C8 R/W
RTC_IO_RTC_PAD18_REG RTC pin 18 configuration register 0x00CC R/W
PR
RTC_IO_RTC_PAD19_REG RTC pin 19 configuration register 0x00D0 R/W

RTC_IO_XTL_EXT_CTR_REG Crystal power down enable GPIO source 0x00E0 R/W
RTC_IO_SAR_I2C_IO_REG RTC I2C pin selection 0x00E4 R/W
Version Register
RTC_IO_DATE_REG Version control register 0x01FC R/W
5.15 Registers

5.15.1 GPIO Matrix Registers

The addresses in this section are relative to the GPIO base address provided in Table 3-4 in Chapter 3 System
and Memory.
Register 5.1. GPIO_BT_SELECT_REG (0x0000)
L
SE
T_
_B
O
PI
G
31 0
0x000000 Reset
RY
GPIO_BT_SEL Reserved (R/W)
Register 5.2. GPIO_OUT_REG (0x0004)
A
RI
O
A_
AT
_D
UT
_O
IN
O
PI
G
31 0
0x000000 Reset
GPIO_OUT_DATA_ORIG GPIO0 ~ 21 and GPIO26 ~ 31 output values in simple GPIO output mode.
IM
The values of bit0 ~ bit21 correspond to the output values of GPIO0 ~ 21, and bit26 ~ bit31 to
GPIO26 ~ 31. Bit22 ~ bit25 are invalid. (R/W)
EL
Register 5.3. GPIO_OUT_W1TS_REG (0x0008)

S
1T
_W
UT
_O
O
PI
G
PR
31 0
0x000000 Reset
GPIO_OUT_W1TS GPIO0 ~ 31 output set register. If the value 1 is written to a bit here, the corre-
sponding bit in GPIO_OUT_REG will be set to 1. Recommended operation: use this register to set
GPIO_OUT_REG. (WO)

Register 5.4. GPIO_OUT_W1TC_REG (0x000C)
C
1T
W_
UT
_O
O
PI
G
31 0
0x000000 Reset
GPIO_OUT_W1TC GPIO0 ~ 31 output clear register. If the value 1 is written to a bit here, the cor-
responding bit in GPIO_OUT_REG will be cleared. Recommended operation: use this register to
clear GPIO_OUT_REG. (WO)
RY
Register 5.5. GPIO_OUT1_REG (0x0010)
G
RI
_ O
TA
DA
A 1_
UT
d )
_O
ve
r
O
se
PI
(re
G
31
0 0 0 0 0 0 0 0 0
22
0
21
IN 0x0000
0
Reset
GPIO_OUT1_DATA_ORIG GPIO32 ~ 48 output value in simple GPIO output mode. The values of
bit0 ~ bit16 correspond to GPIO32 ~ GPIO48. Bit17 ~ bit21 are invalid. (R/W)
IM
Register 5.6. GPIO_OUT1_W1TS_REG (0x0014)

S
EL
1T
W
1_
UT
)
ed
_O
rv
O
se
PI
(re
31 22 21 0
0 0 0 0 0 0 0 0 0 0 0x0000 Reset
PR
GPIO_OUT1_W1TS GPIO32 ~ 48 output value set register. If the value 1 is written to a bit here, the
corresponding bit in GPIO_OUT1_REG will be set to 1. Recommended operation: use this register
to set GPIO_OUT1_REG. (WO)

Register 5.7. GPIO_OUT1_W1TC_REG (0x0018)
C
1T
1 _W
UT
)
ed
_O
rv
O
se
PI
(re
G
31 22 21 0
0 0 0 0 0 0 0 0 0 0 0x0000 Reset
GPIO_OUT1_W1TC GPIO32 ~ 48 output value clear register. If the value 1 is written to a bit here, the
corresponding bit in GPIO_OUT1_REG will be cleared. Recommended operation: use this register
to clear GPIO_OUT1_REG. (WO)
RY
Register 5.8. GPIO_SDIO_SELECT_REG (0x001C)
EL
_S
O
DI
d)
A
_S
ve
r
O
se
PI
(re
G
31 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
GPIO_SDIO_SEL Reserved (R/W)

IN
IM
Register 5.9. GPIO_ENABLE_REG (0x0020)
TA
DA
E_
BL
NA
_E
EL
O
PI
G
31 0
0x000000 Reset
GPIO_ENABLE_DATA GPIO0~31 output enable register. (R/W)

PR

Register 5.10. GPIO_ENABLE_W1TS_REG (0x0024)
S
1T
_W
LE
N AB
_E
O
PI
G
31 0
0x000000 Reset
GPIO_ENABLE_W1TS GPIO0 ~ 31 output enable set register. If the value 1 is written to a bit here,
the corresponding bit in GPIO_ENABLE_REG will be set to 1. Recommended operation: use this
register to set GPIO_ENABLE_REG. (WO)
RY
Register 5.11. GPIO_ENABLE_W1TC_REG (0x0028)
C
1T
W
A
E_
BL
NA
_E
O
PI
G
31
IN
0x000000
0
Reset
GPIO_ENABLE_W1TC GPIO0 ~ 31 output enable clear register. If the value 1 is written to a bit here,
the corresponding bit in GPIO_ENABLE_REG will be cleared. Recommended operation: use this
IM
register to clear GPIO_ENABLE_REG. (WO)
Register 5.12. GPIO_ENABLE1_REG (0x002C)

EL
TA
DA
1_
LE
AB
)
N
ed
_E
rv
O
se
PI
(re
31 22 21 0
PR
0 0 0 0 0 0 0 0 0 0 0x0000 Reset
GPIO_ENABLE1_DATA GPIO32 ~ 48 output enable register. (R/W)

Register 5.13. GPIO_ENABLE1_W1TS_REG (0x0030)
S
1T
W
1_
E
BL
NA
)d
_E
ve
er
O
s
PI
(re
G
31 22 21 0
0 0 0 0 0 0 0 0 0 0 0x0000 Reset
GPIO_ENABLE1_W1TS GPIO32 ~ 48 output enable set register. If the value 1 is written to a bit here,
the corresponding bit in GPIO_ENABLE1_REG will be set to 1. Recommended operation: use this
register to set GPIO_ENABLE1_REG. (WO)
RY
Register 5.14. GPIO_ENABLE1_W1TC_REG (0x0034)
C
1T
_W
A NA
BL
E1
d)
_E
r ve
O
se
PI
(re
G
31
0 0 0 0 0 0 0 0 0
22
0
21
IN 0x0000
0
Reset
GPIO_ENABLE1_W1TC GPIO32 ~ 48 output enable clear register. If the value 1 is written to a bit
IM
here, the corresponding bit in GPIO_ENABLE1_REG will be cleared. Recommended operation:
use this register to clear GPIO_ENABLE1_REG. (WO)
Register 5.15. GPIO_STRAP_REG (0x0038)

EL
G
PIN
AP
TR
)
ed
_S
rv
O
se
PI
(re
31 16 15 0
PR
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
GPIO_STRAPPING GPIO strapping values: bit5 ~ bit2 correspond to stripping pins GPIO3, GPIO45,
GPIO0, and GPIO46 respectively. (RO)

Register 5.16. GPIO_IN_REG (0x003C)
XT
NE
A_
AT
D
N_
_I
O
PI
G
31 0
0 Reset
GPIO_IN_DATA_NEXT GPIO0 ~ 31 input value. Each bit represents a pin input value, 1 for high level
and 0 for low level. (RO)
RY
Register 5.17. GPIO_IN1_REG (0x0040)
E XT
_N
1
TA
DA
A N_
d)
ve
_I
r
O
se
PI
(re
G
31 22 21 0
0 0 0 0 0 0 0 0 0 0
IN 0
GPIO_IN_DATA1_NEXT GPIO32 ~ 48 input value. Each bit represents a pin input value. (RO)
Reset
IM
EL
PR

Register 5.18. GPIO_PINn_REG (n: 048) (0x0074+0x4*n)
LE
SS
AB
_D PAS
PA
EN
NC ER
_P PAD BY
BY
P_
SY RIV
PE
NA
PI Nn_ C1_
2_
IG
EU
TY
NF
_E
AK
T_
_P SYN
NT
IN
W
_C
I
n_
n_
n_
PI Nn_
n_
n
IN
IN
IN
IN
IN
d)
)
ed
I
_P
_P
_P
_P
_P
ve
rv
er
O
se
s
PI
PI
PI
PI
PI
(re
(re
G
G
31 18 17 13 12 11 10 9 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 0x0 0 0x0 0 0 0x0 0 0x0 Reset
GPIO_PINn_SYNC2_BYPASS For the second stage synchronization, GPIO input data can be syn-
RY
chronized on either edge of the APB clock. 0: no synchronization; 1: synchronized on falling edge;
2 and 3: synchronized on rising edge. (R/W)
GPIO_PINn_PAD_DRIVER Pin driver selection. 0: normal output; 1: open drain output. (R/W)
GPIO_PINn_SYNC1_BYPASS For the first stage synchronization, GPIO input data can be synchro-
nized on either edge of the APB clock. 0: no synchronization; 1: synchronized on falling edge; 2
A
and 3: synchronized on rising edge. (R/W)
GPIO_PINn_INT_TYPE Interrupt type selection. 0: GPIO interrupt disabled; 1: rising edge trigger; 2:
IN
falling edge trigger; 3: any edge trigger; 4: low level trigger; 5: high level trigger. (R/W)
GPIO_PINn_WAKEUP_ENABLE GPIO wake-up enable bit, only wakes up the CPU from Light-sleep.
(R/W)
GPIO_PINn_CONFIG Reserved (R/W)

IM
GPIO_PINn_INT_ENA Interrupt enable bits. bit13: CPU interrupt enabled; bit14: CPU non-maskable
interrupt enabled. (R/W)
EL
Register 5.19. GPIO_FUNCy_IN_SEL_CFG_REG (y: 0255) (0x0154+0x4*y)

L
SE
V_
L
SE
IN
_I L
Cy SE
N_
N_
UN N_
_I
Cy
_F _I
PR
O y
UN
PI SIG
d)
_F
e
rv
_
O
O
se
PI
PI
(re
G
G
31 8 7 6 5 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
GPIO_FUNCy_IN_SEL Selection control for peripheral input signal Y, selects a pin from the 48 GPIO
matrix pins to connect this input signal. Or selects 0x38 for a constantly high input or 0x3C for a
constantly low input. (R/W)
GPIO_FUNCy_IN_INV_SEL 1: Invert the input value; 0: Do not invert the input value. (R/W)
GPIO_SIGy_IN_SEL Bypass GPIO matrix. 1: route signals via GPIO matrix, 0: connect signals directly
to peripheral configured in IO MUX. (R/W)

Register 5.20. GPIO_FUNCx_OUT_SEL_CFG_REG (x: 048) (0x0554+0x4*x)
UT EL EL
EL
_O _S _S
_S
EL
Cx EN NV
NV
_S
UN _O _I
_I
_F Cx N
UT
O N OE
_O
PI U _
G F Cx
Cx
O N
UN
d)
PI FU
ve
_F
_
_
er
O
s
PI
PI
(re
G
G
G
31 12 11 10 9 8 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x100 Reset
GPIO_FUNCx_OUT_SEL Selection control for GPIO output X. If a value Y (0<=Y<256) is writ-

ten to this field, the peripheral output signal Y will be connected to GPIO output X.
RY
If a value 256 is written to this field, bit X of GPIO_OUT_REG/GPIO_OUT1_REG and
GPIO_ENABLE_REG/GPIO_ENABLE1_REG will be selected as the output value and output en-
able. (R/W)
GPIO_FUNCx_OUT_INV_SEL 0: Do not invert the output value; 1: Invert the output value. (R/W)
GPIO_FUNCx_OEN_SEL 0: Use output enable signal from peripheral; 1: Force the output enable
A
signal to be sourced from GPIO_ENABLE_REG[x]. (R/W)
GPIO_FUNCn_OEN_INV_SEL 0: Do not invert the output enable signal; 1: Invert the output enable
signal. (R/W)
IN
Register 5.21. GPIO_CLOCK_GATE_REG (0x062C)
IM
N
_E
LK
d)
_C
rve
O
se
PI
(re
31 1
G
0
EL
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 Reset
GPIO_CLK_EN Clock gating enable bit. If set to 1, the clock is free running. (R/W)
PR
Register 5.22. GPIO_STATUS_REG (0x0044)

PT
RU
R
TE
IN
S_
TU
TA
_S
O
PI
G
31 0
0x000000 Reset
GPIO_STATUS_INTERRUPT GPIO0 ~ 31 interrupt status register. (R/W)

Register 5.23. GPIO_STATUS1_REG (0x0050)
T
UP
RR
E
NT
_I
S1
TU
TA
)
ed
_S
rv
O
se
PI
(re
G
31 22 21 0
0 0 0 0 0 0 0 0 0 0 0x0000 Reset
GPIO_STATUS1_INTERRUPT GPIO32 ~ 48 interrupt status register. (R/W)
RY
Register 5.24. GPIO_CPU_INT_REG (0x005C)
T
IN
P U_
_C
O
A
PI
G
31 0
0x000000
IN Reset
GPIO_CPU_INT GPIO0 ~ 31 CPU interrupt status. This interrupt status is corresponding to the bit in
GPIO_STATUS_REG when assert (high) enable signal (bit13 of GPIO_PINn_REG). (RO)
IM
Register 5.25. GPIO_CPU_NMI_INT_REG (0x0060)
T
IN
I_
M
_N
PU
_C
EL
O
PI
G
31 0
0x000000 Reset
GPIO_CPU_NMI_INT GPIO0 ~ 31 CPU non-maskable interrupt status. This interrupt status is

PR
corresponding to the bit in GPIO_STATUS_REG when assert (high) enable signal (bit 14 of
GPIO_PINn_REG). (RO)

Register 5.26. GPIO_CPU_INT1_REG (0x0068)
T
IN
1_
PU
)
ed
_C
rv
O
se
PI
(re
G
31 22 21 0
0 0 0 0 0 0 0 0 0 0 0x0000 Reset
GPIO_CPU1_INT GPIO32 ~ 48 CPU interrupt status. This interrupt status is corresponding to the bit
in GPIO_STATUS1_REG when assert (high) enable signal (bit 13 of GPIO_PINn_REG). (RO)
RY
Register 5.27. GPIO_CPU_NMI_INT1_REG (0x006C)
TN
_I
I1
NM
U_
)
P
ed
_C
rv
O
se
A
PI
(re
G
31 22 21 0
0 0 0 0 0 0 0 0 0 0 0x0000 Reset
IN
GPIO_CPU_NMI1_INT GPIO32 ~ 48 CPU non-maskable interrupt status.
is corresponding to bit in GPIO_STATUS1_REG when assert (high) enable signal (bit 14 of
This interrupt status
GPIO_PINn_REG). (RO)
IM
Register 5.28. GPIO_STATUS_W1TS_REG (0x0048)
S
1T
_W
EL
T US
TA
_S
O
PI
G
31 0
0x000000 Reset
PR
GPIO_STATUS_W1TS GPIO0 ~ 31 interrupt status set register. If the value 1 is written to a bit here,
the corresponding bit in GPIO_STATUS_INTERRUPT will be set to 1. Recommended operation:
use this register to set GPIO_STATUS_INTERRUPT. (WO)

Register 5.29. GPIO_STATUS_W1TC_REG (0x004C)
C
1T
W
S_
TU
TA
_S
O
PI
G
31 0
0x000000 Reset
GPIO_STATUS_W1TC GPIO0 ~ 31 interrupt status clear register. If the value 1 is written to a bit here,
the corresponding bit in GPIO_STATUS_INTERRUPT will be cleared. Recommended operation:
use this register to clear GPIO_STATUS_INTERRUPT. (WO)
RY
Register 5.30. GPIO_STATUS1_W1TS_REG (0x0054)
S
1T
_W
A TA
S1
TU
)
ed
_S
rv
O
se
PI
(re
G
31
0 0 0 0 0 0 0 0 0
22
0
21
IN 0x0000
0
Reset
GPIO_STATUS1_W1TS GPIO32 ~ 48 interrupt status set register. If the value 1 is written to a bit here,
the corresponding bit in GPIO_STATUS1_REG will be set to 1. Recommended operation: use this
IM
register to set GPIO_STATUS1_REG. (WO)
Register 5.31. GPIO_STATUS1_W1TC_REG (0x0058)

EL
C
1T
_W
S1
TU
TA
d)
_S
e
rv
O
se
PI
(re
G
PR
31 22 21 0
0 0 0 0 0 0 0 0 0 0 0x0000 Reset
GPIO_STATUS1_W1TC GPIO32 ~ 48 interrupt status clear register. If the value 1 is written to a bit
here, the corresponding bit in GPIO_STATUS1_REG will be cleared. Recommended operation:
use this register to clear GPIO_STATUS1_REG. (WO)

Register 5.32. GPIO_STATUS_NEXT_REG (0x014C)
T
EX
T _N
UP
RR
TE
IN
S_
TU
TA
_S
O
PI
G
31 0
0x000000 Reset
GPIO_STATUS_INTERRUPT_NEXT Interrupt source signal of GPIO0 ~ 31, could be rising edge in-
RY
terrupt, falling edge interrupt, level sensitive interrupt and any edge interrupt. (RO)
Register 5.33. GPIO_STATUS_NEXT1_REG (0x0150)
XT
A TE
N
UP
RR
NE
T_
IN TA
S1
TU
_I
d)
_S
e
rv
O
se
PI
(re
31 22 21 0
0 0 0 0 0 0 0 0 0 0 0x0000 Reset
IM
GPIO_STATUS1_INTERRUPT_NEXT Interrupt source signal of GPIO32 ~ 48. (RO)
EL
Register 5.34. GPIO_DATE_REG (0x06FC)

E
AT
d)
_D
e
rv
O
se
PI
(re
31 28 27 0
PR
0 0 0 0 0x1907040 Reset
GPIO_DATE Version control register (R/W)
5.15.2 IO MUX Registers

The addresses in this section are relative to the IO MUX base address provided in Table 3-4 in Chapter 3 System
and Memory.

Register 5.35. IO_MUX_PIN_CTRL (0x0000)
M
TR
NU
K3
K2
K1
_C
T_
CL
CL
CL
ER
L_
L_
L_
_P
W
TR
TR
TR
O
CH
_P
_C
_C
_C
IT
D
IN
IN
IN
W
PA
_S
_P
_P
_P
)
_
ed
UX
UX
UX
UX
UX
rv
_M
_M
_M
_M
_M
se
(re
IO
IO
IO
IO
IO
31 16 15 14 12 11 8 7 4 3 0
0x0 0x0 0x2 0x0 0x0 0x0 Reset
IO_MUX_PIN_CTRL_CLKx If you want to output clock for I2S0 to:

CLK_OUT1�then set IO_MUX_PIN_CTRL_CLK1 = 0x0�
RY
CLK_OUT2�then set IO_MUX_PIN_CTRL_CLK2 = 0x0;
CLK_OUT3�then set IO_MUX_PIN_CTRL_CLK3 = 0x0.
If you want to output clock for I2S1 to:
CLK_OUT1�then set IO_MUX_PIN_CTRL_CLK1 = 0xF�
CLK_OUT2�then set IO_MUX_PIN_CTRL_CLK2 = 0xF;
A
CLK_OUT3�then set IO_MUX_PIN_CTRL_CLK3 = 0xF.
Note:
Only the above mentioned combinations of clock source and clock output pins are possible.
IN
The CLK_OUT1 ~ 3 can be found in IO_MUX Pin Function List.
IO_MUX_SWITCH_PRT_NUM GPIO pin power switch delay, delay unit is one APB clock.
IO_MUX_PAD_POWER_CTRL Select power voltage for GPIO33 ~ 37. 1: select VDD_SPI 1.8 V; 0:
IM
select VDD3P3_CPU 3.3 V.
EL
PR

Register 5.36. IO_MUX_n_REG (n: GPIO0GPIO21, GPIO26GPIO48) (0x0010+4*n)
_M _S U_ U
_M _S D
N
U
PD
L
IO UX UN V
IO UX C WP
UX LP WP
E
CU EL
E
UN P
E
_M _F DR
IO UX C IE
R_
_O
_S
(re X_F _W
ed _W
U UN E
_M _M U_
_M _M U_
_ M _F _I
_
E
CU
UN
LT
IO UX C
_M
_ M _M
FI
_F
d)
)
_
UX
UX
UX
IO UX
IO UX
ve
rv
r
_M
_M
_M
_M
_M
se
se
(re
IO
IO
IO
IO
IO
31 16 15 14 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 0x0 0x2 0 0 0 00 0 0 0 0 0 Reset
IO_MUX_MCU_OE Output enable of the pin in sleep mode. 1: Output enabled; 0: Output disabled.
(R/W)
IO_MUX_SLP_SEL Sleep mode selection of this pin. Set to 1 to put the pin in sleep mode. (R/W)
RY
IO_MUX_MCU_WPD Pull-down enable of the pin during sleep mode. 1: Internal pull-down enabled;
0: Internal pull-down disabled. (R/W)
IO_MUX_MCU_WPU Pull-up enable of the pin during sleep mode. 1: Internal pull-up enabled; 0:
Internal pull-up disabled.
A
IO_MUX_MCU_IE Input enable of the pin during sleep mode. 1: Input enabled; 0: Input disabled.
(R/W) IN
IO_MUX_FUN_WPD Pull-down enable of the pin. 1: Pull-down enabled; 0: Pull-down disabled.
(R/W)
IO_MUX_FUN_WPU Pull-up enable of the pin. 1: Internal pull-up enabled; 0: Internal pull-up dis-
abled. (R/W)
IM
IO_MUX_FUN_IE Input enable of the pin. 1: Input enabled; 0: Input disabled. (R/W)
IO_MUX_FUN_DRV Select the drive strength of the pin. 0: ~5 mA: 1: ~10 mA: 2: ~20 mA; 3: ~40
mA. (R/W)
EL
IO_MUX_MCU_SEL Select IO MUX function for this signal. 0: Select Function 0; 1: Select Function
1, etc. (R/W)
IO_MUX_FILTER_EN Enable filter for pin input signals. 1: Filter enabled; 2: Filter disabled. (R/W)
PR
5.15.3 SDM Output Registers

The addresses in this section are relative to (GPIO base address provided in Table 3-4 in Chapter 3 System and
Memory + 0x0F00).

Register 5.37. GPIO_SIGMADELTAn_REG (n: 07) (0x0000+4*n)
LE
S CA
RE
N
_P
_I
Dn
Dn
)
ed
_S
_S
rv
O
se
PI
PI
(re
G
31 16 15 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0xff 0x0 Reset
GPIO_SDn_IN This field is used to configure the duty cycle of sigma delta modulation output. (R/W)
GPIO_SDn_PRESCALE This field is used to set a divider value to divide APB clock. (R/W)
RY
Register 5.38. GPIO_SIGMADELTA_CG_REG (0x0020)
EN
K_
CL
A
D_
)
ed
_S
rv
O
se
PI
(re
G
31 30 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
IN
0 0 0
GPIO_SD_CLK_EN Clock enable bit of configuration registers for sigma delta modulation. (R/W)
0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
IM
Register 5.39. GPIO_SIGMADELTA_MISC_REG (0x0024)
EN
K_
CL
N_
CT P
IO
UN A
EL
_F SW
O I_
)
PI P
ed
G _S
rv
O
se
PI
(re
G
31 30 29 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
PR
GPIO_FUNCTION_CLK_EN Clock enable bit of sigma delta modulation. (R/W)
GPIO_SPI_SWAP Reserved. (R/W)

Register 5.40. GPIOSD_SIGMADELTA_VERSION_REG (0x0028)
E
AT
_D
)
D
ed
_S
rv
O
se
PI
(re
G
31 28 27 0
0 0 0 0 0x1802260 Reset
GPIO_SD_DATE Version control register. (R/W)
5.15.4 RTC IO MUX Registers
RY
The addresses in this section are relative to (Low-Power Management base address provided in Table 3-4 in
Chapter 3 System and Memory + 0x0400).
Register 5.41. RTC_GPIO_OUT_REG (0x0000)
A
A
AT
_D
UT
_O
O
)
PI
ed
G
rv
IN
C_
se
RT
(re
31 10 9 0
0 0 0 0 0 0 0 0 0 0 0 Reset
RTC_GPIO_OUT_DATA GPIO0 ~ 21 output register. Bit10 corresponds to GPIO0, bit11 corresponds

IM
to GPIO1, etc. (R/W)
Register 5.42. RTC_GPIO_OUT_W1TS_REG (0x0004)

EL
S
1T
W
A_
AT
_D
UT
_O
O
)
PI
ed
G
rv
PR
C_
se
RT
(re
31 10 9 0
0 0 0 0 0 0 0 0 0 0 0 Reset
RTC_GPIO_OUT_DATA_W1TS GPIO0 ~ 21 output set register. If the value 1 is written to a bit here,
the corresponding bit in RTC_GPIO_OUT_REG will be set to 1. Recommended operation: use
this register to set RTC_GPIO_OUT_REG. (WO)

Register 5.43. RTC_GPIO_OUT_W1TC_REG (0x0008)
C
1T
W
A_
AT
_D
UT
_O
O
)
PI
ed
G
rv
C_
se
RT
(re
31 10 9 0
0 0 0 0 0 0 0 0 0 0 0 Reset
RTC_GPIO_OUT_DATA_W1TC GPIO0 ~ 21 output clear register. If the value 1 is written to a bit here,
the corresponding bit in RTC_GPIO_OUT_REG will be cleared. Recommended operation: use this
RY
register to clear RTC_GPIO_OUT_REG. (WO)
Register 5.44. RTC_GPIO_ENABLE_REG (0x000C)
A
E
BL
NA
_E
O
)
PI
ed
G
rv
C_
IN
se
RT
(re
31 10 9 0
0 0 0 0 0 0 0 0 0 0 0 Reset
RTC_GPIO_ENABLE GPIO0 ~ 21 output enable. Bit10 corresponds to GPIO0, bit11 corresponds to

IM
GPIO1, etc. If the bit is set to 1, it means this GPIO pin is output. (R/W)
Register 5.45. RTC_GPIO_ENABLE_W1TS_REG (0x0010)

EL
S
1T
W
E_
BL
NA
_E
O
)
PI
ed
G
rv
C_
se
RT
(re
PR
31 10 9 0
0 0 0 0 0 0 0 0 0 0 0 Reset
RTC_GPIO_ENABLE_W1TS GPIO0 ~ 21 output enable set register. If the value 1 is written to a bit
here, the corresponding bit in RTC_GPIO_ENABLE_REG will be set to 1. Recommended opera-
tion: use this register to set RTC_GPIO_ENABLE_REG. (WO)

Register 5.46. RTC_GPIO_ENABLE_W1TC_REG (0x0014)
C
1T
_W
LE
N AB
_E
O
)
PI
ed
G
rv
C_
se
RT
(re
31 10 9 0
0 0 0 0 0 0 0 0 0 0 0 Reset
RTC_GPIO_ENABLE_W1TC GPIO0 ~ 21 output enable clear register. If the value 1 is written to

a bit here, the corresponding bit in RTC_GPIO_ENABLE_REG will be cleared. Recommended
RY
operation: use this register to clear RTC_GPIO_ENABLE_REG. (WO)
Register 5.47. RTC_GPIO_STATUS_REG (0x0018)

T
A
IN
S_
TU
TA
_S
O
)
PI
ed
G
rv
IN
C_
se
RT
(re
31 10 9 0
0 0 0 0 0 0 0 0 0 0 0 Reset
RTC_GPIO_STATUS_INT GPIO0 ~ 21 interrupt status register. Bit10 corresponds to

IM
GPIO0, bit11 corresponds to GPIO1, etc. This register should be used together with
RTC_GPIO_PINn_INT_TYPE in RTC_GPIO_PINn_REG. 0: no interrupt; 1: corresponding
interrupt. (R/W)
EL
Register 5.48. RTC_GPIO_STATUS_W1TS_REG (0x001C)

S
1T
W
T_
IN
S_
PR
TU
TA
_S
O
)
PI
d
ve
G
r
C_
se
RT
(re
31 10 9 0
0 0 0 0 0 0 0 0 0 0 0 Reset
RTC_GPIO_STATUS_INT_W1TS GPIO0 ~ 21 interrupt set register. If the value 1 is written to a bit

here, the corresponding bit in RTC_GPIO_STATUS_INT will be set to 1. Recommended operation:
use this register to set RTC_GPIO_STATUS_INT. (WO)

Register 5.49. RTC_GPIO_STATUS_W1TC_REG (0x0020)
C
1T
W
T_
IN
S_
TU
TA
_S
O
)
PI
ed
G
rv
C_
se
RT
(re
31 10 9 0
0 0 0 0 0 0 0 0 0 0 0 Reset
RTC_GPIO_STATUS_INT_W1TC GPIO0 ~ 21 interrupt clear register. If the value 1 is written to a bit
RY
here, the corresponding bit in RTC_GPIO_STATUS_INT will be cleared. Recommended operation:
use this register to clear RTC_GPIO_STATUS_INT. (WO)
Register 5.50. RTC_GPIO_IN_REG (0x0024)
A
T
EX
N_N
_I
O
)
PI
ed
G
rv
IN
C_
se
RT
(re
31 10 9 0
0 0 0 0 0 0 0 0 0 0 0 Reset
RTC_GPIO_IN_NEXT GPIO0 ~ 21 input value. Bit10 corresponds to GPIO0, bit11 corresponds to

IM
GPIO1, etc. Each bit represents a pin input value, 1 for high level, and 0 for low level. (RO)
Register 5.51. RTC_GPIO_PINn_REG (n: 021) (0x0028+0x4*n)

EL
E
BL
NA
ER
_E
V
E
UP
RI
YP
_D
E
_T
AK
AD
NT
_W
_P
I
n_
Nn
ed INn
IN
I
_P
_P
se O_P
PR
O
d)
d)
)
PI
PI
PI
e
e
G
G
rv
rv
rv
C_
C_
C_
se
se
RT
RT
RT
(re
(re
(re
31 11 10 9 7 6 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RTC_GPIO_PINn_PAD_DRIVER Pin driver selection. 0: normal output; 1: open drain. (R/W)
RTC_GPIO_PINn_INT_TYPE GPIO interrupt type selection. 0: GPIO interrupt disabled; 1: rising

edge trigger; 2: falling edge trigger; 3: any edge trigger; 4: low level trigger; 5: high level trigger.
(R/W)
RTC_GPIO_PINn_WAKEUP_ENABLE GPIO wake-up enable. This will only wake up the chip from
Light-sleep. (R/W)

Register 5.52. RTC_IO_TOUCH_PADn_REG (n: 014) (0x0084+0x4*n)
H_ Dn LP EL
n_ _SE
CH Dn_ PD T
SE
UN E
A X P
E
PA _S _IE
_F _O
CH AD TI T
U C P _S _S
_I
_P n_ E_O
N_
C_ OU _P n_ AR
AD UX
AD RV
n_ E
E
O H_ Dn P
Dn LP
AD RD
RU
FU
_T C A ST
_T C A SL
M
_D
_P n_
IO OU _P n_
IO OU _P n_
Dn
C_ _T CH AD
H D
C_ _T CH AD
PA
A
UC P
RT _IO OU H_P
_P
RT _IO OU H_P
H_
O H_
H
UC
_T C
C _T C
C _T C
IO OU
RT _IO OU
C_ OU
RT _IO OU
O
_T
C_ T
C _T
_T
C T
)
)
ed
ed
ed
_
_
O
RT _IO
RT _IO
IO
RT IO
rv
rv
rv
I
C_
se
se
se
C
C
RT
RT
RT
RT
RT
(re
(re
(re
31 30 29 28 27 26 23 22 21 20 19 18 17 16 15 14 13 12 0
0 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RTC_IO_TOUCH_PADn_FUN_IE Input enable in normal execution. (R/W)
RY
RTC_IO_TOUCH_PADn_SLP_OE Output enable in sleep mode. (R/W)
RTC_IO_TOUCH_PADn_SLP_IE Input enable in sleep mode. (R/W)
RTC_IO_TOUCH_PADn_SLP_SEL 0: no sleep mode; 1: enable sleep mode. (R/W)
RTC_IO_TOUCH_PADn_FUN_SEL Function selection. (R/W)
A
RTC_IO_TOUCH_PADn_MUX_SEL Connect the RTC pin input or digital pin input. 0 is available, i.e.
select digital pin input. (R/W)
RTC_IO_TOUCH_PADn_XPD Touch sensor power on. (R/W)

IN
RTC_IO_TOUCH_PADn_TIE_OPT The tie option of touch sensor. 0: tie low; 1: tie high. (R/W)
RTC_IO_TOUCH_PADn_START Start touch sensor. (R/W)

IM
RTC_IO_TOUCH_PADn_RUE Pull-up enable of the pin. 1: internal pull-up enabled; 0: internal pull-
up disabled. (R/W)
RTC_IO_TOUCH_PADn_RDE Pull-down enable of the pin. 1: internal pull-down enabled, 0: internal

EL
pull-down disabled. (R/W)
RTC_IO_TOUCH_PADn_DRV Select the drive strength of the pin. 0: ~5 mA: 1: ~10 mA: 2: ~20 mA;
3: ~40 mA. (R/W)
PR

Register 5.53. RTC_IO_XTAL_32P_PAD_REG (0x00C0)
UN L
RT _IO 32 SLP L
IO 32 LP EL
E
FU OE
IE
2P X_S
32 SL IE
_S
C_ X _S _S
N_
_X P_ _
P_ P_
V
P_ E
E
U
DR
32 RD
RU
_F
P_
_X _
P_
C _X P_
P
P
C_ 32
IO 32
32
RT _IO 32
X3
_X
C_ _X
_X
C _X
d)
)
ed
ed
_
_
ve
IO
RT IO
IO
IO
RT IO
rv
rv
er
C_
C_
C_
C_
se
se
s
RT
RT
RT
RT
RT
(re
(re
(re
31 30 29 28 27 26 20 19 18 17 16 15 14 13 12 0
0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RTC_IO_X32P_FUN_IE Input enable in normal execution. (R/W)
RTC_IO_X32P_SLP_OE Output enable in sleep mode. (R/W)
RY
RTC_IO_X32P_SLP_IE Input enable in sleep mode. (R/W)
RTC_IO_X32P_SLP_SEL 1: enable sleep mode; 0: no sleep mode. (R/W)
RTC_IO_X32P_FUN_SEL Function selection. (R/W)
RTC_IO_X32P_MUX_SEL 1: use RTC GPIO; 0: use digital GPIO. (R/W)
A
RTC_IO_X32P_RUE Pull-up enable of the pin. 1: internal pull-up enabled; 0: internal pull-up disabled.
(R/W)
IN
RTC_IO_X32P_RDE Pull-down enable of the pin. 1: internal pull-down enabled, 0: internal pull-down
disabled. (R/W)
RTC_IO_X32P_DRV Select the drive strength of the pin. 0: ~5 mA: 1: ~10 mA: 2: ~20 mA; 3: ~40
IM
mA. (R/W)
EL
PR

Register 5.54. RTC_IO_XTAL_32N_PAD_REG (0x00C4)
_F SEL
RT _IO 32 SLP L
IO 32 LP EL
E
FU OE
IE
32 SL IE
_S
C_ X _S _S
_
N_
_X N_ _
N_ P_
UX
V
N_ E
E
UN
DR
32 RD
RU
M
N_
_X _
N_
C _X N_
N
N
C_ 32
IO 32
C_ 32
C_ 32
RT IO 32
_X
C_ _X
_X
_X
C_ _X
d)
)
ed
ed
_
ve
IO
RT IO
IO
IO
RT IO
rv
rv
er
C_
C_
se
se
s
RT
RT
RT
RT
RT
(re
(re
(re
31 30 29 28 27 26 20 19 18 17 16 15 14 13 12 0
0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RTC_IO_X32N_FUN_IE Input enable in normal execution. (R/W)
RTC_IO_X32N_SLP_OE Output enable in sleep mode. (R/W)
RY
RTC_IO_X32N_SLP_IE Input enable in sleep mode. (R/W)
RTC_IO_X32N_SLP_SEL 1: enable sleep mode; 0: no sleep mode. (R/W)
RTC_IO_X32N_FUN_SEL Function selection. (R/W)
RTC_IO_X32N_MUX_SEL 1: use RTC GPIO; 0: use digital GPIO. (R/W)
A
RTC_IO_X32N_RUE Pull-up enable of the pin. 1: internal pull-up enabled; 0: internal pull-up dis-
abled. (R/W)
IN
RTC_IO_X32N_RDE Pull-down enable of the pin. 1: internal pull-down enabled, 0: internal pull-down
disabled. (R/W)
RTC_IO_X32N_DRV Select the drive strength of the pin. 0: ~5 mA: 1: ~10 mA: 2: ~20 mA; 3: ~40
IM
mA. (R/W)
EL
PR

Register 5.55. RTC_IO_RTC_PADn_REG (n: 1721) (0x00C8, 0x00CC, 0x00D0, 0x00D4, 0x00D8)
IO TC AD LP L
_P n_ P_ L
n_ _SE
FU OE
TC AD SL SE
IE
AD SL IE
S
N_
N_
_R _P n_ _
n_ P_
UX
V
n_ E
E
DR
AD D
RU
FU
_M
R
C_ R P _S
n_
_P n_
RT ADn
n
AD
TC AD
RT _IO TC AD
PA
_P
_R _P
_P
C _R _P
C_
_
TC
IO TC
TC
RT IO TC
_R
C_ R
_R
C_ _R
)
)
ed
ed
ed
_
_
IO
RT IO
IO
IO
RT IO
rv
rv
rv
C_
C_
C_
C_
C_
se
se
se
RT
RT
RT
RT
RT
(re
(re
(re
31 30 29 28 27 26 20 19 18 17 16 15 14 13 12 0
0 2 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RTC_IO_RTC_PADn_FUN_IE Input enable in normal execution. (R/W)
RY
RTC_IO_RTC_PADn_SLP_OE Output enable in sleep mode. (R/W)
RTC_IO_RTC_PADn_SLP_IE Input enable in sleep mode. (R/W)
RTC_IO_RTC_PADn_SLP_SEL 1: enable sleep mode; 0: no sleep mode. (R/W)
RTC_IO_RTC_PADn_FUN_SEL Function selection. (R/W)
A
RTC_IO_RTC_PADn_MUX_SEL 1: use RTC GPIO; 0: use digital GPIO. (R/W)
RTC_IO_RTC_PADn_RUE Pull-up enable of the pin. 1: internal pull-up enabled; 0: internal pull-up
disabled. (R/W)
IN
RTC_IO_RTC_PADn_RDE Pull-down enable of the pin. 1: internal pull-down enabled, 0: internal
pull-down disabled. (R/W)
IM
RTC_IO_RTC_PADn_DRV Select the drive strength of the pin. 0: ~5 mA: 1: ~10 mA: 2: ~20 mA; 3:
~40 mA. (R/W)
Register 5.56. RTC_IO_XTL_EXT_CTR_REG (0x00E0)

EL _C
_S
TR
EL
XT
_E
TL
_X
)
ed
IO
PR
rv
C_
se
RT
(re
31 27 26 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RTC_IO_XTL_EXT_CTR_SEL Select the external crystal power down enable source to get into
sleep mode. 0: select GPIO0; 1: select GPIO1, etc. The input value on this pin XOR
RTC_CNTL_EXT_XTL_CONF_REG[30] is the crystal power down enable signal. (R/W)

Register 5.57. RTC_IO_SAR_I2C_IO_REG (0x00E4)
EL
EL
_S
_S
DA
CL
_S
_S
2C
2C
_I
_I
AR
AR
_S
_S
d)
ve
IO
IO
er
C_
C_
s
RT
RT
(re
31 30 29 28 27 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RTC_IO_SAR_I2C_SCL_SEL Selects a pin the RTC I2C SCL signal connects to. 0: use RTC GPIO0;
1: use RTC GPIO2. (R/W)
RY
RTC_IO_SAR_I2C_SDA_SEL Selects a pin the RTC I2C SDA signal connects to. 0: use RTC GPIO1;
1: use RTC GPIO3. (R/W)
Register 5.58. RTC_IO_DATE_REG (0x01FC)
A
E
AT
_D
d)
ve
IO
IN
r
C_
se
RT
(re
31 28 27 0
0 0 0 0 0x1903170 Reset
RTC_IO_DATE Version control register (R/W)

IM
EL
PR

6 Reset and Clock
6 Reset and Clock
6.1 Reset
6.1.1 Overview
ESP32-S3 provides four reset levels, namely CPU Reset, Core Reset, System Reset, and Chip Reset.
All reset levels mentioned above (except Chip Reset) maintain the data stored in internal memory. Figure 6-1
shows the affected subsystems of the four reset levels.
6.1.2 Architectural Overview
A RY
IN
IM
EL
Figure 61. Reset Levels
6.1.3 Features
PR
• Support four reset levels:
– CPU Reset: only resets CPUx core. CPUx can be CPU0 or CPU1 here. Once such reset is released,
programs will be executed from CPUx reset vector. Each CPU core has its own reset logic.
– Core Reset: resets the whole digital system except RTC, including CPU0, CPU1, peripherals, Wi-Fi,
Bluetooth® LE (BLE), and digital GPIOs.
– System Reset: resets the whole digital system, including RTC.
– Chip Reset: resets the whole chip.
• Support software reset and hardware reset:
– Software reset is triggered by CPUx configuring its corresponding registers.

6 Reset and Clock
– Hardware reset is directly triggered by the circuit.
Note:
If CPU Reset is from CPU0, the sensitive registers will be reset, too.

CPU0 and CPU1 will be reset immediately when any of the reset above occurs. After the reset is released, CPU0
and CPU1 can read from the registers RTC_CNTL_RESET_CAUSE_PROCPU and RTC_CNTL_RESET_
CAUSE_APPCPU to get the reset source, respectively. The reset sources recorded in the two registers are
shared by the two CPUs, except the CPU reset sources, i.e. each CPU has its own CPU reset sources.
RY
Table 6-1 lists the reset sources and the types of reset they trigger.
Table 61. Reset Sources
Code Source Reset Type Comments

1
0x01 Chip reset Chip Reset -
A
Chip Reset or
0x0F Brown-out system reset Triggered by brown-out detector2
System Reset IN
0x10 RWDT system reset System Reset See Chapter 11 Watchdog Timers
0x12 Super Watchdog reset System Reset See Chapter 11 Watchdog Timers
0x13 GLITCH reset System Reset See Chapter 20 Clock Glitch Detection
0x03 Software system reset Core Reset Triggered by configuring RTC_CNTL_SW_SYS_RST
IM
See Chapter 7 Low-Power Management (RTC_CNTL) [to be
0x05 Deep-sleep reset Core Reset
added later]
0x07 MWDT0 core reset Core Reset See Chapter 11 Watchdog Timers
0x08 MWDT1 core reset Core Reset See Chapter 11 Watchdog Timers
0x09 RWDT core reset Core Reset See Chapter 11 Watchdog Timers
EL
0x14 eFuse reset Core Reset Triggered by eFuse CRC error

Triggered when external USB host sends a specific command
0x15 USB (UART) reset Core Reset to the Serial interface of USB-Serial-JTAG. See 26 USB Se-
rial/JTAG Controller (USB_SERIAL_JTAG)
Triggered when external USB host sends a specific command
PR
0x16 USB (JTAG) reset Core Reset to the JTAG interface of USB-Serial-JTAG. See 26 USB Se-
rial/JTAG Controller (USB_SERIAL_JTAG)
0x0B MWDT0 CPUx reset CPU Reset See Chapter 11 Watchdog Timers
0x0C Software CPUx reset CPU Reset Triggered by configuring RTC_CNTL_SW_PRO(APP)CPU_RST
0x0D RWDT CPUx reset CPU Reset See Chapter 11 Watchdog Timers
0x11 MWDT1 CPUx reset CPU Reset See Chapter 11 Watchdog Timers
1
Chip Reset can be triggered by the following three sources:
• Triggered by chip power-on;
• Triggered by brown-out detector;
• Triggered by Super Watchdog (SWD).
2
Once brown-out status is detected, the detector will trigger System Reset or Chip Reset, depending on register
configuration. For more information, please see Chapter 7 Low-Power Management (RTC_CNTL) [to be added later].

6 Reset and Clock
6.2 Clock
6.2.1 Overview
ESP32-S3 clocks are mainly sourced from oscillator (OSC), RC, and PLL circuit, and then processed by the
dividers/selectors, which allows most functional modules to select their working clock according to their power
consumption and performance requirements. Figure 6-2 shows the system clock structure.
6.2.2 Architectural Overview
A RY
IN
IM
EL
PR
Figure 62. Clock Structure
6.2.3 Features
ESP32-S3 clocks can be classified in two types depending on their frequencies:
• High speed clocks for devices working at a higher frequency, such as CPU and digital peripherals
– PLL_CLK (320 MHz or 480 MHz): internal PLL clock
– XTAL_CLK (40 MHz): external crystal clock
• Slow speed clocks for low-power devices, such as RTC module and low-power peripherals
– XTAL32K_CLK (32 kHz): external crystal clock

6 Reset and Clock
– FOSC_CLK (17.5 MHz by default): internal fast RC oscillator clock with adjustable frequency
– FOSC_DIV_CLK: internal fast RC oscillator clock derived from FOSC_CLK divided by 256
– RTC_CLK (136 kHz by default): internal low RC oscillator clock with adjustable frequency
6.2.4.1 CPU Clock
As Figure 6-2 shows, CPU_CLK is the master clock for CPUx and it can be as high as 240 MHz when CPUx
works in high performance mode. Alternatively, CPUx can run at lower frequencies, such as at 2 MHz, to lower
power consumption.
RY
Users can set PLL_CLK, FOSC_CLK or XTAL_CLK as CPU_CLK clock source by configuring register
SYSTEM_SOC_CLK_SEL, see Table 6-2 and Table 6-3. By default, the CPU clock is sourced from XTAL_CLK
with a divider of 2, i.e. the CPU clock is 20 MHz.
Table 62. CPU Clock Source
A
SYSTEM_SOC_CLK_SEL Value CPU Clock Source
0 XTAL_CLK
1 PLL_CLK
2
IN FOSC_CLK
Table 63. CPU Clock Frequency
CPU Clock Source SEL_0* SEL_1* SEL_2* CPU Clock Frequency

IM
CPU_CLK = XTAL_CLK/(SYSTEM_PRE_DIV_CNT + 1)
XTAL_CLK 0 - -
SYSTEM_PRE_DIV_CNT ranges from 0 ~ 1023. Default is 1
CPU_CLK = PLL_CLK/6
PLL_CLK (480 MHz) 1 1 0
CPU_CLK frequency is 80 MHz
CPU_CLK = PLL_CLK/3
EL
PLL_CLK (480 MHz) 1 1 1

CPU_CLK = PLL_CLK/2
PLL_CLK (480 MHz) 1 1 2
CPU_CLK = PLL_CLK/4
PLL_CLK (320 MHz) 1 0 0
PR
CPU_CLK = PLL_CLK/2
PLL_CLK (320 MHz) 1 0 1
CPU_CLK = FOSC_CLK/(SYSTEM_PRE_DIV_CNT + 1)
FOSC_CLK 2 - -
SYSTEM_PRE_DIV_CNT ranges from 0 ~ 1023. Default is 1
*
The value of register SYSTEM_SOC_CLK_SEL.
*
The value of register SYSTEM_PLL_FREQ_SEL.
*
The value of register SYSTEM_CPUPERIOD_SEL.
6.2.4.2 Peripheral Clocks
Peripheral clocks include APB_CLK, CRYPTO_PWM_CLK, PLL_160M_CLK, PLL_240M_CLK, LEDC_CLK,

XTAL_CLK, and FOSC_CLK. Table 6-4 shows which clock can be used by each peripheral.

Espressif Systems
6 Reset and Clock

Table 64. Peripheral Clocks
Peripheral XTAL_CLK APB_CLK PLL_160M_CLK PLL_240M_CLK FOSC_CLK CRYPTO_PWM_CLK LEDC_CLK
PR
TIMG Y Y
I2S Y Y Y
UHCI Y
UART Y Y Y
RMT Y Y Y
PWM Y
EL
I2C Y Y
SPI Y Y
PCNT Y
eFuse Controller Y
SARADC Y Y
IM
USB Y
242
CRYPTO Y
TWAI Controller Y
SDIO HOST Y Y
LEDC Y Y Y Y
IN
LCD_CAM Y Y Y
SYS_TIMER Y Y
A RY
6 Reset and Clock
APB_CLK
APB_CLK frequency is determined by the clock source of CPU_CLK as shown in Table 6-5.
Table 65. APB_CLK Fequency
CPU_CLK Source APB_CLK Frequency

PLL_CLK 80 MHz
XTAL_CLK CPU_CLK
FOSC_CLK CPU_CLK
CRYPTO_PWM_CLK
RY
The frequency of CRYPTO_PWM_CLK is determined by the CPU_CLK source, as shown in Table 6-6.
Table 66. CRYPTO_PWM_CLK Frequency
CPU_CLK Source CRYPTO_PWM_CLK Frequency

PLL_CLK 160 MHz
A
XTAL_CLK CPU_CLK
FOSC_CLK IN CPU_CLK
PLL_160M_CLK
PLL_160M_CLK is divided from PLL_CLK according to current PLL frequency.
PLL_240M_CLK
IM
PLL_240M_CLK is divided from PLL_CLK according to current PLL frequency.
LEDC_CLK
LEDC module uses FOSC_CLK as clock source when APB_CLK is disabled. In other words, when the system is
EL
in low-power mode, most peripherals will be halted (APB_CLK is turned off), but LEDC can work normally via
FOSC_CLK.
6.2.4.3 WiFi and Bluetooth LE Clock
Wi-Fi and Bluetooth LE can work only when CPU_CLK uses PLL_CLK as its clock source. Suspending PLL_CLK
PR
requires that Wi-Fi and Bluetooth LE has entered low-power mode first.
LOW_POWER_CLK uses XTAL32K_CLK, XTAL_CLK, FOSC_CLK or SLOW_CLK (the low clock selected by
RTC) as its clock source for Wi-Fi and Bluetooth LE in low-power mode.
6.2.4.4 RTC Clock
The clock sources for SLOW_CLK and FAST_CLK are low-frequency clocks. RTC module can operate when
most other clocks are stopped.
SLOW_CLK is derived from RTC_CLK, XTAL32K_CLK or FOSC_DIV_CLK and used to clock Power
Management module. FAST_CLK is used to clock On-chip Sensor module. It can be sourced from a divided
XTAL_CLK or from FOSC_CLK.

7 Chip Boot Control
7 Chip Boot Control
7.1 Overview
ESP32-S3 has four strapping pins:
• GPIO0
• GPIO3
• GPIO45
• GPIO46
RY
These strapping pins are used to control the following functions during chip power-on or hardware reset:
• control chip boot mode
• enable or disable ROM code printing to UART
• control the voltage of VDD_SPI
A
• control the source of JTAG signals
During system reset triggered by power-on, brown-out or by analog super watchdog (see Chapter 6 Reset and
IN
Clock), hardware captures samples and stores the voltage level of strapping pins as strapping bit of “0” or “1” in
latches, and holds these bits until the chip is powered down or shut down. Software can read the latch status
(strapping value) from the register GPIO_STRAPPING.
By default, GPIO0, GPIO45, and GPIO46 are connected to the chip’s internal pull-up/pull-down resistors. If these
IM
pins are not connected or connected to an external high-impedance circuit, the internal weak pull-up/pull-down
determines the default input level of these strapping pins (see Table 7-1).
Table 71. Default Configuration of Strapping Pins
Strapping Pin Default Configuration

EL
GPIO0 Pull-up
GPIO3 N/A
GPIO45 Pull-down
GPIO46 Pull-down
PR
To change the strapping bit values, users can apply external pull-down/pull-up resistors, or use host MCU GPIOs
to control the voltage level of these pins when powering on ESP32-S3. After the reset is released, the strapping
pins work as normal-function pins.
Note:
The following section provides description of the chip functions and the pattern of the strapping pins values to invoke
each function. Only documented patterns should be used. If some pattern is not documented, it may trigger unexpected
behavior.

7 Chip Boot Control
7.2 Boot Mode Control

GPIO0 and GPIO46 control the boot mode after the reset is released.
Table 72. Boot Mode Control
Boot Mode GPIO0 GPIO46

SPI Boot 1 x
Download Boot 0 0
Table 7-2 shows the strapping pin values of GPIO0 and GPIO46, and the associated boot modes. “x” means
that this value is ignored. The ESP32-S3 chip only supports the two boot modes listed above. The strapping
RY
combination of GPIO0 = 0 and GPIO46 = 1 is not supported and will trigger unexpected behavior.
In SPI Boot mode, the CPU boots the system by reading the program stored in SPI flash. SPI Boot mode can be
further classified as follows:
• Normal Flash Boot: supports Security Boot and programs run in RAM.
A
• Direct Boot: does not support Security Boot and programs run directly in flash. To enable this mode, make
sure that the first two words of the bin file downloading to flash (address: 0x42000000) are 0xaebd041d.
In Download Boot mode, users can download code to flash using UART0 or USB interface. It is also possible to
IN
load a program into SRAM and execute it in this mode.
The following eFuses control boot mode behaviors:
• EFUSE_DIS_FORCE_DOWNLOAD
IM
If this eFuse is 0 (default), software can force switch the chip from SPI Boot mode to Download Boot mode
by setting register RTC_CNTL_FORCE_DOWNLOAD_BOOT and triggering a CPU reset. If this eFuse is 1,
RTC_CNTL_FORCE_DOWNLOAD_BOOT is disabled.
• EFUSE_DIS_DOWNLOAD_MODE
EL
If this eFuse is 1, Download Boot mode is disabled.
• EFUSE_ENABLE_SECURITY_DOWNLOAD
If this eFuse is 1, Download Boot mode only allows reading, writing, and erasing plaintext flash and does
not support any SRAM or register operations. Ignore this eFuse if Download Boot mode is disabled.
PR
USB Serial/JTAG Controller can also force the chip into Download Boot mode from SPI Boot mode, as well as
force the chip into SPI Boot mode from Download Boot mode. For detailed information, please refer to Chapter
26 USB Serial/JTAG Controller (USB_SERIAL_JTAG).
7.3 ROM Code Printing Control

During the early boot process,
• if EFUSE_DIS_USB_DEVICE and EFUSE_DIS_USB are cleared, ROM code is always printed to USB
Serial/JTAG controller.
• Otherwise, GPIO46 controls ROM code printing, together with EFUSE_UART_PRINT_CONTROL. See
Table 7-3.

7 Chip Boot Control
Table 73. ROM Code Printing Control
eFuse1 GPIO46 ROM Code Printing

ROM code is always printed to UART during boot.
0 x
The value of GPIO46 is ignored.
0 Print is enabled during boot.
1
1 Print is disabled during boot.
0 Print is disabled during boot.
2
1 Print is enabled during boot.
Print is always disabled during boot. The value of GPIO46 is
3 x
ignored.
RY
1
eFuse: EFUSE_UART_PRINT_CONTROL
If ROM code is printed to UART, U0TXD is used as the default pin. To print the ROM code to pin U1TXD,
configure EFUSE_UART_PRINT_CHANNEL:
• 0: print to pin U0TXD
A
• 1: print to pin U1TXD
7.4 VDD_SPI Voltage Control

IN
GPIO45 is used to select the VDD_SPI power supply voltage at reset:
• GPIO45 = 0, VDD_SPI pin is powered directly from VDD3P3_RTC via resistor RSP I . Typically this voltage is
3.3 V. For more information, see Figure 4: ESP32-S3 Power Scheme in ESP32-S3 Datasheet.
IM
• GPIO45 = 1, VDD_SPI pin is powered from internal 1.8 V LDO.
This functionality can be overridden by setting eFuse bit EFUSE_VDD_SPI_FORCE to 1, in which case the
EFUSE_
VDD_SPI_TIEH determines the VDD_SPI voltage:
EL
• EFUSE_VDD_SPI_TIEH = 0, VDD_SPI connects to 1.8 V LDO.
• EFUSE_VDD_SPI_TIEH = 1, VDD_SPI connects to VDD3P3_RTC.
7.5 JTAG Signal Source Control

PR
GPIO3 controls the source of JTAG signals during the early boot process. This GPIO is used together with
EFUSE_DIS_PAD_JTAG, EFUSE_DIS_USB_JTAG, and EFUSE_STRAP_JTAG_SEL, see Table 7-4.

7 Chip Boot Control
Table 74. JTAG Signal Source Control
eFuse 1a eFuse 2b eFuse 3c GPIO3 Signal Source

JTAG signals come from USB Serial/JTAG Controller. The value
0 x
of GPIO3 is ignored.
0 0
0 JTAG signals come from corresponding pinsd.
1
1 JTAG signals come from USB Serial/JTAG Controller.
JTAG signals come from corresponding pinsd. The values of
0 1 x x
EFUSE_STRAP_JTAG_SEL and GPIO3 are ignored.
JTAG signals come from USB Serial/JTAG Controller. The values
1 0 x x
of EFUSE_STRAP_JTAG_SEL and GPIO3 are ignored.
RY
JTAG is disabled. The values of EFUSE_STRAP_JTAG_SEL
1 1 x x
and GPIO3 are ignored.
a
eFuse 1: EFUSE_DIS_PAD_JTAG
b
eFuse 2: EFUSE_DIS_USB_JTAG
c
eFuse 3: EFUSE_STRAP_JTAG_SEL
d
JTAG pins: MTDI, MTCK, MTMS, and MTDO.
A
IN
IM
EL
PR

8 Interrupt Matrix (INTERRUPT)
8.1 Overview
The interrupt matrix embedded in ESP32-S3 independently allocates peripheral interrupt sources to the two
CPUs’ peripheral interrupts, to timely inform CPU0 or CPU1 to process the interrupts once the interrupt signals
are generated.
Peripheral interrupt sources must be routed to CPU0/CPU1 peripheral interrupts via this interrupt matrix due to
the following considerations:
• ESP32-S3 has 99 peripheral interrupt sources. To map them to 32 CPU0 interrupts or 32 CPU1 interrupts,
RY
this matrix is needed.
• Through this matrix, one peripheral interrupt source can be mapped to multiple CPU0 interrupts or CPU1
interrupts according to application requirements.
8.2 Features
A
• Accept 99 peripheral interrupt sources as input
• Generate 26 peripheral interrupts to CPU0 and 26 peripheral interrupts to CPU1 as output. Note that the
IN
remaining six CPU0 interrupts and six CPU1 interrupts are internal interrupts.
• Support to disable CPU non-maskable interrupt (NMI) sources
• Support to query current interrupt status of peripheral interrupt sources

IM
Figure 8-1 shows the structure of the interrupt matrix.
EL
PR
Figure 81. Interrupt Matrix Structure
All the interrupts generated by the peripheral interrupt sources can be handled by CPU0 or CPU1. Users can
configure CPU0 interrupt registers (“Core0 Interrupt Reg” module in Figure 8-1) to allocate peripheral interrupt
sources to CPU0, or configure CPU1 interrupt registers (“Core1 Interrupt Reg” module in Figure 8-1) to allocate

peripheral interrupt sources to CPU1. Peripheral interrupt sources can be allocated both to CPU0 and CPU1
simultaneously, if so, CPU0 and CPU1 will accept the interrupts.

8.3.1 Peripheral Interrupt Sources
ESP32-S3 has 99 peripheral interrupt sources in total. For the peripheral interrupt sources and their
configuration/status registers, please refer to Table 8-1.
• Column “No.”: the peripheral interrupt source number, can be 0 ~ 98
• Column “Source”: all peripheral interrupt sources available
RY
• Column “Configuration Register”: the registers used for routing the peripheral interrupt sources to
CPU0/CPU1 peripheral interrupts
• Column “Status Register”: the registers used for indicating the interrupt status of peripheral interrupt
sources
A
– Column “Status Register - Bit”: the bit position in status registers
– Column “Status Register - Name”: the name of status registers

IN
The register in column “Configuration Register” and the bit in column “Bit” correspond to the peripheral interrupt
source in column “Source”. For example, the configuration register for interrupt source MAC_INTR is
INTERRUPT_COREx_MAC_INTR_MAP_REG, and its status bit in INTERRUPT_COREx_INTR_STATUS_0_REG is
bit0.
IM
Note that COREx in the table can be CORE0 (CPU0) or CORE1 (CPU1).
EL
PR

Espressif Systems

Table 81. CPU Peripheral Interrupt Configuration/Status Registers and Peripheral Interrupt Sources
Status Register
No. Source Configuration Register
Bit Name
PR
0 MAC_INTR INTERRUPT_COREx_MAC_INTR_MAP_REG 0
1 MAC_NMI INTERRUPT_COREx_MAC_NMI_MAP_REG 1
2 PWR_INTR INTERRUPT_COREx_PWR_INTR_MAP_REG 2
3 BB_INT INTERRUPT_COREx_BB_INT_MAP_REG 3
4 BT_MAC_INT INTERRUPT_COREx_BT_MAC_INT_MAP_REG 4
5 BT_BB_INT INTERRUPT_COREx_BT_BB_INT_MAP_REG 5
6 BT_BB_NMI INTERRUPT_COREx_BT_BB_NMI_MAP_REG 6
EL
7 RWBT_IRQ INTERRUPT_COREx_RWBT_IRQ_MAP_REG 7
8 RWBLE_IRQ INTERRUPT_COREx_RWBLE_IRQ_MAP_REG 8
9 RWBT_NMI INTERRUPT_COREx_RWBT_NMI_MAP_REG 9
10 RWBLE_NMI INTERRUPT_COREx_RWBLE_NMI_MAP_REG 10
11 I2C_MST_INT INTERRUPT_COREx_I2C_MST_INT_MAP_REG 11
12 reserved reserved 12
IM
14 UHCI0_INTR INTERRUPT_COREx_UHCI0_INTR_MAP_REG 14
250
INTERRUPT_COREx_INTR_STATUS_0_REG
16 GPIO_INTERRUPT_CPU INTERRUPT_COREx_GPIO_INTERRUPT_CPU_MAP_REG 16
17 GPIO_INTERRUPT_CPU_NMI INTERRUPT_COREx_GPIO_INTERRUPT_CPU_NMI_MAP_REG 17
IN
20 SPI_INTR_1 INTERRUPT_COREx_SPI_INTR_1_MAP_REG 20
24 LCD_CAM_INT INTERRUPT_COREx_LCD_CAM_INT_MAP_REG 24
A
25 I2S0_INT INTERRUPT_COREx_I2S0_INT_MAP_REG 25
26 I2S1_INT INTERRUPT_COREx_I2S1_INT_MAP_REG 26
27 UART_INTR INTERRUPT_COREx_UART_INTR_MAP_REG 27
28 UART1_INTR INTERRUPT_COREx_UART1_INTR_MAP_REG 28
RY
29 UART2_INTR INTERRUPT_COREx_UART2_INTR_MAP_REG 29
30 SDIO_HOST_INTERRUPT INTERRUPT_COREx_SDIO_HOST_INTERRUPT_MAP_REG 30
31 PWM0_INTR INTERRUPT_COREx_PWM0_INTR_MAP_REG 31
32 PWM1_INTR INTERRUPT_COREx_PWM1_INTR_MAP_REG 0
33 reserved reserved 1 INTERRUPT_COREx_INTR_STATUS_1_REG
Espressif Systems

Status Register
Bit Name
35 LEDC_INT INTERRUPT_COREx_LEDC_INT_MAP_REG 3
36 EFUSE_INT INTERRUPT_COREx_EFUSE_INT_MAP_REG 4
PR
37 CAN_INT INTERRUPT_COREx_CAN_INT_MAP_REG 5
38 USB_INTR INTERRUPT_COREx_USB_INTR_MAP_REG 6
39 RTC_CORE_INTR INTERRUPT_COREx_RTC_CORE_INTR_MAP_REG 7
40 RMT_INTR INTERRUPT_COREx_RMT_INTR_MAP_REG 8
41 PCNT_INTR INTERRUPT_COREx_PCNT_INTR_MAP_REG 9
42 I2C_EXT0_INTR INTERRUPT_COREx_I2C_EXT0_INTR_MAP_REG 10
43 I2C_EXT1_INTR INTERRUPT_COREx_I2C_EXT1_INTR_MAP_REG 11
EL
50 TG_T0_INT INTERRUPT_COREx_TG_T0_INT_MAP_REG 18
IM
51 TG_T1_INT INTERRUPT_COREx_TG_T1_INT_MAP_REG 19 INTERRUPT_COREx_INTR_STATUS_1_REG
251
52 TG_WDT_INT INTERRUPT_COREx_TG_WDT_INT_MAP_REG 20
53 TG1_T0_INT INTERRUPT_COREx_TG1_T0_INT_MAP_REG 21
54 TG1_T1_INT INTERRUPT_COREx_TG1_T1_INT_MAP_REG 22
55 TG1_WDT_INT INTERRUPT_COREx_TG1_WDT_INT_MAP_REG 23
56 CACHE_IA_INT INTERRUPT_COREx_CACHE_IA_INT_MAP_REG 24
IN
57 SYSTIMER_TARGET0_INT INTERRUPT_COREx_SYSTIMER_TARGET0_INT_MAP_REG 25
60 SPI_MEM_REJECT_INTR INTERRUPT_COREx_SPI_MEM_REJECT_INTR_MAP_REG 28
61 DCACHE_PRELOAD_INT INTERRUPT_COREx_DCACHE_PRELOAD_INT_MAP_REG 29
A
62 ICACHE_PRELOAD_INT INTERRUPT_COREx_ICACHE_PRELOAD_INT_MAP_REG 30
63 DCACHE_SYNC_INT INTERRUPT_COREx_DCACHE_SYNC_INT_MAP_REG 31
64 ICACHE_SYNC_INT INTERRUPT_COREx_ICACHE_SYNC_INT_MAP_REG 0
65 APB_ADC_INT INTERRUPT_COREX_APB_ADC_INT_MAP_REG 1
RY
66 DMA_IN_CH0_INT INTERRUPT_COREX_DMA_IN_CH0_INT_MAP_REG 2
67 DMA_IN_CH1_INT INTERRUPT_COREx_DMA_IN_CH1_INT_MAP_REG 3
71 DMA_OUT_CH0_INT INTERRUPT_COREX_DMA_OUT_CH0_INT_MAP_REG 7
Espressif Systems

Status Register
Bit Name
72 DMA_OUT_CH1_INT INTERRUPT_COREx_DMA_OUT_CH1_INT_MAP_REG 8
PR
76 RSA_INTR INTERRUPT_COREx_RSA_INTR_MAP_REG 12
77 AES_INTR INTERRUPT_COREx_AES_INTR_MAP_REG 13
78 SHA_INTR INTERRUPT_COREx_SHA_INTR_MAP_REG 14
79 CPU_INTR_FROM_CPU_0 INTERRUPT_COREx_CPU_INTR_FROM_CPU_0_MAP_REG 15
EL
83 ASSIST_DEBUG_INTR INTERRUPT_COREx_ASSIST_DEBUG_INTR_MAP_REG 19
84 DMA_APB_PMS_MONITOR_VIOLATE_INTR INTERRUPT_COREx_DMA_APB_PMS_MONITOR_VIOLATE_INTR_MAP_REG 20
85 CORE_0_IRAM0_PMS_MONITOR_VIOLATE_INTR INTERRUPT_COREx_CORE_0_IRAM0_PMS_MONITOR_VIOLATE_INTR_MAP_REG 21
86 CORE_0_DRAM0_PMS_MONITOR_VIOLATE_INTR INTERRUPT_COREx_CORE_0_DRAM0_PMS_MONITOR_VIOLATE_INTR_MAP_REG 22
87 CORE_0_PIF_PMS_MONITOR_VIOLATE_INTR INTERRUPT_COREx_CORE_0_PIF_PMS_MONITOR_VIOLATE_INTR_MAP_REG 23
IM
88 CORE_0_PIF_PMS_MONITOR_VIOLATE_SIZE_INTR INTERRUPT_COREx_CORE_0_PIF_PMS_MONITOR_VIOLATE_SIZE_INTR_MAP_REG 24
252
89 CORE_1_IRAM0_PMS_MONITOR_VIOLATE_INTR INTERRUPT_COREx_CORE_1_IRAM0_PMS_MONITOR_VIOLATE_INTR_MAP_REG 25
90 CORE_1_DRAM0_PMS_MONITOR_VIOLATE_INTR INTERRUPT_COREx_CORE_1_DRAM0_PMS_MONITOR_VIOLATE_INTR_MAP_REG 26
91 CORE_1_PIF_PMS_MONITOR_VIOLATE_INTR INTERRUPT_COREx_CORE_1_PIF_PMS_MONITOR_VIOLATE_INTR_MAP_REG 27
92 CORE_1_PIF_PMS_MONITOR_VIOLATE_SIZE_INTR INTERRUPT_COREx_CORE_1_PIF_PMS_MONITOR_VIOLATE_SIZE_INTR_MAP_REG 28
93 BACKUP_PMS_VIOLATE_INT INTERRUPT_COREx_BACKUP_PMS_VIOLATE_INTR_MAP_REG 29
IN
94 CACHE_CORE0_ACS_INT INTERRUPT_COREx_CACHE_CORE0_ACS_INT_MAP_REG 30
95 CACHE_CORE1_ACS_INT INTERRUPT_COREx_CACHE_CORE1_ACS_INT_MAP_REG 31
96 USB_DEVICE_INT INTERRUPT_COREx_USB_DEVICE_INT_MAP_REG 0
97 PERI_BACKUP_INT INTERRUPT_COREx_PERI_BACKUP_INT_MAP_REG 1
98 DMA_EXTMEM_REJECT_INT INTERRUPT_COREx_DMA_EXTMEM_REJECT_INT_MAP_REG 2
A RY
8.3.2 CPU Interrupts

Each CPU has 32 interrupts, numbered from 0 ~ 31, including 26 peripheral interrupts and six internal
interrupts.
• Peripheral interrupts: triggered by peripheral interrupt sources, include the following types:
– Level-triggered interrupts: triggered by a high level signal. The interrupt sources should hold the level
till the CPUx handles the interrupts.
– Edge-triggered interrupts: triggered on a rising edge. CPUx responds to this kind of interrupts
immediately.
– NMI interrupt: once triggered, the NMI interrupt can not be masked by software using the CPUx
RY
internal registers. World Controller provides a way to mask this kind of interrupt. For more information,
see Chapter 8 World Controller (WCTL) [to be added later].
• Internal interrupts: generated inside CPUx, include the following types:
– Timer interrupts: triggered by internal timers and are used to generate periodic interrupts.
– Software interrupts: triggered when software writes to special registers.
A
– Profiling interrupt: triggered for performance monitoring and analysis.
Level-triggered and edge-triggered both describe the ways of CPUx to accept interrupt signals. For
IN
level-triggered interrupts, the level of interrupt signal should be kept till the CPU handles the interrupt, otherwise
the interrupt may be lost. For edge-triggered interrupts, when a rising edge is detected, this edge will be
recorded by CPUx, which then allows the interrupt signal to be released.
IM
Interrupt matrix routes the peripheral interrupt sources to any of the CPUx peripheral interrupts. By such way,
CPUx can receive the interrupt signals from peripheral interrupt sources. Table 8-2 lists all the interrupts and their
types as well as priorities.
ESP32-S3 supports the above-mentioned 32 interrupts at six levels as shown in the table below. A higher level
corresponds to a higher priority. NMI has the highest interrupt priority and once triggered, the CPUx must handle
EL
such interrupt. Nested interrupts are also supported, i.e. low-level interrupts can be stopped by high-level
interrupts.
Table 82. CPU Interrupts
No. Category Type Priority

PR
0 Peripheral Level-triggered 1
6 Internal Timer.0 1
7 Internal Software 1

No. Category Type Priority

11 Internal Profiling 3
14 Peripheral NMI NMI
RY
A
29
30
Internal
Peripheral
IN
Software
Level-triggered
3
4
IM
8.3.3 Allocate Peripheral Interrupt Source to CPUx Interrupt
In this section, the following terms are used to describe the operation of the interrupt matrix.
• Source_Y: stands for a peripheral interrupt source, wherein, Y means the number of this interrupt source in
Table 8-1.
EL
• INTERRUPT_COREx_SOURCE_Y_MAP_REG: stands for a configuration register for the peripheral interrupt

source (Source_Y) of CPUx.
• Interrupt_P: stands for the CPUx peripheral interrupt numbered as Num_P. The value of Num_P can be 0 ~
5, 8 ~ 10, 12 ~ 14, 17 ~ 28, and 30 ~ 31. See Table 8-2.
PR
• Interrupt_I: stands for the CPUx internal interrupt numbered as Num_I. The value of Num_I can be 6, 7, 11,
15, 16, and 29. See Table 8-2.
8.3.3.1 Allocate one peripheral interrupt source (Source_Y) to CPUx
Setting the corresponding configuration register INTERRUPT_COREx_SOURCE_Y_MAP_REG of Source_Y to

Num
_P allocates this interrupt source to Interrupt_P. Num_P here can be any value from 0 ~ 5, 8 ~ 10, 12 ~ 14, 17 ~
28, and 30 ~ 31. Note that one CPUx interrupt can be shared by multiple peripherals.

8.3.3.2 Allocate multiple peripheral interrupt sources (Source_Yn) to CPUx
Setting the corresponding configuration register INTERRUPT_COREx_SOURCE_Yn_MAP_REG of each interrupt

source to the same Num_P allocates multiple sources to the same Interrupt_P. Any of these sources can trigger
CPUx Interrupt_P. When an interrupt signal is generated, CPUx checks the interrupt status registers to figure out
which peripheral the signal comes from.
8.3.3.3 Disable CPUx peripheral interrupt source (Source_Y)
Setting the corresponding configuration register INTERRUPT_COREx_SOURCE_Y_MAP_REG of the source to

any Num_I disables this interrupt Source_Y. The choice of Num_I (6, 7, 11, 15, 16, 29) does not matter, as none
of peripheral interrupt sources allocated to Num_I is connected to the CPUx. Therefore this functionality can be
RY
used to disable peripheral interrupt sources.
8.3.4 Disable CPUx NMI Interrupt

All CPUx interrupts, except for NMI interrupt (No.14 in Table 8-2), can be masked and enabled by software using
CPU special register (INTENABLE). NMI interrupt can not be masked by the way above, but ESP32-S3 provides
A
two ways to mask NMI interrupt:
• Disconnect peripheral interrupt sources from NMI interrupt, i.e. the sources routed to NMI interrupt before
IN
are now routed to other interrupts. By such way, the previous NMI interrupt is maskable.
• Connect peripheral interrupt sources with NMI interrupt, but use World Controller module to mask NMI
interrupt. For more information, see Chapter Chapter 8 World Controller (WCTL) [to be added later].
IM
8.3.5 Query Current Interrupt Status of Peripheral Interrupt Source
Users can query current interrupt status of a CPUx peripheral interrupt source by reading the bit value in
INTERRUPT_COREx_INTR_STATUS_n_REG (read only). For the mapping between
INTERRUPT_COREx_INTR_STATUS_
EL
n_REG and peripheral interrupt sources, please refer to Table 8-1.

The addresses in this section are relative to the Interrupt Matrix base address provided in Table 3-4 in Chapter 3
System and Memory.
PR

Espressif Systems

8.4.1 CPU0 Interrupt Register Summary
PR
INTERRUPT_CORE0_MAC_INTR_MAP_REG MAC interrupt configuration register 0x0000 R/W
INTERRUPT_CORE0_MAC_NMI_MAP_REG MAC_NMI interrupt configuration register 0x0004 R/W
INTERRUPT_CORE0_PWR_INTR_MAP_REG PWR interrupt configuration register 0x0008 R/W
INTERRUPT_CORE0_BB_INT_MAP_REG BB interrupt configuration register 0x000C R/W
INTERRUPT_CORE0_BT_MAC_INT_MAP_REG BB_MAC interrupt configuration register 0x0010 R/W
EL
INTERRUPT_CORE0_BT_BB_INT_MAP_REG BT_BB interrupt configuration register 0x0014 R/W
INTERRUPT_CORE0_BT_BB_NMI_MAP_REG BT_BB_NMI interrupt configuration register 0x0018 R/W
INTERRUPT_CORE0_RWBT_IRQ_MAP_REG RWBT_IRQ interrupt configuration register 0x001C R/W

INTERRUPT_CORE0_RWBLE_IRQ_MAP_REG RWBLE_IRQ interrupt configuration register 0x0020 R/W
INTERRUPT_CORE0_RWBT_NMI_MAP_REG RWBT_NMI interrupt configuration register 0x0024 R/W
IM
INTERRUPT_CORE0_RWBLE_NMI_MAP_REG RWBLE_NMI interrupt configuration register 0x0028 R/W
256
INTERRUPT_CORE0_I2C_MST_INT_MAP_REG I2C_MST interrupt configuration register 0x002C R/W

INTERRUPT_CORE0_UHCI0_INTR_MAP_REG UHCI0 interrupt configuration register 0x0038 R/W
INTERRUPT_CORE0_GPIO_INTERRUPT_CPU_MAP_REG GPIO_INTERRUPT_CPU interrupt configuration register 0x0040 R/W
IN
INTERRUPT_CORE0_GPIO_INTERRUPT_CPU_NMI_MAP_REG GPIO_INTERRUPT_CPU_NMI interrupt configuration register 0x0044 R/W
INTERRUPT_CORE0_SPI_INTR_1_MAP_REG SPI_INTR_1 interrupt configuration register 0x0050 R/W

INTERRUPT_CORE0_LCD_CAM_INT_MAP_REG LCD_CAM interrupt configuration register 0x0060 R/W
A
INTERRUPT_CORE0_I2S0_INT_MAP_REG I2S0 interrupt configuration register 0x0064 R/W
RY
INTERRUPT_CORE0_UART_INTR_MAP_REG UART interrupt configuration register 0x006C R/W
INTERRUPT_CORE0_UART1_INTR_MAP_REG UART1 interrupt configuration register 0x0070 R/W
INTERRUPT_CORE0_SDIO_HOST_INTERRUPT_MAP_REG SDIO_HOST interrupt configuration register 0x0078 R/W
INTERRUPT_CORE0_PWM0_INTR_MAP_REG PWM0 interrupt configuration register 0x007C R/W
Espressif Systems

INTERRUPT_CORE0_PWM1_INTR_MAP_REG PWM1 interrupt configuration register 0x0080 R/W
INTERRUPT_CORE0_LEDC_INT_MAP_REG LEDC interrupt configuration register 0x008C R/W
PR
INTERRUPT_CORE0_EFUSE_INT_MAP_REG EFUSE interrupt configuration register 0x0090 R/W
INTERRUPT_CORE0_CAN_INT_MAP_REG CAN interrupt configuration register 0x0094 R/W
INTERRUPT_CORE0_USB_INTR_MAP_REG USB interrupt configuration register 0x0098 R/W
INTERRUPT_CORE0_RTC_CORE_INTR_MAP_REG RTC_CORE interrupt configuration register 0x009C R/W
INTERRUPT_CORE0_RMT_INTR_MAP_REG RMT interrupt configuration register 0x00A0 R/W
INTERRUPT_CORE0_PCNT_INTR_MAP_REG PCNT interrupt configuration register 0x00A4 R/W
EL
INTERRUPT_CORE0_I2C_EXT0_INTR_MAP_REG I2C_EXT0 interrupt configuration register 0x00A8 R/W
INTERRUPT_CORE0_I2C_EXT1_INTR_MAP_REG I2C_EXT1 interrupt configuration register 0x00AC R/W
INTERRUPT_CORE0_TG_T0_INT_MAP_REG TG_T0 interrupt configuration register 0x00C8 R/W

INTERRUPT_CORE0_TG_T1_INT_MAP_REG TG_T1 interrupt configuration register 0x00CC R/W
INTERRUPT_CORE0_TG_WDT_INT_MAP_REG TG_WDT interrupt configuration register 0x00D0 R/W
IM
INTERRUPT_CORE0_TG1_T0_INT_MAP_REG TG1_T0 interrupt configuration register 0x00D4 R/W
257

INTERRUPT_CORE0_TG1_WDT_INT_MAP_REG TG1_WDT interrupt configuration register 0x00DC R/W
INTERRUPT_CORE0_CACHE_IA_INT_MAP_REG CACHE_IA interrupt configuration register 0x00E0 R/W
IN
INTERRUPT_CORE0_SYSTIMER_TARGET0_INT_MAP_REG SYSTIMER_TARGET0 interrupt configuration register 0x00E4 R/W
INTERRUPT_CORE0_SYSTIMER_TARGET2_INT_MAP_REG SYSTIMER_TARGET2 interrupt configuration register 0x00EC R/W
INTERRUPT_CORE0_SPI_MEM_REJECT_INTR_MAP_REG SPI_MEM_REJECT interrupt configuration register 0x00F0 R/W
A
INTERRUPT_CORE0_DCACHE_PRELOAD_INT_MAP_REG DCACHE_PRELAOD interrupt configuration register 0x00F4 R/W
INTERRUPT_CORE0_ICACHE_PRELOAD_INT_MAP_REG ICACHE_PRELOAD interrupt configuration register 0x00F8 R/W
INTERRUPT_CORE0_DCACHE_SYNC_INT_MAP_REG DCACHE_SYNC interrupt configuration register 0x00FC R/W
RY
INTERRUPT_CORE0_ICACHE_SYNC_INT_MAP_REG ICACHE_SYNC interrupt configuration register 0x0100 R/W
INTERRUPT_CORE0_APB_ADC_INT_MAP_REG APB_ADC interrupt configuration register 0x0104 R/W
INTERRUPT_CORE0_DMA_IN_CH0_INT_MAP_REG DMA_IN_CH0 interrupt configuration register 0x0108 R/W
INTERRUPT_CORE0_DMA_IN_CH1_INT_MAP_REG DMA_IN_CH1 interrupt configuration register 0x010C R/W
Espressif Systems

PR
INTERRUPT_CORE0_DMA_OUT_CH0_INT_MAP_REG DMA_OUT_CH0 interrupt configuration register 0x011C R/W
INTERRUPT_CORE0_DMA_OUT_CH1_INT_MAP_REG DMA_OUT_CH1 interrupt configuration register 0x0120 R/W
INTERRUPT_CORE0_RSA_INT_MAP_REG RSA interrupt configuration register 0x0130 R/W
EL
INTERRUPT_CORE0_AES_INT_MAP_REG AES interrupt configuration register 0x0134 R/W
INTERRUPT_CORE0_SHA_INT_MAP_REG SHA interrupt configuration register 0x0138 R/W
INTERRUPT_CORE0_CPU_INTR_FROM_CPU_0_MAP_REG CPU_INTR_FROM_CPU_0 interrupt configuration register 0x013C R/W

INTERRUPT_CORE0_CPU_INTR_FROM_CPU_1_MAP_REG CPU_INTR_FROM_CPU_1 interrupt configuration register 0x0140 R/W
IM
258
INTERRUPT_CORE0_ASSIST_DEBUG_INTR_MAP_REG ASSIST_DEBUG interrupt configuration register 0x014C R/W

INTERRUPT_CORE0_DMA_APBPERI_PMS_MONITOR_VIOLATE_ dma_pms_monitor_violatile interrupt configuration register
0x0150 R/W
INTR_MAP_REG
IN
INTERRUPT_CORE0_CORE_0_IRAM0_PMS_MONITOR_VIOLATE core0_IRam0_pms_monitor_violatile interrupt configuration register
0x0154 R/W
_INTR_MAP_REG
INTERRUPT_CORE0_CORE_0_DRAM0_PMS_MONITOR_VIOLATE core0_DRam0_pms_monitor_violatile interrupt configuration register
0x0158 R/W
_INTR_MAP_REG
INTERRUPT_CORE0_CORE_0_PIF_PMS_MONITOR_VIOLATE_ core0_PIF_pms_monitor_violatile interrupt configuration register
A
0x015C R/W
INTR_MAP_REG
INTERRUPT_CORE0_CORE_0_PIF_PMS_MONITOR_VIOLATE_ core0_PIF_pms_monitor_violatile_size interrupt configuration regis-
0x0160 R/W
RY
SIZE_INTR_MAP_REG ter
INTERRUPT_CORE0_CORE_1_IRAM0_PMS_MONITOR_VIOLATE_ core1_IRam0_pms_monitor_violatile interrupt configuration register
0x0164 R/W
INTR_MAP_REG
0x0168 R/W
_INTR_MAP_REG
Espressif Systems

0x016C R/W
INTR_MAP_REG
PR
0x0170 R/W
INTERRUPT_CORE0_BACKUP_PMS_VIOLATE_INTR_MAP_REG BACKUP_PMS_MONITOR_VIOLATILE interrupt configuration regis- 0x0174 R/W
ter
INTERRUPT_CORE0_CACHE_CORE0_ACS_INT_MAP_REG CACHE_CORE0_ACS interrupt configuration register 0x0178 R/W
INTERRUPT_CORE0_CACHE_CORE1_ACS_INT_MAP_REG CACHE_CORE1_ACS interrupt configuration register 0x017C R/W
EL
INTERRUPT_CORE0_USB_DEVICE_INT_MAP_REG USB_DEVICE interrupt configuration register 0x0180 R/W
INTERRUPT_CORE0_PERI_BACKUP_INT_MAP_REG PERI_BACKUP interrupt configuration register 0x0184 R/W
INTERRUPT_CORE0_DMA_EXTMEM_REJECT_INT_MAP_REG DMA_EXTMEM_REJECT interrupt configuration register 0x0188 R/W

Status Registers
INTERRUPT_CORE0_INTR_STATUS_0_REG Interrupt status register 0x018C RO
IM
INTERRUPT_CORE0_INTR_STATUS_1_REG Interrupt status register 0x0190 RO
259

Clock Register
IN
INTERRUPT_CORE0_CLOCK_GATE_REG Clock gate register 0x019C R/W
Version Register
INTERRUPT_CORE0_DATE_REG Version control register 0x07FC R/W
A
8.4.2 CPU1 Interrupt Register Summary
RY
INTERRUPT_CORE1_MAC_INTR_MAP_REG MAC interrupt configuration register 0x0800 R/W
INTERRUPT_CORE1_MAC_NMI_MAP_REG MAC_NMI interrupt configuration register 0x0804 R/W
INTERRUPT_CORE1_PWR_INTR_MAP_REG PWR interrupt configuration register 0x0808 R/W
INTERRUPT_CORE1_BB_INT_MAP_REG BB interrupt configuration register 0x080C R/W
Espressif Systems

INTERRUPT_CORE1_BT_MAC_INT_MAP_REG BB_MAC interrupt configuration register 0x0810 R/W
INTERRUPT_CORE1_BT_BB_INT_MAP_REG BT_BB interrupt configuration register 0x0814 R/W
PR
INTERRUPT_CORE1_BT_BB_NMI_MAP_REG BT_BB_NMI interrupt configuration register 0x0818 R/W
INTERRUPT_CORE1_RWBT_IRQ_MAP_REG RWBT_IRQ interrupt configuration register 0x081C R/W
INTERRUPT_CORE1_RWBLE_IRQ_MAP_REG RWBLE_IRQ interrupt configuration register 0x0820 R/W
INTERRUPT_CORE1_RWBT_NMI_MAP_REG RWBT_NMI interrupt configuration register 0x0824 R/W
INTERRUPT_CORE1_RWBLE_NMI_MAP_REG RWBLE_NMI interrupt configuration register 0x0828 R/W
INTERRUPT_CORE1_I2C_MST_INT_MAP_REG I2C_MST interrupt configuration register 0x082C R/W
EL
INTERRUPT_CORE1_UHCI0_INTR_MAP_REG UHCI0 interrupt configuration register 0x0838 R/W
INTERRUPT_CORE1_GPIO_INTERRUPT_CPU_MAP_REG GPIO_INTERRUPT_CPU interrupt configuration register 0x0840 R/W
INTERRUPT_CORE1_GPIO_INTERRUPT_CPU_NMI_MAP_REG GPIO_INTERRUPT_CPU_NMI Interrupt configuration register 0x0844 R/W

IM
260
INTERRUPT_CORE1_LCD_CAM_INT_MAP_REG LCD_CAM interrupt configuration register 0x0860 R/W

IN
INTERRUPT_CORE1_UART_INTR_MAP_REG UART interrupt configuration register 0x086C R/W
INTERRUPT_CORE1_SDIO_HOST_INTERRUPT_MAP_REG SDIO_HOST interrupt configuration register 0x0878 R/W
A
INTERRUPT_CORE1_PWM0_INTR_MAP_REG PWM0 interrupt configuration register 0x087C R/W
INTERRUPT_CORE1_PWM1_INTR_MAP_REG PWM1 interrupt configuration register 0x0880 R/W
INTERRUPT_CORE1_LEDC_INT_MAP_REG LEDC interrupt configuration register 0x088C R/W
RY
INTERRUPT_CORE1_EFUSE_INT_MAP_REG EFUSE interrupt configuration register 0x0890 R/W
INTERRUPT_CORE1_CAN_INT_MAP_REG CAN interrupt configuration register 0x0894 R/W
INTERRUPT_CORE1_USB_INTR_MAP_REG USB interrupt configuration register 0x0898 R/W
INTERRUPT_CORE1_RTC_CORE_INTR_MAP_REG RTC_CORE interrupt configuration register 0x089C R/W
INTERRUPT_CORE1_RMT_INTR_MAP_REG RMT interrupt configuration register 0x08A0 R/W
Espressif Systems

INTERRUPT_CORE1_PCNT_INTR_MAP_REG PCNT interrupt configuration register 0x08A4 R/W
INTERRUPT_CORE1_I2C_EXT0_INTR_MAP_REG I2C_EXT0 interrupt configuration register 0x08A8 R/W
PR
INTERRUPT_CORE1_I2C_EXT1_INTR_MAP_REG I2C_EXT1 interrupt configuration register 0x08AC R/W
INTERRUPT_CORE1_TG_T1_INT_MAP_REG TG_T1 interrupt configuration register 0x08CC R/W
INTERRUPT_CORE1_TG_WDT_INT_MAP_REG TG_WDT interrupt configuration register 0x08D0 R/W
INTERRUPT_CORE1_TG1_WDT_INT_MAP_REG TG1_WDT interrupt configuration register 0x08DC R/W
EL
INTERRUPT_CORE1_CACHE_IA_INT_MAP_REG CACHE_IA interrupt configuration register 0x08E0 R/W

INTERRUPT_CORE1_SYSTIMER_TARGET2_INT_MAP_REG SYSTIMER_TARGET2 interrupt configuration register 0x08EC R/W
INTERRUPT_CORE1_SPI_MEM_REJECT_INTR_MAP_REG SPI_MEM_REJECT interrupt configuration register 0x08F0 R/W
IM
INTERRUPT_CORE1_DCACHE_PRELOAD_INT_MAP_REG DCACHE_PRELAOD interrupt configuration register 0x08F4 R/W
261
INTERRUPT_CORE1_ICACHE_PRELOAD_INT_MAP_REG ICACHE_PRELOAD interrupt configuration register 0x08F8 R/W

INTERRUPT_CORE1_DCACHE_SYNC_INT_MAP_REG DCACHE_SYNC interrupt configuration register 0x08FC R/W
INTERRUPT_CORE1_ICACHE_SYNC_INT_MAP_REG ICACHE_SYNC interrupt configuration register 0x0900 R/W
IN
INTERRUPT_CORE1_APB_ADC_INT_MAP_REG APB_ADC interrupt configuration register 0x0904 R/W
INTERRUPT_CORE1_DMA_IN_CH1_INT_MAP_REG DMA_IN_CH1 interrupt configuration register 0x090C R/W
A
RY
INTERRUPT_CORE1_RSA_INT_MAP_REG RSA interrupt configuration register 0x0930 R/W
Espressif Systems

INTERRUPT_CORE1_AES_INT_MAP_REG AES interrupt configuration register 0x0934 R/W
INTERRUPT_CORE1_SHA_INT_MAP_REG SHA interrupt configuration register 0x0938 R/W
PR
INTERRUPT_CORE1_CPU_INTR_FROM_CPU_0_MAP_REG CPU_INTR_FROM_CPU_0 interrupt configuration register 0x093C R/W
INTERRUPT_CORE1_ASSIST_DEBUG_INTR_MAP_REG ASSIST_DEBUG interrupt configuration register 0x094C R/W
INTERRUPT_CORE1_DMA_APBPERI_PMS_MONITOR_VIOLATE_ dma_pms_monitor_violatile interrupt configuration register
EL
0x0950 R/W
INTR_MAP_REG
INTERRUPT_CORE1_CORE_0_IRAM0_PMS_MONITOR_VIOLATE core0_IRam0_pms_monitor_violatile interrupt configuration register
0x0954 R/W
_INTR_MAP_REG
0x0958 R/W
_INTR_MAP_REG
IM
262
0x095C R/W
INTR_MAP_REG
0x0960 R/W
INTERRUPT_CORE1_CORE_1_IRAM0_PMS_MONITOR_VIOLATE_ core1_IRam0_pms_monitor_violatile interrupt configuration register
IN
0x0964 R/W
INTR_MAP_REG
0x0968 R/W
_INTR_MAP_REG
A
0x096C R/W
INTR_MAP_REG
0x0970 R/W
RY
INTERRUPT_CORE1_BACKUP_PMS_VIOLATE_INTR_MAP_REG BACKUP_PMS_MONITOR_VIOLATILE interrupt configuration regis- 0x0974 R/W
ter
INTERRUPT_CORE1_CACHE_CORE0_ACS_INT_MAP_REG CACHE_CORE0_ACS interrupt configuration register REG 0x0978 R/W
INTERRUPT_CORE1_CACHE_CORE1_ACS_INT_MAP_REG CACHE_CORE1_ACS interrupt configuration register REG 0x097C R/W
Espressif Systems

INTERRUPT_CORE1_USB_DEVICE_INT_MAP_REG USB_DEVICE interrupt configuration register 0x0980 R/W
INTERRUPT_CORE1_PERI_BACKUP_INT_MAP_REG PERI_BACKUP interrupt configuration register 0x0984 R/W
PR
INTERRUPT_CORE1_DMA_EXTMEM_REJECT_INT_MAP_REG DMA_EXTMEM_REJECT interrupt configuration register 0x0988 R/W
Status Registers
INTERRUPT_CORE1_INTR_STATUS_0_REG Interrupt status register 0x098C RO
EL
Clock Register
INTERRUPT_CORE1_CLOCK_GATE_REG Clock gate register 0x099C R/W
Version Register
INTERRUPT_CORE1_DATE_REG Version control register 0x0FFC R/W
IM
263
IN
A RY
8.5 Registers
8.5.1 CPU0 Interrupt Registers
Register 8.1. INTERRUPT_CORE0_MAC_INTR_MAP_REG (0x0000)
Register 8.2. INTERRUPT_CORE0_MAC_NMI_MAP_REG (0x0004)
Register 8.3. INTERRUPT_CORE0_PWR_INTR_MAP_REG (0x0008)
Register 8.4. INTERRUPT_CORE0_BB_INT_MAP_REG (0x000C)
Register 8.5. INTERRUPT_CORE0_BT_MAC_INT_MAP_REG (0x0010)
Register 8.6. INTERRUPT_CORE0_BT_BB_INT_MAP_REG (0x0014)
RY
Register 8.7. INTERRUPT_CORE0_BT_BB_NMI_MAP_REG (0x0018)
Register 8.8. INTERRUPT_CORE0_RWBT_IRQ_MAP_REG (0x001C)
Register 8.9. INTERRUPT_CORE0_RWBLE_IRQ_MAP_REG (0x0020)
Register 8.10. INTERRUPT_CORE0_RWBT_NMI_MAP_REG (0x0024)
A
Register 8.11. INTERRUPT_CORE0_RWBLE_NMI_MAP_REG (0x0028)
Register 8.12. INTERRUPT_CORE0_I2C_MST_INT_MAP_REG (0x002C)

IN
Register 8.13. INTERRUPT_CORE0_UHCI0_INTR_MAP_REG (0x0038)
Register 8.14. INTERRUPT_CORE0_GPIO_INTERRUPT_CPU_MAP_REG (0x0040)
Register 8.15. INTERRUPT_CORE0_GPIO_INTERRUPT_CPU_NMI_MAP_REG (0x0044)

IM
Register 8.16. INTERRUPT_CORE0_SPI_INTR_1_MAP_REG (0x0050)
Register 8.19. INTERRUPT_CORE0_LCD_CAM_INT_MAP_REG (0x0060)

EL
Register 8.20. INTERRUPT_CORE0_I2S0_INT_MAP_REG (0x0064)
Register 8.22. INTERRUPT_CORE0_UART_INTR_MAP_REG (0x006C)
Register 8.23. INTERRUPT_CORE0_UART1_INTR_MAP_REG (0x0070)

PR
Register 8.25. INTERRUPT_CORE0_SDIO_HOST_INTERRUPT_MAP_REG (0x0078)
Register 8.26. INTERRUPT_CORE0_PWM0_INTR_MAP_REG (0x007C)
Register 8.27. INTERRUPT_CORE0_PWM1_INTR_MAP_REG (0x0080)
Register 8.28. INTERRUPT_CORE0_LEDC_INT_MAP_REG (0x008C)
Register 8.29. INTERRUPT_CORE0_EFUSE_INT_MAP_REG (0x0090)
Register 8.30. INTERRUPT_CORE0_CAN_INT_MAP_REG (0x0094)
Register 8.31. INTERRUPT_CORE0_USB_INTR_MAP_REG (0x0098)
Register 8.32. INTERRUPT_CORE0_RTC_CORE_INTR_MAP_REG (0x009C)

Register 8.33. INTERRUPT_CORE0_RMT_INTR_MAP_REG (0x00A0)
Register 8.34. INTERRUPT_CORE0_PCNT_INTR_MAP_REG (0x00A4)
Register 8.35. INTERRUPT_CORE0_I2C_EXT0_INTR_MAP_REG (0x00A8)
Register 8.36. INTERRUPT_CORE0_I2C_EXT1_INTR_MAP_REG (0x00AC)
Register 8.37. INTERRUPT_CORE0_TG_T0_INT_MAP_REG (0x00C8)
Register 8.38. INTERRUPT_CORE0_TG_T1_INT_MAP_REG (0x00CC)
Register 8.39. INTERRUPT_CORE0_TG_WDT_INT_MAP_REG (0x00D0)
Register 8.40. INTERRUPT_CORE0_TG1_T0_INT_MAP_REG (0x00D4)
RY
Register 8.42. INTERRUPT_CORE0_TG1_WDT_INT_MAP_REG (0x00DC)
Register 8.43. INTERRUPT_CORE0_CACHE_IA_INT_MAP_REG (0x00E0)
Register 8.44. INTERRUPT_CORE0_SYSTIMER_TARGET0_INT_MAP_REG (0x00E4)
A
Register 8.46. INTERRUPT_CORE0_SYSTIMER_TARGET2_INT_MAP_REG (0x00EC)
Register 8.47. INTERRUPT_CORE0_SPI_MEM_REJECT_INTR_MAP_REG (0x00F0)

IN
Register 8.48. INTERRUPT_CORE0_DCACHE_PRELOAD_INT_MAP_REG (0x00F4)
Register 8.49. INTERRUPT_CORE0_ICACHE_PRELOAD_INT_MAP_REG (0x00F8)
Register 8.50. INTERRUPT_CORE0_DCACHE_SYNC_INT_MAP_REG (0x00FC)

IM
Register 8.51. INTERRUPT_CORE0_ICACHE_SYNC_INT_MAP_REG (0x0100)
Register 8.52. INTERRUPT_CORE0_APB_ADC_INT_MAP_REG (0x0104)
Register 8.53. INTERRUPT_CORE0_DMA_IN_CH0_INT_MAP_REG (0x0108)
Register 8.54. INTERRUPT_CORE0_DMA_IN_CH1_INT_MAP_REG (0x010C)

EL
Register 8.58. INTERRUPT_CORE0_DMA_OUT_CH0_INT_MAP_REG (0x011C)

PR
Register 8.59. INTERRUPT_CORE0_DMA_OUT_CH1_INT_MAP_REG (0x0120)
Register 8.63. INTERRUPT_CORE0_RSA_INT_MAP_REG (0x0130)
Register 8.64. INTERRUPT_CORE0_AES_INT_MAP_REG (0x0134)
Register 8.65. INTERRUPT_CORE0_SHA_INT_MAP_REG (0x0138)
Register 8.66. INTERRUPT_CORE0_CPU_INTR_FROM_CPU_0_MAP_REG (0x013C)
Register 8.67. INTERRUPT_CORE0_CPU_INTR_FROM_CPU_1_MAP_REG (0x0140)


Register 8.70. INTERRUPT_CORE0_ASSIST_DEBUG_INTR_MAP_REG (0x014C)
Register 8.71. INTERRUPT_CORE0_DMA_APBPERI_PMS_MONITOR_VIOLATE_INTR_MAP_REG (0x0150)
Register 8.72. INTERRUPT_CORE0_CORE_0_IRAM0_PMS_MONITOR_VIOLATE_INTR_MAP_REG (0x0154)
Register 8.73. INTERRUPT_CORE0_CORE_0_DRAM0_PMS_MONITOR_VIOLATE_INTR_MAP_REG (0x0158)
Register 8.74. INTERRUPT_CORE0_CORE_0_PIF_PMS_MONITOR_VIOLATE_INTR_MAP_REG (0x015C)
Register 8.75. INTERRUPT_CORE0_CORE_0_PIF_PMS_MONITOR_VIOLATE_SIZE_INTR_MAP_REG (0x0160)
RY
Register 8.79. INTERRUPT_CORE0_CORE_1_PIF_PMS_MONITOR_VIOLATE_SIZE_INTR_MAP_REG (0x0170)
Register 8.80. INTERRUPT_CORE0_BACKUP_PMS_VIOLATE_INTR_MAP_REG (0x0174)
Register 8.81. INTERRUPT_CORE0_CACHE_CORE0_ACS_INT_MAP_REG (0x0178)
Register 8.82. INTERRUPT_CORE0_CACHE_CORE1_ACS_INT_MAP_REG (0x017C)
Register 8.83. INTERRUPT_CORE0_USB_DEVICE_INT_MAP_REG (0x0180)
A
Register 8.84. INTERRUPT_CORE0_PERI_BACKUP_INT_MAP_REG (0x0184)
Register 8.85. INTERRUPT_CORE0_DMA_EXTMEM_REJECT_INT_MAP_REG (0x0188)
IN
AP
_M
_Y
CE
UR
SO
0_
RE
IM
CO
T_
UP
d)
ve
RR
r
se
TE
(re
IN
31 5 4 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 16 Reset
EL
INTERRUPT_CORE0_SOURCE_Y_MAP Map interrupt signal of Source_Y to one of CPU0 external

interrupt, can be configured as 0 ~ 5, 8 ~ 10, 12 ~ 14, 17 ~ 28, 30 ~ 31. The remaining values are
invalid. For Source_Y, see Table 8-1. (R/W)
Register 8.86. INTERRUPT_CORE0_INTR_STATUS_0_REG (0x018C)
PR
S_0
TU
TA
_S
TR
IN
0_
RE
O
_C
PT
U
RR
TE
IN
31 0
0x000000 Reset
INTERRUPT_CORE0_INTR_STATUS_0 This register stores the status of the first 32 interrupt

sources. (RO)

Register 8.87. INTERRUPT_CORE0_INTR_STATUS_1_REG (0x0190)
1
S_
TU
TA
_S
TR
IN
0_
RE
O
_C
PT
RU
R
TE
IN
31 0
0x000000 Reset
RY
INTERRUPT_CORE0_INTR_STATUS_1 This register stores the status of the second 32 interrupt
sources. (RO)
A AT
S_
U
2
ST
IN R_
T
IN
0_
RE
O
_C
PT
RU
R
TE
IN
IM
31 0
0x000000 Reset
INTERRUPT_CORE0_INTR_STATUS_2 This register stores the status of the third 32 interrupt

sources. (RO)
EL

3
S_
TU
TA
PR
_S
TR
IN
0_
RE
CO
T_
UP
RR
TE
IN
31 0
0x000000 Reset
INTERRUPT_CORE0_INTR_STATUS_3 This register stores the status of the last 3 interrupt sources.
(RO)

Register 8.90. INTERRUPT_CORE0_CLOCK_GATE_REG (0x019C)
N
_E
LK
_C
0
RE
O
T_C
UP
d)
ve
RR
er
TE
s
(re
IN
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 Reset
INTERRUPT_CORE0_CLK_EN This register is used to control clock-gating of interrupt matrix. (R/W)
RY
Register 8.91. INTERRUPT_CORE0_DATE_REG (0x07FC)
E
AT
_D
PT
RU
A 0_
IN
TER
RE
O
_C
PT
IN
)
RU
ed
rv
R
se
TE
(re
IN
31 28 27 0
0 0 0 0 0x2012300 Reset
IM
INTERRUPT_CORE0_INTERRUPT_DATE Version control register (R/W)
8.5.2 CPU1 Interrupt Registers

EL
Register 8.92. INTERRUPT_CORE1_MAC_INTR_MAP_REG (0x0800)
Register 8.93. INTERRUPT_CORE1_MAC_NMI_MAP_REG (0x0804)
Register 8.94. INTERRUPT_CORE1_PWR_INTR_MAP_REG (0x0808)

PR
Register 8.95. INTERRUPT_CORE1_BB_INT_MAP_REG (0x080C)
Register 8.96. INTERRUPT_CORE1_BT_MAC_INT_MAP_REG (0x0810)
Register 8.97. INTERRUPT_CORE1_BT_BB_INT_MAP_REG (0x0814)
Register 8.98. INTERRUPT_CORE1_BT_BB_NMI_MAP_REG (0x0818)
Register 8.99. INTERRUPT_CORE1_RWBT_IRQ_MAP_REG (0x081C)
Register 8.100. INTERRUPT_CORE1_RWBLE_IRQ_MAP_REG (0x0820)
Register 8.101. INTERRUPT_CORE1_RWBT_NMI_MAP_REG (0x0824)
Register 8.102. INTERRUPT_CORE1_RWBLE_NMI_MAP_REG (0x0828)
Register 8.103. INTERRUPT_CORE1_I2C_MST_INT_MAP_REG (0x082C)

Register 8.104. INTERRUPT_CORE1_UHCI0_INTR_MAP_REG (0x0838)
Register 8.105. INTERRUPT_CORE1_GPIO_INTERRUPT_CPU_MAP_REG (0x0840)
Register 8.106. INTERRUPT_CORE1_GPIO_INTERRUPT_CPU_NMI_MAP_REG (0x0844)
Register 8.110. INTERRUPT_CORE1_LCD_CAM_INT_MAP_REG (0x0860)
RY
Register 8.113. INTERRUPT_CORE1_UART_INTR_MAP_REG (0x086C)
Register 8.116. INTERRUPT_CORE1_SDIO_HOST_INTERRUPT_MAP_REG (0x0878)
A
Register 8.117. INTERRUPT_CORE1_PWM0_INTR_MAP_REG (0x087C)
Register 8.118. INTERRUPT_CORE1_PWM1_INTR_MAP_REG (0x0880)

IN
Register 8.119. INTERRUPT_CORE1_LEDC_INT_MAP_REG (0x088C)
Register 8.120. INTERRUPT_CORE1_EFUSE_INT_MAP_REG (0x0890)
Register 8.121. INTERRUPT_CORE1_CAN_INT_MAP_REG (0x0894)

IM
Register 8.122. INTERRUPT_CORE1_USB_INTR_MAP_REG (0x0898)
Register 8.123. INTERRUPT_CORE1_RTC_CORE_INTR_MAP_REG (0x089C)
Register 8.124. INTERRUPT_CORE1_RMT_INTR_MAP_REG (0x08A0)
Register 8.125. INTERRUPT_CORE1_PCNT_INTR_MAP_REG (0x08A4)

EL
Register 8.126. INTERRUPT_CORE1_I2C_EXT0_INTR_MAP_REG (0x08A8)
Register 8.127. INTERRUPT_CORE1_I2C_EXT1_INTR_MAP_REG (0x08AC)
Register 8.128. INTERRUPT_CORE1_TG_T0_INT_MAP_REG (0x08C8)
Register 8.129. INTERRUPT_CORE1_TG_T1_INT_MAP_REG (0x08CC)

PR
Register 8.130. INTERRUPT_CORE1_TG_WDT_INT_MAP_REG (0x08D0)
Register 8.133. INTERRUPT_CORE1_TG1_WDT_INT_MAP_REG (0x08DC)
Register 8.134. INTERRUPT_CORE1_CACHE_IA_INT_MAP_REG (0x08E0)
Register 8.137. INTERRUPT_CORE1_SYSTIMER_TARGET2_INT_MAP_REG (0x08EC)
Register 8.138. INTERRUPT_CORE1_SPI_MEM_REJECT_INTR_MAP_REG (0x08F0)

Register 8.139. INTERRUPT_CORE1_DCACHE_PRELOAD_INT_MAP_REG (0x08F4)
Register 8.140. INTERRUPT_CORE1_ICACHE_PRELOAD_INT_MAP_REG (0x08F8)
Register 8.141. INTERRUPT_CORE1_DCACHE_SYNC_INT_MAP_REG (0x08FC)
Register 8.142. INTERRUPT_CORE1_ICACHE_SYNC_INT_MAP_REG (0x0900)
Register 8.143. INTERRUPT_CORE1_APB_ADC_INT_MAP_REG (0x0904)
Register 8.145. INTERRUPT_CORE1_DMA_IN_CH1_INT_MAP_REG (0x090C)
RY
A

IN
Register 8.154. INTERRUPT_CORE1_RSA_INT_MAP_REG (0x0930)
Register 8.155. INTERRUPT_CORE1_AES_INT_MAP_REG (0x0934)
Register 8.156. INTERRUPT_CORE1_SHA_INT_MAP_REG (0x0938)
Register 8.157. INTERRUPT_CORE1_CPU_INTR_FROM_CPU_0_MAP_REG (0x093C)

IM

EL
Register 8.161. INTERRUPT_CORE1_ASSIST_DEBUG_INTR_MAP_REG (0x094C)
Register 8.162. INTERRUPT_CORE1_DMA_APBPERI_PMS_MONITOR_VIOLATE_INTR_MAP_REG (0x0950)

PR
Register 8.166. INTERRUPT_CORE1_CORE_0_PIF_PMS_MONITOR_VIOLATE_SIZE_INTR_MAP_REG

(0x0960)
Register 8.170. INTERRUPT_CORE1_CORE_1_PIF_PMS_MONITOR_VIOLATE_SIZE_INTR_MAP_REG

(0x0970)
Register 8.171. INTERRUPT_CORE1_BACKUP_PMS_VIOLATE_INTR_MAP_REG (0x0974)
Register 8.172. INTERRUPT_CORE1_CACHE_CORE0_ACS_INT_MAP_REG (0x0978)

Register 8.173. INTERRUPT_CORE1_CACHE_CORE1_ACS_INT_MAP_REG (0x097C)
Register 8.174. INTERRUPT_CORE1_USB_DEVICE_INT_MAP_REG (0x0980)
Register 8.175. INTERRUPT_CORE1_PERI_BACKUP_INT_MAP_REG (0x0984)
Register 8.176. INTERRUPT_CORE1_DMA_EXTMEM_REJECT_INT_MAP_REG (0x0988)
AP
M
Y_
_
CE
UR
SO
1_
RE
O
_C
T
UP
)
ed
RY RR
rv
se
TE
(re
IN
31 5 4 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 16 Reset
INTERRUPT_CORE1_SOURCE_Y_MAP Map interrupt signal of Source_Y to one of CPU1 external

interrupt, can be configured as 0 ~ 5, 8 ~ 10, 12 ~ 14, 17 ~ 28, 30 ~ 31. The remaining values are
A
invalid. For Source_Y, see Table 8-1. (R/W)
Register 8.177. INTERRUPT_CORE1_INTR_STATUS_0_REG (0x098C)

IN RE
1_
IN
TR
_S
TA
TU
S_
0
IM IN
RR
TE
T_
UP
CO
31 0
0x000000 Reset
EL
INTERRUPT_CORE1_INTR_STATUS_0 This register stores the status of the first 32 interrupt

sources. (RO)
PR

1
S_
TU
TA
_S
TR
IN
1_
RE
O
_C
PT
RU
R
TE
IN
31 0
0x000000 Reset
RY
INTERRUPT_CORE1_INTR_STATUS_1 This register stores the status of the second 32 interrupt
sources. (RO)
A AT
S_
U
2
ST
IN R_
T
IN
1_
RE
O
_C
PT
RU
R
TE
IN
IM
31 0
0x000000 Reset
INTERRUPT_CORE1_INTR_STATUS_2 This register stores the status of the third 32 interrupt

sources. (RO)
EL

3
S_
TU
TA
PR
_S
TR
IN
1_
RE
CO
T_
UP
RR
TE
IN
31 0
0x000000 Reset
INTERRUPT_CORE1_INTR_STATUS_3 This register stores the status of the last 3 interrupt sources.
(RO)

Register 8.181. INTERRUPT_CORE1_CLOCK_GATE_REG (0x099C)
N
_E
LK
_C
1
RE
O
T_C
UP
d)
ve
RR
er
TE
s
(re
IN
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 Reset
INTERRUPT_CORE1_CLK_EN This register is used to control clock-gating of interrupt matrix. (R/W)
RY
Register 8.182. INTERRUPT_CORE1_DATE_REG (0x0FFC)
E
AT
_D
PT
RU
A 1_
IN
TER
RE
O
_C
PT
IN
)
RU
ed
rv
R
se
TE
(re
IN
31 28 27 0
0 0 0 0 0x2012300 Reset
IM
INTERRUPT_CORE1_INTERRUPT_DATE Version control register. (R/W)
EL
PR

9.1 Overview
ESP32-S3 provides a 52-bit timer, which can be used to generate tick interrupts for operating system, or be
used as a general timer to generate periodic interrupts or one-time interrupts. With the help of RTC timer, system
timer can account for the period of the ESP32-S3 being in Light-sleep or Deep-sleep.
The timer consists of two counters UNIT0 and UNIT1. The counter values can be monitored by three
comparators COMP0, COMP1 and COMP2. See the timer block diagram on Figure 9-1.
A RY
IN
IM
Figure 91. System Timer Structure
9.2 Features
EL
• Consist of two 52-bit counters and three 52-bit comparators
• Software accessing registers is clocked by APB_CLK
• Use CNT_CLK for counting, with an average frequency of 16 MHz in two counting cycles
• Use 40 MHz XTAL_CLK as the clock source of CNT_CLK

PR
• Support for 52-bit alarm values (t) and 26-bit alarm periods (δt)
• Provide two modes to generate alarms:
– Target mode: only a one-time alarm is generated based on the alarm value (t)
– Period mode: periodic alarms are generated based on the alarm period (δt)
• Three comparators can generate three independent interrupts based on configured alarm value (t) or alarm
period (δt)
• Load back sleep time recorded by RTC timer via software after Deep-sleep or Light-sleep
• Can be configured to stall or continue running when CPU stalls or enters on-chip-debugging mode

9.3 Clock Source Selection

The counters and comparators are driven using XTAL_CLK. After scaled by a fractional divider, a fXT AL_CLK /3
clock is generated in one count cycle and a fXT AL_CLK /2 clock in another count cycle. The average clock
frequency is fXT AL_CLK /2.5, which is 16 MHz, i.e. the CNT_CLK in Figure 9-2. The timer counting is
incremented by 1/16 µs on each CNT_CLK cycle.
Software operation such as configuring registers is clocked by APB_CLK. For more information about APB_CLK,
see Chapter 6 Reset and Clock.
The following two bits of system registers are also used to control the system timer:
• SYSTEM_SYSTIMER_CLK_EN in register SYSTEM_PERIP_CLK_EN0_REG: enable APB_CLK signal to
RY
system timer.
• SYSTEM_SYSTIMER_RST in register SYSTEM_PERIP_RST_EN0_REG: reset system timer.
Note that if the timer is reset, its registers will be restored to their default values. For more information, please
refer to Table Peripheral Clock Gating and Reset in Chapter 13 System Registers.
A
IN
IM
EL
Figure 92. System Timer Alarms
Figure 9-2 shows the procedure to generate alarm/interrupt in system timer. In this process, one timer counter
and one timer comparator are used. An alarm interrupt will be generated accordingly based on the comparison
PR
result in comparator.
9.4.1 Counter
The system timer has two 52-bit timer counters, shown as UNITn (n = 0 or 1). Their counting clock source is a 16
MHz clock, i.e. CNT_CLK. Whether UNITn works or not is controlled by three bits in register
SYSTIMER_CONF_REG:
• SYSTIMER_TIMER_UNITn_WORK_EN: set this bit to enable the counter UNITn in system timer.
• SYSTIMER_TIMER_UNITn_CORE0_STALL_EN: if this bit is set, the counter UNITn stops counting when
CPU0 is stalled. The counter continues its counting after the CPU0 resumes.
• SYSTIMER_TIMER_UNITn_CORE1_STALL_EN: if this bit is set, the counter UNITn stops counting when
CPU1 is stalled. The counter continues its counting after the CPU1 resumes.

The configuration of the three bits to control the counter UNITn is shown below, assuming that CPU0 and CPU1
both are stalled.
Table 91. UNITn Configuration Bits
SYSTIMER_TIMER_ SYSTIMER_TIMER_ SYSTIMER_TIMER_ Counter

UNITn_WORK_EN UNITn_CORE0_STALL_EN UNITn_CORE1_STALL_EN UNITn
*
0 x x Not at work
Stop counting, but will
1 x 1 continue its counting
after CPU1 resumes.
Stop counting, but will
RY
1 1 x continue its counting
after CPU0 resumes.
1 0 0 Keep counting
*
x: Don’t-care.
A
When the counter UNITn is at work, the count value is incremented on each counting cycle. When the counter
UNITn is stopped or stalled, the count value stops increasing and keeps unchanged.
The low 32 bits and high 20 bits of initial count value are loaded from SYSTIMER_TIMER_UNITn_LOAD_LO and
IN
SYSTIMER_TIMER_UNITn_LOAD_HI. Writing 1 to the bit SYSTIMER_TIMER_UNITn_LOAD will trigger a reload
event, and the current count value will be changed immediately. If UNITn is at work, the counter will continue to
count up from the new reloaded value.
IM
Writing 1 to SYSTIMER_TIMER_UNITn_UPDATE will trigger an update event. The low 32 bits and high 20 bits of
current count value will be locked into SYSTIMER_TIMER_UNITn_VALUE_LO and
SYSTIMER_TIMER_UNITn_VALUE_HI, and then SYSTIMER_TIMER_UNITn_VALUE_VALID is asserted. Before
the next update event, the values of SYSTIMER_TIMER_UNITn_VALUE_LO and
SYSTIMER_TIMER_UNITn_VALUE_HI remain unchanged.
EL
9.4.2 Comparator and Alarm

The system timer has three 52-bit comparators, shown as COMPx (x = 0, 1, or 2). The comparators can
generate independent interrupts based on different alarm values (t) or alarm periods (δt).
PR
Configure SYSTIMER_TARGETx_PERIOD_MODE to choose from the two alarm modes for each COMPx:
• 1: select period mode
• 0: select target mode
In period mode, the alarm period (δt) is provided by the register SYSTIMER_TARGETx_PERIOD. Assuming that
current count value is t1, when it reaches (t1 + δt), an alarm interrupt will be generated. Another alarm interrupt
also will be generated when the counter value reaches (t1 + 2*δt). By such way, periodic alarms are
generated.
In target mode, the low 32 bits and high 20 bits of the alarm value (t) are provided by
SYSTIMER_TIMER_TARGETx_LO and SYSTIMER_TIMER_TARGETx_HI. Assuming that current count value is t2
(t2 <= t), an alarm interrupt will be generated when the count value reaches the alarm value (t). Unlike in period
mode, only one alarm interrupt is generated in target mode.

SYSTIMER_TARGETx_TIMER_UNIT_SEL is used to choose the count value from which timer counter to be
compared for alarm:
• 1: use the count value from UNIT1
• 0: use the count value from UNIT0
Finally, set SYSTIMER_TARGETx_WORK_EN and COMPx starts to compare the count value with the alarm value
(t) in target mode or with the alarm period (t1 + n*δt) in period mode.
An alarm is generated when the count value equals to the alarm value (t) in target mode or to the start value(t1) +
n*alarm period δt (n = 1,2,3...) in period mode. But if the alarm value (t) set in registers is less than current count
value, i.e. the target has already passed, or current count value is larger than the real target value within a range
(0 ~ 251 -1), an alarm interrupt also is generated immediately. The relationship between current count value tc , the
RY
alarm value tt and alarm trigger point is shown below. No matter in target mode or period mode, the low 32 bits
and high 20 bits of the real target value can always be read from SYSTIMER_TARGETx_LO_RO and
SYSTIMER_TARGETx_HI_RO.
Table 92. Trigger Point
A
Relationship Between tc and tt Trigger Point
tc - tt <= 0 tc = tt , an alarm is triggered.
51
0 <= tc - tt < 2 -1 An alarm is triggered immediately.
51
tc - tt >= 2 -1
IN
tc overflows after counting to its maximum value
52’hfffffffffffff, and then starts counting up from 0.
When its value reaches tt , an alarm is triggered.
IM
9.4.3 Synchronization Operation
The clock APB_CLK is used in software operation, while timer counters and comparators are working on
CNT_CLK. Synchronization is needed for some configuration registers. A complete synchronization action takes
two steps:
EL
1. Software writes suitable values to configuration fields, see the first column in Table 9-3.
2. Software writes 1 to corresponding bits to start synchronization, see the second column in Table 9-3.
Table 93. Synchronization Operation

PR
Configuration Fields Synchronization Enable Bit

SYSTIMER_TIMER_UNITn_LOAD_LO
SYSTIMER_TIMER_UNITn_LOAD
SYSTIMER_TIMER_UNITn_LOAD_HI
SYSTIMER_TARGETx_PERIOD
SYSTIMER_TIMER_TARGETx_HI SYSTIMER_TIMER_COMPx_LOAD
SYSTIMER_TIMER_TARGETx_LO
9.4.4 Interrupt
Each comparator has one level-triggered alarm interrupt, named as SYSTIMER_TARGETx_INT. Interrupt signal is
asserted high when the comparator starts to alarm. Until the interrupt is cleared by software, it remains high. To
enable interrupts, set the bit SYSTIMER_TARGETx_INT_ENA.


9.5.1 Read Current Count Value
1. Set SYSTIMER_TIMER_UNITn_UPDATE to update the current count value into SYSTIMER_TIMER_UNITn_
VALUE_HI and SYSTIMER_TIMER_UNITn_VALUE_LO.
2. Poll the reading of SYSTIMER_TIMER_UNITn_VALUE_VALID, till it’s 1, which means user now can read the
count values from SYSTIMER_TIMER_UNITn_VALUE_HI and SYSTIMER_TIMER_UNITn_VALUE_LO.
3. Read the low 32 bits and high 20 bits from SYSTIMER_TIMER_UNITn_VALUE_LO and SYSTIMER_TIMER_
UNITn_VALUE_HI.
RY
9.5.2 Configure OneTime Alarm in Target Mode
1. Set SYSTIMER_TARGETx_TIMER_UNIT_SEL to select the counter (UNIT0 or UNIT1) used for COMPx.
2. Read current count value, see Section 9.5.1. This value will be used to calculate the alarm value (t) in Step
4.
A
3. Clear SYSTIMER_TARGETx_PERIOD_MODE to enable target mode.
4. Set an alarm value (t), and fill its low 32 bits to SYSTIMER_TIMER_TARGETx_LO, and the high 20 bits to
SYSTIMER_TIMER_TARGETx_HI.
IN
5. Set SYSTIMER_TIMER_COMPx_LOAD to synchronize the alarm value to COMPx, i.e. load the alarm value
(t) to the COMPx.
6. Set SYSTIMER_TARGETx_WORK_EN to enable the selected COMPx. COMPx starts comparing the count
IM
value with the alarm value (t).
7. Set SYSTIMER_TARGETx_INT_ENA to enable timer interrupt. When Unitn counts to the alarm value (t), a
SYSTIMER_TARGETx_INT interrupt is triggered.
9.5.3 Configure Periodic Alarms in Period Mode

EL
1. Set SYSTIMER_TARGETx_TIMER_UNIT_SEL to select the counter (UNIT0 or UNIT1) used for COMPx.
2. Set a alarm period (δt), and fill it to SYSTIMER_TARGETx_PERIOD.
3. Set SYSTIMER_TIMER_COMPx_LOAD to synchronize the alarm period (δt) to COMPx. , i.e. load the alarm
PR
period (δt) to COMPx.
4. Set SYSTIMER_TARGETx_PERIOD_MODE to configure COMPx into period mode.
5. Set SYSTIMER_TARGETx_WORK_EN to enable the selected COMPx. COMPx starts comparing the count
value with the sum of start value + n*δt (n = 1, 2, 3...).
6. Set SYSTIMER_TARGETx_INT_ENA to enable timer interrupt. A SYSTIMER_TARGETx_INT interrupt is

triggered when Unitn counts to start value + n*δt (n = 1, 2, 3...) set in step 2.
9.5.4 Update After Deepsleep and Lightsleep

1. Configure RTC timer before the chip goes to Deep-sleep or Light-sleep, to record the exact sleep time. For
more information, see Chapter 7 Low-Power Management (RTC_CNTL) [to be added later].
2. Read the sleep time from RTC timer when the chip is woken up from Deep-sleep or Light-sleep.

3. Read current count value of system timer, see Section 9.5.1.
4. Convert the time value recorded by RTC timer from the clock cycles based on RTC_SLOW_CLK to that
based on 16 MHz CNT_CLK. For example, if the frequency of RTC_SLOW_CLK is 32 KHz, the recorded
RTC timer value should be converted by multiplying by 500.
5. Add the converted RTC value to current count value of system timer:
• Fill the new value into SYSTIMER_TIMER_UNITn_LOAD_LO (low 32 bits) and

SYSTIMER_TIMER_UNITn_LOAD_HI (high 20 bits).
• Set SYSTIMER_TIMER_UNITn_LOAD to load new timer value into system timer. By such way, the
system timer is updated.
RY
The addresses in this section are relative to system timer base address provided in Table 3-4 in Chapter 3 System
and Memory.
A
Clock Control Register
SYSTIMER_CONF_REG Configure system timer clock 0x0000 R/W
UNIT0 Control and Configuration Registers
SYSTIMER_UNIT0_OP_REG
SYSTIMER_UNIT0_LOAD_HI_REG
IN
Read UNIT0 value to registers
High 20 bits to be loaded to UNIT0
0x0004
0x000C
varies
R/W
SYSTIMER_UNIT0_LOAD_LO_REG Low 32 bits to be loaded to UNIT0 0x0010 R/W
SYSTIMER_UNIT0_VALUE_HI_REG UNIT0 value, high 20 bits 0x0040 RO
IM
SYSTIMER_UNIT0_VALUE_LO_REG UNIT0 value, low 32 bits 0x0044 RO
SYSTIMER_UNIT0_LOAD_REG UNIT0 synchronization register 0x005C WT
UNIT1 Control and Configuration Registers
SYSTIMER_UNIT1_OP_REG Read UNIT1 value to registers 0x0008 varies
EL
SYSTIMER_UNIT1_LOAD_HI_REG High 20 bits to be loaded to UNIT1 0x0014 R/W

SYSTIMER_UNIT1_LOAD_LO_REG Low 32 bits to be loaded to UNIT1 0x0018 R/W
SYSTIMER_UNIT1_VALUE_HI_REG UNIT1 value, high 20 bits 0x0048 RO
SYSTIMER_UNIT1_VALUE_LO_REG UNIT1 value, low 32 bits 0x004C RO
SYSTIMER_UNIT1_LOAD_REG UNIT1 synchronization register 0x0060 WT
PR
Comparator0 Control and Configuration Registers

SYSTIMER_TARGET0_HI_REG Alarm value to be loaded to COMP0, high 20 bits 0x001C R/W
SYSTIMER_TARGET0_LO_REG Alarm value to be loaded to COMP0, low 32 bits 0x0020 R/W
SYSTIMER_TARGET0_CONF_REG Configure COMP0 alarm mode 0x0034 R/W
SYSTIMER_COMP0_LOAD_REG COMP0 synchronization register 0x0050 WT
SYSTIMER_TARGET1_HI_REG Alarm value to be loaded to COMP1, high 20 bits 0x0024 R/W
SYSTIMER_TARGET1_CONF_REG Configure COMP1 alarm mode 0x0038 R/W
SYSTIMER_TARGET2_HI_REG Alarm value to be loaded to COMP2, high 20 bits 0x002C R/W


SYSTIMER_TARGET2_CONF_REG Configure COMP2 alarm mode 0x003C R/W
Interrupt Registers
SYSTIMER_INT_ENA_REG Interrupt enable register of system timer 0x0064 R/W
SYSTIMER_INT_RAW_REG Interrupt raw register of system timer 0x0068 R/WTC/SS
SYSTIMER_INT_CLR_REG Interrupt clear register of system timer 0x006C WT
SYSTIMER_INT_ST_REG Interrupt status register of system timer 0x0070 RO
COMP0 Status Registers
SYSTIMER_REAL_TARGET0_LO_REG Actual target value of COMP0, low 32 bits 0x0074 RO
RY
SYSTIMER_REAL_TARGET0_HI_REG Actual target value of COMP0, high 20 bits 0x0078 RO
SYSTIMER_REAL_TARGET1_LO_REG Actual target value of COMP1, low 32 bits 0x007C RO
A
SYSTIMER_REAL_TARGET2_LO_REG Actual target value of COMP2, low 32 bits 0x0084 RO
Version Register
SYSTIMER_DATE_REG
IN
Version control register 0x00FC R/W
IM
EL
PR

9.7 Registers
The addresses in this section are relative to system timer base address provided in Table 3-4 in Chapter 3 System
and Memory.
Register 9.1. SYSTIMER_CONF_REG (0x0000)
_T GE _W CO E0_ AL EN
G 1_W RK E1 TAL EN
LL N
N
2_ R EN TA _E
_E
ER AR T0 1_ R ST L_
AR T O R S L_
ET O _ _S L
IM _T GE NIT CO 1_ AL
ST ER AR _U 1_ RE ST
S ER IM _U 0_ R EN
S ER IM _U 0_ R EN
SY TIM _T ER NIT CO E0_
SY TIM _T ER NIT WO K_
SY TIM _T ER NIT CO K_
RK N
N
S ER IM _U 1_ R
O E
_E
SY TIM _T ER NIT WO
W K_
S ER IM _U 0_
SY TIM _T ER NIT
S ER IM _U
ST ER IM N
SY TIM _T _E
SY IM _T ER
RY
S ER LK
SY IM _C
ST ER
)
ed
SY TIM
rv
se
S
SY
(re
31 30 29 28 27 26 25 24 23 22 21 0
0 1 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
A
SYSTIMER_TARGET2_WORK_EN COMP2 work enable bit. (R/W)
SYSTIMER_TARGET1_WORK_EN COMP1 work enable bit. (R/W) IN

SYSTIMER_TARGET0_WORK_EN COMP0 work enable bit. (R/W)
SYSTIMER_TIMER_UNIT1_CORE1_STALL_EN UNIT1 is stalled when CPU1 stalled. (R/W)

IM
SYSTIMER_TIMER_UNIT1_WORK_EN UNIT1 work enable bit. (R/W)

EL
SYSTIMER_TIMER_UNIT0_WORK_EN UNIT0 work enable bit. (R/W)
SYSTIMER_CLK_EN Register clock gating. 1: Register clock is always enabled for read and write
operations. 0: Only enable needed clock for register read or write operations. (R/W)
PR

Register 9.2. SYSTIMER_UNIT0_OP_REG (0x0004)
D
A LI
_V
AL E
_V AT
UE
T0 PD
NI _U
_U IT0
ER N
IM _U
_T ER
ER IM
IM _T
ST ER
S d)
d)
SY TIM
SY rve
ve
r
se
se
(re
(re
31 30 29 28 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
SYSTIMER_TIMER_UNIT0_VALUE_VALID UNIT0 value is synchronized and valid. (R/SS/WTC)
SYSTIMER_TIMER_UNIT0_UPDATE Update timer UNIT0, i.e. read the UNIT0 count value to SYS-
TIMER_TIMER_UNIT0_VALUE_HI and SYSTIMER_TIMER_UNIT0_VALUE_LO. (WT)
A
Register 9.3. SYSTIMER_UNIT0_LOAD_HI_REG (0x000C)
I
_H
IN
AD
O
_L
T0
NI
_U
ER
IM
_T
ER
d)
IM
ve
IM
r
ST
se
SY
(re
31 20 19 0
0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SYSTIMER_TIMER_UNIT0_LOAD_HI The value to be loaded to UNIT0, high 20 bits. (R/W)

EL
Register 9.4. SYSTIMER_UNIT0_LOAD_LO_REG (0x0010)

O
_L
PR
AD
LO
0_
N IT
_U
ER
IM
_T
ER
IM
ST
SY
31 0
0 Reset
SYSTIMER_TIMER_UNIT0_LOAD_LO The value to be loaded to UNIT0, low 32 bits. (R/W)

Register 9.5. SYSTIMER_UNIT0_VALUE_HI_REG (0x0040)
I
_H
LUE
VA
T0_
NI
_U
ER
IM
_T
ER
d)
IM
ve
er
ST
s
SY
(re
31 20 19 0
0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SYSTIMER_TIMER_UNIT0_VALUE_HI UNIT0 read value, high 20 bits. (RO)
RY
Register 9.6. SYSTIMER_UNIT0_VALUE_LO_REG (0x0044)
O
_L
A UE
AL
_V
T0
NI
_U
ER
IN IM
ER
_T
IM
ST
SY
31 0
0 Reset
IM
SYSTIMER_TIMER_UNIT0_VALUE_LO UNIT0 read value, low 32 bits. (RO)
EL
Register 9.7. SYSTIMER_UNIT0_LOAD_REG (0x005C)
AD
LO
0_
T
NI
_U
ER
IM
_T
PR
ER
)
ed
M
rv
I
ST
se
SY
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SYSTIMER_TIMER_UNIT0_LOAD UNIT0 synchronization enable signal. Set this bit to reload the val-
ues of SYSTIMER_TIMER_UNIT0_LOAD_HI and SYSTIMER_TIMER_UNIT0_LOAD_LO to UNIT0.
(WT)

Register 9.8. SYSTIMER_UNIT1_OP_REG (0x0008)
D
A LI
_V
AL E
_V AT
UE
T1 PD
NI _U
_U IT1
ER N
IM _U
_T ER
ER IM
IM _T
ST ER
S d)
d)
SY TIM
SY rve
ve
r
se
se
(re
(re
31 30 29 28 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
SYSTIMER_TIMER_UNIT1_VALUE_VALID UNIT1 value is synchronized and valid. (R/SS/WTC)
SYSTIMER_TIMER_UNIT1_UPDATE Update timer UNIT1, i.e. read the UNIT1 count value to SYS-
TIMER_TIMER_UNIT1_VALUE_HI and SYSTIMER_TIMER_UNIT1_VALUE_LO. (WT)
A
Register 9.9. SYSTIMER_UNIT1_LOAD_HI_REG (0x0014)
I
_H
IN
AD
O
_L
T1
NI
_U
ER
IM
_T
ER
d)
IM
ve
IM
r
ST
se
SY
(re
31 20 19 0
0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SYSTIMER_TIMER_UNIT1_LOAD_HI The value to be loaded to UNIT1, high 20 bits. (R/W)

EL
Register 9.10. SYSTIMER_UNIT1_LOAD_LO_REG (0x0018)

O
_L
PR
AD
LO
1_
N IT
_U
ER
IM
_T
ER
IM
ST
SY
31 0
0 Reset
SYSTIMER_TIMER_UNIT1_LOAD_LO The value to be loaded to UNIT1, low 32 bits. (R/W)

Register 9.11. SYSTIMER_UNIT1_VALUE_HI_REG (0x0048)
I
_H
LUE
VA
T1_
NI
_U
ER
IM
_T
ER
d)
IM
ve
er
ST
s
SY
(re
31 20 19 0
0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SYSTIMER_TIMER_UNIT1_VALUE_HI UNIT1 read value, high 20 bits. (RO)
RY
Register 9.12. SYSTIMER_UNIT1_VALUE_LO_REG (0x004C)
O
_L
A UE
AL
_V
T1
NI
_U
ER
IN IM
ER
_T
IM
ST
SY
31 0
0 Reset
IM
SYSTIMER_TIMER_UNIT1_VALUE_LO UNIT1 read value, low 32 bits. (RO)
EL
Register 9.13. SYSTIMER_UNIT1_LOAD_REG (0x0060)
AD
LO
1_
T
NI
_U
ER
IM
_T
PR
ER
)
ed
M
rv
I
ST
se
SY
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SYSTIMER_TIMER_UNIT1_LOAD UNIT1 synchronization enable signal. Set this bit to reload the val-
ues of SYSTIMER_TIMER_UNIT1_LOAD_HI and SYSTIMER_TIMER_UNIT1_LOAD_LO to UNIT1.
(WT)

Register 9.14. SYSTIMER_TARGET0_HI_REG (0x001C)
HI
0_
ET
G
AR
_T
ER
IM
_T
ER
)
ed
IM
rv
ST
se
SY
(re
31 20 19 0
0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SYSTIMER_TIMER_TARGET0_HI The alarm value to be loaded to COMP0, high 20 bits. (R/W)
RY
Register 9.15. SYSTIMER_TARGET0_LO_REG (0x0020)
LO
0_
ET
G
A
AR
_T
ER
IM
_T
ER
IM
IN
ST
SY
31 0
0 Reset
SYSTIMER_TIMER_TARGET0_LO The alarm value to be loaded to COMP0, low 32 bits. (R/W)

IM
Register 9.16. SYSTIMER_TARGET0_CONF_REG (0x0034)

EL O L
M SE
D_ _
O IT
RI UN
DE
D
PE R_
O
0_ E
RI
ET IM
PE
G 0_T
0_
AR T
ET
_T GE
G
ER AR
AR
IM _T
_T
ST ER
ER
PR SY TIM
ed
)
IM
rv
ST
se
S
SY
SY
(re
31 30 29 26 25 0
0 0 0 0 0 0 0x00000 Reset
SYSTIMER_TARGET0_PERIOD COMP0 alarm period. (R/W)
SYSTIMER_TARGET0_PERIOD_MODE Set COMP0 to period mode. (R/W)
SYSTIMER_TARGET0_TIMER_UNIT_SEL Select which counter unit to compare for COMP0. (R/W)

Register 9.17. SYSTIMER_COMP0_LOAD_REG (0x0050)
AD
O
_L
P0
M
O
_C
ER
IM
_T
ER
d)
IM
ver
ST
se
SY
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SYSTIMER_TIMER_COMP0_LOAD COMP0 synchronization enable signal. Set this bit to reload the
RY
alarm value/period to COMP0. (WT)
Register 9.18. SYSTIMER_TARGET1_HI_REG (0x0024)
A M
ER
_T
AR
G
ET
1_
HI
IN
I
_T
ER
d)
IM
ve
er
ST
s
SY
(re
31 20 19 0
0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
IM

EL
LO
1_
ET
G
AR
_T
ER
IM
_T
PR
ER
IM
ST
SY
31 0
0 Reset

Register 9.20. SYSTIMER_TARGET1_CONF_REG (0x0038)
O L
M SE
DE
D_ _
O IT
RI UN
D
PE R_
O
1_ E
RI
ET IM
PE
G 1_T
1_
AR T
ET
_T GE
G
ER AR
AR
IM _T
_T
ST ER
ER
)
ed
SY TIM
IM
rv
ST
se
S
SY
SY
(re
31 30 29 26 25 0
0 0 0 0 0 0 0x00000 Reset
RY
A
IN
AD
O
_L
P1
M
O
_C
ER
IM
_T
ER
d)
IM
IM
r ve
ST
se
SY
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
EL
Register 9.22. SYSTIMER_TARGET2_HI_REG (0x002C)

PR
HI
2_
ET
G
AR
_T
ER
IM
_T
ER
)
ed
M
rv
TI
se
S
SY
(re
31 20 19 0
0 0 0 0 0 0 0 0 0 0 0 0 0 Reset

LO
2_
ET
G
AR
_T
ER
IM
_T
ER
IM
ST
SY
31 0
0 Reset
RY
Register 9.24. SYSTIMER_TARGET2_CONF_REG (0x003C)
O L
M SE
DE
D_ _
O IT
RI UN
A D
PE R_
O
2_ E
RI
ET IM
PE
G 2_T
2_
AR T
ET
_T GE
G
ER AR
AR
IN
IM _T
_T
ST ER
ER
)
ed
SY TIM
IM
rv
ST
se
S
SY
SY
(re
31 30 29 26 25 0
0 0 0 0 0 0 0x00000 Reset
IM

EL
AD
O
PR
_L
P2
M
O
_C
ER
IM
_T
ER
d)
M
e
rv
I
ST
se
SY
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset

Register 9.26. SYSTIMER_INT_ENA_REG (0x0064)
ET NT A
T_ A
A
G 1_I _EN
IN N
EN
0_ _E
AR T T
_T GE _IN
ER AR T2
IM _T GE
ST ER AR
SY TIM _T
S ER
)
ed
SY TIM
v
er
S
s
SY
(re
31 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SYSTIMER_TARGET0_INT_ENA SYSTIMER_TARGET0_INT enable bit. (R/W)
RY
Register 9.27. SYSTIMER_INT_RAW_REG (0x0068)
A
ET NT AW
T_ W
W
IN A
RA
G 1_I _R
0_ _R
AR T T
_T GE _IN
IN
ER AR T2
IM _T GE
ST ER AR
SY TIM _T
S ER
)
ed
SY IM
rv
ST
se
SY
(re
IM
31 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SYSTIMER_TARGET0_INT_RAW SYSTIMER_TARGET0_INT raw bit. (R/WTC/SS)

EL

PR

Register 9.28. SYSTIMER_INT_CLR_REG (0x006C)
ET NT LR
T_ R
R
IN L
CL
G 1_I _C
0_ _C
AR T T
_T GE _IN
ER AR T2
IM _T GE
ST ER AR
SY TIM _T
S ER
)
ed
SY TIM
rv
se
S
SY
(re
31 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SYSTIMER_TARGET0_INT_CLR SYSTIMER_TARGET0_INT clear bit. (WT)
RY
Register 9.29. SYSTIMER_INT_ST_REG (0x0070)
A
G 1_I _ST
IN T
ST
0_ _S
T_
AR T T
ET NT
_T GE _IN
IN
ER AR T2
IM _T GE
ST ER AR
SY TIM _T
S ER
)
ed
SY IM
rv
ST
se
SY
(re
31 3 2 1 0
IM
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SYSTIMER_TARGET0_INT_ST SYSTIMER_TARGET0_INT status bit. (RO)

EL
Register 9.30. SYSTIMER_REAL_TARGET0_LO_REG (0x0074)

PR
O
_R
LO
0_
ET
G
AR
_T
ER
IM
ST
SY
31 0
0 Reset
SYSTIMER_TARGET0_LO_RO Actual target value of COMP0, low 32 bits. (RO)

Register 9.31. SYSTIMER_REAL_TARGET0_HI_REG (0x0078)
RO
I_
_H
0
ET
G
AR
_T
ER
)
ed
IM
rv
ST
se
SY
(re
31 20 19 0
0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SYSTIMER_TARGET0_HI_RO Actual target value of COMP0, high 20 bits. (RO)
RY
Register 9.32. SYSTIMER_REAL_TARGET1_LO_REG (0x007C)
O
_R
LO
1_
ET
A
G
AR
_T
ER
IM
ST
SY
31
IN0
0
Reset

IM
O
_R
HI
EL
1_
ET
G
AR
_T
ER
d)
M
e
rv
TI
se
S
SY
(re
31 20 19 0
PR
0 0 0 0 0 0 0 0 0 0 0 0 0 Reset

Register 9.34. SYSTIMER_REAL_TARGET2_LO_REG (0x0084)
O
_R
LO
2_
ET
G
AR
_T
ER
IM
ST
SY
31 0
0 Reset
RY
O
_R
HI
2_
A ET
G
AR
_T
ER
)
ed
IM
rv
ST
se
SY
(re
31
0 0 0 0 0 0 0 0 0 0 0
20
0
19
IN 0
0
Reset

IM
Register 9.36. SYSTIMER_DATE_REG (0x00FC)
E
AT
_D
EL
ER
M
I
ST
SY
31 0
0x2012251 Reset
SYSTIMER_DATE Version control register. (R/W)

PR

10 Timer Group (TIMG)
10.1 Overview
General purpose timers can be used to precisely time an interval, trigger an interrupt after a particular interval
(periodically and aperiodically), or act as a hardware clock. As shown in Figure 10-1, the ESP32-S3 chip contains
two timer groups, namely timer group 0 and timer group 1. Each timer group consists of two general purpose
timers referred to as Tx (where x is 0 or 1) and one Main System Watchdog Timer. All general purpose timers are
based on 16-bit prescalers and 54-bit auto-reload-capable up-down counters.
A RY
IN
IM
Figure 101. Timer Units within Groups
Note that while the Main System Watchdog Timer registers are described in this chapter, their functional
description is included in the Chapter 11 Watchdog Timers. Therefore, the term ‘timers’ within this chapter refers
to the general purpose timers.
EL
The timers’ features are summarized as follows:
• A 16-bit clock prescaler, from 2 to 65536
• A 54-bit time-base counter programmable to incrementing or decrementing
• Able to read real-time value of the time-base counter

PR
• Halting and resuming the time-base counter
• Programmable alarm generation
• Timer value reload (Auto-reload at alarm or software-controlled instant reload)
• Level interrupt generation

RY
Figure 102. Timer Group Architecture
Figure10-2 is a diagram of timer Tx in a timer group. Tx contains a clock selector, a 16-bit integer divider as a
prescaler, a timer-based counter and a comparator for alarm generation.
10.2.1 16bit Prescaler and Clock Selection
A
Each timer can select between the APB clock (APB_CLK) or external clock (XTAL_CLK) as its clock source by
setting the TIMG_Tx_USE_XTAL field of the TIMG_TxCONFIG_REG register. The clock is then divided by a 16-bit
IN
prescaler to generate the time-base counter clock (TB_CLK) used by the time-base counter. When the
TIMG_Tx_DIVIDER field is configured as 2 ~ 65536, the divisor of the prescaler would be 2 ~ 65536. Note that
programming value 0 to TIMG_Tx_DIVIDER will result in the divisor being 65536. When the prescaler is set to 1,
the actual divisor is 2, so the timer counter value represents the half of real time.
IM
Before you modify the 16-bit prescaler, the timer must be disabled (i.e. TIMG_Tx_EN should be cleared).
Otherwise, the result can be unpredictable.
10.2.2 54bit Timebase Counter

EL
The 54-bit time-base counters are based on TB_CLK and can be configured to increment or decrement via the
TIMG_Tx_INCREASE field. The time-base counter can be enabled or disabled by setting or clearing the
TIMG_Tx_EN field, respectively. When enabled, the time-base counter increments or decrements on each cycle
of TB_CLK. When disabled, the time-base counter is essentially frozen. Note that the TIMG_Tx_INCREASE field
can be changed while TIMG_Tx_EN is set and this will cause the time-base counter to change direction
PR
instantly.
To read the 54-bit value of the time-base counter, the timer value must be latched to two registers before being
read by the CPU (due to the CPU being 32-bit). By writing any value to the TIMG_TxUPDATE_REG, the current
value of the 54-bit timer is instantly latched into the TIMG_TxLO_REG and TIMG_TxHI_REG registers containing
the lower 32-bits and higher 22-bits, respectively. TIMG_TxLO_REG and TIMG_TxHI_REG registers will remain
unchanged for the CPU to read in its own time until TIMG_TxUPDATE_REG is written to again.
10.2.3 Alarm Generation

A timer can be configured to trigger an alarm when the timer’s current value matches the alarm value. An alarm
will cause an interrupt to occur and (optionally) an automatic reload of the timer’s current value (see Section
10.2.4). The 54-bit alarm value is configured using TIMG_TxALARMLO_REG and TIMG_TxALARMHI_REG,
which represent the lower 32-bits and higher 22-bits of the alarm value, respectively. However, the configured

alarm value is ineffective until the alarm is enabled by setting the TIMG_Tx_ALARM_EN field. To avoid alarm being
enabled ‘too late’ (i.e. the timer value has already passed the alarm value when the alarm is enabled), the
hardware will trigger the alarm immediately if the current timer value is higher than the alarm value (within a
defined range) when the up-down counter increments, or lower than the alarm value (within a defined range) of
when the up-down counter decrements. Table 10-1 and Table 10-2 show the relationship between the current
value of the timer, the alarm value, and when an alarm is triggered.The current time value and the alarm value are
defined as follows:
• TIMG_VALUE = {TIMG_TxHI_REG, TIMG_TxLO_REG}
• ALARM_VALUE = {TIMG_TxALARMHI_REG, TIMG_TxALARMLO_REG}
Table 101. Alarm Generation When UpDown Counter Increments
RY
Scenario Range Alarm
1 ALARM_VALUE − TIMG_VALUE > 2 53
Triggered
Triggered when the up-down counter counts
2 0 < ALARM_VALUE − TIMG_VALUE ≤ 253
TIMG_VALUE up to ALARM_VALUE
3 0 ≤ TIMG_VALUE − ALARM_VALUE < 2 53
Triggered
A
Triggered when the up-down counter restarts
counting up from 0 after reaching the timer’s
4 TIMG_VALUE − ALARM_VALUE ≥ 253
IN maximum value and counts TIMG_VALUE up
to ALARM_VALUE
Table 102. Alarm Generation When UpDown Counter Decrements

IM
Scenario Range Alarm
5 TIMG_VALUE − ALARM_VALUE > 2 53
Triggered
Triggered when the up-down counter counts
6 0 < TIMG_VALUE − ALARM_VALUE ≤ 253
TIMG_VALUE down to ALARM_VALUE
EL
7 0 ≤ ALARM_VALUE − TIMG_VALUE < 2 53

Triggered
Triggered when the up-down counter restarts
counting down from the timer’s maximum value
8 ALARM_VALUE − TIMG_VALUE ≥ 253
after reaching the minimum value and counts
TIMG_VALUE down to ALARM_VALUE
PR
When an alarm occurs, the TIMG_Tx_ALARM_EN field is automatically cleared and no alarm will occur again until
the TIMG_Tx_ALARM_EN is set next time.
10.2.4 Timer Reload

A timer is reloaded when a timer’s current value is overwritten with a reload value stored in the
TIMG_Tx_LOAD_LO and TIMG_Tx_LOAD_HI fields that correspond to the lower 32-bits and higher 22-bits of the
timer’s new value, respectively. However, writing a reload value to TIMG_Tx_LOAD_LO and TIMG_Tx_LOAD_HI
will not cause the timer’s current value to change. Instead, the reload value is ignored by the timer until a reload
event occurs. A reload event can be triggered either by a software instant reload or an auto-reload at
alarm.

A software instant reload is triggered by the CPU writing any value to TIMG_TxLOAD_REG, which causes the
timer’s current value to be instantly reloaded. If TIMG_Tx_EN is set, the timer will continue incrementing or
decrementing from the new value. If TIMG_Tx_EN is cleared, the timer will remain frozen at the new value until
counting is re-enabled.
An auto-reload at alarm will cause a timer reload when an alarm occurs, thus allowing the timer to continue
incrementing or decrementing from the reload value. This is generally useful for resetting the timer’s value when
using periodic alarms. To enable auto-reload at alarm, the TIMG_Tx_AUTORELOAD field should be set. If not
enabled, the timer’s value will continue to increment or decrement past the alarm value after an alarm.
10.2.5 SLOW_CLK Frequency Calculation
RY
Via XTAL_CLK, a timer could calculate the frequency of clock sources for SLOW_CLK (i.e. RTC_CLK,
RTC20M_D256_CLK, and XTAL32K_CLK) as follows:
1. Start periodic or one-shot frequency calculation;
2. Once receiving the signal to start calculation, the counter of XTAL_CLK and the counter of SLOW_CLK
begin to work at the same time. When the counter of SLOW_CLK counts to C0, the two counters stop
A
counting simultaneously;
3. Assume the value of XTAL_CLK’s counter is C1, and the frequency of SLOW_CLK would be calculated as:
C0×f _XT AL_CLK
f _rtc =
10.2.6 Interrupts
C1
IN
Each timer has its own interrupt line that can be routed to the CPU, and thus each timer group has a total of
IM
three interrupt lines. Timers generate level interrupts that must be explicitly cleared by the CPU on each
triggering.
Interrupts are triggered after an alarm (or stage timeout for watchdog timers) occurs. Level interrupts will be held
high after an alarm (or stage timeout) occurs, and will remain so until manually cleared. To enable a timer’s
interrupt, the TIMG_Tx_INT_ENA bit should be set.
EL
The interrupts of each timer group are governed by a set of registers. Each timer within the group has a
corresponding bit in each of these registers:
• TIMG_Tx_INT_RAW : An alarm event sets it to 1. The bit will remain set until the timer’s corresponding bit in
TIMG_Tx_INT_CLR is written.
PR
• TIMG_WDT_INT_RAW : A stage time out will set the timer’s bit to 1. The bit will remain set until the timer’s
corresponding bit in TIMG_WDT_INT_CLR is written.
• TIMG_Tx_INT_ST : Reflects the status of each timer’s interrupt and is generated by masking the bits of
TIMG_Tx_INT_RAW with TIMG_Tx_INT_ENA.
• TIMG_WDT_INT_ST : Reflects the status of each watchdog timer’s interrupt and is generated by masking
the bits of TIMG_WDT_INT_RAW with TIMG_WDT_INT_ENA.
• TIMG_Tx_INT_ENA : Used to enable or mask the interrupt status bits of timers within the group.
• TIMG_WDT_INT_ENA : Used to enable or mask the interrupt status bits of watchdog timer within the group.

• TIMG_Tx_INT_CLR : Used to clear a timer’s interrupt by setting its corresponding bit to 1. The timer’s
corresponding bit in TIMG_Tx_INT_RAW and TIMG_Tx_INT_ST will be cleared as a result. Note that a
timer’s interrupt must be cleared before the next interrupt occurs.
• TIMG_WDT_INT_CLR : Used to clear a timer’s interrupt by setting its corresponding bit to 1. The watchdog
timer’s corresponding bit in TIMG_WDT_INT_RAW and TIMG_WDT_INT_ST will be cleared as a result.
Note that a watchdog timer’s interrupt must be cleared before the next interrupt occurs.
10.3 Configuration and Usage

10.3.1 Timer as a Simple Clock
RY
1. Configure the time-base counter
• Select clock source by setting or clearing TIMG_Tx_USE_XTAL field.
• Configure the 16-bit prescaler by setting TIMG_Tx_DIVIDER.
• Configure the timer direction by setting or clearing TIMG_Tx_INCREASE.
A
• Set the timer’s starting value by writing the starting value to TIMG_Tx_LOAD_LO and
TIMG_Tx_LOAD_HI, then reloading it into the timer by writing any value to TIMG_TxLOAD_REG.
2. Start the timer by setting TIMG_Tx_EN.
3. Get the timer’s current value.

IN
• Write any value to TIMG_TxUPDATE_REG to latch the timer’s current value.
• Read the latched timer value from TIMG_TxLO_REG and TIMG_TxHI_REG.

IM
10.3.2 Timer as Oneshot Alarm
1. Configure the time-base counter following step 1 of Section 10.3.1.
2. Configure the alarm.

EL
• Configure the alarm value by setting TIMG_TxALARMLO_REG and TIMG_TxALARMHI_REG.
• Enable interrupt by setting TIMG_Tx_INT_ENA.
3. Disable auto reload by clearing TIMG_Tx_AUTORELOAD.

PR
4. Start the alarm by setting TIMG_Tx_ALARM_EN.
5. Handle the alarm interrupt.
• Clear the interrupt by setting the timer’s corresponding bit in TIMG_Tx_INT_CLR.
• Disable the timer by clearing TIMG_Tx_EN.
10.3.3 Timer as Periodic Alarm

1. Configure the time-base counter following step 1 in Section 10.3.1.
2. Configure the alarm following step 2 in Section 10.3.2.
3. Enable auto reload by setting TIMG_Tx_AUTORELOAD and configure the reload value via
TIMG_Tx_LOAD_LO and TIMG_Tx_LOAD_HI.

4. Start the alarm by setting TIMG_Tx_ALARM_EN.
5. Handle the alarm interrupt (repeat on each alarm iteration).
• If the next alarm requires a new alarm value and reload value (i.e. different alarm interval per iteration),
then TIMG_TxALARMLO_REG, TIMG_TxALARMHI_REG, TIMG_Tx_LOAD_LO, and
TIMG_Tx_LOAD_HI should be reconfigured as needed. Otherwise, the aforementioned registers
should remain unchanged.
• Re-enable the alarm by setting TIMG_Tx_ALARM_EN.
6. Stop the timer (on final alarm iteration).
RY
• Disable the timer by clearing TIMG_Tx_EN.
10.3.4 SLOW_CLK Frequency Calculation

1. One-shot frequency calculation
A
• Select the clock whose frequency is to be calculated (clock source of SLOW_CLK) via
TIMG_RTC_CALI_CLK_SEL, and configure the time of calculation via TIMG_RTC_CALI_MAX.
IN
• Select one-shot frequency calculation by clearing TIMG_RTC_CALI_START_CYCLING, and enable
the two counters via TIMG_RTC_CALI_START.
• Once TIMG_RTC_CALI_RDY becomes 1, read TIMG_RTC_CALI_VALUE to get the value of

XTAL_CLK’s counter, and calculate the frequency of SLOW_CLK.
IM
2. Periodic frequency calculation
• Select the clock whose frequency is to be calculated (clock source of SLOW_CLK) via
TIMG_RTC_CALI_CLK_SEL, and configure the time of calculation via TIMG_RTC_CALI_MAX.
EL
• Select periodic frequency calculation by enabling TIMG_RTC_CALI_START_CYCLING.
• When TIMG_RTC_CALI_CYCLING_DATA_VLD is 1, TIMG_RTC_CALI_VALUE is valid.
3. Timeout
If the counter of SLOW_CLK cannot finish counting in TIMG_RTC_CALI_TIMEOUT_RST_CNT cycles,
PR
TIMG_RTC_CALI_TIMEOUT will be set to indicate a timeout.


The addresses in this section are relative to Timer Group base address provided in Table 3-4 in Chapter 3 System
and Memory.

Timer 0 configuration and control registers
TIMG_T0CONFIG_REG Timer 0 configuration register 0x0000 varies
TIMG_T0LO_REG Timer 0 current value, low 32 bits 0x0004 RO
TIMG_T0HI_REG Timer 0 current value, high 22 bits 0x0008 RO
TIMG_T0UPDATE_REG Write to copy current timer value to 0x000C R/W/SC
TIMG_T0LO_REG or TIMG_T0HI_REG
RY
TIMG_T0ALARMLO_REG Timer 0 alarm value, low 32 bits 0x0010 R/W
TIMG_T0ALARMHI_REG Timer 0 alarm value, high bits 0x0014 R/W
TIMG_T0LOADLO_REG Timer 0 reload value, low 32 bits 0x0018 R/W
TIMG_T0LOADHI_REG Timer 0 reload value, high 22 bits 0x001C R/W
TIMG_T0LOAD_REG Write to reload timer from 0x0020 WT
A
TIMG_T0LOADLO_REG or
TIMG_T0LOADHI_REG
Timer 1 configuration and control registers
TIMG_T1CONFIG_REG
TIMG_T1LO_REG
IN
Timer 1 configuration register
Timer 1 current value, low 32 bits
0x0024
0x0028
varies
RO
TIMG_T1HI_REG Timer 1 current value, high 22 bits 0x002C RO
TIMG_T1UPDATE_REG Write to copy current timer value to 0x0030 R/W/SC
IM
TIMG_T1LO_REG or TIMG_T1HI_REG
TIMG_T1ALARMLO_REG Timer 1 alarm value, low 32 bits 0x0034 R/W
TIMG_T1ALARMHI_REG Timer 1 alarm value, high bits 0x0038 R/W
TIMG_T1LOADLO_REG Timer 1 reload value, low 32 bits 0x003C R/W
TIMG_T1LOADHI_REG Timer 1 reload value, high 22 bits 0x0040 R/W
EL
TIMG_T1LOAD_REG Write to reload timer from 0x0044 WT

TIMG_T1LOADLO_REG or
TIMG_T1LOADHI_REG
Configuration and control registers for WDT
TIMG_WDTCONFIG0_REG Watchdog timer configuration register 0x0048 R/W
PR
TIMG_WDTCONFIG1_REG Watchdog timer prescaler register 0x004C R/W

TIMG_WDTCONFIG2_REG Watchdog timer stage 0 timeout value 0x0050 R/W
TIMG_WDTCONFIG5_REG Watchdog timer stage 3 timeout value 0x005C R/W
TIMG_WDTFEED_REG Write to feed the watchdog timer 0x0060 WT
TIMG_WDTWPROTECT_REG Watchdog write protect register 0x0064 R/W
Configuration and control registers for RTC frequency calculation
TIMG_RTCCALICFG_REG RTC frequency calculation configuration reg- 0x0068 varies
ister 0


TIMG_RTCCALICFG1_REG RTC frequency calculation configuration reg- 0x006C RO
ister 1
TIMG_RTCCALICFG2_REG RTC frequency calculation calibration register 0x0080 varies
2
Interrupt registers
TIMG_INT_ENA_TIMERS_REG Interrupt enable bits 0x0070 R/W
TIMG_INT_RAW_TIMERS_REG Raw interrupt status 0x0074 R/WTC/SS
TIMG_INT_ST_TIMERS_REG Masked interrupt status 0x0078 RO
TIMG_INT_CLR_TIMERS_REG Interrupt clear bits 0x007C WT
Version register
RY
TIMG_NTIMERS_DATE_REG Timer version control register 0x00F8 R/W
Timer group configuration registers
TIMG_REGCLK_REG Timer group clock gate register 0x00FC R/W
A
IN
IM
EL
PR

10.5 Registers
The addresses in this section are relative to Timer Group base address provided in Table 3-4 in Chapter 3 System
and Memory.
Register 10.1. TIMG_TxCONFIG_REG (x: 01) (0x0000+0x24*x)

AD
LO
E_ _EN
TO SE
AL
RE
XT
AU EA
US M
E
x_ AR
ID
x_ R
_T C
IV
TI _T N
_T L
G IN
G A
G E
M x_
M x_
x_
M x_
)
)
ed
ed
TI _T
_T
TI _T
rv
rv
G
G
se
se
M
M
(re
(re
TI
TI
TI
31 30 29 28 13 12 11 10 9 8 0
RY
0 1 1 0x01 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
TIMG_Tx_USE_XTAL 0: Use APB_CLK as the source clock of timer group; 1: Use XTAL_CLK as the
source clock of timer group. (R/W)
TIMG_Tx_ALARM_EN When set, the alarm is enabled. This bit is automatically cleared once an alarm
A
occurs. (R/W/SC)
TIMG_Tx_DIVIDER Timer x clock (Tx_clk) prescaler value. (R/W)

IN
TIMG_Tx_AUTORELOAD When set, timer x auto-reload at alarm is enabled. (R/W)
TIMG_Tx_INCREASE When set, the timer x time-base counter will increment every clock tick. When
cleared, the timer x time-base counter will decrement. (R/W)
IM
TIMG_Tx_EN When set, the timer x time-base counter is enabled. (R/W)
Register 10.2. TIMG_TxLO_REG (x: 01) (0x0004+0x24*x)

EL
LO
x_
_T
G
M
TI
31 0
0x000000 Reset
PR
TIMG_Tx_LO After writing to TIMG_TxUPDATE_REG, the low 32 bits of the time-base counter of timer
x can be read here. (RO)

Register 10.3. TIMG_TxHI_REG (x: 01) (0x0008+0x24*x)
HI
x_
d)
ve
_T
r
G
se
M
(re
TI
31 22 21 0
0 0 0 0 0 0 0 0 0 0 0x0000 Reset
TIMG_Tx_HI After writing to TIMG_TxUPDATE_REG, the high 22 bits of the time-base counter of timer
x can be read here. (RO)
RY
Register 10.4. TIMG_TxUPDATE_REG (x: 01) (0x000C+0x24*x)
TE
DA
UP
x_
d)
e
_T
rv
G
se
M
(re
TI
31 30 0
A
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
TIMG_Tx_UPDATE After writing 0 or 1 to TIMG_TxUPDATE_REG, the counter value is latched.

(R/W/SC)
IN
Register 10.5. TIMG_TxALARMLO_REG (x: 01) (0x0010+0x24*x)
IM
O
_L
RM
ALA
x_
_T
G
M
TI
EL
31 0
0x000000 Reset
TIMG_Tx_ALARM_LO Timer x alarm trigger time-base counter value, low 32 bits. (R/W)
PR
Register 10.6. TIMG_TxALARMHI_REG (x: 01) (0x0014+0x24*x)

I
_H
M
AR
AL
x_
d)
ve
_T
r
G
se
M
(re
TI
31 22 21 0
0 0 0 0 0 0 0 0 0 0 0x0000 Reset
TIMG_Tx_ALARM_HI Timer x alarm trigger time-base counter value, high 22 bits. (R/W)

Register 10.7. TIMG_TxLOADLO_REG (x: 01) (0x0018+0x24*x)
O
_L
AD
LO
x_
_T
G
M
TI
31 0
0x000000 Reset
TIMG_Tx_LOAD_LO Low 32 bits of the value that a reload will load onto timer x time-base counter.
(R/W)
RY
Register 10.8. TIMG_TxLOADHI_REG (x: 01) (0x001C+0x24*x)
I
_H
AD
LO
x_
ed)
_T
rv
G
se
A
M
(re
TI
31 22 21 0
0 0 0 0 0 0 0 0 0 0 0x0000 Reset
IN
TIMG_Tx_LOAD_HI High 22 bits of the value that a reload will load onto timer x time-base counter.
(R/W)
IM
Register 10.9. TIMG_TxLOAD_REG (x: 01) (0x0020+0x24*x)
AD
LO
x_
_T
G
M
EL
TI
31 0
0x000000 Reset
TIMG_Tx_LOAD Write any value to trigger a timer x time-base counter reload. (WT)
PR

Register 10.10. TIMG_WDTCONFIG0_REG (0x0048)
RE ET EN
TH
TH
SE _EN
EN
U_ ES D_
G
T_
EN
CP _R MO
EN
_L
_L
PP U _ T
ET
ET
_A C O
DT O O
ES
ES
B
P
_R
_R
_W _ SH
0
PU
TG
TG
G DT LA
_W EN
R
Y
ST
ST
_C
_S
_S
_S
P
TI _W _F
_
_
DT
DT
DT
DT
DT
DT
DT
G DT
)
d)
ed
_W
_W
_W
_W
_W
_W
TI _W
ve
rv
r
G
G
se
se
M
M
M
M
(re
(re
TI
TI
TI
TI
TI
TI
TI
TI
31 30 29 28 27 26 25 24 23 22 21 20 18 17 15 14 13 12 11 0
0 0 0 0 0 0 0 0x1 0x1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
TIMG_WDT_APPCPU_RESET_EN Reserved. (R/W)
RY
TIMG_WDT_PROCPU_RESET_EN WDT reset CPU enable. (R/W)
TIMG_WDT_FLASHBOOT_MOD_EN When set, Flash boot protection is enabled. (R/W)
TIMG_WDT_SYS_RESET_LENGTH System reset signal length selection. 0: 100 ns; 1: 200 ns; 2:
300 ns; 3: 400 ns; 4: 500 ns; 5: 800 ns; 6: 1.6 µs; 7: 3.2 µs. (R/W)
A
TIMG_WDT_CPU_RESET_LENGTH CPU reset signal length selection. 0: 100 ns; 1: 200 ns; 2: 300
ns; 3: 400 ns; 4: 500 ns; 5: 800 ns; 6: 1.6 µs; 7: 3.2 µs. (R/W)
TIMG_WDT_STG3 Stage 3 configuration. 0: off; 1: interrupt; 2: reset CPU; 3: reset system. (R/W)
IN
IM
TIMG_WDT_EN When set, MWDT is enabled. (R/W)

EL
Register 10.11. TIMG_WDTCONFIG1_REG (0x004C)

E
AL
SC
RE
_P
LK
PR
_C
DT
)
ed
_W
rv
G
se
M
(re
TI
31 16 15 0
0x01 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
TIMG_WDT_CLK_PRESCALE MWDT clock prescaler value. MWDT clock period = 12.5 ns *

TIMG_WDT_CLK_PRESCALE. (R/W)

LD
HO
0_
TG
_S
DT
_W
G
M
TI
31 0
26000000 Reset
TIMG_WDT_STG0_HOLD Stage 0 timeout value, in MWDT clock cycles. (R/W)
RY
LD
HO
1_
TG
_S
DT
A
_W
G
M
TI
31 0
IN
0x7ffffff

Reset
IM
LD
HO
2_
G
T
_S
EL
DT
_W
G
M
TI
31 0
0x0fffff Reset

PR

Register 10.15. TIMG_WDTCONFIG5_REG (0x005C)
LD
HO
3_
GT
_S
DT
_W
G
M
TI
31 0
0x0fffff Reset
RY
Register 10.16. TIMG_WDTFEED_REG (0x0060)
D
EE
_F
DT
_W
G
M
A
TI
31 0
0x000000
IN Reset
TIMG_WDT_FEED Write any value to feed the MWDT. (WT)
Register 10.17. TIMG_WDTWPROTECT_REG (0x0064)

IM
Y
KE
_W
DT
_W
G
M
TI
EL
31 0
0x50d83aa1 Reset
TIMG_WDT_WKEY If the register contains a different value than its reset value, write protection is
enabled. (R/W)
PR

Register 10.18. TIMG_RTCCALICFG_REG (0x0068)
G
IN
CL
CY
ST EL
T_
AL K_S
T
AR
AR
AX
Y
_C RD
L
ST
_M
C
I_
TC LI_
TC LI_
I_
LI
AL
CA
A
_C
_C
_C
_
TC
TC
TC
)
ed
_R
_R
_R
_R
_R
rv
G
se
M
(re
TI
TI
TI
TI
TI
31 30 16 15 14 13 12 11 0
0 0x01 0 0x1 1 0 0 0 0 0 0 0 0 0 0 0 0 Reset
TIMG_RTC_CALI_START_CYCLING Enables periodic frequency calculation. (R/W)
RY
TIMG_RTC_CALI_CLK_SEL Used to select the clock to be calibrated. 0: RTC_CLK; 1:
RTC20M_D256_CLK; 2: XTAL32K_CLK. (R/W)
TIMG_RTC_CALI_RDY Marks the completion of frequency calculation. (RO)
TIMG_RTC_CALI_MAX Configures the time of frequency calculation. (R/W)
A
TIMG_RTC_CALI_START Enables one-shot frequency calculation. (R/W)
IN
Register 10.19. TIMG_RTCCALICFG1_REG (0x006C)
D
VL
A_
IM
AT
_D
G
IN
E
CL
LU
CY
VA
_
I_
LI
AL
CA
_C
C_
TC
)
T
ed
_R
_R
rv
G
G
se
EL
M
M
(re
TI
TI
31 7 6 1 0
0x00000 0 0 0 0 0 0 0 Reset
TIMG_RTC_CALI_CYCLING_DATA_VLD Marks the completion of periodic frequency calculation.

(RO)
PR
TIMG_RTC_CALI_VALUE Frequency calculation result. (RO)

Register 10.20. TIMG_RTCCALICFG2_REG (0x0080)
NT
S
_C
E
HR
ST
_R
_T
UT
UT
UT
EO
EO
EO
M
M
TI
TI
TI
I_
I_
I_
AL
AL
AL
_C
_C
_C
TC
TC
TC
)
ed
_R
_R
_R
rv
G
G
se
M
M
(re
TI
TI
TI
31 7 6 3 2 1 0
0x1ffffff 3 0 0 0 Reset
RY
TIMG_RTC_CALI_TIMEOUT Indicates frequency calculation timeout. (RO)
TIMG_RTC_CALI_TIMEOUT_RST_CNT Cycles to reset frequency calculation timeout. (R/W)
TIMG_RTC_CALI_TIMEOUT_THRES Threshold value for the frequency calculation timer. If the

timer’s value exceeds this threshold, a timeout is triggered. (R/W)
A
Register 10.21. TIMG_INT_ENA_TIMERS_REG (0x0070)
IN
0_ _E NA
T_ A
A
_T T E
IN N
EN
G _IN T_
M 1 N
TI _T _I
G T
M WD
)
ed
rv
_
G
se
M
(re
TI
TI
IM
31 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
TIMG_Tx_INT_ENA The interrupt enable bit for the TIMG_Tx_INT interrupt. (R/W)
TIMG_WDT_INT_ENA The interrupt enable bit for the TIMG_WDT_INT interrupt. (R/W)
EL
Register 10.22. TIMG_INT_RAW_TIMERS_REG (0x0074)

0_ _R AW
PR
T_ W
W
_T T R
IN A
RA
G _IN T_
M 1 N
TI _T _I
G DT
d)
TI _W
e
rv
G
se
M
M
(re
TI
31 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
TIMG_Tx_INT_RAW The raw interrupt status bit for the TIMG_Tx_INT interrupt. (R/WTC/SS)
TIMG_WDT_INT_RAW The raw interrupt status bit for the TIMG_WDT_INT interrupt. (R/WTC/SS)

Register 10.23. TIMG_INT_ST_TIMERS_REG (0x0078)
0_ _S T
_T T S
IN T
ST
G _IN T_
T_
M 1 N
TI _T _I
G T
M WD
)
ed
rv
_
G
se
M
(re
TI
TI
31 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
TIMG_Tx_INT_ST The masked interrupt status bit for the TIMG_Tx_INT interrupt. (RO)
TIMG_WDT_INT_ST The masked interrupt status bit for the TIMG_WDT_INT interrupt. (RO)
RY
Register 10.24. TIMG_INT_CLR_TIMERS_REG (0x007C)
0_ _C LR
T_ R
R
_T T C
IN L
CL
G _IN T_
M 1 N
TI _T _I
G DT
A
)
ed
TI _W
rv
G
se
M
M
(re
TI
31 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
IN
TIMG_Tx_INT_CLR Set this bit to clear the TIMG_Tx_INT interrupt. (WT)
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
TIMG_WDT_INT_CLR Set this bit to clear the TIMG_WDT_INT interrupt. (WT)

IM
Register 10.25. TIMG_NTIMERS_DATE_REG (0x00F8)
TE
DA
EL
S_
ER
M
TI
)
ed
_N
rv
G
se
M
(re
TI
31 28 27 0
0 0 0 0 0x2003071 Reset
PR
TIMG_NTIMERS_DATE Timer version control register. (R/W)

Register 10.26. TIMG_REGCLK_REG (0x00FC)
N
_E
LK
)
ed
_C
rv
G
se
M
(re
TI
31 30 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
TIMG_CLK_EN Register clock gate signal. 0: The clock used by software to read and write registers
is on only when there is software operation. 1: The clock used by software to read and write
registers is always on. (R/W)
A RY
IN
IM
EL
PR

11 Watchdog Timers
11 Watchdog Timers
11.1 Overview
Watchdog timers are hardware timers used to detect and recover from malfunctions. They must be periodically
fed (reset) to prevent a timeout. A system/software that is behaving unexpectedly (e.g. is stuck in a software loop
or in overdue events) will fail to feed the watchdog thus trigger a watchdog timeout. Therefore, watchdog timers
are useful for detecting and handling erroneous system/software behavior.
As shown in Figure 11-1, ESP32-S3 contains three digital watchdog timers: one in each of the two timer groups
in Chapter 10 Timer Group (TIMG)(called Main System Watchdog Timers, or MWDT) and one in the RTC Module
RY
(called the RTC Watchdog Timer, or RWDT). Each digital watchdog timer allows for four separately configurable
stages and each stage can be programmed to take one action upon expiry, unless the watchdog is fed or
disabled. MWDT supports three timeout actions: interrupt, CPU reset, and core reset, while RWDT supports four
timeout actions: interrupt, CPU reset, core reset, and system reset (see details in Section 11.2.2.2 Stages and
Timeout Actions). A timeout value can be set for each stage individually.
During the flash boot process, RWDT and the first MWDT in timergroup 0 are enabled automatically in order to
A
detect and recover from booting errors.
ESP32-S3 also has one analog watchdog timer: Super watchdog (SWD). It is an ultra-low-power circuit in analog
IN
domain that helps to prevent the system from operating in a sub-optimal state and resets the system if
required.
IM
EL
PR
Figure 111. Watchdog Timers Overview
Note that while this chapter provides the functional descriptions of the watchdog timer’s, their register
descriptions are provided in Chapter 10 Timer Group (TIMG) and Chapter 7 Low-Power Management (RTC_CNTL)
[to be added later].

11 Watchdog Timers
11.2 Digital Watchdog Timers

11.2.1 Features
Watchdog timers have the following features:
• Four stages, each with a programmable timeout value. Each stage can be configured and
enabled/disabled separately
• Three timeout actions (interrupt, CPU reset, or core reset) for MWDT and four timeout actions (interrupt,
CPU reset, core reset, or system reset) for RWDT upon expiry of each stage
• 32-bit expiry counter
RY
• Write protection, to prevent RWDT and MWDT configuration from being altered inadvertently
• Flash boot protection

If the boot process from an SPI flash does not complete within a predetermined period of time, the
watchdog will reboot the entire main system.
A
IN
IM
EL
PR

11 Watchdog Timers
A RY
IN
IM
EL
Figure 112. Watchdog Timers in ESP32S3

PR
Figure 11-2 shows the three watchdog timers in ESP32-S3 digital systems.
11.2.2.1 Clock Source and 32Bit Counter
At the core of each watchdog timer is a 32-bit counter. The clock source of MWDTs is derived from the APB
clock via a pre-MWDT 16-bit configurable prescaler. In contrast, the clock source of RWDT is derived directly
from an RTC slow clock (the RTC slow clock source shown in Chapter 6 Reset and Clock). The 16-bit prescaler
for MWDTs is configured via the TIMG_WDT_CLK_PRESCALE field of TIMG_WDTCONFIG1_REG.
MWDTs and RWDT are enabled by setting the TIMG_WDT_EN and RTC_CNTL_WDT_EN fields respectively.
When enabled, the 32-bit counters of each watchdog will increment on each source clock cycle until the timeout
value of the current stage is reached (i.e. expiry of the current stage). When this occurs, the current counter value
is reset to zero and the next stage will become active. If a watchdog timer is fed by software, the timer will return

11 Watchdog Timers
to stage 0 and reset its counter value to zero. Software can feed a watchdog timer by writing any value to
TIMG_WDTFEED_REG for MDWTs and RTC_CNTL_RTC_WDT_FEED for RWDT.
11.2.2.2 Stages and Timeout Actions
Timer stages allow for a timer to have a series of different timeout values and corresponding expiry action. When
one stage expires, the expiry action is triggered, the counter value is reset to zero, and the next stage becomes
active. MWDTs/ RWDT provide four stages (called stages 0 to 3). The watchdog timers will progress through
each stage in a loop (i.e. from stage 0 to 3, then back to stage 0).
Timeout values of each stage for MWDTs are configured in TIMG_WDTCONFIGi_REG (where i ranges from 2 to
5), whilst timeout values for RWDT are configured using RTC_CNTL_WDT_STGj_HOLD field (where j ranges from
RY
0 to 3).
Please note that the timeout value of stage 0 for RWDT (Thold0 ) is determined by the combination of the
EFUSE_WDT_DELAY_SEL field of eFuse register EFUSE_RD_REPEAT_DATA1_REG and
RTC_CNTL_WDT_STG0_HOLD. The relationship is as follows:
A
Thold0 = RT C_CN T L_W DT _ST G0_HOLD << (EF U SE_W DT _DELAY _SEL + 1)
where << is a left-shift operator.

IN
Upon the expiry of each stage, one of the following expiry actions will be executed:
• Trigger an interrupt
When the stage expires, an interrupt is triggered.
IM
• CPU reset – Reset a CPU core
When the stage expires, the CPU core will be reset.
• Core reset – Reset the main system

When the stage expires, the main system (which includes MWDTs, CPU, and all peripherals) will be reset.
EL
The power management unit and RTC peripheral will not be reset.
• System reset – Reset the main system, power management unit and RTC peripheral
When the stage expires the main system, power management unit and RTC peripheral (see details in
Chapter 7 Low-Power Management (RTC_CNTL) [to be added later]) will all be reset. This action is only
available in RWDT.
PR
• Disabled
This stage will have no effects on the system.
For MWDTs, the expiry action of all stages is configured in TIMG_WDTCONFIG0_REG. Likewise for RWDT, the
expiry action is configured in RTC_CNTL_WDTCONFIG0_REG.
11.2.2.3 Write Protection
Watchdog timers are critical to detecting and handling erroneous system/software behavior, thus should not be
disabled easily (e.g. due to a misplaced register write). Therefore, MWDTs and RWDT incorporate a write
protection mechanism that prevent the watchdogs from being disabled or tampered with due to an accidental
write.

11 Watchdog Timers
The write protection mechanism is implemented using a write-key field for each timer (TIMG_WDT_WKEY for
MWDT, RTC_CNTL_WDT_WKEY for RWDT). The value 0x50D83AA1 must be written to the watchdog timer’s
write-key field before any other register of the same watchdog timer can be changed. Any attempts to write to a
watchdog timer’s registers (other than the write-key field itself) whilst the write-key field’s value is not
0x50D83AA1 will be ignored. The recommended procedure for accessing a watchdog timer is as follows:
1. Disable the write protection by writing the value 0x50D83AA1 to the timer’s write-key field.
2. Make the required modification of the watchdog such as feeding or changing its configuration.
3. Re-enable write protection by writing any value other than 0x50D83AA1 to the timer’s write-key field.
11.2.2.4 Flash Boot Protection
RY
During flash booting process, MWDT in timer group 0 (see Figure 10-1 Timer Units within Groups), as well as
RWDT, are automatically enabled. Stage 0 for the enabled MWDT is automatically configured to reset the system
upon expiry. Likewise, stage 0 for RWDT is configured to reset the main system and RTC when it expires. After
booting, TIMG_WDT_FLASHBOOT_MOD_EN and RTC_CNTL_WDT_FLASHBOOT_MOD_EN should be cleared
to stop the flash boot protection procedure for both MWDT and RWDT respectively. After this, MWDT and RWDT
A
can be configured by software.
11.3 Super Watchdog

IN
Super watchdog (SWD) is an ultra-low-power circuit in analog domain that helps to prevent the system from
operating in a sub-optimal state and resets the system if required. SWD contains a watchdog circuit that needs
to be fed for at least once during its timeout period, which is slightly less than one second. About 100 ms before
IM
watchdog timeout, it will also send out a WD_INTR signal as a request to remind the system to feed the
watchdog.
If the system doesn’t respond to SWD feed request and watchdog finally times out, SWD will generate a system
level signal SWD_RSTB to reset whole digital circuits on the chip.
EL
11.3.1 Features
SWD has the following features:
• Ultra-low power
PR
• Interrupt to indicate that the SWD timeout period is close to expiring
• Various dedicated methods for software to feed SWD, which enables SWD to monitor the working state of
the whole operating system
11.3.2 Super Watchdog Controller

11 Watchdog Timers
11.3.2.1 Structure
A RY
Figure 113. Super Watchdog Controller Structure
11.3.2.2 Workflow
IN
In normal state:
• SWD controller receives feed request from SWD.

IM
• SWD controller can send an interrupt to main CPU or ULP-RISC-V.
• Main CPU can decide whether to feed SWD directly by setting RTC_CNTL_SWD_FEED, or send an
interrupt to ULP-RISC-V and ask ULP-RISC-V to feed SWD by setting RTC_CNTL_SWD_FEED.
• When trying to feed SWD, CPU or ULP-RISC-V needs to disable SWD controller’s write protection by
EL
writing 0x8F1D312A to RTC_CNTL_SWD_WKEY. This prevents SWD from being fed by mistake when the
system is operating in sub-optimal state.
• If setting RTC_CNTL_SWD_AUTO_FEED_EN to 1, SWD controller can also feed SWD itself without any
interaction with CPU or ULP-RISC-V.
PR
After reset:
• Check RTC_CNTL_RESET_CAUSE_PROCPU[5:0] for the cause of CPU reset.

If RTC_CNTL_RESET_CAUSE_PROCPU[5:0] == 0x12, it indicates that the cause is SWD reset.
• Set RTC_CNTL_SWD_RST_FLAG_CLR to clear the SWD reset flag.
11.4 Interrupts
For watchdog timer interrupts, please refer to Section 10.2.6 Interrupts in Chapter 10 Timer Group (TIMG).

11 Watchdog Timers
11.5 Registers
MWDT registers are part of the timer submodule and are described in Section 10.4 Register Summary in Chapter
10 Timer Group (TIMG). RWDT and SWD registers are part of the RTC submodule and are described in Section 9
Register Summary in Chapter 7 Low-Power Management (RTC_CNTL) [to be added later].
A RY
IN
IM
EL
PR

12 XTAL32K Watchdog Timers (XTWDT)
12.1 Overview
The XTAL32K watchdog timer on ESP32-S3 is used to monitor the status of external crystal XTAL32K_CLK. This
watchdog timer can detect the oscillation failure of XTAL32K_CLK, change the clock source of RTC, etc. When
XTAL32K_CLK works as the clock source of RTC SLOW_CLK (for clock description, see Chapter 6 Reset and
Clock) and stops oscillating, the XTAL32K watchdog timer first switches to BACKUP32K_CLK derived from
RTC_CLK and generates an interrupt (if the chip is in Light-sleep or Deep-sleep mode, the CPU will be woken
up), and then switches back to XTAL32K_CLK after it is restarted by software.
A RY
IN
IM
Figure 121. XTAL32K Watchdog Timer
EL
12.2 Features
12.2.1 Interrupt and WakeUp
When the XTAL32K watchdog timer detects the oscillation failure of XTAL32K_CLK, an oscillation failure interrupt
RTC_XTAL32K_DEAD_INT (for interrupt description, please refer to Chapter 7 Low-Power Management
PR
(RTC_CNTL) [to be added later]) is generated. At this point, the CPU will be woken up if in Light-sleep mode or
Deep-sleep mode.
12.2.2 BACKUP32K_CLK
Once the XTAL32K watchdog timer detects the oscillation failure of XTAL32K_CLK, it replaces XTAL32K_CLK
with BACKUP32K_CLK (with a frequency of 32 kHz or so) derived from RTC_CLK as RTC’s SLOW_CLK, so as
to ensure proper functioning of the system.

12.3.1 Workflow
1. The XTAL32K watchdog timer starts counting when RTC_CNTL_XTAL32K_WDT_EN is enabled. The
counter based on RTC_CLK keeps counting until it detects the positive edge of XTAL_32K and is then
cleared. When the counter reaches RTC_CNTL_XTAL32K_WDT_TIMEOUT, it generates an interrupt or a
wake-up signal and is then reset.
2. If RTC_CNTL_XTAL32K_AUTO_BACKUP is set and step 1 is finished, the XTAL32K watchdog timer will
automatically enable BACKUP32K_CLK as the alternative clock source of RTC SLOW_CLK, to ensure the
system’s proper functioning and the accuracy of timers running on RTC SLOW_CLK (e.g. RTC_TIMER).
For information about clock frequency configuration, please refer to Section 12.3.2.
3. To restore the XTAL32K watchdog timer, software restarts XTAL32K_CLK by turning its XPD (meaning no
RY
power-down) signal off and on again via RTC_CNTL_XPD_XTAL_32K bit. Then, the XTAL32K watchdog
timer switches back to XTAL32K_CLK as the clock source of RTC SLOW_CLK by clearing
RTC_CNTL_XTAL32K_WDT_EN (BACKUP32K_CLK_EN is also automatically cleared). If the chip is in
Light-sleep or Deep-sleep mode mode, the XTAL32K watchdog timer will wake up the CPU to finish the
above steps.
A
12.3.2 BACKUP32K_CLK Working Principle
Chips have different RTC_CLK frequencies due to production process variations. To ensure the accuracy of
IN
RTC_TIMER and other timers running on SLOW_CLK when BACKUP32K_CLK is at work, the divisor of
BACKUP32K_CLK should be configured according to the actual frequency of RTC_CLK (see details in Chapter 7
Low-Power Management (RTC_CNTL) [to be added later]) via RTC_CNTL_XTAL32K_CLK_FACTOR_REG register.
Each byte in this register corresponds to a divisor component (x0 ~x7 ). BACKUP32K_CLK is divided by a
IM
fraction where the denominator is always 4, as calculated below.
f _back_clk/4 = f _rtc_clk/S
S = x0 + x1 + ... + x7
EL
f_back_clk is the desired frequency of BACKUP32K_CLK; f_rtc_clk is the actual frequency of RTC_CLK; x0 ~x7
correspond to the pulse width in high and low state of four BACKUP32K_CLK clock signals (unit: RTC_CLK
clock cycle).
PR
12.3.3 Configuring the Divisor Component of BACKUP32K_CLK

Based on principles described in Section 12.3.2, you can configure the divisor component as follows:
• Calculate the sum of divisor components S according to the frequency of RTC_CLK and the desired
frequency of BACKUP32K_CLK;
• Calculate the integer part of divisor N = f _rtc_clk/f _back_clk;
• Calculate the integer part of divisor component M = N /2. The integer part of divisor N are separated into
two parts because a divisor component corresponds to a pulse width in high or low state;
• Calculate the number of divisor components that equal M (xn = M) and the number of divisor components
that equal M + 1 (xn = M + 1) according to the value of M and S. (M + 1) is the fractional part of divisor
component.

For example, if the frequency of RTC_CLK is 163 kHz, then f _rtc_clk = 163000, f _back_clk = 32768, S = 20,
M = 2, and {x0 , x1 , x2 , x3 , x4 , x5 , x6 , x7 } = {2, 3, 2, 3, 2, 3, 2, 3}. As a result, the frequency of BACKUP32K_CLK
is 32.6 kHz.
A RY
IN
IM
EL
PR

13 System Registers
13 System Registers
13.1 Overview
The ESP32-S3 integrates a large number of peripherals, and enables the control of individual peripherals to
achieve optimal characteristics in performance-vs-power-consumption scenarios. Specifically, ESP32-S3 has a
various of system configuration registers that can be used for the chip’s clock management (clock gating), power
management, and the configuration of peripherals and core-system modules. This chapter lists all these system
registers and their functions.
13.2 Features
RY
ESP32-S3 system registers can be used to control the following peripheral blocks and core modules:
• System and memory
• Clock
• Software Interrupt
A
• Low-power management
• Peripheral clock gating and reset
• CPU Control
IN
13.3 Function Description
IM
13.3.1 System and Memory Registers
13.3.1.1 Internal Memory
The following registers can be used to control ESP32-S3’s internal memory:

EL
• In register APB_CTRL_CLKGATE_FORCE_ON_REG:
– Setting different bits of the APB_CTRL_ROM_CLKGATE_FORCE_ON field forces on the clock gates
of different blocks of Internal ROM 0 and Internal ROM 1.
– Setting different bits of the APB_CTRL_SRAM_CLKGATE_FORCE_ON field forces on the clock gates
PR
of different blocks of Internal SRAM.
– This means when the respective bits of this register are set to 1, the clock gate of the corresponding
ROM or SRAM blocks will always be on. Otherwise, the clock gate will turn on automatically when the
corresponding ROM or SRAM blocks are accessed and turn off automatically when the corresponding
ROM or SRAM blocks are not accessed. Therefore, it’s recommended to configure these bits to 0 to
lower power consumption.
• In register APB_CTRL_MEM_POWER_DOWN_REG:
– Setting different bits of the APB_CTRL_ROM_POWER_DOWN field sends different blocks of Internal
ROM 0 and Internal ROM 1 into retention state.

13 System Registers
– Setting different bits of the APB_CTRL_SRAM_POWER_DOWN field sends different blocks of Internal
SRAM into retention state.
– The “Retention” state is a low-power state of a memory block. In this state, the memory block still
holds all the data stored but cannot be accessed, thus reducing the power consumption. Therefore,
you can send a certain block of memory into the retention state to reduce power consumption if you
know you are not going to use such memory block for some time.
• In register APB_CTRL_MEM_POWER_UP_REG:
– By default, all memory enters low-power state when the chip enters the Light-sleep mode.
– Setting different bits of the APB_CTRL_ROM_POWER_UP field forces different blocks of Internal ROM
0 and Internal ROM 1 to work as normal (do not enter the retention state) when the chip enters
RY
Light-sleep.
– Setting different bits of the APB_CTRL_SRAM_POWER_UP field forces different blocks of Internal
SRAM to work as normal (do not enter the retention state) when the chip enters Light-sleep.
For detailed information about the controlling bits of different blocks, please see Table 13-1 below.
A
Table 131. Internal Memory Controlling Bit
Internal Memory Lowest Address1 Highest Address1 Lowest Address2 Highest Address2 Controlling Bit
Internal ROM 0
Internal ROM 1
0x4000_0000
0x4004_0000
IN
0x4003_FFFF
0x4004_FFFF
-
-
-
-
Bit0
Bit1
Internal ROM 2 0x4005_0000 0x4005_FFFF 0x3FF0_0000 0x3FF0_FFFF Bit2
SRAM Block0 0x4037_0000 0x4037_3FFF - - Bit0
IM
SRAM Block1 0x4037_4000 0x4037_7FFF - - Bit1
SRAM Block2 0x4037_8000 0x4037_FFFF 0x3FC8_8000 0x3FC8_FFFF Bit2
SRAM Block3 0x4038_0000 0x4038_FFFF 0x3FC9_0000 0x3FC9_FFFF Bit3
SRAM Block4 0x4039_8000 0x4039_FFFF 0x3FCA_0000 0x3FCA_FFFF Bit4
SRAM Block5 0x403A_C000 0x403A_FFFF 0x3FCB_C000 0x3FCB_FFFF Bit5
EL
SRAM Block6 0x403B_0000 0x403B_FFFF 0x3FCC_0000 0x3FCC_FFFF Bit6

SRAM Block7 0x403C_0000 0x403C_FFFF 0x3FCD_4000 0x3FCD_FFFF Bit7
SRAM Block8 0x403D_0000 0x403D_BFFF 0x3FCE_8000 0x3FCE_FFFF Bit8
SRAM Block9 - - 0x3FCF_0000 0x3FCF_7FFF Bit9
SRAM Block10 - - 0x3FCF_8000 0x3FCF_FFFF Bit10
PR
For detailed information about the controlling bits of different blocks, please see Table 13-1 below.
13.3.1.2 External Memory
SYSTEM_EXTERNAL_DEVICE_ENCRYPT_DECRYPT_CONTROL_REG configures encryption and decryption

options of the external memory. For details, please refer to Chapter 19 External Memory Encryption and Decryption
(XTS_AES).
13.3.1.3 RSA Memory
SYSTEM_RSA_PD_CTRL_REG controls the SRAM memory in the RSA accelerator.

13 System Registers
• Setting the SYSTEM_RSA_MEM_PD bit to send the RSA memory into retention state. This bit has the
lowest priority, meaning it can be masked by the SYSTEM_RSA_MEM_FORCE_PU field. This bit is invalid
when the Digital Signature (DS) occupies the RSA.
• Setting the SYSTEM_RSA_MEM_FORCE_PU bit to force the RSA memory to work as normal when the
chip enters light sleep. This bit has the second highest priority, meaning it overrides the
SYSTEM_RSA_MEM_PD field.
• Setting the SYSTEM_RSA_MEM_FORCE_PD bit to send the RSA memory into retention state. This bit has
the highest priority, meaning it sends the RSA memory into retention state regardless of the
SYSTEM_RSA_MEM_FORCE_PU field.
RY
13.3.2 Clock Registers
The following registers are used to set clock sources and frequency. For more information, please refer to
Chapter 6 Reset and Clock.
• SYSTEM_CPU_PER_CONF_REG
• SYSTEM_SYSCLK_CONF_REG
A
• SYSTEM_BT_LPCK_DIV_FRAC_REG
13.3.3 Interrupt Signal Registers

IN
The following registers are used for generating the interrupt signals, which then can be routed to the CPU
peripheral interrupts via the interrupt matrix. To be more specific, writing 1 to any of the following registers
generates an interrupt signal. Therefore, these registers can be used by software to control interrupts. For more
IM
information, please refer to Chapter 8 Interrupt Matrix (INTERRUPT).
• SYSTEM_CPU_INTR_FROM_CPU_0_REG
EL
13.3.4 Lowpower Management Registers

The following registers are used for low-power management. For more information, please refer to Chapter 7
PR
Low-Power Management (RTC_CNTL) [to be added later].
• SYSTEM_RTC_FASTMEM_CONFIG_REG: configures the RTC CRC check.
• SYSTEM_RTC_FASTMEM_CRC_REG: configures the CRC check value.
13.3.5 Peripheral Clock Gating and Reset Registers

The following registers are used for controlling the clock gating and reset of different peripherals. Details can be
seen in Table 13-2.
• SYSTEM_CACHE_CONTROL_REG
• SYSTEM_EDMA_CTRL_REG
• SYSTEM_PERIP_CLK_EN0_REG

13 System Registers
• SYSTEM_PERIP_RST_EN0_REG
• SYSTEM_PERIP_CLK_EN1_REG
• SYSTEM_PERIP_RST_EN1_REG
Table 132. Peripheral Clock Gating and Reset Bits
Peripheral Clock Enabling Bit1 Reset Controlling Bit23

EDMA Ctrl SYSTEM_EDMA_CTRL_REG
EDMA SYSTEM_EDMA_CLK_ON SYSTEM_EDMA_RESET
CACHE Ctrl SYSTEM_CACHE_CONTROL_REG
DCACHE SYSTEM_DCACHE_CLK_ON SYSTEM_DCACHE_RESET
RY
ICACHE SYSTEM_ICACHE_CLK_ON SYSTEM_ICACHE_RESET
Peripheral SYSTEM_PERIP_CLK_EN0_REG SYSTEM_PERIP_RST_EN0_REG
Timer Group0 SYSTEM_TIMERGROUP_CLK_EN SYSTEM_TIMERGROUP_RST
Timer Group1 SYSTEM_TIMERGROUP1_CLK_EN SYSTEM_TIMERGROUP1_RST
System Timer SYSTEM_SYSTIMER_CLK_EN SYSTEM_SYSTIMER_RST
UART0 SYSTEM_UART_CLK_EN SYSTEM_UART_RST
A
UART1 SYSTEM_UART1_CLK_EN SYSTEM_UART1_RST
4
UART MEM SYSTEM_UART_MEM_CLK_EN SYSTEM_UART_MEM_RST
SPI0� SPI1
SPI2
SYSTEM_SPI01_CLK_EN
SYSTEM_SPI2_CLK_EN
IN SYSTEM_SPI01_RST
SYSTEM_SPI2_RST
SPI3 SYSTEM_SPI3_CLK_EN SYSTEM_SPI3_RST
I2C0 SYSTEM_I2C_EXT0_CLK_EN SYSTEM_I2C_EXT0_RST
IM
I2C1 SYSTEM_I2C_EXT1_CLK_EN SYSTEM_I2C_EXT1_RST
I2S0 SYSTEM_I2S0_CLK_EN SYSTEM_I2S0_RST
I2S1 SYSTEM_I2S1_CLK_EN SYSTEM_I2S1_RST
TWAI Controller SYSTEM_CAN_CLK_EN SYSTEM_CAN_RST
UHCI0 SYSTEM_UHCI0_CLK_EN SYSTEM_UHCI0_RST
EL
USB SYSTEM_USB_CLK_EN SYSTEM_USB_RST

RMT SYSTEM_RMT_CLK_EN SYSTEM_RMT_RST
PCNT SYSTEM_PCNT_CLK_EN SYSTEM_PCNT_RST
PWM0 SYSTEM_PWM0_CLK_EN SYSTEM_PWM0_RST
PWM1 SYSTEM_PWM1_CLK_EN SYSTEM_PWM1_RST
PR
LED_PWM Controller SYSTEM_LEDC_CLK_EN SYSTEM_LEDC_RST

ADC Controller SYSTEM_ADC2_ARB_CLK_EN SYSTEM_ADC2_ARB_RST
Accelerators SYSTEM_PERIP_CLK_EN1_REG SYSTEM_PERIP_RST_EN1_REG
USB_DEVICE SYSTEM_USB_DEVICE_CLK_EN SYSTEM_USB_DEVICE_RST
UART2 SYSTEM_UART2_CLK_EN SYSTEM_UART2_RST
LCD_CAM SYSTEM_LCD_CAM_CLK_EN SYSTEM_LCD_CAM_RST
SDIO_HOST SYSTEM_SDIO_HOST_CLK_EN SYSTEM_SDIO_HOST_RST
DMA SYSTEM_DMA_CLK_EN SYSTEM_DMA_RST 5
HMAC SYSTEM_CRYPTO_HMAC_CLK_EN SYSTEM_CRYPTO_HMAC_RST 6
Digital Signature SYSTEM_CRYPTO_DS_CLK_EN SYSTEM_CRYPTO_DS_RST 7
RSA Accelerator SYSTEM_CRYPTO_RSA_CLK_EN SYSTEM_CRYPTO_RSA_RST
SHA Accelerator SYSTEM_CRYPTO_SHA_CLK_EN SYSTEM_CRYPTO_SHA_RST

13 System Registers
AES Accelerator SYSTEM_CRYPTO_AES_CLK_EN SYSTEM_CRYPTO_AES_RST

peri backup SYSTEM_PERI_BACKUP_CLK_EN SYSTEM_PERI_BACKUP_RST
Note:
1. Setting the clock enable register to 1 enables the clock, and to 0 disables the clock;
2. Setting the reset enabling register to 1 resets a peripheral, and to 0 disables the reset.
3. Reset registers cannot be cleared by hardware. Therefore, SW reset clear is required after setting the reset registers.
4. UART memory is shared by all UART peripherals, meaning having any active UART peripherals will prevent the
UART memory from entering the clock-gated state.
RY
5. When DMA is required for peripheral communications, for example, UCHI0, SPI, I2S, LCD_CAM, AES, SHA and
ADC, DMA clock should also be enabled.
6. Resetting this bit also resets the SHA accelerator.
7. Resetting this bit also resets the AES, SHA, and RSA accelerators.
A
13.3.6 CPU Control Registers
These registers control CPU0 and CPU1 of ESP32-S3. Note that, by default, only CPU0 is started when the SoC
IN
powers up. During this time, the clock of CPU1 is disabled. Therefore, users need to enable CPU1 clock
manually to use both CPU0 and CPU1.
• SYSTEM_CORE_1_CONTROL_0_REG
IM
– Setting the SYSTEM_CONTROL_CORE_1_RESETING bit resets CPU1.
– SYSTEM_CONTROL_CORE_1_CLKGATE_EN controls the CPU1 clock.
– Setting the SYSTEM_CONTROL_CORE_1_RUNSTALL bit stalls CPU1. When this bit is set, CPU1 will
finish the on-going task and stalls.
EL
• Register SYSTEM_CORE_1_CONTROL_1_REG is used to facilitate the communication between CPU0

and CPU1. To be more specific, one CPU can write this register, using the agreed-on formats, which will
then be read by the other CPU, thus achieving communication between these two CPUs. Note that the
value in this register will not affect any hardware configuration, which allows CPU communication solely
controlled by software.
PR

13 System Registers

In this section, the addresses of all the registers starting with SYSTEM are relative to the base address of system
registers provided in Table 3-4 in Chapter 3 System and Memory; and those starting with APB are relative to the
base address of APB control also provided in Table 3-4 in Chapter 3 System and Memory.

SYSTEM_CORE_1_CONTROL_0_REG Core1 control register 0 0x0000 R/W
SYSTEM_CORE_1_CONTROL_1_REG Core1 control register 1 0x0004 R/W
SYSTEM_CPU_PER_CONF_REG CPU peripheral clock configuration register 0x0010 R/W
SYSTEM_PERIP_CLK_EN0_REG System peripheral clock enable register 0 0x0018 R/W
SYSTEM_PERIP_CLK_EN1_REG System peripheral clock enable register 1 0x001C R/W
RY
SYSTEM_PERIP_RST_EN0_REG System peripheral reset register 0 0x0020 R/W
SYSTEM_PERIP_RST_EN1_REG System peripheral reset register 1 0x0024 R/W
SYSTEM_BT_LPCK_DIV_FRAC_REG Low-power clock configuration register 1 0x002C R/W
SYSTEM_CPU_INTR_FROM_CPU_0_REG Software interrupt source register 0 0x0030 R/W
A
SYSTEM_CPU_INTR_FROM_CPU_3_REG Software interrupt source register 3 0x003C R/W
SYSTEM_RSA_PD_CTRL_REG RSA memory power control register 0x0040 R/W
SYSTEM_EDMA_CTRL_REG
SYSTEM_CACHE_CONTROL_REG
IN
EDMA control register
Cache control register
0x0044
0x0048
R/W
R/W
SYSTEM_EXTERNAL_DEVICE_ENCRYPT_ External memory encryption and decryption 0x004C R/W
DECRYPT_CONTROL_REG control register
IM
SYSTEM_RTC_FASTMEM_CONFIG_REG Fast memory CRC configuration register 0x0050 varies
SYSTEM_RTC_FASTMEM_CRC_REG Fast memory CRC result register 0x0054 RO
SYSTEM_CLOCK_GATE_REG System clock control register 0x005C R/W
SYSTEM_SYSCLK_CONF_REG System clock configuration register 0x0060 varies
SYSTEM_DATE_REG Version register 0x0FFC R/W
EL

APB_CTRL_CLKGATE_FORCE_ON_REG Internal memory clock gate enable register 0x00A8 R/W
APB_CTRL_MEM_POWER_DOWN_REG Internal memory control register 0x00AC R/W
PR
APB_CTRL_MEM_POWER_UP_REG Internal memory control register 0x00B0 R/W

13 System Registers
13.5 Registers
In this section, the addresses of all the registers starting with SYSTEM are relative to the base address of system
registers provided in Table 3-4 in Chapter 3 System and Memory; and those starting with APB are relative to the
base address of APB control also provided in Table 3-4 in Chapter 3 System and Memory.
Register 13.1. SYSTEM_CORE_1_CONTROL_0_REG (0x0000)
G
IN
ET
ES
_R
_1
EN
RE
L
E_
AL
CO
AT
ST
G
UN
LK
L_
CO 1_C
_R
RY
O
_1
_
R
RE
RE
NT
NT _CO
L_
O
L
_C RO
RO
_C
NT
d)
EM
O
e
_C
rv
ST
EM
EM
se
ST
ST
SY
(re
SY
SY
31 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 Reset
A
SYSTEM_CONTROL_CORE_1_RUNSTALL Set this bit to stall Core 1. (R/W)
SYSTEM_CONTROL_CORE_1_CLKGATE_EN Set this bit to enable Core 1 clock. (R/W)

IN
SYSTEM_CONTROL_CORE_1_RESETING Set this bit to reset Core 1. (R/W)
Register 13.2. SYSTEM_CORE_1_CONTROL_1_REG (0x0004)

IM
E
G
SA
ES
_M
_1
RE
CO
EL
L_
RO
NT
O
_C
EM
ST
SY
31 0
0 Reset
PR
SYSTEM_CONTROL_CORE_1_MESSAGE This field is used to facilitate the communication be-

tween CPU0 and CPU1. (R/W)

13 System Registers
Register 13.3. SYSTEM_CPU_PER_CONF_REG (0x0010)
N
O
E_
RC
UM
O
_N
PE SE E_F
AY
L
_ D
EL
SE
L
EQ MO
_D
D_
_F IT_
TI
O
AI
RI
LL A
_W
_P _W
R
PU
PU
EM P
_C
ST _C
_C
)
ed
EM
SY EM
EM
rv
ST
ST
ST
se
SY
SY
SY
(re
31 8 7 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 1 1 0 Reset
RY
SYSTEM_CPUPERIOD_SEL Set this field to select the CPU clock frequency. (R/W)
SYSTEM_PLL_FREQ_SEL Set this bit to select the PLL clock frequency. (R/W)
SYSTEM_CPU_WAIT_MODE_FORCE_ON Set this bit to force on the clock gate of CPU wait mode.
Usually, after executing the WAITI instruction, CPU enters the wait mode, during which the clock
A
gate of CPU is turned off until any interrupts occur. In this way, power consumption is reduced.
However, if this bit is set, the clock gate of CPU is always on and will not be turned off by the WAITI
instruction. (R/W)
IN
SYSTEM_CPU_WAITI_DELAY_NUM Sets the number of delay cycles to turn off the CPU clock gate
after the CPU enters the wait mode because of a WAITI instruction. (R/W)
IM
EL
PR

13 System Registers
Register 13.4. SYSTEM_PERIP_CLK_EN0_REG (0x0018)
EN
EN
K_
EN
LK EN
K_
N
CL
SY rve TIM CL K_E EN
SY rve I2S 1_C EN EN

_E
EN K_
CL
_C K_
1_
K_ EN
se _ I3_ L _
se _ RT K_ _
S _ _ E K_ N
S d) ER K_ N
ST _U I2_ 0_C N
K_ CL
P_
ER L
S _ CI K_ N
EN
CL EN
SY TEM RM _C _EN
(re TEM SP 0_C CLK
(re EM A CL LK
SY TEM I2C CL K_E
SY TEM SP XT _E
UP
M _C
SY TEM I2C 0_C EN

SY TEM PW XT EN
G EN
SY TEM CA 1_C EN
EN
SY EM H CL _E
CL _
CL _
S d) 0_ LK
K_
1_ K_
S d) B_ EM
S _ _ E LK
TI B
RO
ST _U T_ LK
S _ NT LK
S _ M K_
S _ M 1_
S _ N_ L
YS AR
ed I0 L
R
SY rve US _M
rv SP _C
SY EM C C
SY EM W CL
G
_S C2_
_
ST d) ER
se _ RT
se _ T
ST _P C
ST _P 1_
R
SY EM ED
SY ve IM
SY EM 2S
EM D
(re TEM UA
(re EM A
ST _U
ST _A
ST _L
ST _I
S _
se _
S d)
)
ed
SY TEM
SY EM
SY TEM
(re TEM
SY EM
SY TEM
SY rve
rv
r
ST
se
se
SY
(re
(re
31 30 29 28 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 1 1 0 0 0 0 1 1 0 0 0 0 0 0 1 1 0 1 0 0 0 0 0 0 1 1 0 0 1 1 0 Reset
SYSTEM_SPI01_CLK_EN Set this bit to enable SPI01 clock. (R/W)
RY
SYSTEM_UART_CLK_EN Set this bit to enable UART clock. (R/W)
SYSTEM_I2S0_CLK_EN Set this bit to enable I2S0 clock. (R/W)
SYSTEM_UART1_CLK_EN Set this bit to enable UART1 clock. (R/W)
A
SYSTEM_I2C_EXT0_CLK_EN Set this bit to enable I2C_EXT0 clock. (R/W) IN
SYSTEM_UHCI0_CLK_EN Set this bit to enable UHCI0 clock. (R/W)
SYSTEM_RMT_CLK_EN Set this bit to enable RMT clock. (R/W)
SYSTEM_PCNT_CLK_EN Set this bit to enable PCNT clock. (R/W)

IM
SYSTEM_LEDC_CLK_EN Set this bit to enable LEDC clock. (R/W)
SYSTEM_TIMERGROUP_CLK_EN Set this bit to enable TIMERGROUP0 clock. (R/W)
SYSTEM_TIMERGROUP1_CLK_EN Set this bit to enable TIMERGROUP1 clock. (R/W)

EL
SYSTEM_PWM0_CLK_EN Set this bit to enable PWM0 clock. (R/W)
SYSTEM_I2C_EXT1_CLK_EN Set this bit to enable I2C_EXT1 clock. (R/W)
SYSTEM_CAN_CLK_EN Set this bit to enable CAN clock. (R/W)

PR
SYSTEM_PWM1_CLK_EN Set this bit to enable PWM1 clock. (R/W)
SYSTEM_I2S1_CLK_EN Set this bit to enable I2S1 clock. (R/W)
SYSTEM_USB_CLK_EN Set this bit to enable USB clock. (R/W)
SYSTEM_UART_MEM_CLK_EN Set this bit to enable UART_MEM clock. (R/W)
SYSTEM_SYSTIMER_CLK_EN Set this bit to enable SYSTEM TIMER clock. (R/W)
SYSTEM_ADC2_ARB_CLK_EN Set this bit to enable ADC2_ARB clock. (R/W)

13 System Registers
Register 13.5. SYSTEM_PERIP_CLK_EN1_REG (0x001C)
EM R TO SA K_ EN
N
UP LK N
I_ _A _C _EN
LK N
ST _C YP _R CL K_
S _ IO M_ N EN
_E
_P YPT _SH _C EN
CK _C _E
_C _E
N
SY TEM CR TO S_ _CL
SY TEM CR TO EN K_E
SY TEM CR CL T_C EN
SY TEM SD CA K_E K_
BA ES LK
ER O A LK
S _ D_ L CL
S _ A_ S K_
S _ P D C
S _ YP K_ L
SY TEM CR TO MA
SY TEM LC 2_C E_
SY TEM DM _HO CL
S _ RT VIC
S _ YP _H
_
SY TEM UA DE
S _ B_
Y
SY EM S
ST _U
d)
SY TEM
ve
er
S
s
SY
(re
31 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 Reset
SYSTEM_PERI_BACKUP_CLK_EN Set this bit to enable peri backup clock. (R/W)
RY
SYSTEM_CRYPTO_AES_CLK_EN Set this bit to enable AES clock. (R/W)
SYSTEM_CRYPTO_SHA_CLK_EN Set this bit to enable SHA clock. (R/W)
SYSTEM_CRYPTO_RSA_CLK_EN Set this bit to enable RSA clock. (R/W)
A
SYSTEM_CRYPTO_DS_CLK_EN Set this bit to enable DS clock. (R/W)
SYSTEM_CRYPTO_HMAC_CLK_EN Set this bit to enable HMAC clock. (R/W)

IN
SYSTEM_DMA_CLK_EN Set this bit to enable DMA clock. (R/W)
SYSTEM_SDIO_HOST_CLK_EN Set this bit to enable SDIO_HOST clock. (R/W)
SYSTEM_LCD_CAM_CLK_EN Set this bit to enable LCD_CAM clock. (R/W)

IM
SYSTEM_UART2_CLK_EN Set this bit to enable UART2 clock. (R/W)
SYSTEM_USB_DEVICE_CLK_EN Set this bit to enable USB_DEVICE clock. (R/W)

EL
PR

13 System Registers
Register 13.6. SYSTEM_PERIP_RST_EN0_REG (0x0020)
T
RS
T
RS
T
_R T
1_
T RS
ST
ER S
P_
(re TEM SP 0_R RST
(re EM A RS ST
UP
M _R
RS _
RS T
ST _U I2_ 0_R
S d) B_ EM
SY TEM I2C RS T
SY rve TIM RS T
SY TEM SP XT T
TI B
RO
S _ T_ ST
T
S d) 0_ S
1_ T
ST _R NT ST
S _ M 1_
S _ N_ S
se _ I3_ S
S _ _E S
S _ CI T
S _ _E T
S d) ER T
se _ R T T
RS
YS AR
ed I0 S
S _ M T
T
R
SY rve I2S 1_R

SY TEM CA 1_R
SY TEM I2C 0_R

SY rve US _M
SY TEM UH RS
SY EM W RS
SY EM M _R
rv SP _R
SY TEM PW XT
SY TEM PC _R
G
G
_S C2_
ST d) ER
se _ RT
se _ T
S _ C
ST _P 1_
R
SY EM ED
SY ve IM
SY EM 2S
EM D
(re EM A
(re EM A
ST _U
ST _U
ST _A
ST _L
ST _I
se _
S d)
)
ed
SY TEM
SY TEM
SY TEM
(re TEM
SY EM
SY TEM
SY rve
rv
r
se
se
S
SY
(re
(re
31 30 29 28 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SYSTEM_SPI01_RST Set this bit to reset SPI01. (R/W)
RY
SYSTEM_UART_RST Set this bit to reset UART. (R/W)
SYSTEM_I2S0_RST Set this bit to reset I2S0. (R/W)
SYSTEM_UART1_RST Set this bit to reset UART1. (R/W)
A
SYSTEM_I2C_EXT0_RST Set this bit to reset I2C_EXT0. (R/W)
SYSTEM_UHCI0_RST Set this bit to reset UHCI0. (R/W)
SYSTEM_RMT_RST Set this bit to reset RMT. (R/W)

IN
SYSTEM_PCNT_RST Set this bit to reset PCNT. (R/W)
SYSTEM_LEDC_RST Set this bit to reset LEDC. (R/W)

IM
SYSTEM_TIMERGROUP_RST Set this bit to reset TIMERGROUP0. (R/W)
SYSTEM_TIMERGROUP1_RST Set this bit to reset TIMERGROUP1. (R/W)

EL
SYSTEM_PWM0_RST Set this bit to reset PWM0. (R/W)
SYSTEM_I2C_EXT1_RST Set this bit to reset I2C_EXT1. (R/W)
SYSTEM_CAN_RST Set this bit to reset CAN. (R/W)

PR
SYSTEM_PWM1_RST Set this bit to reset PWM1. (R/W)
SYSTEM_I2S1_RST Set this bit to reset I2S1. (R/W)
SYSTEM_USB_RST Set this bit to reset USB. (R/W)
SYSTEM_UART_MEM_RST Set this bit to reset UART_MEM. (R/W)
SYSTEM_SYSTIMER_RST Set this bit to reset SYSTIMER. (R/W)
SYSTEM_ADC2_ARB_RST Set this bit to reset ADC2_ARB. (R/W)

13 System Registers
Register 13.7. SYSTEM_PERIP_RST_EN1_REG (0x0024)
ST _C YP _R RS T
SY TEM CR TO S_ _RS
ST
BA ES ST
ER O A T
UP ST
T
_P YPT _SH _RS

EM R TO SA T
S _ YP T ST
_R
S _ D_ S RS
I_ _A _R
CK _R
S _ YP _D C
S _ A_ S T
SY TEM CR RS T_R
SY TEM CR TO MA
SY EM M O S
SY TEM LC 2_R E_
R
SY TEM SD CA T
S _ RT VIC
S _ YP _H
ST _D IO_ M_
SY TEM CR TO
SY TEM UA DE
H
S _ B_
SY EM S
ST _U
d)
SY TEM
ve
er
S
s
SY
(re
31 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 Reset
SYSTEM_PERI_BACKUP_RST Set this bit to reset BACKUP. (R/W)
RY
SYSTEM_CRYPTO_AES_RST Set this bit to reset CRYPTO_AES. (R/W)
SYSTEM_CRYPTO_SHA_RST Set this bit to reset CRYPTO_SHA. (R/W)
SYSTEM_CRYPTO_RSA_RST Set this bit to reset CRYPTO_RSA. (R/W)
SYSTEM_CRYPTO_DS_RST Set this bit to reset CRYPTO_DS. (R/W)
A
SYSTEM_CRYPTO_HMAC_RST Set this bit to reset CRYPTO_HMAC. (R/W)
SYSTEM_DMA_RST Set this bit to reset DMA. (R/W)
SYSTEM_SDIO_HOST_RST Set this bit to reset SDIO_HOST. (R/W)

IN
SYSTEM_LCD_CAM_RST Set this bit to reset LCD_CAM. (R/W)
SYSTEM_UART2_RST Set this bit to reset UART2. (R/W)

IM
SYSTEM_USB_DEVICE_RST Set this bit to reset USB_DEVICE. (R/W)
EL
PR

13 System Registers
Register 13.8. SYSTEM_BT_LPCK_DIV_FRAC_REG (0x002C)
W
LO
LK EL TA 2K
_S
PC _S _X L3
_S _8 L
TC
_L LK EL TA
ST _L LK EL N
EL M
SY TEM LPC K_S C_E
_R
EM PC _S _X
S _ L T
SY TEM LPC K_R
S _ L
SY TEM LPC
S _
)
)
ed
ed
SY TEM
rv
rv
se
se
S
SY
(re
(re
31 29 28 27 26 25 24 23 0
0 0 0 0 0 0 1 0 1 Reset
SYSTEM_LPCLK_SEL_RTC_SLOW Set this bit to select RTC slow clock as the low-power clock.
RY
(R/W)
SYSTEM_LPCLK_SEL_8M Set this bit to select 8 MHz clock as the low-power clock. (R/W)
SYSTEM_LPCLK_SEL_XTAL Set this bit to select XTAL clock as the low-power clock. (R/W)
SYSTEM_LPCLK_SEL_XTAL32K Set this bit to select XTAL32K clock as the low-power clock. (R/W)
A
SYSTEM_LPCLK_RTC_EN Set this bit to enable the RTC low-power clock. (R/W)
IN
Register 13.9. SYSTEM_CPU_INTR_FROM_CPU_0_REG (0x0030)
IM
0
U_
P
_C
M
RO
_F
TR
N
_I
PU
_C
d )
EM
ve
EL
er
ST
s
SY
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SYSTEM_CPU_INTR_FROM_CPU_0 Set this bit to generate CPU interrupt 0. This bit needs to be
PR
reset by software in the ISR process. (R/W)

13 System Registers
_1
PU
_C
M
O
FR
R_
NT
_I
PU
_C
d)
EM
ve
er
ST
s
SY
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
A
2
U_
P
_C
M
O
FR
R_
IN
NT
_I
PU
_C
d)
EM
r ve
ST
se
SY
(re
31 1 0
IM
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
EL
Register 13.12. SYSTEM_CPU_INTR_FROM_CPU_3_REG (0x003C)
_3
PU
_C
M
O
PR
FR
R_
NT
_I
PU
_C
d)
EM
e
rv
ST
se
SY
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset

13 System Registers
Register 13.13. SYSTEM_RSA_PD_CTRL_REG (0x0040)
_P RC PD
U
D E_P
EM FO E_
_M M_ RC
SA E FO
_R A_M M_
EM S E
ST _R A_M
SY TEM RS
S _
d)
SY TEM
ve
er
S
s
SY
(re
31 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 Reset
SYSTEM_RSA_MEM_PD Set this bit to send the RSA memory into retention state. This bit has the
RY
lowest priority, meaning it can be masked by the SYSTEM_RSA_MEM_FORCE_PU field. When
Digital Signature occupies the RSA, this bit is invalid. (R/W)
SYSTEM_RSA_MEM_FORCE_PU Set this bit to force the RSA memory to work as normal when
the chip enters light sleep. This bit has the second highest priority, meaning it overrides the SYS-
TEM_RSA_MEM_PD field. (R/W)
A
SYSTEM_RSA_MEM_FORCE_PD Set this bit to send the RSA memory into retention state. This bit
has the highest priority, meaning it sends the RSA memory into retention state regardless of the
SYSTEM_RSA_MEM_FORCE_PU field. (R/W)
IN
Register 13.14. SYSTEM_EDMA_CTRL_REG (0x0044)
IM
N
O
CL T
A_ ESE
K_
DM _R
_E MA
EM D
ST _E
)
ed
SY TEM
rv
se
S
SY
(re
EL
31 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 Reset
SYSTEM_EDMA_CLK_ON Set this bit to enable EDMA clock. (R/W)
SYSTEM_EDMA_RESET Set this bit to reset EDMA. (R/W)

PR

13 System Registers
Register 13.15. SYSTEM_CACHE_CONTROL_REG (0x0048)
E_ ESE N
N
CH _R _O
_I CH _C ET
O
CL T
K_
EM CA HE ES
CA E LK
ST _I AC _R
SY TEM DC HE
S _ AC
SY EM C
ST _D
d)
SY TEM
ve
er
S
s
SY
(re
31 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 Reset
SYSTEM_ICACHE_CLK_ON Set this bit to enable i-cache clock. (R/W)
RY
SYSTEM_ICACHE_RESET Set this bit to reset i-cache. (R/W)
SYSTEM_DCACHE_CLK_ON Set this bit to enable d-cache clock. (R/W)
SYSTEM_DCACHE_RESET Set this bit to reset d-cache. (R/W)
A
Register 13.16. SYSTEM_EXTERNAL_DEVICE_ENCRYPT_DECRYPT_CONTROL_REG (0x004C)
EC YPT
T
IN
R
UA _EN RYP
CB ENC
CR PT
Y
T
_
CR
YP
AL
_D
AD NU
EN
A
AN DB
NL _G0
NL _M
L_
_
AD
AD
O
O
NL
M
W
I_
O
DO
SP
_D
_D
E_
E_
LE
E
EM ABL
BL
BL
B
d)
NA
NA
NA
N
e
_E
_E
_E
_E
rv
EM
EM
EM
IM se
ST
ST
ST
ST
(re
SY
SY
SY
SY
31 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SYSTEM_ENABLE_SPI_MANUAL_ENCRYPT Set this bit to enable Manual Encryption under SPI

EL
Boot mode. (R/W)
SYSTEM_ENABLE_DOWNLOAD_DB_ENCRYPT Set this bit to enable Auto Encryption under

Download Boot mode. (R/W)
SYSTEM_ENABLE_DOWNLOAD_G0CB_DECRYPT Set this bit to enable Auto Decryption under

PR
Download Boot mode. (R/W)
SYSTEM_ENABLE_DOWNLOAD_MANUAL_ENCRYPT Set this bit to enable Manual Encryption

under Download Boot mode. (R/W)

13 System Registers
Register 13.17. SYSTEM_RTC_FASTMEM_CONFIG_REG (0x0050)
T
R
AR
IS
DD
N
IN
ST
LE
_A
_F
_
RC
RC
RC
RC
_C
_C
_C
_C
EM
EM
EM
EM
M
_M
_M
_M
_
TC
TC
TC
TC
_R
_R
_R
_R
)
ed
EM
EM
EM
EM
rv
ST
ST
ST
ST
se
SY
SY
SY
SY
(re
31 30 20 19 9 8 7 0
0 0x7ff 0x0 0 0 0 0 0 0 0 0 0 Reset
SYSTEM_RTC_MEM_CRC_START Set this bit to start the CRC of RTC memory (R/W)
RY
SYSTEM_RTC_MEM_CRC_ADDR This field is used to set address of RTC memory for CRC. (R/W)
SYSTEM_RTC_MEM_CRC_LEN This field is used to set length of RTC memory for CRC based on
start address. (R/W)
SYSTEM_RTC_MEM_CRC_FINISH This bit stores the status of RTC memory CRC. High level means
A
finished while low level means not finished. (RO)
IN
Register 13.18. SYSTEM_RTC_FASTMEM_CRC_REG (0x0054)
_C
_R
RC
ES
IM
EM
_M
TC
_R
EM
ST
SY
31 0
EL
0 Reset
SYSTEM_RTC_MEM_CRC_RES This field stores the CRC result of RTC memory. (RO)
PR
Register 13.19. SYSTEM_CLOCK_GATE_REG (0x005C)

N
_E
LK
_C
)
ed
EM
rv
ST
se
SY
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 Reset
SYSTEM_CLK_EN Set this bit to enable the system clock. (R/W)

13 System Registers
Register 13.20. SYSTEM_SYSCLK_CONF_REG (0x0060)
E Q
NT
FR
SE
L_
_C
K_
TA
V
CL
DI
_X
C_
_
LK
RE
O
_C
_S
_P
d)
EM
EM
EM
ve
er
ST
ST
ST
s
SY
SY
SY
(re
31 19 18 12 11 10 9 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x1 Reset
SYSTEM_PRE_DIV_CNT This field is used to set the count of prescaler of XTAL_CLK. For details,
please refer to Table 6-4 in Chapter 6 Reset and Clock. (R/W)
RY
SYSTEM_SOC_CLK_SEL This field is used to select SOC clock. For details, please refer to Table
6-2 in Chapter 6 Reset and Clock. (R/W)
SYSTEM_CLK_XTAL_FREQ This field is used to read XTAL frequency in MHz. (RO)
A
Register 13.21. SYSTEM_DATE_REG (0x0FFC)
IN AT
_D
E
)
ed
ME
rv
ST
se
SY
(re
31 28 27 0
0 0 0 0 0x2101220 Reset
IM
SYSTEM_DATE Version control register. (R/W)
EL
PR

13 System Registers
Register 13.22. APB_CTRL_CLKGATE_FORCE_ON_REG (0x00A8)
N
O
_O
E_
E
RC
RC
O
O
_F
_F
E
E
AT
AT
G
KG
LK
L
_C
_C
M
M
A
RO
SR
L_
L_
R
R
d)
CT
CT
ve
er
B_
B_
s
AP
AP
(re
31 14 13 3 2 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x7ff 0x7 Reset
RY
APB_CTRL_ROM_CLKGATE_FORCE_ON Set 1 to configure the ROM clock gate to be always on;
Set 0 to configure the clock gate to turn on automatically when ROM is accessed and turn off
automatically when ROM is not accessed. (R/W)
APB_CTRL_SRAM_CLKGATE_FORCE_ON Set 1 to configure the SRAM clock gate to be always

on; Set 0 to configure the clock gate to turn on automatically when SRAM is accessed and turn
A
off automatically when SRAM is not accessed. (R/W)
IN
Register 13.23. APB_CTRL_MEM_POWER_DOWN_REG (0x00AC)
N
W
W
O
O
_D
_D
IM
ER
ER
W
W
O
O
_P
_P
M
M
RA
O
_R
_S
RL
RL
d)
CT
CT
e
rv
B_
B_
se
AP
AP
EL (re
31 14 13 3 2 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
APB_CTRL_ROM_POWER_DOWN Set this field to send the internal ROM into retention state. (R/W)
PR
APB_CTRL_SRAM_POWER_DOWN Set this field to send the internal SRAM into retention state.
(R/W)

13 System Registers
Register 13.24. APB_CTRL_MEM_POWER_UP_REG (0x00B0)
P
_U
_U
ER
ER
W
W
O
O
_P
_P
M
M
A
RO
SR
L_
L_
R
R
d)
CT
CT
ve
er
B_
B_
s
AP
AP
(re
31 14 13 3 2 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x7ff 0x7 Reset
APB_CTRL_ROM_POWER_UP Set this field to force the internal ROM to work as normal (do not
RY
enter the retention state) when the chip enters light sleep. (R/W)
APB_CTRL_SRAM_POWER_UP Set this field to force the internal SRAM to work as normal (do not
enter the retention state) when the chip enters light sleep. (R/W)
A
IN
IM
EL
PR

14 SHA Accelerator (SHA)
14.1 Introduction
ESP32-S3 integrates an SHA accelerator, which is a hardware device that speeds up SHA algorithm significantly,
compared to SHA algorithm implemented solely in software. The SHA accelerator integrated in ESP32-S3 has
two working modes, which are Typical SHA and DMA-SHA.
14.2 Features
The following functionality is supported:
RY
• All the hash algorithms introduced in FIPS PUB 180-4 Spec.
– SHA-1
– SHA-224
– SHA-256
A
– SHA-384
– SHA-512
– SHA-512/224
IN
– SHA-512/256
– SHA-512/t
IM
• Two working modes
– Typical SHA
– DMA-SHA
EL
• interleaved function when working in Typical SHA working mode
• Interrupt function when working in DMA-SHA working mode
14.3 Working Modes

PR
The SHA accelerator integrated in ESP32-S3 has two working modes.
• Typical SHA Working Mode: all the data is written and read via CPU directly.
• DMA-SHA Working Mode: all the data is read via DMA. That is, users can configure the DMA controller to
read all the data needed for hash operation, thus releasing CPU for completing other tasks.
Users can start the SHA accelerator with different working modes by configuring registers SHA_START_REG and
SHA_DMA_START_REG. For details, please see Table 14-1.

Table 141. SHA Accelerator Working Mode
Working Mode Configuration Method

Typical SHA Set SHA_START_REG to 1
DMA-SHA Set SHA_DMA_START_REG to 1
Users can choose hash algorithms by configuring the SHA_MODE_REG register. For details, please see Table
14-2.
Table 142. SHA Hash Algorithm Selection
Hash Algorithm SHA_MODE_REG Configuration
RY
SHA-1 0
SHA-224 1
SHA-256 2
SHA-384 3
SHA-512 4
A
SHA-512/224 5
SHA-512/256 6
SHA-512/t 7
IN
Notice:
ESP32-S3’s Digital Signature (DS) and HMAC Accelerator (HMAC) modules also call the SHA accelerator.
Therefore, users cannot access the SHA accelerator when these modules are working.
IM
14.4 Function Description

EL
SHA accelerator can generate the message digest via two steps: Preprocessing and Hash operation.
14.4.1 Preprocessing
Preprocessing consists of three steps: padding the message, parsing the message into message blocks and
setting the initial hash value.
PR
14.4.1.1 Padding the Message
The SHA accelerator can only process message blocks of 512 or 1024 bits, depending on the algorithm. Thus,
all the messages should be padded to a multiple of 512 or 1024 bits before the hash task.
Suppose that the length of the message M is m bits. Then M shall be padded as introduced below:
• SHA1, SHA224 and SHA256
1. First, append the bit “1” to the end of the message;
2. Second, append k zero bits, where k is the smallest, non-negative solution to the equation
m + 1 + k ≡ 448 mod 512;
3. Last, append the 64-bit block of value equal to the number m expressed using a binary representation.

• SHA384, SHA512, SHA512/224, SHA512/256 and SHA512/t
1. First, append the bit “1” to the end of the message;
2. Second, append k zero bits, where k is the smallest, non-negative solution to the equation
m + 1 + k ≡ 896 mod 1024;
3. Last, append the 128-bit block of value equal to the number m expressed using a binary
representation.
For more details, please refer to Section “5.1 Padding the Message” in FIPS PUB 180-4 Spec.
14.4.1.2 Parsing the Message
RY
The message and its padding must be parsed into N 512-bit or 1024-bit blocks.
• For SHA1, SHA224 and SHA256: the message and its padding are parsed into N 512-bit blocks, M (1) ,
M (2) , …, M (N ) . Since the 512 bits of the input block may be expressed as sixteen 32-bit words, the first
(i) (i) (i)
32 bits of message block i are denoted M0 , the next 32 bits are M1 , and so on up to M15 .
• For SHA384, SHA512, SHA512/224, SHA512/256 and SHA512/t: the message and its padding are
A
parsed into N 1024-bit blocks. Since the 1024 bits of the input block may be expressed as sixteen 64-bit
(i) (i) (i)
words, the first 64 bits of message block i are denoted M0 , the next 64 bits are M1 , and so on up to M15 .
IN
During the task, all the message blocks are written into the SHA_M_n_REG, following the rules below:
(i) (i)
• For SHA1, SHA224 and SHA256: M0 is stored in SHA_M_0_REG, M1 stored in SHA_M_1_REG, …,
(i)
and M15 stored in SHA_M_15_REG.
• For SHA384, SHA512, SHA512/224 and SHA512/256: the most significant 32 bits and the least
IM
(i)
significant 32 bits of M0 are stored in SHA_M_0_REG and SHA_M_1_REG, respectively, …, the most
(i)
significant 32 bits and the least significant 32 bits of M15 are stored in SHA_M_30_REG and
SHA_M_31_REG, respectively.
Note:
EL
For more information about “message block”, please refer to Section “2.1 Glossary of Terms and Acronyms” in FIPS PUB
180-4 Spec.
14.4.1.3 Initial Hash Value

PR
Before hash task begins for each of the secure hash algorithms, the initial Hash value H(0) must be set based on
different algorithms, among which the SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and
SHA-512/256 algorithms use the initial Hash values (constant C) stored in the hardware.
However, SHA-512/t requires a distinct initial hash value for each operation for a given value of t. Simply put,
SHA-512/t is the generic name for a t-bit hash function based on SHA-512 whose output is truncated to t bits. t
is any positive integer without a leading zero such that t<512, and t is not 384. The initial hash value for
SHA-512/t for a given value of t can be calculated by performing SHA-512 from hexadecimal representation of
the string “SHA-512/t”. It’s not hard to observe that when determining the initial hash values for SHA-512/t
algorithms with different t, the only difference lies in the value of t.
Therefore, we have specially developed the following simplified method to calculate the initial hash value for
SHA-512/t:

1. Generate t_string and t_length: t_string is a 32-bit data that stores the input message of t. t_length is a
7-bit data that stores the length of the input message. The t_string and t_length are generated in methods
described below, depending on the value of t:
• If 1 <= t <= 9, then t_length = 7′ h48 and t_string is padded in the following format:
8′ h30 + 8′ ht0 1′ b1 23′ b0
where t0 = t.
For example, if t = 8, then t0 = 8 and t_string = 32′ h38800000.
• If 10 <= t <= 99, then t_length = 7′ h50 and t_string is padded in the following format:
RY
8′ h30 + 8′ ht1 8′ h30 + 8′ ht0 1′ b1 15′ b0
where, t0 = t%10 and t1 = t/10.
For example, if t = 56, then t0 = 6, t1 = 5, and t_string = 32′ h35368000.
• If 100 <= t < 512, then t_length = 7′ h58 and t_string is padded in the following format:
A
8′ h30 + 8′ ht2 8′ h30 + 8′ ht1 8′ h30 + 8′ ht0 1′ b1 7′ b0
IN
where, t0 = t%10, t1 = (t/10)%10, and t2 = t/100.
For example, if t = 231, then t0 = 1, t1 = 3, t2 = 2, and t_string = 32′ h32333180.
2. Initialize relevant registers: Initialize SHA_T_STRING_REG and SHA_T_LENGTH_REG with the

IM
generated t_string and t_length in the previous step.
3. Obtain initial hash value: Set the SHA_MODE_REG register to 7. Set the SHA_START_REG register to 1
to start the SHA accelerator. Then poll register SHA_BUSY_REG until the content of this register becomes
0, indicating the calculation of initial hash value is completed.
EL
Please note that the initial value for SHA-512/t can be also calculated according to the Section “5.3.6 SHA-512/t”
in FIPS PUB 180-4 Spec, that is performing SHA-512 operation (with its initial hash value set to the result of
8-bitwise XOR operation of C and 0xa5) from the hexadecimal representation of the string “SHA-512/t”.
14.4.2 Hash task Process

PR
After the preprocessing, the ESP32-S3 SHA accelerator starts to hash a message M and generates message
digest of different lengths, depending on different hash algorithms. As described above, the ESP32-S3 SHA
accelerator supports two working modes, which are Typical SHA and DMA-SHA. The operation process for the
SHA accelerator under two working modes is described in the following subsections.
14.4.2.1 Typical SHA Mode Process
Usually, the SHA accelerator will process all blocks of a message and produce a message digest before starting
the next message digest.
However, ESP32-S3 SHA working in Typical SHA mode also supports optional “interleaved” message digest
calculation. Users can insert new calculation (both Typical SHA and DMA-SHA) each time the SHA accelerator
completes one message block. To be more specific, users can store the message digest in registers

SHA_H_n_REG after completing each message block, and assign the accelerator with other higher priority tasks.
After the inserted calculation completes, users can put the message digest stored back to registers
SHA_H_n_REG, and resume the accelerator with the previously paused calculation.
Typical SHA Process (except for SHA512/t)
1. Select a hash algorithm.
• Configure the SHA_MODE_REG register based on Table 14-2.
2. Process the current message block 1 .
• Write the message block in registers SHA_M_n_REG.
RY
3. Start the SHA accelerator.
• If this is the first time to execute this step, set the SHA_START_REG register to 1 to start the SHA
accelerator. In this case, the accelerator uses the initial hash value stored in hardware for a given
algorithm configured in Step 1 to start the calculation;
• If this is not the first time to execute this step2 , set the SHA_CONTINUE_REG register to 1 to start the
A
SHA accelerator. In this case, the accelerator uses the hash value stored in the SHA_H_n_REG
register to start calculation. IN
4. Check the progress of the current message block.
• Poll register SHA_BUSY_REG until the content of this register becomes 0, indicating the accelerator
has completed the calculation for the current message block and now is in the “idle” status 3 .
5. Decide if you have more message blocks to process:

IM
• If yes, please go back to Step 2.
• Otherwise, please continue.
6. Obtain the message digest.

EL
• Read the message digest from registers SHA_H_n_REG.
Typical SHA Process (SHA512/t)

PR
• Configure the SHA_MODE_REG register to 7 for SHA-512/t.
2. Calculate the initial hash value.
(a) Calculate t_stiring and t_length and initialize SHA_T_STRING_REG and SHA_T_LENGTH_REG with
the generated t_string and t_length. For details, please refer to Section 14.4.1.3.
(b) Set the SHA_START_REG register to 1 to start the SHA accelerator.
(c) Poll register SHA_BUSY_REG until the content of this register becomes 0, indicating the calculation of
initial hash value is completed.
3. Process the current message block1 .
• Write the message block in registers SHA_M_n_REG.
4. Start the SHA accelerator

• Set the SHA_CONTINUE_REG register to 1. In this case, the accelerator uses the hash value stored in
the SHA_H_n_REG register to start calculation.
5. Check the progress of the calculation.
• Poll register SHA_BUSY_REG until the content of this register becomes 0, indicating the accelerator
has completed the calculation for the current message block and now is in the “idle” status3 .
6. Decide if you have more message blocks to process:
• If yes, please go back to Step 3.
• Otherwise, please continue.
7. Obtain the message digest.
RY
Note:
1. In this step, the software can also write the next message block (to be processed) in registers SHA_M_n_REG, if
any, while the hardware starts SHA calculation, to save time.
A
2. You are resuming the SHA accelerator with the previously paused calculation.
3. Here you can decide if you want to insert other calculations. If yes, please go to the process for interleaved
calculations for details.
IN
As mentioned above, ESP32-S3 SHA accelerator supports “interleaving” calculation under the Typical SHA
working mode.
IM
The process to implement interleaved calculation is described below.
1. Prepare to hand the SHA accelerator over for an interleaved calculation by saving the following data of the
previous calculation.
• The selected hash algorithm stored in the SHA_MODE_REG register.

EL
• The message digest stored in registers SHA_H_n_REG.
2. Perform the interleaved calculation. For the detailed process of the interleaved calculation, please refer to
Typical SHA process or DMA-SHA process, depending on the working mode of your interleaved calculation.
3. Prepare to hand the SHA accelerator back to the previously paused calculation by restoring the following
PR
data of the previous calculation.
• Write the previously stored hash algorithm back to register SHA_MODE_REG
• Write the previously stored message digest back to registers SHA_H_n_REG
4. Write the next message block from the previous paused calculation in registers SHA_M_n_REG, and set the
SHA_CONTINUE_REG register to 1 to restart the SHA accelerator with the previously paused calculation.
14.4.2.2 DMASHA Mode Process
ESP32-S3 SHA accelerator does not support “interleaving” message digest calculation when using the DMA,
which means you cannot insert new calculation before the whole DMA-SHA process completes. In this case,

users who need inserted calculation are recommended to divide your message blocks and perform several
DMA-SHA calculation, instead of trying to compute all the messages in one go.
In contrast to the Typical SHA working mode, when the SHA accelerator is working under the DMA-SHA mode,
all data read are completed via DMA.
Therefore, users are required to configure the DMA controller following the description in Chapter 2 GDMA
Controller (GDMA).
DMASHA process (except SHA512/t)
RY
• Select a hash algorithm by configuring the SHA_MODE_REG register. For details, please refer to Table
14-2.
2. Configure the SHA_INT_ENA_REG register to enable or disable interrupt (Set 1 to enable).
3. Configure the number of message blocks.
• Write the number of message blocks M to the SHA_DMA_BLOCK_NUM_REG register.
A
4. Start the DMA-SHA calculation.
• If the current DMA-SHA calculation follows a previous calculation, firstly write the message digest from
IN
the previous calculation to registers SHA_H_n_REG, then write 1 to register
SHA_DMA_CONTINUE_REG to start SHA accelerator;
• Otherwise, write 1 to register SHA_DMA_START_REG to start the accelerator.

IM
5. Wait till the completion of the DMA-SHA calculation, which happens when:
• The content of SHA_BUSY_REG register becomes 0, or
• An SHA interrupt occurs. In this case, please clear interrupt by writing 1 to the SHA_INT_CLEAR_REG
register.
EL
6. Obtain the message digest:
DMASHA process for SHA512/t

PR
• Select SHA-512/t algorithm by configuring the SHA_MODE_REG register to 7.
2. Configure the SHA_INT_ENA_REG register to enable or disable interrupt (Set 1 to enable).
3. Calculate the initial hash value.
(a) Calculate t_string and t_length and initialize SHA_T_STRING_REG and SHA_T_LENGTH_REG with
the generated t_string and t_length. For details, please refer to Section 14.4.1.3.
(b) Set the SHA_START_REG register to 1 to start the SHA accelerator.
(c) Poll register SHA_BUSY_REG until the content of this register becomes 0, indicating the calculation of
initial hash value is completed.
4. Configure the number of message blocks.

• Write the number of message blocks M to the SHA_DMA_BLOCK_NUM_REG register.
5. Start the DMA-SHA calculation.
• Write 1 to register SHA_DMA_CONTINUE_REG to start the accelerator.
6. Wait till the completion of the DMA-SHA calculation, which happens when:
• The content of SHA_BUSY_REG register becomes 0, or
• An SHA interrupt occurs. In this case, please clear interrupt by writing 1 to the SHA_INT_CLEAR_REG
register.
7. Obtain the message digest:
RY
14.4.3 Message Digest

After the hash task completes, the SHA accelerator writes the message digest from the task to registers
SHA_H_n_REG(n: 0~15). The lengths of the generated message digest are different depending on different hash
algorithms. For details, see Table 14-6 below:
A
Table 146. The Storage and Length of Message digest from Different Algorithms
IN
Hash Algorithm Length of Message Digest (in bits) Storage1
SHA-1 160 SHA_H_0_REG ~ SHA_H_4_REG
IM
SHA-512/224 224 SHA_H_0_REG ~ SHA_H_6_REG
SHA-512/256 256 SHA_H_0_REG ~ SHA_H_7_REG
2
SHA-512/t t SHA_H_0_REG ~ SHA_H_x_REG
EL
1
The message digest are stored in registers from most significant bits to the least significant
bits, with the first word stored in register SHA_H_0_REG and the second word stored in
register SHA_H_1_REG... For details, please see subsection 14.4.1.2.
2
The registers used for SHA-512/t algorithm depend on the value of t. x+1 indicates the
number of 32-bit registers used to store t bits of message digest, so that x = roundup(t/32)-
PR
1. For example:
• When t = 8, then x = 0, indicating that the 8-bit long message digest is stored in the
most significant 8 bits of register SHA_H_0_REG;
• When t = 32, then x = 0, indicating that the 32-bit long message digest is stored in
register SHA_H_0_REG;
• When t = 132, then x = 4, indicating that the 132-bit long message digest is stored
in registers SHA_H_0_REG, SHA_H_1_REG, SHA_H_2_REG, SHA_H_3_REG, and
SHA_H_4_REG.

14.4.4 Interrupt
SHA accelerator supports interrupt on the completion of message digest calculation when working in the
DMA-SHA mode. To enable this function, write 1 to register SHA_INT_ENA_REG. Note that the interrupt should
be cleared by software after use via setting the SHA_INT_CLEAR_REG register to 1.

The addresses in this section are relative to the SHA accelerator base address provided in Table 3-4 in Chapter 3
System and Memory.
RY
Control/Status registers
Continues SHA operation (only effective in Typi-
SHA_CONTINUE_REG 0x0014 WO
cal SHA mode)
SHA_BUSY_REG Indicates if SHA Accelerator is busy or not 0x0018 RO
Starts the SHA accelerator for DMA-SHA oper-
SHA_DMA_START_REG 0x001C WO
ation
A
Starts the SHA accelerator for Typical SHA op-
SHA_START_REG 0x0010 WO
eration
Continues SHA operation (only effective in DMA-
SHA_DMA_CONTINUE_REG
SHA mode)
IN 0x0020 WO
SHA_INT_CLEAR_REG DMA-SHA interrupt clear register 0x0024 WO

SHA_INT_ENA_REG DMA-SHA interrupt enable register 0x0028 R/W
Version Register
IM
SHA_DATE_REG Version control register 0x002C R/W
SHA_MODE_REG Defines the algorithm of SHA accelerator 0x0000 R/W
String content register for calculating initial Hash
SHA_T_STRING_REG 0x0004 R/W
EL
Value (only effective for SHA-512/t)

String length register for calculating initial Hash
SHA_T_LENGTH_REG 0x0008 R/W
Value (only effective for SHA-512/t)
Memories
Block number register (only effective for DMA-
SHA_DMA_BLOCK_NUM_REG 0x000C R/W
PR
SHA)
SHA_H_0_REG Hash value 0x0040 R/W
SHA_H_3_REG Hash value 0x004C R/W


SHA_M_0_REG Message 0x0080 R/W
SHA_M_3_REG Message 0x008C R/W
RY
SHA_M_7_REG Message 0x009C R/W
SHA_M_8_REG Message 0x00A0 R/W
A
SHA_M_11_REG Message 0x00AC R/W
SHA_M_12_REG Message 0x00B0 R/W
SHA_M_13_REG
SHA_M_14_REG
Message
Message
IN 0x00B4
0x00B8
R/W
R/W
SHA_M_15_REG Message 0x00BC R/W
SHA_M_16_REG Message 0x00C0 R/W
IM
SHA_M_19_REG Message 0x00CC R/W
SHA_M_20_REG Message 0x00D0 R/W
EL

SHA_M_23_REG Message 0x00DC R/W
SHA_M_24_REG Message 0x00E0 R/W
PR
SHA_M_27_REG Message 0x00EC R/W

SHA_M_28_REG Message 0x00F0 R/W
SHA_M_31_REG Message 0x00FC R/W
14.6 Registers
The addresses in this section are relative to the SHA accelerator base address provided in Table 3-4 in Chapter 3
System and Memory.

Register 14.1. SHA_START_REG (0x0010)
T
AR
d)
ST
ve
A_
r
se
SH
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SHA_START Write 1 to start Typical SHA calculation. (WO)
Register 14.2. SHA_CONTINUE_REG (0x0014)
RY
UE
IN
NT
d)
CO
e
rv
A_
se
SH
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
A
SHA_CONTINUE Write 1 to continue Typical SHA calculation. (WO)
IN
Register 14.3. SHA_BUSY_REG (0x0018)
TE
TA
IM
_S
SY
d )
BU
ve
A_
ser
SH
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
EL
SHA_BUSY_STATE Indicates the states of SHA accelerator. (RO) 1’h0: idle 1’h1: busy
Register 14.4. SHA_DMA_START_REG (0x001C)

PR
T
AR
ST
A_
)
ed
DM
rv
A_
se
SH
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SHA_DMA_START Write 1 to start DMA-SHA calculation. (WO)

Register 14.5. SHA_DMA_CONTINUE_REG (0x0020)
UE
IN
NT
CO
A_
d)
DM
ve
A_
ser
SH
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SHA_DMA_CONTINUE Write 1 to continue DMA-SHA calculation. (WO)
RY
Register 14.6. SHA_INT_CLEAR_REG (0x0024)
T
UP
RR
TE
IN
R_
EA
d )
CL
A
ve
A_
r
se
SH
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SHA_CLEAR_INTERRUPT Clears DMA-SHA interrupt. (WO)

IN
IM
Register 14.7. SHA_INT_ENA_REG (0x0028)
NA
_E
PT
RU
ER
d)
T
EL
ve
IN
A_
r
se
SH
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SHA_INTERRUPT_ENA Enables DMA-SHA interrupt. (R/W)

PR
Register 14.8. SHA_DATE_REG (0x002C)

E
AT
)
ed
_D
rv
se
A
SH
(re
31 30 29 0
0 0 0x20190402 Reset
SHA_DATE Version control register. (R/W)

Register 14.9. SHA_MODE_REG (0x0000)
DE
)
O
ed
M
rv
A_
se
SH
(re
31 3 2 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
SHA_MODE Defines the SHA algorithm. For details, please see Table 14-2. (R/W)
Register 14.10. SHA_T_STRING_REG (0x0004)
RY
NG
RI
ST
T_
A_
SH
31 0
0x000000 Reset
A
SHA_T_STRING Defines t_string for calculating the initial Hash value for SHA-512/t. (R/W)
IN
Register 14.11. SHA_T_LENGTH_REG (0x0008)
TH
NG
IM
LE
)
ed
T_
rv
A_
se
SH
(re
31 6 5 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
EL
SHA_T_LENGTH Defines t_length for calculating the initial Hash value for SHA-512/t. (R/W)
Register 14.12. SHA_DMA_BLOCK_NUM_REG (0x000C)

PR
UM
_N
CK
B LO
A_
d)
DM
e
rv
A_
se
SH
(re
31 6 5 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
SHA_DMA_BLOCK_NUM Defines the DMA-SHA block number. (R/W)

Register 14.13. SHA_H_n_REG (n: 015) (0x0040+4*n)
n
H_
A_
SH
31 0
0x000000 Reset
SHA_H_n Stores the nth 32-bit piece of the Hash value. (R/W)
Register 14.14. SHA_M_n_REG (n: 031) (0x0080+4*n)
RY
_n
M
A_
SH
31 0
0x000000 Reset
SHA_M_n Stores the nth 32-bit piece of the message. (R/W)
A
IN
IM
EL
PR

15 AES Accelerator (AES)
15.1 Introduction
ESP32-S3 integrates an Advanced Encryption Standard (AES) Accelerator, which is a hardware device that
speeds up AES Algorithm significantly, compared to AES algorithms implemented solely in software. The AES
Accelerator integrated in ESP32-S3 has two working modes, which are Typical AES and DMA-AES.
15.2 Features
RY
• Typical AES working mode
– AES-128/AES-256 encryption and decryption
• DMA-AES working mode
– AES-128/AES-256 encryption and decryption
A
– Block cipher mode
* ECB (Electronic Codebook)
* CBC (Cipher Block Chaining)

IN
* OFB (Output Feedback)
* CTR (Counter)
IM
* CFB8 (8-bit Cipher Feedback)
* CFB128 (128-bit Cipher Feedback)
– Interrupt on completion of computation

EL
15.3 AES Working Modes

The AES Accelerator integrated in ESP32-S3 has two working modes, which are Typical AES and
DMA-AES.
• Typical AES Working Mode:

PR
– Supports encryption and decryption using cryptographic keys of 128 and 256 bits, specified in NIST
FIPS 197.
In this working mode, the plaintext and ciphertext is written and read via CPU directly.
• DMA-AES Working Mode:
– Supports encryption and decryption using cryptographic keys of 128 and 256 bits, specified in NIST
FIPS 197;
– Supports block cipher modes ECB/CBC/OFB/CTR/CFB8/CFB128 under NIST SP 800-38A.
In this working mode, the plaintext and ciphertext is written and read via DMA. An interrupt will be
generated when operation completes.

Users can choose the working mode for AES accelerator by configuring the AES_DMA_ENABLE_REG register
according to Table 15-1 below.
Table 151. AES Accelerator Working Mode
AES_DMA_ENABLE_REG Working Mode

0 Typical AES
1 DMA-AES
Users can choose the length of cryptographic keys and encryption / decryption by configuring the
AES_MODE_REG register according to Table 15-2 below.
RY
Table 152. Key Length and Encryption / Decryption
AES_MODE_REG[2:0] Key Length and Encryption / Decryption

0 AES-128 encryption
1 reserved
2 AES-256 encryption
A
3 reserved
4 AES-128 decryption
5 reserved
6
7
IN
AES-256 decryption
reserved
IM
For detailed introduction on these two working modes, please refer to Section 15.4 and Section 15.5
below.
Notice: ESP32-S3’s Digital Signature (DS) module will call the AES accelerator. Therefore, users cannot
access the AES accelerator when Digital Signature (DS) module is working.
EL
15.4 Typical AES Working Mode

In the Typical AES working mode, users can check the working status of the AES accelerator by inquiring the
AES_STATE_REG register and comparing the return value against the Table 15-3 below.
PR
Table 153. Working Status under Typical AES Working Mode
AES_STATE_REG Status Description

0 IDLE The AES accelerator is idle or completed operation.
1 WORK The AES accelerator is in the middle of an operation.
15.4.1 Key, Plaintext, and Ciphertext

The encryption or decryption key is stored in AES_KEY_n_REG, which is a set of eight 32-bit registers.
• For AES-128 encryption/decryption, the 128-bit key is stored in AES_KEY_0_REG ~ AES_KEY_3_REG.
• For AES-256 encryption/decryption, the 256-bit key is stored in AES_KEY_0_REG ~ AES_KEY_7_REG.

The plaintext and ciphertext are stored in AES_TEXT_IN_m_REG and AES_TEXT_OUT_m_REG, which are two
sets of four 32-bit registers.
• For AES-128/AES-256 encryption, the AES_TEXT_IN_m_REG registers are initialized with plaintext. Then,
the AES Accelerator stores the ciphertext into AES_TEXT_OUT_m_REG after operation.
• For AES-128/AES-256 decryption, the AES_TEXT_IN_m_REG registers are initialized with ciphertext. Then,
the AES Accelerator stores the plaintext into AES_TEXT_OUT_m_REG after operation.
15.4.2 Endianness
Text Endianness
In Typical AES working mode, the AES Accelerator uses cryptographic keys to encrypt and decrypt data in
RY
blocks of 128 bits. When filling data into AES_TEXT_IN_m_REG register or reading result from
AES_TEXT_OUT_m_REG registers, users should follow the text endianness type specified in Table 15-4.
Table 154. Text Endianness Type for Typical AES
Plaintext/Ciphertext
A
c2
State1
0 1 2 3
0 AES_TEXT_x_0_REG[7:0] AES_TEXT_x_1_REG[7:0] AES_TEXT_x_2_REG[7:0] AES_TEXT_x_3_REG[7:0]
r
1
2
AES_TEXT_x_0_REG[15:8]
IN
3 AES_TEXT_x_0_REG[31:24] AES_TEXT_x_1_REG[31:24] AES_TEXT_x_2_REG[31:24] AES_TEXT_x_3_REG[31:24]
1
The definition of “State (including c and r)” is described in Section 3.4 The State in NIST FIPS 197.
IM
2
Where x = IN or OUT.
Key Endianness
In Typical AES working mode, When filling key into AES_KEY_m_REG registers, users should follow the key
EL
endianness type specified in Table 15-5 and Table 15-6.
Table 155. Key Endianness Type for AES128 Encryption and Decryption
Bit1 w[0] w[1] w[2] w[3]2

[31:24] AES_KEY_0_REG[7:0] AES_KEY_1_REG[7:0] AES_KEY_2_REG[7:0] AES_KEY_3_REG[7:0]
PR

1
Column “Bit” specifies the bytes of each word stored in w[0] ~ w[3].
2
w[0] ~ w[3] are “the first Nk words of the expanded key” as specified in Section 5.2 Key Expansion in NIST FIPS 197.

Espressif Systems
15
Table 156. Key Endianness Type for AES256 Encryption and Decryption
AES Accelerator (AES)

Bit1 w[0] w[1] w[2] w[3] w[4] w[5] w[6] w[7]2
[31:24] AES_KEY_0_REG[7:0] AES_KEY_1_REG[7:0] AES_KEY_2_REG[7:0] AES_KEY_3_REG[7:0] AES_KEY_4_REG[7:0] AES_KEY_5_REG[7:0] AES_KEY_6_REG[7:0] AES_KEY_7_REG[7:0]
PR
1
Column “Bit” specifies the bytes of each word stored in w[0] ~ w[7].
2
w[0] ~ w[7] are “the first Nk words of the expanded key” as specified in Chapter 5.2 Key Expansion in NIST FIPS 197.
EL
359
IM
IN
A RY
15.4.3 Operation Process

Single Operation
1. Write 0 to the AES_DMA_ENABLE_REG register.
2. Initialize registers AES_MODE_REG, AES_KEY_n_REG, AES_TEXT_IN_m_REG.
3. Start operation by writing 1 to the AES_TRIGGER_REG register.
4. Wait till the content of the AES_STATE_REG register becomes 0, which indicates the operation is
completed.
5. Read results from the AES_TEXT_OUT_m_REG register.
RY
Consecutive Operations
In consecutive operations, primarily the input AES_TEXT_IN_m_REG and output AES_TEXT_OUT_m_REG

registers are being written and read, while the content of AES_DMA_ENABLE_REG, AES_MODE_REG,
AES_KEY_n_REG is kept unchanged. Therefore, the initialization can be simplified during the consecutive
operation.
A
1. Write 0 to the AES_DMA_ENABLE_REG register before starting the first operation.
2. Initialize registers AES_MODE_REG and AES_KEY_n_REG before starting the first operation.
IN
3. Update the content of AES_TEXT_IN_m_REG.
5. Wait till the content of the AES_STATE_REG register becomes 0, which indicates the operation completes.
IM
6. Read results from the AES_TEXT_OUT_m_REG register, and return to Step 3 to continue the next
operation.
15.5 DMAAES Working Mode

EL
In the DMA-AES working mode, the AES accelerator supports six block cipher modes including
ECB/CBC/OFB/CTR/CFB8/CFB128. Users can choose the block cipher mode by configuring the
AES_BLOCK_MODE_REG register according to Table 15-7 below.
Table 157. Block Cipher Mode

PR
AES_BLOCK_MODE_REG[2:0] Block Cipher Mode

0 ECB (Electronic Codebook)
1 CBC (Cipher Block Chaining)
2 OFB (Output Feedback)
3 CTR (Counter)
4 CFB8 (8-bit Cipher Feedback)
5 CFB128 (128-bit Cipher Feedback)
6 reserved
7 reserved
Users can check the working status of the AES accelerator by inquiring the AES_STATE_REG register and
comparing the return value against the Table 15-8 below.

Table 158. Working Status under DMAAES Working mode
AES_STATE_REG[1:0] Status Description

0 IDLE The AES accelerator is idle.
1 WORK The AES accelerator is in the middle of an operation.
2 DONE The AES accelerator completed operations.
When working in the DMA-AES working mode, the AES accelerator supports interrupt on the completion of
computation. To enable this function, write 1 to the AES_INT_ENA_REG register. By default, the interrupt
function is disabled. Also, note that the interrupt should be cleared by software after use.
RY
15.5.1 Key, Plaintext, and Ciphertext
Block Operation
During the block operations, the AES Accelerator reads source data from DMA, and write result data to DMA
after the computation.
A
• For encryption, DMA reads plaintext from memory, then passes it to AES as source data. After
computation, AES passes ciphertext as result data back to DMA to write into memory.
• For decryption, DMA reads ciphertext from memory, then passes it to AES as source data. After
IN
computation, AES passes plaintext as result data back to DMA to write into memory.
During block operations, the lengths of the source data and result data are the same. The total computation time
is reduced because the DMA data operation and AES computation can happen concurrently.
IM
The length of source data for AES Accelerator under DMA-AES working mode must be 128 bits or the integral
multiples of 128 bits. Otherwise, trailing zeros will be added to the original source data, so the length of source
data equals to the nearest integral multiples of 128 bits. Please see details in Table 15-9 below.
Table 159. TEXTPADDING

EL
Function : TEXTPADDING( )
Input : X, bit string.
Output : Y = TEXTPADDING(X), whose length is the nearest integral multiples of 128 bits.
Steps
Let us assume that X is a data-stream that can be split into n parts as following:
PR
X = X1 ||X2 || · · · ||Xn−1 ||Xn

Here, the lengths of X1 , X2 , · · · , Xn−1 all equal to 128 bits, and the length of Xn is t
(0<=t<=127).
If t = 0, then
TEXTPADDING(X) = X;
If 0 < t <= 127, define a 128-bit block, Xn∗ , and let Xn∗ = Xn ||0128−t , then
TEXTPADDING(X) = X1 ||X2 || · · · ||Xn−1 ||Xn∗ = X||0128−t
15.5.2 Endianness
Under the DMA-AES working mode, the transmission of source data and result data for AES Accelerator is solely
controlled by DMA. Therefore, the AES Accelerator cannot control the Endianness of the source data and result

data, but does have requirement on how these data should be stored in memory and on the length of the
data.
For example, let us assume DMA needs to write the following data into memory at address 0x0280.
• Data represented in hexadecimal:
– 0102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F20
• Data Length:
– Equals to 2 blocks.
Then, this data will be stored in memory as shown in Table 15-10 below.
RY
Table 1510. Text Endianness for DMAAES
Address Byte Address Byte Address Byte Address Byte

0x0280 0x01 0x0281 0x02 0x0282 0x03 0x0283 0x04
0x0284 0x05 0x0285 0x06 0x0286 0x07 0x0287 0x08
0x0288 0x09 0x0289 0x0A 0x028A 0x0B 0x028B 0x0C
A
0x028C 0x0D 0x028D 0x0E 0x028E 0x0F 0x028F 0x10
0x0290 0x11 0x0291 0x12 0x0292 0x13 0x0293 0x14
0x0294 0x15 0x0295 0x16 0x0296 0x17 0x0297 0x18
0x0298
0x029C
0x19
0x1D
0x0299
0x029D
IN
0x1A
0x1E
0x029A
0x029E
0x1B
0x1F
0x029B
0x029F
0x1C
0x20
DMA can access both internal memory and PSRAM outside ESP32-S3. When you use DMA to access external
IM
PSRAM, please use base addresses that meet the requirements for DMA. When you use DMA to access internal
memory, base addresses do not have such requirements. Details can be found in Chapter 2 GDMA Controller
(GDMA).
EL
15.5.3 Standard Incrementing Function

AES accelerator provides two Standard Incrementing Functions for the CTR block operation, which are INC32
and INC128 Standard Incrementing Functions. By setting the AES_INC_SEL_REG register to 0 or 1, users can
choose the INC32 or INC128 functions respectively. For details on the Standard Incrementing Function, please see
Chapter B.1 The Standard Incrementing Function in NIST SP 800-38A.
PR
15.5.4 Block Number

Register AES_BLOCK_NUM_REG stores the Block Number of plaintext P or ciphertext C. The length of this
register equals to length(TEXTPADDING(P ))/128 or length(TEXTPADDING(C))/128. The AES Accelerator only
uses this register when working in the DMA-AES mode.
15.5.5 Initialization Vector

AES_IV_MEM is a 16-byte memory, which is only available for AES Accelerator working in block operations. For
CBC/OFB/CFB8/CFB128 operations, the AES_IV_MEM memory stores the Initialization Vector (IV). For the CTR
operation, the AES_IV_MEM memory stores the Initial Counter Block (ICB).

Both IV and ICB are 128-bit strings, which can be divided into Byte0, Byte1, Byte2 · · · Byte15 (from left to right).
AES_IV_MEM stores data following the Endianness pattern presented in Table 15-10, i.e. the most significant
(i.e., left-most) byte Byte0 is stored at the lowest address while the least significant (i.e., right-most) byte Byte15
at the highest address.
For more details on IV and ICB, please refer to NIST SP 800-38A.
15.5.6 Block Operation Process

1. Select one of DMA channels to connect with AES, configure the DMA chained list, and then start DMA. For
details, please refer to Chapter 2 GDMA Controller (GDMA).
2. Initialize the AES accelerator-related registers:
RY
• Write 1 to the AES_DMA_ENABLE_REG register.
• Configure the AES_INT_ENA_REG register to enable or disable the interrupt function.
• Initialize registers AES_MODE_REG and AES_KEY_n_REG.
• Select block cipher mode by configuring the AES_BLOCK_MODE_REG register. For details, see Table
A
15-7.
• Initialize the AES_BLOCK_NUM_REG register. For details, see Section 15.5.4.

IN
• Initialize the AES_INC_SEL_REG register (only needed when AES Accelerator is working under CTR
block operation).
• Initialize the AES_IV_MEM memory (This is always needed except for ECB block operation).

IM
4. Wait for the completion of computation, which happens when the content of AES_STATE_REG becomes 2
or the AES interrupt occurs.
5. Check if DMA completes data transmission from AES to memory. At this time, DMA had already written the
result data in memory, which can be accessed directly. For details on DMA, please refer to Chapter 2
EL
GDMA Controller (GDMA).
6. Clear interrupt by writing 1 to the AES_INT_CLR_REG register, if any AES interrupt occurred during the
computation.
7. Release the AES Accelerator by writing 0 to the AES_DMA_EXIT_REG register. After this, the content of the
PR
AES_STATE_REG register becomes 0. Note that, you can release DMA earlier, but only after Step 4 is
completed.
15.6 Memory Summary

The addresses in this section are relative to the AES accelerator base address provided in Table 3-4 in Chapter 3
System and Memory.
Name Description Size (byte) Starting Address Ending Address Access

AES_IV_MEM Memory IV 16 bytes 0x0050 0x005F R/W


System and Memory.

Key Registers
AES_KEY_0_REG AES key register 0 0x0000 R/W
AES_KEY_3_REG AES key register 3 0x000C R/W
RY
AES_KEY_7_REG AES key register 7 0x001C R/W
TEXT_IN Registers
AES_TEXT_IN_0_REG Source data register 0 0x0020 R/W
A
AES_TEXT_IN_3_REG Source data register 3 0x002C R/W
TEXT_OUT Registers
AES_TEXT_OUT_0_REG
IN
Result data register 0 0x0030 RO
AES_TEXT_OUT_1_REG Result data register 1 0x0034 RO
AES_TEXT_OUT_2_REG Result data register 2 0x0038 RO
IM
AES_TEXT_OUT_3_REG Result data register 3 0x003C RO
AES_MODE_REG Defines key length and encryption / decryp- 0x0040 R/W
tion
AES_DMA_ENABLE_REG Selects the working mode of the AES accel- 0x0090 R/W
EL
erator
AES_BLOCK_MODE_REG Defines the block cipher mode 0x0094 R/W
AES_BLOCK_NUM_REG Block number configuration register 0x0098 R/W
AES_INC_SEL_REG Standard incrementing function register 0x009C R/W
Controlling / Status Registers
PR
AES_TRIGGER_REG Operation start controlling register 0x0048 WO

AES_STATE_REG Operation status register 0x004C RO
AES_DMA_EXIT_REG Operation exit controlling register 0x00B8 WO
Interruption Registers
AES_INT_CLR_REG DMA-AES interrupt clear register 0x00AC WO
AES_INT_ENA_REG DMA-AES interrupt enable register 0x00B0 R/W

15.8 Registers
System and Memory.
Register 15.1. AES_KEY_n_REG (n: 07) (0x0000+4*n)
31 0
0x000000000 Reset
AES_KEY_n_REG (n: 07) Stores AES keys. (R/W)
RY
Register 15.2. AES_TEXT_IN_m_REG (m: 03) (0x0020+4*m)
31 0
0x000000000 Reset
A
AES_TEXT_IN_m_REG (m: 03) Stores the source data when the AES Accelerator operates in the
Typical AES working mode. (R/W) IN
Register 15.3. AES_TEXT_OUT_m_REG (m: 03) (0x0030+4*m)
31 0
IM
0x000000000 Reset
AES_TEXT_OUT_m_REG (m: 03) Stores the result data when the AES Accelerator operates in the
Typical AES working mode. (RO)
EL
Register 15.4. AES_MODE_REG (0x0040)

DE
d)
O
e
M
rv
S_
se
AE
(re
PR
31 3 2 0
0x00000000 0 Reset
AES_MODE Defines the key length and encryption / decryption of the AES Accelerator. For details,
see Table 15-2. (R/W)

Register 15.5. AES_DMA_ENABLE_REG (0x0090)
LE
AB
EN
A_
d)
DM
ve
r
S_
se
AE
(re
31 1 0
0x00000000 0 Reset
AES_DMA_ENABLE Defines the working mode of the AES Accelerator. 0: Typical AES, 1: DMA-AES.
For details, see Table 15-1. (R/W)
RY
Register 15.6. AES_BLOCK_MODE_REG (0x0094)
DE
O
_M
CK
O
d)
BL
e
rv
A
S_
se
AE
(re
31 3 2 0
0x00000000 0 Reset
IN
AES_BLOCK_MODE Defines the block cipher mode of the AES Accelerator operating under the
DMA-AES working mode. For details, see Table 15-7. (R/W)
IM
Register 15.7. AES_BLOCK_NUM_REG (0x0098)
31 0
0x00000000 Reset
EL
AES_BLOCK_NUM Stores the Block Number of plaintext or ciphertext when the AES Accelerator
operates under the DMA-AES working mode. For details, see Section 15.5.4. (R/W)
PR
Register 15.8. AES_INC_SEL_REG (0x009C)

L
SE
C_
)
ed
IN
rv
S_
se
AE
(re
31 1 0
0x00000000 0 Reset
AES_INC_SEL Defines the Standard Incrementing Function for CTR block operation. Set this bit to
0 or 1 to choose INC32 or INC128 . (R/W)

Register 15.9. AES_TRIGGER_REG (0x0048)
ER
G
IG
d)
TR
ve
r
S_
se
AE
(re
31 1 0
0x00000000 x Reset
AES_TRIGGER Set this bit to 1 to start AES operation. (WO)
Register 15.10. AES_STATE_REG (0x004C)
RY
E
AT
)
ed
ST
rv
S_
se
AE
(re
31 2 1 0
0x00000000 0x0 Reset
A
AES_STATE Stores the working status of the AES Accelerator. For details, see Table 15-3 for Typical
AES working mode and Table 15-8 for DMA AES working mode. (RO)
IN
Register 15.11. AES_DMA_EXIT_REG (0x00B8)
IT
IM
EX
A_
d)
DM
r ve
S_
se
AE
(re
31 1 0
0x00000000 x Reset
EL
AES_DMA_EXIT Set this bit to 1 to exit AES operation. This register is only effective for DMA-AES
operation. (WO)
Register 15.12. AES_INT_CLR_REG (0x00AC)

PR
LR
_C
)
ed
NT
rv
I
S_
se
AE
(re
31 1 0
0x00000000 x Reset
AES_INT_CLR Set this bit to 1 to clear AES interrupt. (WO)

Register 15.13. AES_INT_ENA_REG (0x00B0)
A
EN
T_
d)
ve
IN
r
S_
se
AE
(re
31 1 0
0x00000000 0 Reset
AES_INT_ENA Set this bit to 1 to enable AES interrupt and 0 to disable interrupt. (R/W)
A RY
IN
IM
EL
PR

16 RSA Accelerator (RSA)
16.1 Introduction
The RSA Accelerator provides hardware support for high precision computation used in various RSA asymmetric
cipher algorithms by significantly reducing their software complexity. Compared with RSA algorithms
implemented solely in software, this hardware accelerator can speed up RSA algorithms significantly. Besides,
the RSA Accelerator also supports operands of different lengths, which provides more flexibility during the
computation.
16.2 Features
RY
• Large-number modular exponentiation with two optional acceleration options
• Large-number modular multiplication
• Large-number multiplication
A
• Operands of different lengths
• Interrupt on completion of computation

IN
The RSA Accelerator is activated by setting the SYSTEM_CRYPTO_RSA_CLK_EN bit in the
IM
SYSTEM_PERIP_CLK_EN1_REG register and clearing the SYSTEM_RSA_MEM_PD bit in the
SYSTEM_RSA_PD_CTRL_REG register. This releases the RSA Accelerator from reset.
The RSA Accelerator is only available after the RSA-related memories are initialized. The content of the
RSA_CLEAN_REG register is 0 during initialization and will become 1 after the initialization is done. Therefore, it is
EL
advised to wait until RSA_CLEAN_REG becomes 1 before using the RSA Accelerator.
The RSA_INTERRUPT_ENA_REG register is used to control the interrupt triggered on completion of

computation. Write 1 or 0 to this register to enable or disable interrupt. By default, the interrupt function of the
RSA Accelerator is enabled.
PR
Notice:
ESP32-S3’s Digital Signature (DS) module also calls the RSA accelerator. Therefore, users cannot access the
RSA accelerator when Digital Signature (DS) is working.
16.3.1 Large Number Modular Exponentiation

Large-number modular exponentiation performs Z = X Y mod M . The computation is based on Montgomery
multiplication. Therefore, aside from the X, Y , and M arguments, two additional ones are needed — r and M ′ ,
which need to be calculated in advance by software.
RSA Accelerator supports operands of length N = 32 × x, where x ∈ {1, 2, 3, . . . , 128}. The bit lengths of
arguments Z, X, Y , M , and r can be arbitrary N , but all numbers in a calculation must be of the same length.

The bit length of M ′ must be 32.
To represent the numbers used as operands, let us define a base-b positional notation, as follows:
b = 232
Using this notation, each number is represented by a sequence of base-b digits:

N
n=
32
Z = (Zn−1 Zn−2 · · · Z0 )b
X = (Xn−1 Xn−2 · · · X0 )b
Y = (Yn−1 Yn−2 · · · Y0 )b
RY
M = (Mn−1 Mn−2 · · · M0 )b
r = (rn−1 rn−2 · · · r0 )b
Each of the n values in Zn−1 · · · Z0 , Xn−1 · · · X0 , Yn−1 · · · Y0 , Mn−1 · · · M0 , rn−1 · · · r0 represents one base-b
digit (a 32-bit word).
A
Zn−1 , Xn−1 , Yn−1 , Mn−1 and rn−1 are the most significant bits of Z, X, Y , M , while Z0 , X0 , Y0 , M0 and r0 are
the least significant bits.
If we define R = bn , the additional arguments can be calculated as r = R2 mod M .

IN
The following equation in the form compatible with the extended binary GCD algorithm can be written as�
M −1 × M + 1 = R × R−1
IM
M ′ = M −1 mod b
Large-number modular exponentiation can be implemented as follows:

EL
1. Write 1 or 0 to the RSA_INTERRUPT_ENA_REG register to enable or disable the interrupt function.
2. Configure relevant registers:

N
(a) Write ( 32 − 1) to the RSA_MODE_REG register.
(b) Write M ′ to the RSA_M_PRIME_REG register.

PR
(c) Configure registers related to the acceleration options, which are described later in Section 16.3.4.
3. Write Xi , Yi , Mi and ri for i ∈ {0, 1, . . . , n − 1} to memory blocks RSA_X_MEM, RSA_Y_MEM,

RSA_M_MEM and RSA_Z_MEM. The capacity of each memory block is 128 words. Each word of each
memory block can store one base-b digit. The memory blocks use the little endian format for storage, i.e.
the least significant digit of each number is in the lowest address.
Users need to write data to each memory block only according to the length of the number; data beyond
this length are ignored.
4. Write 1 to the RSA_MODEXP_START_REG register to start computation.
5. Wait for the completion of computation, which happens when the content of RSA_IDLE_REG becomes 1
or the RSA interrupt occurs.

6. Read the result Zi for i ∈ {0, 1, . . . , n − 1} from RSA_Z_MEM.
7. Write 1 to RSA_CLEAR_INTERRUPT_REG to clear the interrupt, if you have enabled the interrupt function.
After the computation, the RSA_MODE_REG register, memory blocks RSA_Y_MEM and RSA_M_MEM, as well
as the RSA_M_PRIME_REG remain unchanged. However, Xi in RSA_X_MEM and ri in RSA_Z_MEM
computation are overwritten, and only these overwritten memory blocks need to be re-initialized before starting
another computation.
16.3.2 Large Number Modular Multiplication

Large-number modular multiplication performs Z = X × Y mod M . This computation is based on Montgomery
multiplication. Therefore, similar to the large number modular exponentiation, two additional arguments are
RY
needed – r and M ′ , which need to be calculated in advance by software.
The RSA Accelerator supports large-number modular multiplication with operands of 128 different lengths.
The computation can be executed as follows:
A
2. Configure relevant registers:
N
(a) Write ( 32 − 1) to the RSA_MODE_REG register.IN
(b) Write M ′ to the RSA_M_PRIME_REG register.
3. Write Xi , Yi , Mi , and ri for i ∈ {0, 1, . . . , n − 1} to memory blocks RSA_X_MEM, RSA_Y_MEM,

RSA_M_MEM and RSA_Z_MEM. The capacity of each memory block is 128 words. Each word of each
memory block can store one base-b digit. The memory blocks use the little endian format for storage, i.e.
IM
the least significant digit of each number is in the lowest address.
4. Write 1 to the RSA_MODMULT_START_REG register.

EL
6. Read the result Zi for i ∈ {0, 1, . . . , n − 1} from RSA_Z_MEM.
PR
After the computation, the length of operands in RSA_MODE_REG, the Xi in memory RSA_X_MEM, the Yi in
memory RSA_Y_MEM, the Mi in memory RSA_M_MEM, and the M ′ in memory RSA_M_PRIME_REG remain
unchanged. However, the ri in memory RSA_Z_MEM has already been overwritten, and only this overwritten
memory block needs to be re-initialized before starting another computation.
16.3.3 Large Number Multiplication

Large-number multiplication performs Z = X × Y . The length of result Z is twice that of operand X and operand
Y . Therefore, the RSA Accelerator only supports Large Number Multiplication with operand length N = 32 × x,
where x ∈ {1, 2, 3, . . . , 64}. The length N̂ of result Z is 2 × N .
The computation can be executed as follows:


N̂
2. Write ( 32 − 1), i.e. ( 16
N
− 1) to the RSA_MODE_REG register.
3. Write Xi and Yi for ∈ {0, 1, . . . , n − 1} to memory blocks RSA_X_MEM and RSA_Z_MEM. The capacity of
each memory block is 64 words. Each word of each memory block can store one base-b digit. The
memory blocks use the little endian format for storage, i.e. the least significant digit of each number is in
N
the lowest address. n is 32 .
Write Xi for i ∈ {0, 1, . . . , n − 1} to the address of the i words of the RSA_X_MEM memory block. Note
that Yi for i ∈ {0, 1, . . . , n − 1} will not be written to the address of the i words of the RSA_Z_MEM register,
but the address of the n + i words, i.e. the base address of the RSA_Z_MEM memory plus the address
offset 4 × (n + i).
RY
4. Write 1 to the RSA_MULT_START_REG register.
A
6. Read the result Zi for i ∈ {0, 1, . . . , n̂ − 1} from the RSA_Z_MEM register. n̂ is 2 × n.
IN
After the computation, the length of operands in RSA_MODE_REG and the Xi in memory RSA_X_MEM remain
unchanged. However, the Yi in memory RSA_Z_MEM has already been overwritten, and only this overwritten
memory block needs to be re-initialized before starting another computation.
IM
16.3.4 Options for Acceleration
The ESP32-S3 RSA accelerator also provides SEARCH and CONSTANT_TIME options that can be configured to
accelerate the large-number modular exponentiation. By default, both options are configured for no acceleration.
Users can choose to use one or two of these options to accelerate the computation.
EL
To be more specific, when neither of these two options are configured for acceleration, the time required to
calculate Z = X Y mod M is solely determined by the lengths of operands. When either or both of these two
options are configured for acceleration, the time required is also correlated with the 0/1 distribution of Y .
To better illustrate how these two options work, first assume Y is represented in binaries as
PR
Y = (YeN −1 YeN −2 · · · Yet+1 Yet Yet−1 · · · Ye0 )2
where,
• N is the length of Y ,
• Yet is 1,
• YeN −1 , YeN −2 , …, Yet+1 are all equal to 0,
• and Yet−1 , Yet−2 , …, Ye0 are either 0 or 1 but exactly m bits should be equal to 0 and t-m bits 1, i.e. the
Hamming weight of Yet−1 Yet−2 , · · · , Ye0 is t − m.

When either of these two options is configured for acceleration:
• SEARCH Option (Configuring RSA_SEARCH_ENABLE to 1 for acceleration)
– The accelerator ignores the bit positions of Yei , where i > α. Search position α is set by configuring
the RSA_SEARCH_POS_REG register. The maximum value of α is N -1, which leads to the same
result when this option is not used for acceleration. The best acceleration performance can be
achieved by setting α to t, in which case, all the YeN −1 , YeN −2 , …, Yet+1 of 0s are ignored during the
calculation. Note that if you set α to be less than t, then the result of the modular exponentiation
Z = X Y mod M will be incorrect.
• CONSTANT_TIME Option (Configuring RSA_CONSTANT_TIME_REG to 0 for acceleration)
– The accelerator speeds up the calculation by simplifying the calculation concerning the 0 bits of Y .
RY
Therefore, the higher the proportion of bits 0 against bits 1, the better the acceleration performance is.
We provide an example to demonstrate the performance of the RSA Accelerator under different combinations of
SEARCH and CONSTANT_TIME configuration. Here we perform Z = X Y mod M with N = 3072 and Y =
65537. Table 16-1 below demonstrates the time costs under different combinations of SEARCH and
CONSTANT_TIME configuration. Here, we should also mention that, α is set to 16 when the SEARCH option is
A
enabled.
Table 161. Acceleration Performance
SEARCH Option
No acceleration
IN
CONSTANT_TIME Option
No acceleration
Time Cost (ms)
752.81
Accelerated No acceleration 4.52
No acceleration Acceleration 2.406
IM
Acceleration Acceleration 2.33
It’s obvious that:
• The time cost is the biggest when none of these two options is configured for acceleration.
EL
• The time cost is the smallest when both of these two options are configured for acceleration.
• The time cost can be dramatically reduced when either or both option(s) are configured for acceleration.
16.4 Memory Summary

PR
The addresses in this section are relative to the RSA accelerator base address provided in Table 3-4 in Chapter 3
System and Memory.
Table 162. RSA Accelerator Memory Blocks

RSA_M_MEM Memory M 512 0x0000 0x01FF WO
RSA_Z_MEM Memory Z 512 0x0200 0x03FF R/W
RSA_Y_MEM Memory Y 512 0x0400 0x05FF WO
RSA_X_MEM Memory X 512 0x0600 0x07FF WO


System and Memory.

RSA_M_PRIME_REG Register to store M’ 0x0800 R/W
RSA_MODE_REG RSA length mode 0x0804 R/W
RSA_CONSTANT_TIME_REG The constant_time option 0x0820 R/W
RSA_SEARCH_ENABLE_REG The search option 0x0824 R/W
RSA_SEARCH_POS_REG The search position 0x0828 R/W
RY
Status/Control Registers
RSA_CLEAN_REG RSA clean register 0x0808 RO
RSA_MODEXP_START_REG Modular exponentiation starting bit 0x080C WO
RSA_MODMULT_START_REG Modular multiplication starting bit 0x0810 WO
RSA_MULT_START_REG Normal multiplication starting bit 0x0814 WO
A
RSA_IDLE_REG RSA idle register 0x0818 RO
Interrupt Registers
RSA_CLEAR_INTERRUPT_REG RSA clear interrupt register 0x081C WO
RSA_INTERRUPT_ENA_REG
Version Register
IN
RSA interrupt enable register 0x082C R/W
RSA_DATE_REG Version control register 0x0830 R/W

IM
16.6 Registers
System and Memory.
EL
Register 16.1. RSA_M_PRIME_REG (0x0800)
31 0
0x000000000 Reset
RSA_M_PRIME_REG Stores M’.(R/W)

PR
Register 16.2. RSA_MODE_REG (0x0804)

DE
d)
O
ve
M
r
A_
se
RS
(re
31 7 6 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RSA_MODE Stores the mode of modular exponentiation. (R/W)

Register 16.3. RSA_CLEAN_REG (0x0808)
A N
LE
d)
ve
_C
r
se
A
RS
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RSA_CLEAN The content of this bit is 1 when memories complete initialization. (RO)
Register 16.4. RSA_MODEXP_START_REG (0x080C)
RY
T
R
TA
_S
XP
DE
)
O
d
ve
M
r
A_
se
RS
(re
31 1 0
A
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RSA_MODEXP_START Set this bit to 1 to start the modular exponentiation. (WO)

IN
Register 16.5. RSA_MODMULT_START_REG (0x0810)
IM
T
AR
ST
T_
UL
DM
d)
O
ve
M
r
A_
se
RS
(re
31 1 0
EL
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RSA_MODMULT_START Set this bit to 1 to start the modular multiplication. (WO)

PR
Register 16.6. RSA_MULT_START_REG (0x0814)

T
AR
ST
T_
UL
)
ed
M
rv
A_
se
RS
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RSA_MULT_START Set this bit to 1 to start the multiplication. (WO)

Register 16.7. RSA_IDLE_REG (0x0818)
E
d)
DL
ve
_I
r
se
A
RS
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RSA_IDLE The content of this bit is 1 when the RSA accelerator is idle. (RO)
Register 16.8. RSA_CLEAR_INTERRUPT_REG (0x081C)
RY
PT
RU
ER
T
IN
R_
EA
d)
CL
e
rv
A_
se
RS
(re
31 1 0
A
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RSA_CLEAR_INTERRUPT Set this bit to 1 to clear the RSA interrupts. (WO)

IN
Register 16.9. RSA_CONSTANT_TIME_REG (0x0820)
IM
E
M
TI
T_
N
TA
NS
d)
CO
rve
A_
se
RS
(re
31 1 0
EL
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 Reset
RSA_CONSTANT_TIME_REG Controls the constant_time option. 0: acceleration. 1: no accelera-

tion (by default). (R/W)
PR
Register 16.10. RSA_SEARCH_ENABLE_REG (0x0824)

E
BL
NA
_E
CH
AR
d)
SE
e
rv
A_
se
RS
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RSA_SEARCH_ENABLE Controls the search option. 0: no acceleration (by default). 1: acceleration.

(R/W)

Register 16.11. RSA_SEARCH_POS_REG (0x0828)
S
_PO
CH
AR
d)
SE
ver
A_
se
RS
(re
31 12 11 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x000 Reset
RSA_SEARCH_POS Is used to configure the starting address when the acceleration option of search
is used. (R/W)
RY
Register 16.12. RSA_INTERRUPT_ENA_REG (0x082C)
NA
_E
PT
RU
ER
d )
T
A
ve
IN
er
A_
s
RS
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 Reset
IN
RSA_INTERRUPT_ENA Set this bit to 1 to enable the RSA interrupt. This option is enabled by default.
(R/W)
IM
Register 16.13. RSA_DATE_REG (0x0830)
TE
)
ed
DA
rv
A_
se
EL
RS
(re
31 30 29 0
0 0 0x20190425 Reset
RSA_DATE Version control register. (R/W)

PR

17 HMAC Accelerator (HMAC)

The Hash-based Message Authentication Code (HMAC) module computes Message Authentication Codes
(MACs) using Hash algorithm and keys as described in RFC 2104. The underlying hash algorithm is SHA-256,
and the 256-bit HMAC key is stored in an eFuse key block and can be set as read-protected for users.
17.1 Main Features

• Standard HMAC-SHA-256 algorithm
• Hash result only accessible by configurable hardware peripheral (in downstream mode)
RY
• Compatible to challenge-response authentication algorithm
• Generates required keys for the Digital Signature (DS) peripheral (in downstream mode)
• Re-enables soft-disabled JTAG (in downstream mode)
A
The HMAC module operates in two modes: upstream mode and downstream mode. In upstream mode, the
HMAC message is provided by the user and the calculation result is read back by the user; in downstream mode,
IN
the HMAC module is used as a Key Derivation Function (KDF) for other internal hardware. For instance, the JTAG
can be temporarily disabled by burning odd number bits of EFUSE_SOFT_DIS_JTAG in eFuse. In this case,
users can temporarily re-enable JTAG using the HMAC module in downstream mode.
After the reset signal being released, the HMAC module will check whether the DS key exists in the eFuse. If the
IM
key exists, the HMAC module will enter downstream digital signature mode and finish the DS key calculation
automatically.
17.2.1 Upstream Mode

EL
Common use cases for the upstream mode are challenge-response protocols supporting HMAC-SHA-256
algorithm. In upstream mode, the user should provide the related HMAC information and read back its
calculation results.
Assume the two entities in the challenge-response protocol are A and B respectively, and the entities share the
same secret KEY. The data message they expect to exchange is M. The general process of this protocol is as
PR
follows:
• A calculates a unique random number M
• A sends M to B
• B calculates the HMAC value (through M and KEY) and sends the result to A
• A also calculates the HMAC value (through M and KEY) internally
• A compares these two values. If they are the same, then the identity of B is authenticated
To calculate the HMAC value (the following steps should be done by the user):
1. Initialize the HMAC module, and enter upstream mode.
2. Write the correctly padded message to the HMAC, one block at a time.

3. Read back the result from HMAC.
For details of this process, please see Section 17.2.6.
17.2.2 Downstream JTAG Enable Mode

There are two parameters in the eFuse memory to disable JTAG debugging, namely EFUSE_DIS_PAD_JTAG and
EFUSE_SOFT_DIS_JTAG. Set EFUSE_DIS_PAD_JTAG to 1 can disable JTAG permanently, and set odd numbers
of 1 to EFUSE_SOFT_DIS_JTAG can disable JTAG temporarily. For more details, please see Chapter 4 eFuse
Controller.
To re-enable the temporarily disabled JTAG, users can follow the steps below:
1. Enable the HMAC module and enter downstream JTAG enable mode.
RY
2. Write 1 to the HMAC_SOFT_JTAG_CTRL_REG register to enter JTAG re-enable compare mode.
3. Write the 256-bit HMAC value which is calculated locally from the 32-byte 0x00 using HMAC-SHA-256
algorithm and the pre-generated key to register HMAC_WR_JTAG_REG, in big-endian order of word.
4. If the HMAC internally calculated value matches the value that user programmed, then JTAG is re-enabled.
A
Otherwise, JTAG remains disabled.
5. JTAG remains in the status as in step 4 until the user writes 1 to register
HMAC_SET_INVALIDATE_JTAG_REG or restart JTAG.
IN
For detailed steps of this process, please see Section 17.2.6.
17.2.3 Downstream Digital Signature Mode

IM
The Digital Signature (DS) module encrypts its parameters using AES-CBC algorithm. The HMAC module is used
as a Key Derivation Function (KDF) to derive the AES key to decrypt these parameters.
Before starting the DS module, the user needs to obtain the key for it first through HMAC calculation. For more
information, please see Chapter 18 Digital Signature (DS). After the clock of HMAC be enabled and reset of
EL
HMAC be released, the HMAC module will check to see if there is a functional key in eFuses for the DS module.
If yes, HMAC will enter downstream digital signature mode and finish DS key calculation automatically.
17.2.4 HMAC eFuse Configuration

The HMAC module provides three different functionalities: re-enabling JTAG and serving as DS KDF in
PR
downstream mode as well as pure HMAC calculation in upstream mode. Table 17-1 lists the register value
corresponding to each purpose, which should be written to register HMAC_SET_PARA_PURPOSE_REG by the
user (see Section 17.2.6).

Table 171. HMAC Purposes and Configuration Values
Purpose Mode Value Description

JTAG Re-enable Downstream 6 EFUSE_KEY_PURPOSE_HMAC_DOWN_JTAG
DS Key Derivation Downstream 7 EFUSE_KEY_PURPOSE_HMAC_DOWN_DIGITAL_SIGNATURE
HMAC Calculation Upstream 8 EFUSE_KEY_PURPOSE_HMAC_UP
Both JTAG Re-enable Downstream 5 EFUSE_KEY_PURPOSE_HMAC_DOWN_ALL
and DS KDF
Before enabling HMAC to do calculations, user should make sure the key to be used has been burned in eFuse.
You can burn a key to eFuse as follows:
RY
1. Prepare a secret 256-bit HMAC key and burn the key to an empty eFuse block y (there are six blocks for
storing a key in eFuse. The numbers of those blocks range from 4 to 9, so y = 4,5,..,9. Hence, if we are
talking about key0, we mean eFuse block4), and then program the purpose to
EFUSE_KEY_PURPOSE_(y − 4). Take upstream mode as an example: after programming the key, the
user should program EFUSE_KEY_PURPOSE_HMAC_UP (corresponding value is 8) to
A
EFUSE_KEY_PURPOSE_(y − 4). Please see Chapter 4 eFuse Controller on how to program eFuse keys.
2. Configure this eFuse key block to be read protected, so that users cannot read its value. A copy of this key
should be kept by any party who needs to verify this device.
IN
17.2.5 HMAC Initialization
The eFuse key blocks (with correctly programmed purpose values) must be coordinated with the HMAC modes,
IM
or HMAC will terminate calculation.
Configure HMAC modes
The correct purpose (see Table 17-1) has to be written to register HMAC_SET_PARA_PURPOSE_REG by the
user.
EL
Select eFuse Key Blocks
The eFuse controller provides six key blocks, i.e., KEY0 ~ 5. To select a particular KEYn for a certain HMAC
calculation, write the key number n to register HMAC_SET_PARA_KEY_REG.
Note that the purpose of the key has also been programmed to eFuse memory. Only when the configured HMAC
PR
purpose matches the defined purpose of KEYn, will the HMAC module execute the configured calculation.
Otherwise, it will return a matching error and stop the current calculation. For example, suppose a user selects
KEY3 for HMAC calculation, and the value programmed to KEY_PURPOSE_3 is 6
(EFUSE_KEY_PURPOSE_HMAC_DOWN_JTAG). Based on Table 17-1, KEY3 can be used to re-enable JTAG. If
the value written to register HMAC_SET_PARA_PURPOSE_REG is also 6, then the HMAC module will start the
process to re-enable JTAG.
17.2.6 HMAC Process (Detailed)

The process to call HMAC in ESP32-S3 is as follows:
1. Enable HMAC module

(a) Set the peripheral clock bits for HMAC and SHA peripherals in SYSTEM_PEIRP_CLK_EN1_REG, and
clear the corresponding peripheral reset bits in SYSTEM_PEIRP_RST_EN1_REG. For registers
information, please see Chapter 3 System and Memory.
(b) Write 1 to register HMAC_SET_START_REG.
2. Configure HMAC keys and key purposes
(a) Write the key purpose m to register HMAC_SET_PARA_PURPOSE_REG. The possible key purpose
values are shown in Table 17-1. For more information, please refer to Section 17.2.4.
(b) Select KEYn in eFuse memory as the key by writing n (0 ~ 5) to register

HMAC_SET_PARA_KEY_REG. For more information, please refer to Section 17.2.5.
RY
(c) Write 1 to register HMAC_SET_PARA_FINISH_REG to complete the configuration.
(d) Read register HMAC_QUERY_ERROR_REG. If its value is 1, it means the purpose of the selected
block does not match the configured key purpose and the calculation will not proceed. If its value is 0,
it means the purpose of the selected block matches the configured key purpose, and then the
calculation can proceed.
A
(e) When the value of HMAC_SET_PARA_PURPOSE_REG is not 8, it means the HMAC module is in
downstream mode, proceed with Step 3. When the value is 8, it means the HMAC module is in
upstream mode, proceed with Step 4.
3. Downstream mode
IN
(a) Poll Status register HMAC_QUERY_BUSY_REG. When the value of this register is 0, HMAC
calculation in downstream mode is completed.
IM
(b) In downstream mode, the calculation result is used by either the JTAG or DS module in the hardware.
To clear the result and make further usage of the dependent hardware (JTAG or DS), write 1 to either
register HMAC_SET_INVALIDATE_JTAG_REG to clear the result generated by JTAG key; or to register
HMAC_SET_INVALIDATE_DS_REG to clear the result generated by DS key.
EL
(c) Downstream mode operation completed.
4. Transmit message block Block_n (n >= 1) in upstream mode
(a) Poll Status register HMAC_QUERY_BUSY_REG. When the value of this register is 0, go to step 4(b).
(b) Write the 512-bit Block_n to register

PR
HMAC_WDATA0~15_REG. Write 1 to register HMAC_SET_MESSAGE_ONE_REG, to trigger the

processing of this message block.
(c) Poll Status register HMAC_QUERY_BUSY_REG. When the value of this register is 0, go to step 4(d).
(d) Different message blocks will be generated, depending on whether the size of the to-be-processed
message is a multiple of 512 bits.
• If the bit length of the message is a multiple of 512 bits, there are three possible options:
i. If Block_n+1 exists, write 1 to register HMAC_SET_MESSAGE_ING_REG to make n = n + 1,

and then jump to step 4(b).
ii. If Block_n is the last block of the message and the user wants to apply SHA padding in
hardware, write 1 to register HMAC_SET_MESSAGE_END_REG, and then jump to step 6.

iii. If Block_n is the last block of the padded message and the user has applied SHA padding in
software, write 1 to register HMAC_SET_MESSAGE_PAD_REG, and then jump to step 5.
• If the bit length of the message is not a multiple of 512 bits, there are three possible options as
follows. Note that in this case, the user should apply SHA padding to the message, after which
the padded message length should be a multiple of 512 bits.
i. If Block_n is the only message block, n = 1, and Block_1 has included all padding bits, write
1 to register HMAC_ONE_BLOCK_REG, and then jump to step 6.
ii. If Block_n is the second to last padded block, write 1 to register

HMAC_SET_MESSAGE_PAD_REG, and then jump to step 5.
iii. If Block_n is neither the last nor the second to last message block, write 1 to register
RY
HMAC_SET_MESSAGE_ING_REG and define n = n + 1, and then jump to step 4.(b).
5. Apply SHA padding to message
(a) After applying SHA padding to the last message block as described in Section 17.3.1, write this block
to register HMAC_WDATA0~15_REG, and then write 1 to register
HMAC_SET_MESSAGE_ONE_REG. Then the HMAC module will calculate this message block.
A
(b) Jump to step 6.
6. Read hash result in upstream mode

IN
(a) Poll Status register HMAC_QUERY_BUSY_REG. When the value of this register is 0, go to the next
step.
(b) Read hash result from register HMAC_RDATA0~7_REG.

IM
(c) Write 1 to register HMAC_SET_RESULT_FINISH_REG to finish calculation.
(d) Upstream mode operation is completed.
Note:
EL
The SHA accelerator can be called directly, or used internally by the DS module and the HMAC module. However, they
can not share the hardware resources simultaneously. Therefore, SHA module can not be called by the CPU nor DS
module when the HMAC module is in use.
PR
17.3 HMAC Algorithm Details

17.3.1 Padding Bits
The HMAC module uses SHA-256 as hash algorithm. If the input message is not a multiple of 512 bits, a
SHA-256 padding algorithm must be applied in software. The SHA-256 padding algorithm is the same as
described in Section Padding the Message of FIPS PUB 180-4.
As shown in Figure 17-1, suppose the length of the unpadded message is m bits. Padding steps are as
follows:
1. Append one bit of value “1” to the end of the unpadded message;
2. Append k bits of value “0”, where k is the smallest non-negative number which satisfies
m + 1 + k≡448(mod512);

3. Append a 64-bit integer value as a binary block. This block includes the length of the unpadded message
as a big-endian binary integer value m.
Figure 171. HMAC SHA256 Padding Diagram
In downstream mode, there is no need to input any message or apply padding. In upstream mode, if the length
RY
of the unpadded message is a multiple of 512 bits, the user can choose to configure hardware to apply the SHA
padding. If the length is not a multiple of 512 bits, the user must apply the SHA padding manually. For detailed
steps, please see Section 17.2.6.
17.3.2 HMAC Algorithm Structure
A
The structure of the implemented algorithm in the HMAC module is shown in Figure 17-2. This is the standard
HMAC algorithm as described in RFC 2104. IN
IM
EL
PR
Figure 172. HMAC Structure Schematic Diagram

In Figure 17-2:
1. ipad is a 512-bit message block composed of 64 bytes of 0x36.
2. opad is a 512-bit message block composed of 64 bytes of 0x5c.
The HMAC module appends a 256-bit 0 sequence after the bit sequence of the 256-bit key K in order to get a
512-bit K0 . Then, the HMAC module XORs K0 with ipad to get the 512-bit S1. Afterwards, the HMAC module
appends the input message (multiple of 512 bits) after the 512-bit S1, and exercises the SHA-256 algorithm to
get the 256-bit H1.
The HMAC module appends the 256-bit SHA-256 hash result H1 to the 512-bit S2 value, which is calculated
using the XOR operation of K0 and opad. A 768-bit sequence will be generated. Then, the HMAC module uses
the SHA padding algorithm described in Section 17.3.1 to pad the 768-bit sequence to a 1024-bit sequence,
RY
and applies the SHA-256 algorithm to get the final hash result (256-bit).
A
IN
IM
EL
PR


The addresses in this section are relative to HMAC Accelerator base address provided in Table 3-4 in Chapter 3
System and Memory.

Status/Control Register
HMAC_SET_START_REG HMAC start control register 0x040 WO
HMAC_SET_PARA_PURPOSE_REG HMAC parameter purpose register 0x044 WO
HMAC_SET_PARA_KEY_REG HMAC pamameter key register 0x048 WO
HMAC_SET_PARA_FINISH_REG Finish initial configuration 0x04C WO
HMAC_SET_MESSAGE_ONE_REG HMAC message control register 0x050 WO
RY
HMAC_SET_MESSAGE_ING_REG HMAC message continue register 0x054 WO
HMAC_SET_MESSAGE_END_REG HMAC message end register 0x058 WO
HMAC_SET_RESULT_FINISH_REG HMAC result reading finish register 0x05C WO
HMAC_SET_INVALIDATE_JTAG_REG Invalidate JTAG result register 0x060 WO
HMAC_SET_INVALIDATE_DS_REG Invalidate digital signature result register 0x064 WO
A
HMAC_QUERY_ERROR_REG Stores matching results between keys gener- 0x068 RO
ated by users and corresponding purposes
HMAC_QUERY_BUSY_REG Busy state of HMAC module 0x06C RO
HMAC Message Block
HMAC_WR_MESSAGE_0_REG
IN
Message register 0 0x080 WO
HMAC_WR_MESSAGE_1_REG Message register 1 0x084 WO
IM
HMAC_WR_MESSAGE_3_REG Message register 3 0x08C WO
HMAC_WR_MESSAGE_7_REG Message register 7 0x09C WO
EL
HMAC_WR_MESSAGE_8_REG Message register 8 0x0A0 WO

HMAC_WR_MESSAGE_11_REG Message register 11 0x0AC WO
HMAC_WR_MESSAGE_12_REG Message register 12 0x0B0 WO
PR

HMAC_WR_MESSAGE_15_REG Message register 15 0x0BC WO
HMAC Upstream Result
HMAC_RD_RESULT_0_REG Hash result register 0 0x0C0 RO
HMAC_RD_RESULT_3_REG Hash result register 3 0x0CC RO
HMAC_RD_RESULT_4_REG Hash result register 4 0x0D0 RO


HMAC_RD_RESULT_7_REG Hash result register 7 0x0DC RO
configuration Register
HMAC_SET_MESSAGE_PAD_REG Software padding register 0x0F0 WO
HMAC_ONE_BLOCK_REG One block message register 0x0F4 WO
HMAC_SOFT_JTAG_CTRL_REG Re-enable JTAG register 0 0x0F8 WO
HMAC_WR_JTAG_REG Re-enable JTAG register 1 0x0FC WO
Version Register
HMAC_DATE_REG Version control register 0x1FC R/W
A RY
IN
IM
EL
PR

17.5 Registers
The addresses in this section are relative to HMAC Accelerator base address provided in Table 3-4 in Chapter 3
System and Memory.
Register 17.1. HMAC_SET_START_REG (0x040)
TR
TA
_S
ET
d)
_S
ve
AC
ser
HM
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
HMAC_SET_START Set this bit to start hmac operation. (WO)
Register 17.2. HMAC_SET_PARA_PURPOSE_REG (0x044)
A
ET
_S
SE
PO
UR
IN
)
_P
ed
rv
AC
se
HM
(re
31 4 3 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
IM
HMAC_PURPOSE_SET Set HMAC parameter purpose, please see Table 17-1. (WO)
Register 17.3. HMAC_SET_PARA_KEY_REG (0x048)

EL
ET
_S
EY
)
_K
ed
rv
AC
se
HM
(re
31 3 2 0
PR
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
HMAC_KEY_SET Set HMAC parameter key. There are six keys with index 0 ~ 5. Write the index of
the selected key to this field. (WO)

Register 17.4. HMAC_SET_PARA_FINISH_REG (0x04C)
D
EN
A_
AR
_P
ET
)
_S
ed
rv
AC
se
HM
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
HMAC_SET_PARA_END Set this bit to finish HMAC configuration. (WO)
RY
Register 17.5. HMAC_SET_MESSAGE_ONE_REG (0x050)
NE
O
T_
EX
_T
ET
d)
_S
e
A
rv
AC
se
HM
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
IN
HMAC_SET_TEXT_ONE Call SHA to calculate one message block. (WO)
IM
Register 17.6. HMAC_SET_MESSAGE_ING_REG (0x054)
G
_ IN
EXT
_T
ET
d)
_S
ve
EL
AC
r
se
HM
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
HMAC_SET_TEXT_ING Set this bit to show there are still some message blocks to be processed.
PR
(WO)

Register 17.7. HMAC_SET_MESSAGE_END_REG (0x058)
D
_EN
XT
E
_T
ET
)
_S
ed
rv
AC
se
HM
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
HMAC_SET_TEXT_END Set this bit to start hardware padding. (WO)
RY
Register 17.8. HMAC_SET_RESULT_FINISH_REG (0x05C)
D
EN
_
LT
SU
E
_R
ET
A
d)
_S
e
rv
AC
se
HM
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
IN
0 0 0 0 0
HMAC_SET_RESULT_END After read result from upstream, then let HMAC back to idle. (WO)
0 0 0 0 0 0 0 0 0 0 0 0 Reset
IM
Register 17.9. HMAC_SET_INVALIDATE_JTAG_REG (0x060)
G
TA
E_J
AT
ID
AL
EL
NV
_I
ET
)
_S
ed
rv
AC
se
HM
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
PR
HMAC_SET_INVALIDATE_JTAG Set this bit to clear calculation results when re-enabling JTAG in
downstream mode. (WO)

Register 17.10. HMAC_SET_INVALIDATE_DS_REG (0x064)
S
_D
E
AT
ID
AL
NV
_I
ET
d)
_S
ve
AC
ser
HM
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
HMAC_SET_INVALIDATE_DS Set this bit to clear calculation results of the DS module in downstream
mode. (WO)
RY
Register 17.11. HMAC_QUERY_ERROR_REG (0x068)
CK
HE
A
_C
EY
UR
d)
_Q
e
rv
AC
se
HM
(re
31
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
IN
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
1
0
0
0 Reset
HMAC_QUREY_CHECK Indicates whether a HMAC key matches the purpose.

IM
• 0: HMAC key and purpose match.
• 1: error. (RO)
EL
Register 17.12. HMAC_QUERY_BUSY_REG (0x06C)
E
AT
ST
Y_
US
)
_B
ed
rv
AC
se
PR
HM
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
HMAC_BUSY_STATE Indicates whether HMAC is in busy state.
• 1’b0: idle.
• 1’b1: HMAC is still working for calculation. (RO)

Register 17.13. HMAC_WR_MESSAGE_n_REG (n: 015) (0x080+4*n)
0_
TA
DA
_W
AC
HM
31 0
0 Reset
HMAC_WDATA_n Store the nth 32-bit of message. (WO)
RY
Register 17.14. HMAC_RD_RESULT_n_REG (n: 07) (0x0C0+4*n)
_0
TA
DA
_R
AC
HM
31 0
A
0 Reset
HMAC_RDATA_n Read the nth 32-bit of hash result. (RO)

IN
Register 17.15. HMAC_SET_MESSAGE_PAD_REG (0x0F0)
IM
D
_ PA
XT
E
_T
ET
d)
_S
ve
AC
r
se
HM
(re
31 1 0
EL
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
HMAC_SET_TEXT_PAD Set this bit to start software padding. (WO)

PR
Register 17.16. HMAC_ONE_BLOCK_REG (0x0F4)

CK
LO
_B
NE
_O
ET
)
_S
ed
rv
AC
se
HM
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
HMAC_SET_ONE_BLOCK Set this bit to show that no padding is required. (WO)

Register 17.17. HMAC_SOFT_JTAG_CTRL_REG (0x0F8)
L
TR
_C
G
TA
_J
FT
O
d)
_S
ve
AC
ser
HM
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
HMAC_SOFT_JTAG_CTRL Set this bit to turn on JTAG verification. (WO)
RY
Register 17.18. HMAC_WR_JTAG_REG (0x0FC)
AG
JT
R_
_W
AC
A
HM
31 0
IN 0 Reset
HMAC_WR_JTAG 32-bit of key to be compared. (WO)
Register 17.19. HMAC_DATE_REG (0x1FC)

IM
E
AT
)
_D
ed
rv
AC
se
HM
(re
31 30 29 0
EL
0 0 0x20190402 Reset
HMAC_DATE Version control register.(R/W)

PR

18 Digital Signature (DS)
18.1 Overview
A Digital Signature is used to verify the authenticity and integrity of a message using a cryptographic algorithm.
This can be used to validate a device’s identity to a server, or to check the integrity of a message.
The ESP32-S3 includes a Digital Signature (DS) module providing hardware acceleration of messages’ signatures
based on RSA. It uses pre-encrypted parameters to calculate a signature. The parameters are encrypted using
HMAC as a key-derivation function. In turn, the HMAC uses eFuses as an input key. The whole process happens
in hardware so that neither the decryption key for the RSA parameters nor the input key for the HMAC key
RY
derivation function can be seen by the users while calculating the signature.
18.2 Features
• RSA Digital Signatures with key length up to 4096 bits
• Encrypted private key data, only decryptable by DS peripheral
A
• SHA-256 digest to protect private key data against tampering by an attacker

IN
18.3.1 Overview
The DS peripheral calculates RSA signature as Z = X Y mod M where Z is the signature, X is the input
IM
message, Y and M are the RSA private key parameters.
Private key parameters are stored in flash or other memory as ciphertext. They are decrypted using a key
(DS_KEY ) which can only be read by the DS peripheral via the HMAC peripheral. The required inputs
(HM AC_KEY ) to generate the key are only stored in eFuse and can only be accessed by the HMAC peripheral.
EL
The DS peripheral hardware can decrypt the private key, and the private key in plaintext is never accessed by the
software. For more detailed information about eFuse and HMAC peripherals, please refer to Chapter 4 eFuse
Controller and 17 HMAC Accelerator (HMAC) peripheral.
The input message X will be sent directly to the DS peripheral by the software, each time a signature is needed.
After the RSA signature operation, the signature Z is read back by the software.
PR
For better understanding, we define some symbols and functions here, which are only applicable to this
chapter:
• 1s A bit string consist of s bits that stores “1”.
• [x]s A bit string of s bits, in which s should be the integral multiple of 8 bits. If x is a number (x < 2s ), it is
represented in little endian byte order in the bit string. x may be a variable value such as [Y ]4096 or as a
hexadecimal constant such as [0x0C]8 . If necessary, the value [x]t can be right-padded with (s − t)
number of 0 to reach s bits in length, and finally get [x]s . For example, [0x05]8 = 00000101,
[0x05]16 = 0000010100000000, [0x0005]16 = 0000000000000101, [0x13]8 = 00010011,
[0x13]16 = 0001001100000000, [0x0013]16 = 0000000000010011.
• || A bit string concatenation operator for joining multiple bit strings into a longer bit string.

18.3.2 Private Key Operands

Private key operands Y (private key exponent) and M (key modulus) are generated by the user. They have a
particular RSA key length (up to 4096 bits). Two additional private key operands are needed: r and M ′ . These
two operands are derived from Y and M .
Operands Y , M , r and M ′ are encrypted by the user along with an authentication digest and stored as a single
ciphertext C. C is inputted to the DS peripheral in this encrypted format, decrypted by the hardware, and then
used for RSA signature calculation. Detailed description of how to generate C is provided in Section
18.3.3.
The DS peripheral supports RSA signature calculation Z = X Y mod M , in which the length of operands should
be N = 32 × x where x ∈ {1, 2, 3, . . . , 128}. The bit lengths of arguments Z, X, Y , M and r should be an
RY
arbitrary value in N , and all of them in a calculation must be of the same length, while the bit length of M ′ should
always be 32. For more detailed information about RSA calculation, please refer to Section 16.3.1 Large Number
Modular Exponentiation in Chapter 16 RSA Accelerator (RSA).
18.3.3 Software Prerequisites
A
The left side of Figure 18-1 lists preparations required by the software before the hardware starts RSA signature
calculation, while the right side lists the hardware workflow during the entire calculation procedure.
IN
IM
EL
PR
Figure 181. Software Preparations and Hardware Working Process
Note:
1. The software preparation (left side in the Figure 18-1) is a one-time operation before any signature is calculated,
while the hardware calculation (right side in the Figure 1-1) repeats for every signature calculation.
Users need to follow the steps shown in the left part of Figure 18-1 to calculate C. Detailed instructions are as
follows:
• Step 1: Prepare operands Y and M whose lengths should meet the requirements in Section 18.3.2.

N
Define [L]32 = 32 (i.e., for RSA 4096, [L]32 == [0x80]32 ). Prepare [HM AC_KEY ]256 and calculate
[DS_KEY ]256 based on DS_KEY = HMAC-SHA256 ([HM AC_KEY ]256 , 1256 ). Generate a random
[IV ]128 which should meet the requirements of the AES-CBC block encryption algorithm. For more
information on AES, please refer to Chapter 15 AES Accelerator (AES).
• Step 2: Calculate r and M ′ based on M .
• Step 3: Extend Y , M and r, in order to get [Y ]4096 , [M ]4096 and [r]4096 , respectively. This step is only
required for Y , M and r whose length are less than 4096 bits, since their largest length are 4096 bits.
• Step 4�Calculate MD authentication code using the SHA-256:

[M D]256 = SHA256 ( [Y ]4096 ||[M ]4096 ||[r]4096 ||[M ′ ]32 ||[L]32 ||[IV ]128 )
• Step 5: Build [P ]12672 = ( [Y ]4096 ||[M ]4096 ||[r]4096 ||[M D]256 ||[M ′ ]32 ||[L]32 ||[β]64 ), where [β]64 is a PKCS#7
RY
padding value, i.e., a 64-bit string [0x0808080808080808]64 composed of 8 bytes (value = 0x80). The
purpose of [β]64 is to make the bit length of P a multiple of 128.
• Step 6: Calculate C = [C]12672 = AES-CBC-ENC ([P ]12672 , [DS_KEY ]256 , [IV ]128 ), where C is the
ciphertext with length of 12672 bits.
A
18.3.4 DS Operation at the Hardware Level
The hardware operation is triggered each time a digital signature needs to be calculated. The inputs are the
IN
pre-generated private key ciphertext C, a unique message X, and IV .
The DS operation at the hardware level can be divided into the following three stages:
1. Decryption: Step 7 and 8 in Figure 181

IM
The decryption process is the inverse of Step 6 in figure 18-1. The DS peripheral will call AES accelerator to
decrypt C in CBC block mode and get the resulted plaintext. The decryption process can be represented
by P = AES-CBC-DEC (C, DS_KEY , IV ), where IV (i.e., [IV ]128 ) is defined by users. [DS_KEY ]256 is
provided by HMAC module, derived from HM AC_KEY stored in eFuse. [DS_KEY ]256 , as well as
[HM AC_KEY ]256 are not readable by users.
EL
With P, the DS peripheral can derive [Y ]4096 , [M ]4096 , [r]4096 , [M ′ ]32 , [L]32 , MD authentication code, and
the padding value [β]64 . This process is the inverse of Step 5.
2. Check: Step 9 and 10 in Figure 181
The DS peripheral will perform two checks: MD check and padding check. Padding check is not shown in
PR
Figure 18-1, as it happens at the same time with MD check.
• MD check: The DS peripheral calls SHA-256 to calculate the MD authentication code

[CALC_M D]256 from [Y ]4096 ||[M ]4096 ||[r]4096 ||[M ′ ]32 ||[L]32 ||[IV ]128 ). Then, [CALC_M D]256 is
compared against the pre-calculated MD authentication code [M D]256 from step 4. Only when the
two match, MD check passes.
• Padding check: The DS peripheral checks if [β]64 complies with the aforementioned PKCS#7 format.
Only when [β]64 complies with the format, padding check passes.
The DS peripheral will only perform subsequent operations if MD check passes. If padding check fails, an
error bit is set in the query register, but it does not affect the subsequent operations, i.e., it is up to the user
to proceed or not.

3. Calculation: Step 11 and 12 in Figure 181
The DS peripheral treats X (input by users) and Y , M , r (compiled) as big numbers. With M ′ , all operands
to perform X Y mod M are in place. The operand length is defined by L. The DS peripheral will get the
signed result Z by calling RSA to perform Z = X Y mod M .
18.3.5 DS Operation at the Software Level

The following software steps should be followed each time a Digital Signature needs to be calculated. The inputs
are the pre-generated private key ciphertext C, a unique message X, and IV . These software steps trigger the
hardware steps described in Section 18.3.4.
We assume that the software has called the HMAC peripheral and HMAC on the hardware has calculated
RY
DS_KEY based on HM AC_KEY .
1. Prerequisites: Prepare operands C, X, IV according to Section 18.3.3.
2. Activate the DS peripheral: Write 1 to DS_SET_START_REG.
3. Check if DS_KEY is ready: Poll DS_QUERY_BUSY_REG until the software reads 0.
A
If the software does not read 0 in DS_QUERY_BUSY_REG after approximately 1 ms, it indicates a problem
with HMAC initialization. In such a case, the software can read register DS_QUERY_KEY_WRONG_REG to
get more information:
IN
• If the software reads 0 in DS_QUERY_KEY_WRONG_REG, it indicates that the HMAC peripheral has
not been activated.
• If the software reads any value from 1 to 15 in DS_QUERY_KEY_WRONG_REG, it indicates that

IM
HMAC was activated, but the DS peripheral did not successfully receive the DS_KEY value from the
HMAC peripheral. This may indicate that the HMAC operation has been interrupted due to a software
concurrency problem.
4. Configure register: Write IV block to register DS_IV_m_REG (m: 0-3). For more information on the IV
block, please refer to Chapter 15 AES Accelerator (AES).
EL
5. Write X to memory block DS_X_MEM: Write Xi (i ∈ {0, 1, . . . , n − 1}), where n = N

32 , to memory block
DS_X_MEM whose capacity is 128 words. Each word can store one base-b digit. The memory block uses
the little endian format for storage, i.e., the least significant digit of the operand is in the lowest address.
Words in DS_X_MEM block after the configured length of X (N bits, as described in Section 18.3.2) are
PR
ignored.
6. Write C to memory block DS_C_MEM: Write Ci (i ∈ {0, 1, . . . , 395}) to memory block DS_C_MEM
whose capacity is 396 words. Each word can store one base-b digit.
7. Start DS operation: Write 1 to register DS_SET_ME_REG.
8. Wait for the operation to be completed: Poll register DS_QUERY_BUSY_REG until the software reads 0.
9. Query check result: Read register DS_QUERY_CHECK_REG and determine the subsequent operations
based on the return value.
• If the value is 0, it indicates that both padding check and MD check pass. Users can continue to get
the signed result Z.

• If the value is 1, it indicates that the padding check passes but MD check fails. The signed result Z is
invalid. The operation will resume directly from Step 11.
• If the value is 2, it indicates that the padding check fails but MD check passes. Users can continue to
get the signed result Z. But please note that the data encapsulation format does not complie with the
aforementioned PKCS#7 format, which may not be what you want.
• If the value is 3, it indicates that both padding check and MD check fail. In this case, some fatal errors
may occurred and the signed result Z is invalid. The operation will resume directly from Step 11.
10. Read the signed result: Read the signed result Zi (i ∈ {0, 1, . . . , n − 1}), where n = N
32 , from memory
block DS_Z_MEM. The memory block stores Z in little-endian byte order.
11. Exit the operation: Write 1 to DS_SET_FINISH_REG, then poll DS_QUERY_BUSY_REG until the software
RY
reads 0.
After the operation, all the input/output registers and memory blocks are cleared.
A
IN
IM
EL
PR

18.4 Memory Summary

The addresses in this section are relative to the [Digital Signature] base address provided in Table 3-4 in Chapter
3 System and Memory.

DS_C_MEM Memory block C 1584 0x0000 0x062F WO
DS_X_MEM Memory block X 512 0x0800 0x09FF WO
DS_Z_MEM Memory block Z 512 0x0A00 0x0BFF RO
A RY
IN
IM
EL
PR


The addresses in this section are relative to the Digital Signature base address provided in Table 3-4 in Chapter 3
System and Memory.

DS_IV_0_REG IV block data 0x0630 WO
DS_IV_3_REG IV block data 0x063C WO
Status/Control Registers
RY
DS_SET_START_REG Activates the DS peripheral 0x0E00 WO
DS_SET_ME_REG Starts DS operation 0x0E04 WO
DS_SET_FINISH_REG Ends DS operation 0x0E08 WO
DS_QUERY_BUSY_REG Status of the DS peripheral 0x0E0C RO
DS_QUERY_KEY_WRONG_REG Checks the reason why DS_KEY is not 0x0E10 RO
A
ready
DS_QUERY_CHECK_REG Queries DS check result 0x0814 RO
Version Register
DS_DATE_REG
IN
Version control register 0x0820 W/R
IM
EL
PR

18.6 Registers
The addresses in this section are relative to the Digital Signature base address provided in Table 3-4 in Chapter 3
System and Memory.
Register 18.1. DS_IV_m_REG (m: 03) (0x0630+4*m)
31 0
0x000000000 Reset
DS_IV_m_REG (m: 03) IV block data. (WO)
RY
Register 18.2. DS_SET_START_REG (0x0E00)
RT
TA
_S
d )
ET
ve
_S
r
se
DS
(re
A
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
IN
DS_SET_START Write 1 to this register to activate the DS peripheral. (WO)
Register 18.3. DS_SET_ME_REG (0x0E04)

IM
E
_M
d)
ET
ve
_S
r
se
DS
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
EL
DS_SET_ME Write 1 to this register to start DS operation. (WO)
Register 18.4. DS_SET_FINISH_REG (0x0E08)

PR
SH
I NI
_F
)
ed
ET
rv
_S
se
DS
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
DS_SET_FINISH Write 1 to this register to end DS operation. (WO)

Register 18.5. DS_QUERY_BUSY_REG (0x0E0C)
SY
_ BU
RY
d)
UE
ve
Q
r
se
_
DS
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
DS_QUERY_BUSY 1: The DS peripheral is busy; 0: The DS peripheral is idle. (RO)
RY
Register 18.6. DS_QUERY_KEY_WRONG_REG (0x0E10)
NG
RO
W
Y_
_ KE
RY
)
ed
UE
rv
_Q
se
A
DS
(re
31 4 3 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
IN 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
DS_QUERY_KEY_WRONG 1-15: HMAC was activated, but the DS peripheral did not successfully
receive the DS_KEY from the HMAC peripheral. (The biggest value is 15); 0: HMAC is not
activated. (RO)
IM
Register 18.7. DS_QUERY_CHECK_REG (0x0E14)
RO AD
ER _B
R
D_ NG
EL
_M DI
d)
DS PAD
e
rv
se
_
DS
(re
31 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
DS_PADDING_BAD 1: The padding check fails; 0: The padding check passes. (RO)
PR
DS_MD_ERROR 1: The MD check fails; 0: The MD check passes. (RO)
Register 18.8. DS_DATE_REG (0x0E20)

)
E
ed
AT
rv
_D
se
DS
(re
31 30 29 0
0 0 0x20191217 Reset
DS_DATE Version control register. (R/W)

19 External Memory Encryption and Decryption (XTS_AES)
19.1 Overview
The ESP32-S3 integrates an External Memory Encryption and Decryption module that complies with the
XTS_AES standard algorithm specified in IEEE Std 1619-2007, providing security for users’ application code and
data stored in the external memory (flash and RAM). Users can store proprietary firmware and sensitive data
(e.g., credentials for gaining access to a private network) to the external flash, or store general data to the
external RAM.
19.2 Features
RY
• General XTS_AES algorithm, compliant with IEEE Std 1619-2007
• Software-based manual encryption
• High-speed auto encryption, without software’s participation
• High-speed auto decryption, without software’s participation
A
• Encryption and decryption functions jointly determined by registers configuration, eFuse parameters, and
boot mode
19.3 Module Structure

IN
The External Memory Encryption and Decryption module consists of three blocks, namely the Manual Encryption
IM
block, Auto Encryption block, and Auto Decryption block. The module architecture is shown in Figure
19-1.
EL
PR
Figure 191. External Memory Encryption and Decryption Operation Settings

The Manual Encryption block can encrypt instructions/data which will then be written to the external flash as
ciphertext via SPI1.
When the CPU writes data to the external RAM through cache, the Auto Encryption block will automatically
encrypt the data first, then the data will be written to the external RAM as ciphertext.
When the CPU reads from the external flash or external RAM through cache, the Auto Decryption block will
automatically decrypt the ciphertext to retrieve instructions and data.
In the System Registers (SYSREG) peripheral, the following four bits in register
SYSTEM_EXTERNAL_DEVICE_ENCRYPT_DECRYPT_CONTROL_REG are relevant to the external memory
encryption and decryption:
• SYSTEM_ENABLE_DOWNLOAD_MANUAL_ENCRYPT
RY
• SYSTEM_ENABLE_DOWNLOAD_G0CB_DECRYPT
• SYSTEM_ENABLE_DOWNLOAD_DB_ENCRYPT
• SYSTEM_ENABLE_SPI_MANUAL_ENCRYPT
The XTS_AES module also fetches two parameters from the peripheral 4 eFuse Controller, which are:
A
EFUSE_DIS_DOWNLOAD_MANUAL_ENCRYPT and EFUSE_SPI_BOOT_CRYPT_CNT.

IN
19.4.1 XTS Algorithm
The manual encryption and auto encryption/decryption all use the same algorithm, i.e., XTS algorithm. During
IM
implementation, the XTS algorithm is characterized by a ”data unit” of 1024 bits, which is defined in the Section
XTS-AES encryption procedure of XTS-AES Tweakable Block Cipher Standard. For more information about
XTS-AES algorithm, please refer to IEEE Std 1619-2007.
19.4.2 Key
EL
The Manual Encryption block, Auto Encryption block and Auto Decryption block share the same Key when
implementing XTS algorithm. The Key is provided by the eFuse hardware and cannot be accessed by
users.
The Key can be either 256-bit or 512-bit long. The value and length of the Key are determined by eFuse
PR
parameters. For easier description, now define:
• BlockA : the BLOCK in BLOCK4 ~ BLOCK9 whose key purpose is

EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_1. If BlockA is true, then the 256-bit KeyA is stored in it.
• BlockB : the BLOCK in BLOCK4 ~ BLOCK9 whose key purpose is

EFUSE_KEY_PURPOSE_XTS_AES_256_KEY_2. If BlockB is true, then the 256-bit KeyB is stored in it.
• BlockC : the BLOCK in BLOCK4 ~ BLOCK9 whose key purpose is

EFUSE_KEY_PURPOSE_XTS_AES_128_KEY. If BlockC is true, then the 256-bit KeyC is stored in it.
There are five possibilities of how the Key is generated depending on whether BlockA , BlockB and BlockC exists
or not, as shown in Table 19-1. In each case, the Key can be uniquely determined by BlockA , BlockB or
BlockC .

Table 191. Key generated based on KeyA , KeyB and KeyC
BlockA BlockB BlockC Key Key Length (bit)

Yes Yes Don’t care KeyA ||KeyB 512
Yes No Don’t care KeyA ||0 256
512
No Yes Don’t care 0 256
||KeyB 512
No No Yes KeyC 256
256
No No No 0 256
Notes:
“YES” indicates that the block exists; “NO” indicates that the block does not exist; “0256 ” indicates a bit string
that consists of 256-bit zeros; “||” is a bonding operator for joining one bit string to another.
RY
For more information of key purposes, please refer to Table 4-2 Secure Key Purpose Values in Chapter 4 eFuse
Controller.
19.4.3 Target Memory Space

The target memory space refers to a continuous address space in the external memory where the first encrypted
A
ciphertext is stored. The target memory space can be uniquely determined by three relevant parameters: type,
size and base address, whose definitions are listed below. IN
• Type: the type of the target memory space, either external flash or external RAM. Value 0 indicates external
flash, while 1 indicates external RAM.
• Size: the size of the target memory space, indicating the number bytes encrypted in one encryption
operation, which supports 16, 32 or 64 bytes.
IM
• Base address: the base_addr of the target memory space. It is a 30-bit physical address, with range of
0x0000_0000 ~ 0x3FFF_FFFF. It should be aligned to size, i.e., base_addr%size == 0.
For example, if there are 16 bytes of instruction data need to be encrypted and written to address 0x130 ~ 0x13F
in the external flash, then the target space is 0x130 ~ 0x13F, type is 0 (external flash), size is 16 (bytes), and base
EL
address is 0x130.
The encryption of any length (must be multiples of 16 bytes) of plaintext instruction/data can be completed
separately in multiple operations, and each operation has individual target memory space and the relevant
parameters.
PR
For Auto Encryption/Decryption blocks, these parameters are automatically defined by hardware. For Manual
Encryption block, these parameters should be configured manually by users.
Note:
The “tweak” defined in Chapter 5.1 Data units and tweaks of IEEE Std 1619-2007 is a 128-bit non-negative integer
(tweak), which can be generated according to tweak = type ∗ 230 + (base_addr & 0x3FFFFF80). The lowest 7 bits
and the highest 97 bits in tweak are always zero.
19.4.4 Data Padding

For Auto Encryption/Decryption blocks, data padding is automatically completed by hardware. For Manual
Encryption block, data padding should be completed manually by users. The Manual Encryption block has a

registers block which consists of 16 registers, i.e., XTS_AES_PLAIN_n_REG (n: 0-15), that are dedicated to data
padding and can store up to 512 bits of plaintext instructions/data.
Actually, the Manual Encryption block does not care where the plaintext comes from, but only where the
ciphertext will be stored. Because of the strict correspondence between plaintext and ciphertext, in order to
better describe how the plaintext is stored in the register block, we assume that the plaintext is stored in the
target memory space in the first place and replaced by ciphertext after encryption. Therefore, the following
description no longer has the concept of “plaintext”, but uses “target memory space” instead. Please note that
the plaintext can come from everywhere in actual use, but users should understand how the plaintext is stored in
the register block.
How mapping works between target memory space and registers:
RY
of f set
Assume a word in the target memory space is stored in address, define of f set = address%64, n = 4 , then
the word will be stored in register XTS_AES_PLAIN_n_REG.
For example, if the size of the target memory space is 64, then all the 16 registers will be used for data storage.
The mapping between of f set and registers is shown in Table 19-2.
Table 192. Mapping Between Offsets and Registers
A
of f set Register of f set Register
0x00 XTS_AES_PLAIN_0_REG 0x20 XTS_AES_PLAIN_8_REG
0x04
0x08
XTS_AES_PLAIN_1_REG
XTS_AES_PLAIN_2_REG
IN 0x24
0x28
XTS_AES_PLAIN_9_REG
XTS_AES_PLAIN_10_REG
0x0C XTS_AES_PLAIN_3_REG 0x2C XTS_AES_PLAIN_11_REG
IM
0x1C XTS_AES_PLAIN_7_REG 0x3C XTS_AES_PLAIN_15_REG
EL
19.4.5 Manual Encryption Block

The Manual Encryption block is a peripheral module. It is equipped with registers and can be accessed by the
CPU directly. Registers embedded in this block, the System Registers (SYSREG) peripheral, eFuse parameters,
and boot mode jointly configure and use this module. Please note that the Manual Encryption block can only
encrypt for storage in the external flash.
PR
The Manual Encryption block is operational only under certain conditions. The operating conditions
are:
• In SPI Boot mode
If bit SYSTEM_ENABLE_SPI_MANUAL_ENCRYPT in register

SYSTEM_EXTERNAL_DEVICE_ENCRYPT_DECRYPT_CONTROL_REG is 1, the Manual Encryption block
can be enabled. Otherwise, it is not operational.
• In Download Boot mode
If bit SYSTEM_ENABLE_DOWNLOAD_MANUAL_ENCRYPT in register

SYSTEM_EXTERNAL_DEVICE_ENCRYPT_DECRYPT_CONTROL_REG is 1 and the eFuse parameter

EFUSE_DIS_DOWNLOAD_MANUAL_ENCRYPT is 0, the Manual Encryption block can be enabled.

Otherwise, it is not operational.
Note:
• Even though the CPU can skip cache and get the encrypted instruction/data directly by reading the external mem-
ory, users can by no means access Key.
19.4.6 Auto Encryption Block

The Auto Encryption block is not a conventional peripheral, so it does not have any registers and cannot be
RY
accessed by the CPU directly. The System Registers (SYSREG) peripheral, eFuse parameters, and boot mode
jointly configure and use this block.
The Auto Encryption block is operational only under certain conditions. The operating conditions are:
If the first bit or the third bit in parameter SPI_BOOT_CRYPT_CNT (3 bits) is set to 1, then the Auto
A
Encryption block can be enabled. Otherwise, it is not operational.
If bit SYSTEM_ENABLE_DOWNLOAD_DB_ENCRYPT in register

IN
SYSTEM_EXTERNAL_DEVICE_ENCRYPT_DECRYPT_CONTROL_REG is 1, the Auto Encryption block can
be enabled. Otherwise, it is not operational.
IM
Note:
• When the Auto Encryption block is enabled, it will automatically encrypt data if the CPU writes data to the external
RAM, and then the encrypted ciphertext will be written to the external RAM. The entire encryption process does
not need software participation and is transparent to the cache. Users can by no means obtain the encryption Key
during the process.
EL
• When the Auto Encryption block is disabled, it will ignore the CPU’s access request to cache and do not process
the data. Therefore, the data will be written to the external RAM as plaintext directly.
19.4.7 Auto Decryption Block

PR
The Auto Decryption block is not a conventional peripheral, so it does not have any registers and cannot be
accessed by the CPU directly. The System Registers (SYSREG) peripheral, eFuse parameters, and boot mode
jointly configure and use this block.
The Auto Decryption block is operational only under certain conditions. The operating conditions are:
If the first bit or the third bit in parameter SPI_BOOT_CRYPT_CNT (3 bits) is set to 1, then the Auto
Decryption block can be enabled. Otherwise, it is not operational.
If bit SYSTEM_ENABLE_DOWNLOAD_G0CB_DECRYPT in register

SYSTEM_EXTERNAL_DEVICE_ENCRYPT_DECRYPT_CONTROL_REG is 1, the Auto Decryption block

can be enabled. Otherwise, it is not operational.
Note:
• When the Auto Decryption block is enabled, it will automatically decrypt the ciphertext if the CPU reads instruc-
tions/data from the external memory via cache to retrieve the instructions/data. The entire decryption process does
not need software participation and is transparent to the cache. Users can by no means obtain the decryption Key
during the process.
• When the Auto Decryption block is disabled, it does not have any effect on the contents stored in the external
memory, no matter they are encrypted or not. Therefore, what the CPU reads via cache is the original information
stored in the external memory.
RY
19.5 Software Process
When the Manual Encryption block operates, software needs to be involved in the process. The steps are as
follows:
1. Configure XTS_AES:
A
• Set register XTS_AES_DESTINATION_REG to type = 0.
• Set register XTS_AES_PHYSICAL_ADDRESS_REG to base_addr.
• Set register XTS_AES_LINESIZE_REG to

INsize
32 .
For definitions of type, base_addr and size, please refer to Section 19.4.3.
2. Pad plaintext data to the registers block XTS_AES_PLAIN_n_REG (n: 0-15). For detailed information,
IM
please refer to Section 19.4.4.
Please pad data to registers according to your actual needs, and the unused ones could be set to arbitrary
values.
3. Wait for Manual Encrypt block to be idle. Poll register XTS_AES_STATE_REG until the software reads 0.
EL
4. Trigger manual encryption by writing 1 to register XTS_AES_TRIGGER_REG.
5. Wait for the encryption process. Poll register XTS_AES_STATE_REG until the software reads 2.
Step 1 to 5 are the steps of encrypting plaintext instructions with the Manual Encryption block using the
Key.
PR
6. Grant the ciphertext access to SPI1. Write 1 to register XTS_AES_RELEASE_REG to grant SPI1 the
access to the encrypted ciphertext. After this, the value of register XTS_AES_STATE_REG will become 3.
7. Call SPI1 to write the ciphertext in the external flash (see Chapter 5 SPI Controller (SPI) [to be added later]).
8. Destroy the ciphertext. Write 1 to register XTS_AES_DESTROY_REG. After this, the value of register
XTS_AES_STATE_REG will become 0.
Repeat above steps to meet plaintext instructions/data encryption demands.


The addresses in this section are relative to the External Memory Encryption and Decryption base address
provided in Table 3-4 in Chapter 3 System and Memory.

Plaintext Register Heap
XTS_AES_PLAIN_0_REG Plaintext register 0 0x0000 R/W
XTS_AES_PLAIN_3_REG Plaintext register 3 0x000C R/W
RY
A
IN
Plaintext register 13
Plaintext register 14
0x0034
0x0038
R/W
R/W
IM
XTS_AES_LINESIZE_REG Configures the size of target memory space 0x0040 R/W
XTS_AES_DESTINATION_REG Configures the type of the external memory 0x0044 R/W
XTS_AES_PHYSICAL_ADDRESS_REG Physical address 0x0048 R/W
Contro/Status Registers
XTS_AES_TRIGGER_REG Activates AES algorithm 0x004C WO
EL
XTS_AES_RELEASE_REG Release control 0x0050 WO

XTS_AES_DESTROY_REG Destroys control 0x0054 WO
XTS_AES_STATE_REG Status register 0x0058 RO
Version Register
XTS_AES_DATE_REG Version control register 0x005C RO
PR

19.7 Registers
The addresses in this section are relative to the External Memory Encryption and Decryption base address
Register 19.1. XTS_AES_PLAIN_n_REG (n: 015) (0x0000+4*n)
n
N_
AI
PL
S_
AE
S_
XT
31 0
0x000000 Reset
RY
XTS_AES_PLAIN_n Stores nth 32-bit piece of plain text. (R/W)
Register 19.2. XTS_AES_LINESIZE_REG (0x0040)
A
ZE
SI
NE
LI
S_
)
ed
IN
AE
rv
S_
se
XT
(re
31 2 1 0
0x00000000 0 Reset
IM
XTS_AES_LINESIZE Configures the data size of one encryption.
• 0: 16 bytes;
• 1: 32 bytes;
• 2: 64 bytes. (R/W)
EL
Register 19.3. XTS_AES_DESTINATION_REG (0x0044) N

PR
OI
AT
IN
ST
DE
S_
)
ed
AE
rv
S_
se
XT
(re
31 1 0
0x00000000 0 Reset
XTS_AES_DESTINATION Configures the type of the external memory. Currently, it must be set to 0,
as the Manual Encryption block only supports flash encryption. Errors may occur if users write 1.
0: flash; 1: external RAM. (R/W)

Register 19.4. XTS_AES_PHYSICAL_ADDRESS_REG (0x0048)
SS
RE
DD
_A
AL
IC
YS
PH
S_
d)
AE
ve
er
S_
s
XT
(re
31 30 29 0
0x0 0x00000000 Reset
XTS_AES_PHYSICAL_ADDRESS Physical address. (R/W)
RY
Register 19.5. XTS_AES_TRIGGER_REG (0x004C)
ER
G
IG
TR
A
S_
d)
AE
e
rv
S_
se
XT
(re
31 1 0
IN
0x00000000 x Reset
XTS_AES_TRIGGER Write 1 to enable manual encryption. (WO)

IM
Register 19.6. XTS_AES_RELEASE_REG (0x0050)
E
AS
LE
RE
S_
)
EL
ed
AE
rv
S_
se
XT
(re
31 1 0
0x00000000 x Reset
XTS_AES_RELEASE Write 1 to grant SPI1 access to encrypted result. (WO)

PR
Register 19.7. XTS_AES_DESTROY_REG (0x0054)

Y
RO
ST
DE
S_
d)
AE
rve
S_
se
XT
(re
31 1 0
0x00000000 x Reset
XTS_AES_DESTROY Write 1 to destroy encrypted result. (WO)

Register 19.8. XTS_AES_STATE_REG (0x0058)
E
AT
ST
S_
)
ed
AE
rv
S_
se
XT
(re
31 2 1 0
0x00000000 0x0 Reset
XTS_AES_STATE Indicates the status of the Manual Encryption block. (RO)
• 0x0 (XTS_AES_IDLE): idle;
• 0x1 (XTS_AES_BUSY): busy with encryption;
RY
• 0x2 (XTS_AES_DONE): encryption is completed, but the encrypted result is not accessible to
SPI;
• 0x3 (XTS_AES_RELEASE): encrypted result is accessible to SPI.
A
Register 19.9. XTS_AES_DATE_REG (0x005C)
IN TE
DA
S_
d)
AE
e
rv
S_
se
XT
(re
31 30 29 0
IM
0 0 0x20200111 Reset
XTS_AES_DATE Version control register. (R/W)

EL
PR

20 Clock Glitch Detection
20 Clock Glitch Detection

时钟毛刺检测
20.1 Overview
1.
The概述
Clock Glitch Detection module on ESP32-S3 detects glitches in external crystal XTAL_CLK signals, and
为提升a ESP32-S2
generates signal (see Chapter 6 Reset and Clock) whenXTAL
system reset的安全性能，防止攻击者通过给外部晶振附加毛刺，使芯片进入异常状态，
detecting glitches to reset the whole
digital circuit including RTC.ESP32-S2
从而实施对芯片的攻击， By doing so, it prevents attackers,Glitch_Detect)
搭载了毛刺检测模块 from injecting glitches on external crystal
，用于检测从外部晶振输入的
XTAL_CLK clock
XTAL_CLK to compromise ESP32-S3 and thus strengthens chip security.
是否携带毛刺，并在检测到毛刺后，发送中断或者产生系统复位信号。
20.2
2. Functional Description
功能描述
RY
20.2.1 Clock Glitch Detection
2.1 毛刺检测
The Clock Glitch Detection module on ESP32-S3 monitors input clock signals from XTAL_CLK. If it detects a
ESP32-S2
glitch, 的毛刺检测模块将对输入芯片的
namely a clock XTAL_CLK
pulse (a or b in the figure below) shorter than 3 ns, input clock signals ,a
with a width 时钟信号进行检测，当时钟的脉宽或
from :)小
于 3ns 时，将认为检测到毛刺，触发毛刺检测信号
XTAL_CLK are blocked. ,屏蔽输入的 XTAL_CLK 时钟信号。
A
a a
IN
XTAL_CLK
b
IM
Figure 201. XTAL_CLK Pulse Width
2.2 中断及复位
20.2.2 Reset
EL
当毛刺检测信号触发后，毛刺检测模块将向系统发送中断,GLITCH_DET_INT)，如果
Once detecting a glitch on XTAL_CLK that affects the circuit’s normal operation, the Clock Glitch Detection
RTC_CNTL_GLITCH_RST_EN 使能，将触发系统级复位。
module triggers a system reset if RTC_CNTL_GLITCH_RST_EN bit is enabled. By default, this bit is set to enable
a reset.
PR

21 Random Number Generator (RNG)
21.1 Introduction
The ESP32-S3 contains a true random number generator, which generates 32-bit random numbers that can be
used for cryptographical operations, among other things.
21.2 Features
The random number generator in ESP32-S3 generates true random numbers, which means random number
generated from a physical process, rather than by means of an algorithm. No number generated within the
RY
specified range is more or less likely to appear than any other number.

Every 32-bit value that the system reads from the RNG_DATA_REG register of the random number generator is a
true random number. These true random numbers are generated based on the thermal noise in the system and
A
the asynchronous clock mismatch.
Thermal noise comes from the high-speed ADC or SAR ADC or both. Whenever the high-speed ADC or SAR
IN
ADC is enabled, bit streams will be generated and fed into the random number generator through an XOR logic
gate as random seeds.
When the RTC20M_CLK clock is enabled for the digital core, the random number generator will also sample
RTC20M_CLK (20 MHz) as a random bit seed. RTC20M_CLK is an asynchronous clock source and it increases
IM
the RNG entropy by introducing circuit metastability. However, to ensure maximum entropy, it’s recommended to
always enable an ADC source as well.
Random bit
SAR ADC
seeds XOR
XOR
EL
Random RNG_DATA_REG
Number
Generator
High Speed Random bit
ADC seeds
Random bit
RTC20M_CLK
seeds
PR
Figure 211. Noise Source
When there is noise coming from the SAR ADC, the random number generator is fed with a 2-bit entropy in one
clock cycle of RTC20M_CLK (20 MHz), which is generated from an internal RC oscillator (see Chapter 6 Reset
and Clock for details). Thus, it is advisable to read the RNG_DATA_REG register at a maximum rate of 500 kHz to
obtain the maximum entropy.
When there is noise coming from the high-speed ADC, the random number generator is fed with a 2-bit entropy
in one APB clock cycle, which is normally 80 MHz. Thus, it is advisable to read the RNG_DATA_REG register at a
maximum rate of 5 MHz to obtain the maximum entropy.


When using the random number generator, make sure at least either the SAR ADC, high-speed ADC, or
RTC20M_CLK is enabled. Otherwise, pseudo-random numbers will be returned.
• SAR ADC can be enabled by using the DIG ADC controller. For details, please refer to Chapter 6 On-Chip
Sensors and Analog Signal Processing [to be added later].
• High-speed ADC is enabled automatically when the Wi-Fi or Bluetooth modules is enabled.
• RTC20M_CLK is enabled by setting the RTC_CNTL_DIG_CLK20M_EN bit in the

RTC_CNTL_CLK_CONF_REG register.
RY
Note:
Note that, when the Wi-Fi module is enabled, the value read from the high-speed ADC can be saturated in some extreme
cases, which lowers the entropy. Thus, it is advisable to also enable the SAR ADC as the noise source for the random
number generator for such cases.
When using the random number generator, read the RNG_DATA_REG register multiple times until sufficient
A
random numbers have been generated. Ensure the rate at which the register is read does not exceed the
frequencies described in section 21.3 above. IN
The address in the following table is relative to the random number generator base address provided in Table 3-4
in Chapter 3 System and Memory.
IM
RNG_DATA_REG Random number data 0x0110 RO
EL
21.6 Register
The address in this section is relative to the random number generator base address provided in Table 3-4 in
Register 21.1. RNG_DATA_REG (0x0110)

PR
31 0
0x00000000 Reset
RNG_DATA Random number source. (RO)

22 UART Controller (UART)
22.1 Overview
In embedded system applications, data are required to be transferred in a simple way with minimal system
resources. This can be achieved by a Universal Asynchronous Receiver/Transmitter (UART), which flexibly
exchanges data with other peripheral devices in full-duplex mode. ESP32-S3 has three UART controllers
compatible with various UART devices. They support Infrared Data Association (IrDA) and RS485
transmission.
Each of the three UART controllers has a group of registers that function identically. In this chapter, the three
RY
UART controllers are referred to as UARTn, in which n denotes 0, 1, or 2.
A UART is a character-oriented data link for asynchronous communication between devices. Such
communication does not provide any clock signal to send data. Therefore, in order to communicate successfully,
the transmitter and the receiver must operate at the same baud rate with the same stop bit and parity bit.
A UART data frame usually begins with one start bit, followed by data bits, one parity bit (optional) and one or
A
more stop bits. UART controllers on ESP32-S3 support various lengths of data bits and stop bits. These
controllers also support software and hardware flow control as well as GDMA for seamless high-speed data
transfer. This allows developers to use multiple UART ports at minimal software cost.
22.2 Features
IN
Each UART controller has the following features:
IM
• Three clock sources that can be divided
• Programmable baud rate
• 1024 x 8-bit RAM shared by TX FIFOs and RX FIFOs of the three UART controllers
• Full-duplex asynchronous communication

EL
• Automatic baud rate detection of input signals
• Data bits ranging from 5 to 8
• Stop bits of 1, 1.5, 2 or 3 bits

PR
• Parity bit
• Special character AT_CMD detection
• RS485 protocol
• IrDA protocol
• High-speed data communication using GDMA
• UART as wake-up source
• Software and hardware flow control

22.3 UART Structure
A RY
IN
IM
Figure 221. UART Structure
Figure 22-1 shows the basic structure of a UART controller. A UART controller works in two clock domains,
namely APB_CLK domain and Core Clock domain (the UART Core’s clock domain). The UART Core has three
EL
clock sources: 80 MHz APB_CLK, FOSC_CLK and external crystal clock XTAL_CLK (for details, please refer to
Chapter 6 Reset and Clock), which are selected by configuring UART_SCLK_SEL. The selected clock source is
divided by a divider to generate clock signals that drive the UART Core.
A UART controller is broken down into two parts: a transmitter and a receiver.
PR
The transmitter contains a FIFO, called TX FIFO (or Tx_FIFO), which buffers data to be sent. Software can write
data to the Tx_FIFO either via the APB bus, or using GDMA. Tx_FIFO_Ctrl controls writing and reading the
Tx_FIFO. When Tx_FIFO is not empty, Tx_FSM reads data bits in the data frame via Tx_FIFO_Ctrl, and converts
them into a bitstream. The levels of output signal txd_out can be inverted by configuring UART_TXD_INV
field.
The receiver also contains a FIFO, called RX FIFO (or Rx_FIFO), which buffers received data. The levels of input
signal rxd_in can be inverted by configuring UART_RXD_INV field. Baudrate_Detect measures the baud rate of
input signal rxd_in by detecting its minimum pulse width. Start_Detect detects the start bit in a data frame. If the
start bit is detected, Rx_FSM stores data bits in the data frame into Rx_FIFO by Rx_FIFO_Ctrl. Software can read
data from Rx_FIFO via the APB bus, or receive data using GDMA.
HW_Flow_Ctrl controls rxd_in and txd_out data flows by standard UART RTS and CTS flow control signals
(rtsn_out and ctsn_in). SW_Flow_Ctrl controls data flows by automatically adding special characters to outgoing

data and detecting special characters in incoming data.
When a UART controller is in Light-sleep mode (see Chapter 7 Low-Power Management (RTC_CNTL) [to be
added later] for more details), Wakeup_Ctrl counts up rising edges of rxd_in. When the number reaches
UART_ACTIVE_THRESHOLD + 2, a wake_up signal is generated and sent to RTC, which then wakes up the
ESP32-S3 chip.

22.4.1 Clock and Reset
UART controllers are asynchronous. their configuration registers, TX FIFOs, and RX FIFOs are in APB_CLK
RY
domain, while the module controlling transmission and reception (i.e. UART Core) is in Core Clock domain. The
latter can be sourced out of three clocks, namely APB_CLK, FOSC_CLK and external crystal clock XTAL_CLK,
which can be selected by configuring UART_SCLK_SEL. The selected clock source can be divided. This divider
supports fractional division, and the divisor is equal to:
U ART _SCLK_DIV _B
U ART _SCLK_DIV _N U M +
U ART _SCLK_DIV _A
A
The divisor ranges from 1 ~ 256.
When the frequency of the UART Core’s clock is higher than the frequency needed to generate baud rate, the
IN
UART Core can be clocked at a lower frequency by the divider, in order to reduce power consumption. Usually,
the UART Core’s clock frequency is lower than the APB_CLK’s frequency, and can be divided by the largest
divisor value when higher than the frequency needed to generate baud rate. The frequency of the UART Core’s
clock can also be at most twice higher than the APB_CLK. The clock for the UART transmitter and the UART
IM
receiver can be controlled independently. To enable the clock for the UART transmitter, UART_TX_SCLK_EN
shall be set; to enable the clock for the UART receiver, UART_RX_SCLK_EN shall be set.
Section 22.5 explains the procedure to ensure that the configured register values are synchronized between
APB_CLK domain and Core Clock domain.
EL
Section 22.5.2.1 explains the procedure to reset the whole UART controller. Note that it is not recommended to
only reset the APB clock domain module or UART Core.
PR

22.4.2 UART RAM
A RY
Figure 222. UART Controllers Sharing RAM
All three UART controllers on ESP32-S3 share 1024 × 8 bits of RAM. As Figure 22-2 illustrates, the RAM is
IN
divided into 8 blocks, each has 128 × 8 bits. Figure 22-2 shows how many RAM blocks are allocated by default
to TX and RX FIFOs for each of the three UART controllers. UARTn Tx_FIFO can be expanded by configuring
UART_TX_SIZE, while UARTn Rx_FIFO can be expanded by configuring UART_RX_SIZE. Some limits are
imposed:
IM
• UART0 Tx_FIFO can be increased up to 8 blocks (the whole RAM);
• UART1 Tx_FIFO can be increased up to 7 blocks (from offset 128 to the end address);
• UART2 Tx_FIFO can be increased up to 6 blocks (from offset 256 to the end address);
EL
• UART0 Rx_FIFO can be increased up to 4 blocks (from offset 512 to the end address);
• UART1 Rx_FIFO can be increased up to 3 blocks (from offset 640 to the end address);
• UART2 Rx_FIFO can be increased up to 2 blocks (from offset 768 to the end address).
Please note that starting addresses of all FIFOs are fixed, so expanding one FIFO may take up the default space
PR
of other FIFOs. For example, by setting UART_TX_SIZE of UART0 to 2, the size of UART0 Tx_FIFO is increased
by 128 bytes (from offset 0 to offset 255). In this case, UART0 Tx_FIFO takes up the default space for UART1
Tx_FIFO, and UART1’s transmitting function cannot be used as a result.
When neither of the three UART controllers is active, RAM can enter low-power mode by setting
UART_MEM_FORCE_PD.
UARTn Tx_FIFO is reset by setting UART_TXFIFO_RST. UARTn Rx_FIFO is reset by setting

UART_RXFIFO_RST.
The ”empty” signal threshold for Tx_FIFO is configured by setting UART_TXFIFO_EMPTY_THRHD. When data
stored in Tx_FIFO is less than UART_TXFIFO_EMPTY_THRHD, a UART_TXFIFO_EMPTY_INT interrupt is
generated. The ”full” signal threshold for Rx_FIFO is configured by setting UART_RXFIFO_FULL_THRHD. When
data stored in Rx_FIFO is equal to or greater than UART_RXFIFO_FULL_THRHD, a UART_RXFIFO_FULL_INT

interrupt is generated. In addition, when Rx_FIFO receives more data than its capacity, a
UART_RXFIFO_OVF_INT interrupt is generated.
TX FIFO and RX FIFO can be accessed via the APB bus or GDMA. Access via the APB bus is performed through
register UART_FIFO_REG. You can put data into TX FIFO by writing UART_RXFIFO_RD_BYTE, and get data in
RX FIFO by reading this exact same field. For access via GDMA, please refer to Section 22.4.10.
22.4.3 Baud Rate Generation and Detection
22.4.3.1 Baud Rate Generation
Before a UART controller sends or receives data, the baud rate should be configured by setting corresponding
RY
registers. The baud rate generator of a UART controller functions by dividing the input clock source. It can divide
the clock source by a fractional amount. The divisor is configured by UART_CLKDIV_REG: UART_CLKDIV for the
integer part, and UART_CLKDIV_FRAG for the fractional part. When using the 80 MHz input clock, the UART
controller supports a maximum baud rate of 5 Mbaud.
The divisor of the baud rate is equal to

U ART _CLKDIV _F RAG
A
U ART _CLKDIV +
16
meaning that the final baud rate is equal to IN
IN P U T _F REQ
U ART _CLKDIV + U ART _CLKDIV
16
_F RAG
where INPUT_FREQ is the frequency of UART Core’s source clock. For example, if UART_CLKDIV = 694 and
UART_CLKDIV_FRAG = 7 then the divisor value is
IM
7
694 + = 694.4375
16
When UART_CLKDIV_FRAG is 0, the baud rate generator is an integer clock divider where an output pulse is
generated every UART_CLKDIV input pulses.
EL
When UART_CLKDIV_FRAG is not 0, the divider is fractional and the output baud rate clock pulses are not
strictly uniform. As shown in Figure 22-3, for every 16 output pulses, the frequency of some pulses is
INPUT_FREQ/(UART_CLKDIV + 1), and the frequency of the other pulses is INPUT_FREQ/UART_CLKDIV. A total
of UART_CLKDIV_FRAG output pulses are generated by dividing (UART_CLKDIV + 1) input pulses, and the
remaining (16 - UART_CLKDIV_FRAG) output pulses are generated by dividing UART_CLKDIV input
pulses.
PR
The output pulses are interleaved as shown in Figure 22-3 below, to make the output timing more uniform:
Figure 223. UART Controllers Division

To support IrDA (see Section 22.4.6 for details), the fractional clock divider for IrDA data transmission generates
clock signals divided by 16 × UART_CLKDIV_REG. This divider works similarly as the one elaborated above: it
takes UART_CLKDIV/16 as the integer value and the lowest four bits of UART_CLKDIV as the fractional
value.
22.4.3.2 Baud Rate Detection
Automatic baud rate detection (Autobaud) on UARTs is enabled by setting UART_AUTOBAUD_EN. The
Baudrate_Detect module shown in Figure 22-1 filters any noise whose pulse width is shorter than
UART_GLITCH_FILT.
Before communication starts, the transmitter can send random data to the receiver for baud rate detection.
RY
UART_LOWPULSE_MIN_CNT stores the minimum low pulse width, UART_HIGHPULSE_MIN_CNT stores the
minimum high pulse width, UART_POSEDGE_MIN_CNT stores the minimum pulse width between two rising
edges, and UART_NEGEDGE_MIN_CNT stores the minimum pulse width between two falling edges. These four
fields are read by software to determine the transmitter’s baud rate.
A
IN
IM
Figure 224. The Timing Diagram of Weak UART Signals Along Falling Edges
Baud rate can be determined in the following three ways:
1. Normally, to avoid sampling erroneous data along rising or falling edges in metastable state, which results in
EL
inaccuracy of UART_LOWPULSE_MIN_CNT or UART_HIGHPULSE_MIN_CNT, use a weighted average of

these two values to eliminate errors. In this case, baud rate is calculated as follows:
fclk
Buart =
(UART_LOWPULSE_MIN_CNT + UART_HIGHPULSE_MIN_CNT + 2)/2
PR
2. If UART signals are weak along falling edges as shown in Figure 22-4, which leads to inaccurate average of
UART_LOWPULSE_MIN_CNT and UART_HIGHPULSE_MIN_CNT, use UART_POSEDGE_MIN_CNT to
determine the transmitter’s baud rate as follows:
fclk
Buart =
(UART_POSEDGE_MIN_CNT + 1)/2
3. If UART signals are weak along rising edges, use UART_NEGEDGE_MIN_CNT to determine the
transmitter’s baud rate as follows:
fclk
Buart =
(UART_NEGEDGE_MIN_CNT + 1)/2

22.4.4 UART Data Frame
Figure 225. Structure of UART Data Frame
RY
Figure 22-5 shows the basic structure of a data frame. A frame starts with one START bit, and ends with STOP
bits which can be 1, 1.5, 2 or 3 bits long, configured by UART_STOP_BIT_NUM, UART_DL1_EN and
UART_DL0_EN. The START bit is logical low, whereas STOP bits are logical high.
The actual data length can be anywhere between 5 ~ 8 bits, configured by UART_BIT_NUM. When
A
UART_PARITY_EN is set, a parity bit is added after data bits. UART_PARITY is used to choose even parity or
odd parity. When the receiver detects a parity bit error in data received, a UART_PARITY_ERR_INT interrupt is
generated, and the erroneous data are still stored into the RX FIFO. When the receiver detects a data frame error,
IN
a UART_FRM_ERR_INT interrupt is generated, and the erroneous data by default is stored into the RX
FIFO.
If all data in Tx_FIFO have been sent, a UART_TX_DONE_INT interrupt is generated. After this, if the
UART_TXD_BRK bit is set then the transmitter will send several low level bits, namely delimiters, to separate data
IM
packets. The number of low level bits is configured by UART_TX_BRK_NUM. Once the transmitter has sent all
delimiters, a UART_TX_BRK_DONE_INT interrupt is generated. The minimum interval between data frames can
be configured using UART_TX_IDLE_NUM. If the transmitter stays idle for UART_TX_IDLE_NUM or more time (in
the unit of bit time, i.e. the time it takes to transfer one bit), a UART_TX_BRK_IDLE_DONE_INT interrupt is
generated.
EL
PR
Figure 226. AT_CMD Character Structure
Figure 22-6 is the structure of a special character AT_CMD. If the receiver constantly receives AT_CMD_CHAR
and the following conditions are met, a UART_AT_CMD_CHAR_DET_INT interrupt is generated. The specific
value of AT_CMD_CHAR can be read from UARTn_AT_CMD_CHAR.
• The interval between the first AT_CMD_CHAR and the last non-AT_CMD_CHAR character is at least
UART_PRE_IDLE_NUM cycles.
• The interval between two AT_CMD_CHAR characters is less than UART_RX_GAP_TOUT cycles.
• The number of AT_CMD_CHAR characters is equal to or greater than UART_CHAR_NUM.

• The interval between the last AT_CMD_CHAR character and next non-AT_CMD_CHAR character is at least
UART_POST_IDLE_NUM cycles.
22.4.5 RS485
All three UART controllers support RS485 protocol. This protocol uses differential signals to transmit data, so it
can communicate over longer distances at higher bit rates than RS232. RS485 has two-wire half-duplex mode
and four-wire full-duplex modes. UART controllers support two-wire half-duplex transmission and bus snooping.
In a two-wire RS485 multidrop network, there can be 32 slaves at most.
22.4.5.1 Driver Control
RY
As shown in Figure 22-7, in a two-wire multidrop network, an external RS485 transceiver is needed for differential
to single-ended conversion. A RS485 transceiver contains a driver and a receiver. When a UART controller is not
in transmitter mode, the connection to the differential line can be broken by disabling the driver. When the DE
(Driver Enable) signal is 1, the driver is enabled; when DE is 0, the driver is disabled.
The UART receiver converts differential signals to single-ended signals via an external receiver. RE is the enable
A
control signal for the receiver. When RE is 0, the receiver is enabled; when RE is 1, the receiver is disabled. If RE
is configured as 0, the UART controller is allowed to snoop data on the bus, including data sent by itself.
DE can be controlled by either software or hardware. To reduce the cost of software, DE is controlled by
IN
hardware in our design. As shown in Figure 22-7, DE is connected to dtrn_out of UART (please refer to Section
22.4.9.1 for more details).
IM
EL
Figure 227. Driver Control Diagram in RS485 Mode
22.4.5.2 Turnaround Delay

PR
By default, all three UART controllers work in receiver mode. When a UART controller is switched from
transmitter mode to receiver mode, the RS485 protocol requires a turnaround delay of one cycle after the stop
bit. The UART transmitter supports adding a turnaround delay of one cycle not only before the start bit but also
after the stop bit. When UART_DL0_EN is set, a turnaround delay of one cycle is added before the start bit;
when UART_DL1_EN is set, a turnaround delay of one cycle is added after the stop bit.
22.4.5.3 Bus Snooping
In a two-wire multidrop network, UART controllers support bus snooping if RE of the external RS485 transceiver
is 0. By default, a UART controller is not allowed to transmit and receive data simultaneously. If
UART_RS485TX_RX_EN is set and the external RS485 transceiver is configured as in Figure 22-7, a UART

controller may receive data in transmitter mode and snoop the bus. If UART_RS485RXBY_TX_EN is set, a UART
controller may transmit data in receiver mode.
All three UART controllers can snoop data sent by themselves. In transmitter mode, when a UART controller
monitors a collision between data sent and data received, a UART_RS485_CLASH_INT interrupt is generated;
when it monitors a data frame error, a UART_RS485_FRM_ERR_INT interrupt is generated; when it monitors a
polarity error, a UART_RS485_PARITY_ERR_INT is generated.
22.4.6 IrDA
IrDA protocol consists of three layers, namely the physical layer, the link access protocol, and the link
management protocol. The three UART controllers implement IrDA’s physical layer. In IrDA encoding, a UART
RY
controller supports data rates up to 115.2 kbit/s (SIR, or serial infrared mode). As shown in Figure 22-8, the IrDA
encoder converts a NRZ (non-return to zero code) signal to a RZI (return to zero code) signal and sends it to the
external driver and infrared LED. This encoder uses modulated signals whose pulse width is 3/16 bits to indicate
logic “0”, and low levels to indicate logic “1”. The IrDA decoder receives signals from the infrared receiver and
converts them to NRZ signals. In most cases, the receiver is high when it is idle, and the encoder output polarity
is the opposite of the decoder input polarity. If a low pulse is detected, it indicates that a start bit has been
A
received.
When IrDA function is enabled, one bit is divided into 16 clock cycles. If the bit to be sent is zero, then the 9th,
IN
10th and 11th clock cycle are high.
IM
EL
PR
Figure 228. The Timing Diagram of Encoding and Decoding in SIR mode
The IrDA transceiver is half-duplex, meaning that it cannot send and receive data simultaneously. As shown in
Figure 22-9, IrDA function is enabled by setting UART_IRDA_EN. When UART_IRDA_TX_EN is set (high), the
IrDA transceiver is enabled to send data and not allowed to receive data; when UART_IRDA_TX_EN is reset (low),
the IrDA transceiver is enabled to receive data and not allowed to send data.

Figure 229. IrDA Encoding and Decoding Diagram
RY
22.4.7 Wakeup
UART0 and UART1 can be set as a wake-up source for Light-sleep mode. To be specific Wakeup_Ctrl counts up
the rising edges of rxd_in, and when this count becomes greater than UART_ACTIVE_THRESHOLD + 2, a
wake_up signal is generated and sent to RTC, which then wakes ESP32-S3 up.
A
22.4.8 Loopback Test
UARTn supports loopback testing, which can be enabled by setting UART_LOOPBACK. When loopback testing
IN
is enabled, UART output signal txd_out is connected to its input signal rxd_in, rtsn_out is connected to ctsn_in,
and dtrn_out is connected to dsrn_out. Data are then sent out through txd_out. If the data received match the
data sent, it indicates that UARTn controller is working properly.
IM
22.4.9 Flow Control
UART controllers have two ways to control data flow, namely hardware flow control and software flow control.
Hardware flow control is achieved using output signal rtsn_out and input signal dsrn_in. Software flow control is
achieved by inserting special characters (XON or XOFF) in data flow sent and detecting special characters in data
flow received.
EL
PR

22.4.9.1 Hardware Flow Control
A RY
IN
Figure 2210. Hardware Flow Control Diagram
IM
Figure 22-10 shows hardware flow control of a UART controller. Hardware flow control uses output signal
rtsn_out and input signal dsrn_in. Figure 22-11 illustrates how these signals are connected between UART on
ESP32-S3 (hereinafter referred to as IU0) and the external UART (hereinafter referred to as EU0).
When rtsn_out of IU0 is low, EU0 is allowed to send data; when rtsn_out of IU0 is high, EU0 is notified to stop
EL
sending data until rtsn_out of IU0 returns to low. The output signal rtsn_out can be controlled in two ways.
• Software control: Enter this mode by clearing UART_RX_FLOW_EN to 0. In this mode, the level of rtsn_out
is changed by configuring UART_SW_RTS.
• Hardware control: Enter this mode by setting UART_RX_FLOW_EN to 1. In this mode, rtsn_out is pulled
high when data in Rx_FIFO exceeds UART_RX_FLOW_THRHD.
PR
Figure 2211. Connection between Hardware Flow Control Signals

When ctsn_in of IU0 is low, IU0 is allowed to send data; when ctsn_in is high, IU0 is not allowed to send data.
When IU0 detects an edge change on ctsn_in, a UART_CTS_CHG_INT interrupt is generated.
If dtrn_out of IU0 is high, it indicates that IU0 is ready to transmit data. dtrn_out is generated by configuring the
UART_SW_DTR field. When the IU0 transmitter detects a edge change on dsrn_in, a UART_DSR_CHG_INT
interrupt is generated. After this interrupt is detected, software can obtain the level of input signal dsrn_in by
reading UART_DSRN. If dsrn_in is high, it indicates that EU0 is ready to transmit data.
In a two-wire RS485 multidrop network enabled by setting UART_RS485_EN, dtrn_out is generated by hardware
and used for transmit/receive turnaround. When data transmission starts, dtrn_out is pulled high and the external
driver is enabled; when data transmission completes, dtrn_out is pulled low and the external driver is disabled.
Please note that when there is turnaround delay of one cycle added after the stop bit, dtrn_out is pulled low after
RY
the delay.
22.4.9.2 Software Flow Control
Instead of CTS/RTS lines, software flow control uses XON/XOFF characters to start or stop data transmission.
Such flow control can be enabled by setting UART_SW_FLOW_CON_EN to 1.
A
When choosing software flow control, the hardware automatically detects if XON and XOFF characters are used
in data flow, and generates a UART_SW_XOFF_INT or a UART_SW_XON_INT interrupt accordingly. When XOFF
character is detected, the transmitter stops data transmission once the current byte has been transmitted; when
IN
XON character is detected, the transmitter starts data transmission. In addition, software can force the
transmitter to stop sending data or to start sending data by setting respectively UART_FORCE_XOFF or
UART_FORCE_XON.
Software determines whether to insert flow control characters according to the remaining room in the RX FIFO.
IM
When UART_SEND_XOFF is set, the transmitter sends an XOFF character configured by UART_XOFF_CHAR
after the current byte in transmission; when UART_SEND_XON is set, the transmitter sends an XON character
configured by UART_XON_CHAR after the current byte in transmission. If the RX FIFO of a UART controller
stores more data than UART_XOFF_THRESHOLD, UART_SEND_XOFF is set by hardware. As a result, the
EL
transmitter sends an XOFF character configured by UART_XOFF_CHAR after the current byte in transmission. If
the RX FIFO of a UART controller stores less data than UART_XON_THRESHOLD, UART_SEND_XON is set by
hardware. As a result, the transmitter sends an XON character configured by UART_XON_CHAR after the current
byte in transmission.
22.4.10 GDMA Mode

PR
All three UART controllers on ESP32-S3 share one TX/RX GDMA (general direct memory access) channel via
UHCI. In GDMA mode, UART controllers support the decoding and encoding of HCI data packets. The
UHCI_UARTn_CE field determines which UART controller occupies the GDMA TX/RX channel.

Figure 2212. Data Transfer in GDMA Mode
RY
Figure 22-12 shows how data are transferred using GDMA. Before GDMA receives data, software prepares an
inlink (i.e. a linked list of receive descriptors. For details, see Chapter 2 GDMA Controller (GDMA)).
GDMA_INLINK_ADDR_CHn points to the first receive descriptor in the inlink. After GDMA_INLINK_START_CHn
is set, UHCI passes data that UART has received to the decoder. The decoded data are then stored into the
RAM pointed by the inlink under the control of GDMA.
A
Before GDMA sends data, software prepares an outlink and data to be sent. GDMA_OUTLINK_ADDR_CHn
points to the first transmit descriptor in the outlink. After GDMA_OUTLINK_START_CHn is set, GDMA reads data
from the RAM pointed by outlink. The data are then encoded by the encoder, and sent sequentially by the UART
transmitter.
IN
HCI data packets have separators at the beginning and the end, with data bits in the middle (separators + data
bits + separators). The encoder inserts separators in front of and after data bits, and replaces data bits identical
IM
to separators with special characters (i.e. escape characters). The decoder removes separators in front of and
after data bits, and replaces escape characters with separators. There can be more than one continuous
separator at the beginning and the end of a data packet. The separator is configured by UHCI_SEPER_CHAR,
0xC0 by default. The escape characters are configured by UHCI_ESC_SEQ0_CHAR0 (0xDB by default) and
UHCI_ESC_SEQ0_CHAR1 (0xDD by default). When all data have been sent, a
EL
GDMA_OUT_TOTAL_EOF_CHn_INT interrupt is generated. When all data have been received, a

GDMA_IN_SUC_EOF_CHn_INT is generated.
22.4.11 UART Interrupts

• UART_AT_CMD_CHAR_DET_INT: Triggered when the receiver detects an AT_CMD character.
PR
• UART_RS485_CLASH_INT: Triggered when a collision is detected between the transmitter and the receiver
in RS485 mode.
• UART_RS485_FRM_ERR_INT: Triggered when an error is detected in the data frame sent by the
transmitter in RS485 mode.
• UART_RS485_PARITY_ERR_INT: Triggered when an error is detected in the parity bit sent by the
transmitter in RS485 mode.
• UART_TX_DONE_INT: Triggered when all data in the TX FIFO have been sent.
• UART_TX_BRK_IDLE_DONE_INT: Triggered when the transmitter stays idle after sending the last data bit.
The minimum amount of time marking the transmitter state as idle is determined by the configurable
threshold value.

• UART_TX_BRK_DONE_INT: Triggered when the transmitter has sent all NULL characters following the
complete transmission of data from the TX FIFO.
• UART_GLITCH_DET_INT: Triggered when the receiver detects a glitch in the middle of the start bit.
• UART_SW_XOFF_INT: Triggered when UART_SW_FLOW_CON_EN is set and the receiver receives a XOFF
character.
• UART_SW_XON_INT: Triggered when UART_SW_FLOW_CON_EN is set and the receiver receives a XON
character.
• UART_RXFIFO_TOUT_INT: Triggered when the receiver takes more time than UART_RX_TOUT_THRHD to
receive one byte.
RY
• UART_BRK_DET_INT: Triggered when the receiver detects a NULL character after stop bits.
• UART_CTS_CHG_INT: Triggered when the receiver detects an edge change on CTSn signals.
• UART_DSR_CHG_INT: Triggered when the receiver detects an edge change on DSRn signals.
• UART_RXFIFO_OVF_INT: Triggered when the receiver receives more data than the capacity of the RX FIFO.
A
• UART_FRM_ERR_INT: Triggered when the receiver detects a data frame error.
• UART_PARITY_ERR_INT: Triggered when the receiver detects a parity error.

IN
• UART_TXFIFO_EMPTY_INT: Triggered when the TX FIFO stores less data than what
UART_TXFIFO_EMPTY_THRHD specifies.
• UART_RXFIFO_FULL_INT: Triggered when the receiver receives more data than what
UART_RXFIFO_FULL_THRHD specifies.
IM
• UART_WAKEUP_INT: Triggered when UART is woken up.
22.4.12 UHCI Interrupts

• UHCI_APP_CTRL1_INT: Triggered when software sets UHCI_APP_CTRL1_INT_RAW.
EL
• UHCI_APP_CTRL0_INT: Triggered when software sets UHCI_APP_CTRL0_INT_RAW.
• UHCI_OUTLINK_EOF_ERR_INT: Triggered when an EOF error is detected in a transmit descriptor.
• UHCI_SEND_A_REG_Q_INT: Triggered when UHCI has sent a series of short packets using always_send.
• UHCI_SEND_S_REG_Q_INT: Triggered when UHCI has sent a series of short packets using single_send.
PR
• UHCI_TX_HUNG_INT: Triggered when UHCI takes too long to read RAM using a GDMA transmit channel.
• UHCI_RX_HUNG_INT: Triggered when UHCI takes too long to receive data using a GDMA receive channel.
• UHCI_TX_START_INT: Triggered when GDMA detects a separator character.
• UHCI_RX_START_INT: Triggered when a separator character has been sent.
22.5 Programming Procedures

22.5.1 Register Type
All UART registers are in APB_CLK domain. According to whether clock domain crossing and synchronization
are required, UART registers that can be configured by software are classified into three types, namely

synchronous registers, static registers, and immediate registers. Synchronous registers are read in Core Clock
domain, and take effect after synchronization. Static registers are also read in Core Clock domain, but would not
change dynamically. Therefore, for static registers, clock domain crossing is not required, and software can turn
on and off the clock for the UART transmitter or receiver to ensure that the configuration sampled in Core Clock
domain is correct. Immediate registers are read in APB_CLK domain, and take effect after being configured via
the APB bus.
22.5.1.1 Synchronous Registers
Since synchronous registers are read in core clock domain, but written in APB_CLK domain, they implement the
clock domain crossing design to ensure that their values sampled in Core Clock domain are correct. These
RY
registers as listed in Table 22-1 are configured as follows:
• Enable register synchronization by clearing UART_UPDATE_CTRL to 0;
• Wait for UART_REG_UPDATE to become 0, which indicates the completion of last synchronization;
• Configure synchronous registers;
• Synchronize the configured values to Core Clock domain by writing 1 to UART_REG_UPDATE.
A
Table 221. UARTn Synchronous Registers
IN
Register Field
UART_CLKDIV_REG UART_CLKDIV_FRAG[3:0]
UART_CLKDIV[11:0]
UART_CONF0_REG UART_AUTOBAUD_EN
IM
UART_ERR_WR_MASK
UART_TXD_INV
UART_RXD_INV
UART_IRDA_EN
UART_TX_FLOW_EN
EL
UART_LOOPBACK
UART_IRDA_RX_INV
UART_IRDA_TX_EN
UART_IRDA_WCTL
UART_IRDA_TX_EN
PR
UART_IRDA_DPLX
UART_STOP_BIT_NUM
UART_BIT_NUM
UART_PARITY_EN
UART_PARITY


Register Field
UART_FLOW_CONF_REG UART_SEND_XOFF
UART_SEND_XON
UART_FORCE_XOFF
UART_FORCE_XON
UART_XONOFF_DEL
UART_SW_FLOW_CON_EN
UART_RS485_CONF_REG UART_RS485_TX_DLY_NUM[3:0]
UART_RS485_RX_DLY_NUM
UART_RS485RXBY_TX_EN
RY
UART_RS485TX_RX_EN
UART_DL1_EN
UART_DL0_EN
UART_RS485_EN
A
22.5.1.2 Static Registers
Static registers, though also read in Core Clock domain, would not change dynamically when UART controllers
IN
are at work, so they do not implement the clock domain crossing design. These registers must be configured
when the UART transmitter or receiver is not at work. In this case, software can turn off the clock for the UART
transmitter or receiver, so that static registers are not sampled in their metastable state. When software turns on
the clock, the configured values are stable to be correctly sampled. Static registers as listed in Table 22-2 are
IM
configured as follows:
• Turn off the clock for the UART transmitter by clearing UART_TX_SCLK_EN, or the clock for the UART
receiver by clearing UART_RX_SCLK_EN, depending on which one (transmitter or receiver) is not at work;
• Configure static registers;

EL
• Turn on the clock for the UART transmitter by writing 1 to UART_TX_SCLK_EN, or the clock for the UART
receiver by writing 1 to UART_RX_SCLK_EN.
Table 222. UARTn Static Registers
Register Field
PR
UART_RX_FILT_REG UART_GLITCH_FILT_EN
UART_GLITCH_FILT[7:0]
UART_SLEEP_CONF_REG UART_ACTIVE_THRESHOLD[9:0]
UART_SWFC_CONF0_REG UART_XOFF_CHAR[7:0]
UART_SWFC_CONF1_REG UART_XON_CHAR[7:0]
UART_IDLE_CONF_REG UART_TX_IDLE_NUM[9:0]
UART_AT_CMD_PRECNT_REG UART_PRE_IDLE_NUM[15:0]
UART_AT_CMD_POSTCNT_REG UART_POST_IDLE_NUM[15:0]
UART_AT_CMD_GAPTOUT_REG UART_RX_GAP_TOUT[15:0]
UART_AT_CMD_CHAR_REG UART_CHAR_NUM[7:0]
UART_AT_CMD_CHAR[7:0]

22.5.1.3 Immediate Registers
Except those listed in Table 22-1 and Table 22-2, registers that can be configured by software are immediate
registers read in APB_CLK domain, such as interrupt and FIFO configuration registers.
22.5.2 Detailed Steps

Figure 22-13 illustrates the process to program UART controllers, namely initializing the UART, configuring the
registers, enabling the transmitter and/or receiver, and finishing data transmission.
A RY
IN
IM
EL
PR
Figure 2213. UART Programming Procedures
22.5.2.1 Initializing UARTn
Initializing UARTn requires two steps: resetting UARTn and enabling register synchronization.
To reset UARTn:

• enable the clock for UART RAM by setting SYSTEM_UART_MEM_CLK_EN to 1;
• enable APB_CLK for UARTn by setting SYSTEM_UARTn_CLK_EN to 1;
• clear SYSTEM_UARTn_RST;
• write 1 to UART_RST_CORE;
• write 1 to SYSTEM_UARTn_RST;
• clear SYSTEM_UARTn_RST;
• clear UART_RST_CORE.
To enable register synchronization, clear UART_UPDATE_CTRL.
RY
22.5.2.2 Configuring UARTn Communication
To configure UARTn communication:
• wait for UART_REG_UPDATE to become 0, which indicates the completion of last synchronization;
• configure static registers (if any) following Section 22.5.1.2;
A
• select the clock source via UART_SCLK_SEL;
• configure divisor of the divider via UART_SCLK_DIV_NUM, UART_SCLK_DIV_A, and UART_SCLK_DIV_B;

IN
• configure the baud rate for transmission via UART_CLKDIV and UART_CLKDIV_FRAG;
• configure data length via UART_BIT_NUM;
• configure odd or even parity check via UART_PARITY_EN and UART_PARITY;

IM
• optional steps depending on application ...
• synchronize the configured values to Core Clock domain by writing 1 to UART_REG_UPDATE.
22.5.2.3 Enabling UARTn

EL
To enable UARTn transmitter:
• configure the TX FIFO’s empty threshold via UART_TXFIFO_EMPTY_THRHD;
• disable UART_TXFIFO_EMPTY_INT interrupt by clearing UART_TXFIFO_EMPTY_INT_ENA;

PR
• write data to be sent to UART_RXFIFO_RD_BYTE;
• clear UART_TXFIFO_EMPTY_INT interrupt by setting UART_TXFIFO_EMPTY_INT_CLR;
• enable UART_TXFIFO_EMPTY_INT interrupt by setting UART_TXFIFO_EMPTY_INT_ENA;
• detect UART_TXFIFO_EMPTY_INT and wait for the completion of data transmission.
To enable UARTn receiver:
• configure RXFIFO’s full threshold via UART_RXFIFO_FULL_THRHD;
• enable UART_RXFIFO_FULL_INT interrupt by setting UART_RXFIFO_FULL_INT_ENA;
• detect UART_TXFIFO_FULL_INT and wait until the RXFIFO is full;

• read data from RXFIFO via UART_RXFIFO_RD_BYTE, and obtain the number of bytes received in RXFIFO
via UART_RXFIFO_CNT.
A RY
IN
IM
EL
PR


22.6.1 UART Register Summary
The addresses in this section are relative to UART Controller base address provided in Table 3-4 in Chapter 3
System and Memory.

FIFO Configuration
UART_FIFO_REG FIFO data register 0x0000 RO
UART_MEM_CONF_REG UART threshold and allocation configuration 0x0060 R/W
UART Interrupt Register
RY
UART_INT_RAW_REG Raw interrupt status 0x0004 R/WTC/SS
UART_INT_ST_REG Masked interrupt status 0x0008 RO
UART_INT_ENA_REG Interrupt enable bits 0x000C R/W
UART_INT_CLR_REG Interrupt clear bits 0x0010 WT
A
UART_CLKDIV_REG Clock divider configuration 0x0014 R/W
UART_RX_FILT_REG RX filter configuration 0x0018 R/W
UART_CONF0_REG Configuration register 0 0x0020 R/W
UART_CONF1_REG
UART_FLOW_CONF_REG
IN
Configuration register 1
Software flow control configuration
0x0024
0x0034
R/W
varies
UART_SLEEP_CONF_REG Sleep mode configuration 0x0038 R/W
UART_SWFC_CONF0_REG Software flow control character configuration 0x003C R/W
IM
UART_SWFC_CONF1_REG Software flow control character configuration 0x0040 R/W
UART_TXBRK_CONF_REG TX break character configuration 0x0044 R/W
UART_IDLE_CONF_REG Frame end idle time configuration 0x0048 R/W
UART_RS485_CONF_REG RS485 mode configuration 0x004C R/W
UART_CLK_CONF_REG UART core clock configuration 0x0078 R/W
EL
Status Register
UART_STATUS_REG UART status register 0x001C RO
UART_MEM_TX_STATUS_REG TX FIFO write and read offset address 0x0064 RO
UART_MEM_RX_STATUS_REG RX FIFO write and read offset address 0x0068 RO
UART_FSM_STATUS_REG UART transmitter and receiver status 0x006C RO
PR
Autobaud Register
UART_LOWPULSE_REG Autobaud minimum low pulse duration register 0x0028 RO
Autobaud minimum high pulse duration
UART_HIGHPULSE_REG 0x002C RO
register
UART_RXD_CNT_REG Autobaud edge change count register 0x0030 RO
UART_POSPULSE_REG Autobaud high pulse register 0x0070 RO
UART_NEGPULSE_REG Autobaud low pulse register 0x0074 RO
AT Escape Sequence Selection Configuration
UART_AT_CMD_PRECNT_REG Pre-sequence timing configuration 0x0050 R/W
UART_AT_CMD_POSTCNT_REG Post-sequence timing configuration 0x0054 R/W
UART_AT_CMD_GAPTOUT_REG Timeout configuration 0x0058 R/W
UART_AT_CMD_CHAR_REG AT escape sequence detection configuration 0x005C R/W


Version Register
UART_DATE_REG UART version control register 0x007C R/W
UART_ID_REG UART ID register 0x0080 varies
22.6.2 UHCI Register Summary

The addresses in this section are relative to UHCI Controller base address provided in Table 3-4 in Chapter 3
System and Memory.
RY
UHCI_CONF0_REG UHCI configuration register 0x0000 R/W
UHCI_CONF1_REG UHCI configuration register 0x0018 varies
UHCI_ESCAPE_CONF_REG Escape character configuration 0x0024 R/W
UHCI_HUNG_CONF_REG Timeout configuration 0x0028 R/W
UHCI_ACK_NUM_REG UHCI ACK number configuration 0x002C varies
A
UHCI_QUICK_SENT_REG UHCI quick_sent configuration register 0x0034 varies
UHCI_REG_Q0_WORD0_REG Q0_WORD0 quick_sent register 0x0038 R/W
UHCI_REG_Q0_WORD1_REG Q0_WORD1 quick_sent register 0x003C R/W
UHCI_REG_Q1_WORD0_REG
UHCI_REG_Q1_WORD1_REG
IN
Q1_WORD0 quick_sent register
Q1_WORD1 quick_sent register
0x0040
0x0044
R/W
R/W
IM
EL

UHCI_ESC_CONF0_REG Escape sequence configuration register 0 0x0070 R/W
PR

UHCI_ESC_CONF3_REG Escape sequence configuration register 3 0x007C R/W
UHCI_PKT_THRES_REG Configuration register for packet length 0x0080 R/W
UHCI Interrupt Register
UHCI_INT_RAW_REG Raw interrupt status 0x0004 varies
UHCI_INT_ST_REG Masked interrupt status 0x0008 RO
UHCI_INT_ENA_REG Interrupt enable bits 0x000C R/W
UHCI_INT_CLR_REG Interrupt clear bits 0x0010 WT
UHCI_APP_INT_SET_REG Software interrupt trigger source 0x0014 WT
UHCI Status Register
UHCI_STATE0_REG UHCI receive status 0x001C RO


UHCI_STATE1_REG UHCI transmit status 0x0020 RO
UHCI_RX_HEAD_REG UHCI packet header register 0x0030 RO
Version Register
UHCI_DATE_REG UHCI version control register 0x0084 R/W
A RY
IN
IM
EL
PR

22.7 Registers
22.7.1 UART Registers
The addresses in this section are relative to UART Controller base address provided in Table 3-4 in Chapter 3
System and Memory.
Register 22.1. UART_FIFO_REG (0x0000)
E
B YT
D_
_R
FO
FI
RX
d)
RY
ve
T_
er
R
s
UA
(re
31 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
UART_RXFIFO_RD_BYTE UARTn accesses FIFO via this field. (RO)
A
Register 22.2. UART_MEM_CONF_REG (0x0060)
IN
HD
HD
RC PU
PD
HR
HR
O E_
E_
_T
_F RC
_T
W
UT
EM FO
E
E
O
IZ
IZ
TO
FL
_M M_
_S
S
X_
X_
X_
RT E
X
)
)
ed
ed
UA T_M
_R
_R
_R
_T
rv
rv
RT
RT
RT
RT
IM
se
se
R
UA
UA
UA
UA
UA
(re
(re
31 29 28 27 26 17 16 7 6 4 3 1 0
0 0 0 0 0 0xa 0x0 0x1 1 0 Reset
UART_RX_SIZE This field is used to configure the amount of RAM allocated for RX FIFO. The default
EL
number is 128 bytes. (R/W)
UART_TX_SIZE This field is used to configure the amount of RAM allocated for TX FIFO. The default
number is 128 bytes. (R/W)
UART_RX_FLOW_THRHD This field is used to configure the maximum amount of data bytes that
can be received when hardware flow control works. (R/W)
PR
UART_RX_TOUT_THRHD This field is used to configure the threshold time that receiver takes
to receive one byte, in the unit of bit time (the time it takes to transfer one bit). The
UART_RXFIFO_TOUT_INT interrupt will be triggered when the receiver takes more time to receive
one byte with UART RX_TOUT_EN set to 1. (R/W)
UART_MEM_FORCE_PD Set this bit to force power down UART RAM. (R/W)
UART_MEM_FORCE_PU Set this bit to force power up UART RAM. (R/W)

Register 22.3. UART_INT_RAW_REG (0x0004)
R X N IT _ AW AW
RT XF ON NT _R AW AW
W
RA
UA T_G _BR _ID _R R_I AW
UA T_T _DO AR ERR _R _R
UA T_R _X F_I INT _R _R

R L K LE AW NT_
RA W
R X _P _ NT INT
R W F _ T T
R X K NT R _R
R X H IN AW W
N
W
T_ A
UA _B IF _IN _R AW
UL _I W
_R IFO RR _R AW
I
UA T_R R_C G_ _R RA
IN _R
UA T_T _BR E_I Y_E INT
UA T_T 485 RM H_I T_
UA T_S _X DE E_I E_
_F TY RA
UA T_T RIT R_ INT W
R R O_ IN AW
XF _E _I AW
R R O_ T AW
L_ NT
R S _F S DE
R S H NT T_
RT XF Y_E INT _R
R W H_ N N
R S _C HA W
R T E UT W
R A ER F_ A
N
O P _
UA T_S ITC _DO _DO
UA T_R 485 _C _RA
UA T_C K_D TO _RA
UA T_P M_ OV T_R
UA T_D S_C T_I _IN
UA T_F FIF G_ T_R
IF M NT
UA T_R 485 LA R_
R S D T
T
UA _R CM _IN
RT T_ UP
O
UA T_A KE
R A
d)
UA T_W
ve
er
R
s
UA
(re
31 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 Reset
RY
UART_RXFIFO_FULL_INT_RAW This interrupt raw bit turns to high level when the receiver receives
more data than what UART_RXFIFO_FULL_THRHD specifies. (R/WTC/SS)
UART_TXFIFO_EMPTY_INT_RAW This interrupt raw bit turns to high level when the amount of data
in TX FIFO is less than what UART_TXFIFO_EMPTY_THRHD specifies. (R/WTC/SS)
UART_PARITY_ERR_INT_RAW This interrupt raw bit turns to high level when the receiver detects a
A
parity error in the data. (R/WTC/SS)
UART_FRM_ERR_INT_RAW This interrupt raw bit turns to high level when the receiver detects a
data frame error. (R/WTC/SS)
IN
UART_RXFIFO_OVF_INT_RAW This interrupt raw bit turns to high level when the receiver receives
more data than the capacity of RX FIFO. (R/WTC/SS)
IM
UART_DSR_CHG_INT_RAW This interrupt raw bit turns to high level when the receiver detects the
edge change of DSRn signal. (R/WTC/SS)
UART_CTS_CHG_INT_RAW This interrupt raw bit turns to high level when the receiver detects the
edge change of CTSn signal. (R/WTC/SS)
EL
UART_BRK_DET_INT_RAW This interrupt raw bit turns to high level when the receiver detects a 0
after the stop bit. (R/WTC/SS)
UART_RXFIFO_TOUT_INT_RAW This interrupt raw bit turns to high level when the receiver takes
more time than UART_RX_TOUT_THRHD to receive a byte. (R/WTC/SS)
PR
UART_SW_XON_INT_RAW This interrupt raw bit turns to high level when the receiver receives an
XON character and UART_SW_FLOW_CON_EN is set to 1. (R/WTC/SS)
UART_SW_XOFF_INT_RAW This interrupt raw bit turns to high level when the receiver receives an
XOFF character and UART_SW_FLOW_CON_EN is set to 1. (R/WTC/SS)
UART_GLITCH_DET_INT_RAW This interrupt raw bit turns to high level when the receiver detects a
glitch in the middle of a start bit. (R/WTC/SS)

Register 22.3. UART_INT_RAW_REG (0x0004)
UART_TX_BRK_DONE_INT_RAW This interrupt raw bit turns to high level when the transmitter com-
pletes sending NULL characters, after all data in TX FIFO are sent. (R/WTC/SS)
UART_TX_BRK_IDLE_DONE_INT_RAW This interrupt raw bit turns to high level when the transmitter
has kept the shortest duration after sending the last data. (R/WTC/SS)
UART_TX_DONE_INT_RAW This interrupt raw bit turns to high level when the transmitter has sent
out all data in FIFO. (R/WTC/SS)
RY
UART_RS485_PARITY_ERR_INT_RAW This interrupt raw bit turns to high level when the receiver
detects a parity error from the echo of the transmitter in RS485 mode. (R/WTC/SS)
UART_RS485_FRM_ERR_INT_RAW This interrupt raw bit turns to high level when the receiver de-
tects a data frame error from the echo of the transmitter in RS485 mode. (R/WTC/SS)
A
UART_RS485_CLASH_INT_RAW This interrupt raw bit turns to high level when a collision is detected
between the transmitter and the receiver in RS485 mode. (R/WTC/SS)
UART_AT_CMD_CHAR_DET_INT_RAW This interrupt raw bit turns to high level when the receiver
IN
detects the configured UART_AT_CMD_CHAR. (R/WTC/SS)
UART_WAKEUP_INT_RAW This interrupt raw bit turns to high level when the input RXD edge
changes more times than what UART_ACTIVE_THRESHOLD specifies in Light-sleep mode.
IM
(R/WTC/SS)
EL
PR

Register 22.4. UART_INT_ST_REG (0x0008)
R X ON NT _S T T
ST
UA T_T _DO AR ERR _ST _S
UA T_R _X F_I INT _S _S

RT LI K_ LE_ T NT_
UA T_G _BR _ID _S R_I T
R X _P _ NT INT
R W OF T_ NT INT
S
T_ T
_
I N _S
UA T_R R_C G_ _S ST
UA T_S _X DE E_I E_
ST
UA T_B FIF _IN _S T
_F TY ST
_R IFO RR _S T
L_ NT
R S _F S DE
R S H NT T_
R W H_ N N
RT XF Y_E INT _S
R
R X N IT _
R A E R F_ T
R R O_ IN T
O P _
XF _E _I T
R R O_ T T
UA _S TC DO DO
R X H INT T
UA T_R 485 _C _ST
UA T_P M_ OV T_S
UA T_D S_C T_I _IN
UA T_C K_D TO _ST
IF M NT
UA T_F FIF G_ _S
UA T_T RIT R_ INT
UL _I
UA T_R 485 LA R_
R S _C HA
R T E UT
R S D T
N
UA _R CM _IN
RT T_ UP
K
UA T_A KE
R A
d)
X
UA T_W
ve
er
R
s
UA
(re
31 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
UART_RXFIFO_FULL_INT_ST This is the status bit for UART_RXFIFO_FULL_INT when
RY
UART_RXFIFO_FULL_INT_ENA is set to 1. (RO)
UART_TXFIFO_EMPTY_INT_ST This is the status bit for UART_TXFIFO_EMPTY_INT when

UART_TXFIFO_EMPTY_INT_ENA is set to 1. (RO)
UART_PARITY_ERR_INT_ST This is the status bit for UART_PARITY_ERR_INT when
A
UART_PARITY_ERR_INT_ENA is set to 1. (RO)
UART_FRM_ERR_INT_ST This is the status bit for UART_FRM_ERR_INT when

UART_FRM_ERR_INT_ENA is set to 1. (RO)
UART_RXFIFO_OVF_INT_ST This is the

IN status bit for UART_RXFIFO_OVF_INT when
UART_RXFIFO_OVF_INT_ENA is set to 1. (RO)
UART_DSR_CHG_INT_ST This is the status bit for UART_DSR_CHG_INT when

IM
UART_DSR_CHG_INT_ENA is set to 1. (RO)
UART_CTS_CHG_INT_ST This is the status bit for UART_CTS_CHG_INT when

UART_CTS_CHG_INT_ENA is set to 1. (RO)
UART_BRK_DET_INT_ST This is the status bit for UART_BRK_DET_INT when

EL
UART_BRK_DET_INT_ENA is set to 1. (RO)
UART_RXFIFO_TOUT_INT_ST This is the status bit for UART_RXFIFO_TOUT_INT when

UART_RXFIFO_TOUT_INT_ENA is set to 1. (RO)
UART_SW_XON_INT_ST This is the status bit for UART_SW_XON_INT when

PR
UART_SW_XON_INT_ENA is set to 1. (RO)
UART_SW_XOFF_INT_ST This is the status bit for UART_SW_XOFF_INT when

UART_SW_XOFF_INT_ENA is set to 1. (RO)
UART_GLITCH_DET_INT_ST This is the status bit for UART_GLITCH_DET_INT when

UART_GLITCH_DET_INT_ENA is set to 1. (RO)
UART_TX_BRK_DONE_INT_ST This is the status bit for UART_TX_BRK_DONE_INT when

UART_TX_BRK_DONE_INT_ENA is set to 1. (RO)

Register 22.4. UART_INT_ST_REG (0x0008)
UART_TX_BRK_IDLE_DONE_INT_ST This is the status bit for UART_TX_BRK_IDLE_DONE_INT

when UART_TX_BRK_IDLE_DONE_INT_ENA is set to 1. (RO)
UART_TX_DONE_INT_ST This is the status bit for UART_TX_DONE_INT when

UART_TX_DONE_INT_ENA is set to 1. (RO)
UART_RS485_PARITY_ERR_INT_ST This is the status bit for UART_RS485_PARITY_ERR_INT

when UART_RS485_PARITY_INT_ENA is set to 1. (RO)
RY
UART_RS485_FRM_ERR_INT_ST This is the status bit for UART_RS485_FRM_ERR_INT when
UART_RS485_FRM_ERR_INT_ENA is set to 1. (RO)
UART_RS485_CLASH_INT_ST This is the status bit for UART_RS485_CLASH_INT when

UART_RS485_CLASH_INT_ENA is set to 1. (RO)
A
UART_AT_CMD_CHAR_DET_INT_ST This is the status bit for UART_AT_CMD_CHAR_DET_INT
when UART_AT_CMD_CHAR_DET_INT_ENA is set to 1. (RO)
UART_WAKEUP_INT_ST This is the status bit for UART_WAKEUP_INT when

UART_WAKEUP_INT_ENA is set to 1. (RO)
IN
IM
EL
PR

Register 22.5. UART_INT_ENA_REG (0x000C)
R X N IT _ A NA
RT XF ON NT _E NA NA
A
EN
UA T_T _DO AR ERR _EN _E
UA T_R _X F_I INT _E _E

UA T_G _BR _ID _E R_I NA
R L K LE NA NT_
R X _P _ NT INT
R W F _ T T
EN A
R X K NT R _E
R X H IN NA A
T_ N
A
UA _B IF _IN _E NA
I
UA T_R R_C G_ _E EN
UL _I A
_R IFO RR _E NA
IN _E
UA T_S _X DE E_I E_
_F TY EN
UA T_T RIT R_ INT A
R R O_ IN NA
XF _E _I NA
L_ NT
R R O_ T NA
R S _F S DE
R S H NT T_
R W H_ N N
RT XF Y_E INT _E
R S _C HA A
R T E UT A
R A ER F_ N
N
O P _
UA T_S ITC _DO _DO
UA T_R 485 _C _EN
UA T_C K_D TO _EN

UA T_D S_C T_I _IN
UA T_P M_ OV T_E
IF M NT
UA T_F FIF G_ T_E
UA T_R 485 LA R_
R S D T
T
UA _R CM _IN
RT T_ UP
O
UA T_A KE
R A
d)
UA T_W
ve
er
R
s
UA
(re
31 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
UART_RXFIFO_FULL_INT_ENA This is the enable bit for UART_RXFIFO_FULL_INT. (R/W)
UART_TXFIFO_EMPTY_INT_ENA This is the enable bit for UART_TXFIFO_EMPTY_INT. (R/W)
UART_PARITY_ERR_INT_ENA This is the enable bit for UART_PARITY_ERR_INT. (R/W)
UART_FRM_ERR_INT_ENA This is the enable bit for UART_FRM_ERR_INT. (R/W)
A
UART_RXFIFO_OVF_INT_ENA This is the enable bit for UART_RXFIFO_OVF_INT. (R/W)
UART_DSR_CHG_INT_ENA This is the enable bit for UART_DSR_CHG_INT. (R/W)

IN
UART_CTS_CHG_INT_ENA This is the enable bit for UART_CTS_CHG_INT. (R/W)
UART_BRK_DET_INT_ENA This is the enable bit for UART_BRK_DET_INT. (R/W)
UART_RXFIFO_TOUT_INT_ENA This is the enable bit for UART_RXFIFO_TOUT_INT. (R/W)

IM
UART_SW_XON_INT_ENA This is the enable bit for UART_SW_XON_INT. (R/W)
UART_SW_XOFF_INT_ENA This is the enable bit for UART_SW_XOFF_INT. (R/W)
UART_GLITCH_DET_INT_ENA This is the enable bit for UART_GLITCH_DET_INT. (R/W)

EL
UART_TX_BRK_DONE_INT_ENA This is the enable bit for UART_TX_BRK_DONE_INT. (R/W)
UART_TX_BRK_IDLE_DONE_INT_ENA This is the enable bit for UART_TX_BRK_IDLE_DONE_INT.

(R/W)
UART_TX_DONE_INT_ENA This is the enable bit for UART_TX_DONE_INT. (R/W)

PR

Register 22.5. UART_INT_ENA_REG (0x000C)
UART_RS485_PARITY_ERR_INT_ENA This is the enable bit for UART_RS485_PARITY_ERR_INT.

(R/W)
UART_RS485_FRM_ERR_INT_ENA This is the enable bit for UART_RS485_PARITY_ERR_INT.

(R/W)
UART_RS485_CLASH_INT_ENA This is the enable bit for UART_RS485_CLASH_INT. (R/W)
UART_AT_CMD_CHAR_DET_INT_ENA This is the enable bit for UART_AT_CMD_CHAR_DET_INT.
RY
(R/W)
UART_WAKEUP_INT_ENA This is the enable bit for UART_WAKEUP_INT. (R/W)
A
IN
IM
EL
PR

Register 22.6. UART_INT_CLR_REG (0x0010)
R X N IT _ LR LR
RT XF ON NT _C LR LR
R
CL
UA T_T _DO AR ERR _C _C
UA T_R _X F_I INT _C _C

UA T_G _BR _ID _C R_I LR
R L K LE LR NT_
R X _P _ NT INT
R W F _ T T
T_ LR
R X K NT R _C
R X H INT LR R
R
UA _B IF _IN _C LR
I
IN _C
UL _I LR
UA T_R R_C G_ _C CL
_R IFO RR _C LR
UA T_S _X DE E_I E_
CL
R A ER F_ LR
R R O_ IN LR
L_ NT
_F TY C
XF _E _I LR
RT XF Y_E INT _C
R S _ F S DE
R R O _ T LR
R S H NT T_
R W H_ N N
R S _C HA R
R T E UT R
N
O P _
UA T_S ITC _DO _DO
UA T_P M_ OV T_C
UA T_R 485 _C _CL
UA T_C K_D TO _CL

UA T_D S_C T_I _IN
UA T_F FIF G_ _C
IF M NT
UA T_T RIT R_ INT
UA T_R 485 LA R_
R S D T
T
UA _R CM _IN
RT T_ UP
O
UA T_A KE
R A
d)
UA T_W
ve
er
R
s
UA
(re
31 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
UART_RXFIFO_FULL_INT_CLR Set this bit to clear the UART_THE RXFIFO_FULL_INT interrupt.
(WT)
UART_TXFIFO_EMPTY_INT_CLR Set this bit to clear the UART_TXFIFO_EMPTY_INT interrupt.

(WT)
UART_PARITY_ERR_INT_CLR Set this bit to clear the UART_PARITY_ERR_INT interrupt. (WT)
A
UART_FRM_ERR_INT_CLR Set this bit to clear the UART_FRM_ERR_INT interrupt. (WT)
UART_RXFIFO_OVF_INT_CLR Set this bit to clear the UART_UART_RXFIFO_OVF_INT interrupt.

(WT)
IN
UART_DSR_CHG_INT_CLR Set this bit to clear the UART_DSR_CHG_INT interrupt. (WT)
UART_CTS_CHG_INT_CLR Set this bit to clear the UART_CTS_CHG_INT interrupt. (WT)

IM
UART_BRK_DET_INT_CLR Set this bit to clear the UART_BRK_DET_INT interrupt. (WT)
UART_RXFIFO_TOUT_INT_CLR Set this bit to clear the UART_RXFIFO_TOUT_INT interrupt. (WT)
UART_SW_XON_INT_CLR Set this bit to clear the UART_SW_XON_INT interrupt. (WT)

EL
UART_SW_XOFF_INT_CLR Set this bit to clear the UART_SW_XOFF_INT interrupt. (WT)
UART_GLITCH_DET_INT_CLR Set this bit to clear the UART_GLITCH_DET_INT interrupt. (WT)
UART_TX_BRK_DONE_INT_CLR Set this bit to clear the UART_TX_BRK_DONE_INT interrupt. (WT)

PR
UART_TX_BRK_IDLE_DONE_INT_CLR Set this bit to clear the UART_TX_BRK_IDLE_DONE_INT

interrupt. (WT)
UART_TX_DONE_INT_CLR Set this bit to clear the UART_TX_DONE_INT interrupt. (WT)
UART_RS485_PARITY_ERR_INT_CLR Set this bit to clear the UART_RS485_PARITY_ERR_INT in-

terrupt. (WT)

Register 22.6. UART_INT_CLR_REG (0x0010)
UART_RS485_FRM_ERR_INT_CLR Set this bit to clear the UART_RS485_FRM_ERR_INT interrupt.

(WT)
UART_RS485_CLASH_INT_CLR Set this bit to clear the UART_RS485_CLASH_INT interrupt. (WT)
UART_AT_CMD_CHAR_DET_INT_CLR Set this bit to clear the UART_AT_CMD_CHAR_DET_INT in-

terrupt. (WT)
UART_WAKEUP_INT_CLR Set this bit to clear the UART_WAKEUP_INT interrupt. (WT)
RY
Register 22.7. UART_CLKDIV_REG (0x0014)
AG
FR
A
V_
IV
DI
D
LK
LK
)
d)
ed
_C
_C
e
rv
rv
RT
RT
se
se
UA
UA
(re
(re
31
0 0 0 0 0 0 0
24
0
23
0x0
20 19
0 0 0
IN
0 0 0 0
12
0
11
0x2b6
0
Reset
UART_CLKDIV The integral part of the frequency divisor. (R/W)

IM
UART_CLKDIV_FRAG The fractional part of the frequency divisor. (R/W)
Register 22.8. UART_RX_FILT_REG (0x0018)

EL
N
_E
LT
LT
FI
I
_F
H_
CH
TC
T
LI
LI
d)
_G
G
ve
T_
RT
r
se
R
UA
UA
(re
31 9 8 7 0
PR
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x8 Reset
UART_GLITCH_FILT When input pulse width is lower than this value, the pulse is ignored. (R/W)
UART_GLITCH_FILT_EN Set this bit to enable RX signal filter. (R/W)

Register 22.9. UART_CONF0_REG (0x0020)
M
UA T_D K_E _M N
R T N AS
R R BA EN
NU
R L R _E
R RD BA N
R RD TX V
R RD W V
R X EN T
UA T_T A_ _EN
R RD O_ T
UA T_I OP _E
UA T_I A_ CTL
UA T_I A_ _IN
UA T_I A_ CK
UA T_C R_W UD
UA T_I A_ _IN
UA _E O K_
UA T_S D_B LX
UA T_T A_ RS
IT EN
T_
UA T_I FIF RS
R O OW
RT W RK
M
R X DP
RT UT CL
R T NV
R X NV
BI
R RD RX
UA SW TR
R T NV
R X NV
_S TS
R X NV
R S NV
R RD TX
AR _
R X _
NU
_P I TY
Y
UA T_R FIFO
P_
UA T_A M_
_ _D
UA T_C R_I
UA T_L _FL
RT _R
UA T_T D_I
UA T_R R_I
UA T_R S_I
UA T_T S_I
UA T_D D_I
_
TO
RT AR
IT
R E
)d
UA _M
_B
UA _P
ve
RT
RT
RT
ser
UA
UA
UA
(re
31 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 3 0 0 Reset
UART_PARITY This bit is used to configure the parity check mode. (R/W)
UART_PARITY_EN Set this bit to enable UART parity check. (R/W)
RY
UART_BIT_NUM This field is used to set the length of data. (R/W)
UART_STOP_BIT_NUM This field is used to set the length of stop bit. (R/W)
UART_SW_RTS This bit is used to configure the software RTS signal which is used in software flow
control. (R/W)
A
UART_SW_DTR This bit is used to configure the software DTR signal which is used in software flow
control. (R/W) IN
UART_TXD_BRK Set this bit to enable the transmitter to send NULL characters when the process of
sending data is done. (R/W)
UART_IRDA_DPLX Set this bit to enable IrDA loopback mode. (R/W)

IM
UART_IRDA_TX_EN This is the start enable bit for IrDA transmitter. (R/W)
UART_IRDA_WCTL 0: Set IrDA transmitter’s 11th bit to 0; 1: The IrDA transmitter’s 11th bit is the
same as 10th bit. (R/W)
UART_IRDA_TX_INV Set this bit to invert the level of IrDA transmitter. (R/W)
EL
UART_IRDA_RX_INV Set this bit to invert the level of IrDA receiver. (R/W)
UART_LOOPBACK Set this bit to enable UART loopback test mode. (R/W)
UART_TX_FLOW_EN Set this bit to enable flow control function for transmitter. (R/W)
PR
UART_IRDA_EN Set this bit to enable IrDA protocol. (R/W)
UART_RXFIFO_RST Set this bit to reset the UART RX FIFO. (R/W)
UART_TXFIFO_RST Set this bit to reset the UART TX FIFO. (R/W)
UART_RXD_INV Set this bit to invert the level value of UART RXD signal. (R/W)
UART_CTS_INV Set this bit to invert the level value of UART CTS signal. (R/W)
UART_DSR_INV Set this bit to invert the level value of UART DSR signal. (R/W)

UART_TXD_INV Set this bit to invert the level value of UART TXD signal. (R/W)
UART_RTS_INV Set this bit to invert the level value of UART RTS signal. (R/W)
UART_DTR_INV Set this bit to invert the level value of UART DTR signal. (R/W)
UART_CLK_EN 0: Support clock only when application writes registers; 1: Force clock on for regis-
ters. (R/W)
RY
UART_ERR_WR_MASK 0: Receiver stores the data even if the received data is wrong; 1: Receiver
stops storing data into FIFO when data is wrong. (R/W)
UART_AUTOBAUD_EN This is the enable bit for baud rate detection. (R/W)
UART_MEM_CLK_EN The signal to enable UART RAM clock gating. (R/W)
A
IN RH
D
D
O IS
RH
T_ _D
TH
VF
H
DA OW
Y_
_T
PT
IS UT N
RT X_ OW N
LL
X_ FL
_D TO _E
UA _R FL _E
U
_R _
_F
RT X_ UT
_E
O
FO
UA T_R _TO
IF
FI
XF
IM
R X
d)
X
UA T_R
_R
_T
ve
RT
RT
r
se
R
UA
UA
UA
(re
31 24 23 22 21 20 19 10 9 0
0 0 0 0 0 0 0 0 0 0 0 0 0x60 0x60 Reset
UART_RXFIFO_FULL_THRHD An UART_RXFIFO_FULL_INT interrupt is generated when the re-

EL
ceiver receives more data than the value of this field. (R/W)
UART_TXFIFO_EMPTY_THRHD An UART_TXFIFO_EMPTY_INT interrupt is generated when the

number of data bytes in TX FIFO is less than the value of this field. (R/W)
UART_DIS_RX_DAT_OVF Disable UART RX data overflow detection. (R/W)

PR
UART_RX_TOUT_FLOW_DIS Set this bit to stop accumulating idle_cnt when hardware flow control
works. (R/W)
UART_RX_FLOW_EN This is the flow enable bit for UART receiver. (R/W)
UART_RX_TOUT_EN This is the enable bit for UART receiver’s timeout function. (R/W)

Register 22.11. UART_FLOW_CONF_REG (0x0034)
EN
N_
O
LO EL
RT ON E_X FF
_C
_S O ON
R O _X F
UA T_F RC ON
UA T_X RC XO
_F _D
UA T_F ND OF
W
W FF
R O E_
R E _X
UA T_S ND
R E
)
ed
UA T_S
rv
se
R
UA
(re
31 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
UART_SW_FLOW_CON_EN Set this bit to enable software flow control. When UART receives
flow control characters XON or XOFF, which can be configured by UART_XON_CHAR or
RY
UART_XOFF_CHAR respectively, UART_SW_XON_INT or UART_SW_XOFF_INT interrupts can be
triggered if enabled. (R/W)
UART_XONOFF_DEL Set this bit to remove flow control characters from the received data. (R/W)
UART_FORCE_XON Set this bit to force the transmitter to send data. (R/W)
A
UART_FORCE_XOFF Set this bit to stop the transmitter from sending data. (R/W)
UART_SEND_XON Set this bit to send an XON character. This bit is cleared by hardware automati-
IN
cally. (R/W/SS/SC)
UART_SEND_XOFF Set this bit to send an XOFF character. This bit is cleared by hardware automat-
ically. (R/W/SS/SC)
IM
Register 22.12. UART_SLEEP_CONF_REG (0x0038)
LD
O
SH
RE
EL
TH
E_
IV
CT
)
ed
_A
rv
RT
se
UA
(re
31 10 9 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0xf0 Reset
PR
UART_ACTIVE_THRESHOLD UART is activated from Light-sleep mode when the input RXD edge
changes more times than the value of this field. (R/W)

Register 22.13. UART_SWFC_CONF0_REG (0x003C)
LD
HO
ES
R
HA
HR
_C
_T
FF
FF
XO
XO
d)
ve
T_
T_
er
R
s
UA
UA
31 (re 18 17 10 9 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x13 0xe0 Reset
UART_XOFF_THRESHOLD When the number of data bytes in RX FIFO is more than the value of this
field with UART_SW_FLOW_CON_EN set to 1, the transmitter sends an XOFF character. (R/W)
RY
UART_XOFF_CHAR This field stores the XOFF flow control character. (R/W)
Register 22.14. UART_SWFC_CONF1_REG (0x0040)
A
LD
O
SH
AR
RE
CH
TH
N_
N_
O
O
IN
)
ed
_X
_X
rv
RT
RT
se
UA
UA
(re
31 18 17 10 9 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x11 0x0 Reset

IM
UART_XON_THRESHOLD When the number of data bytes in RX FIFO is less than the value of this
field with UART_SW_FLOW_CON_EN set to 1, the transmitter sends an XON character. (R/W)
UART_XON_CHAR This field stores the XON flow control character. (R/W)
EL
Register 22.15. UART_TXBRK_CONF_REG (0x0044)

M
NU
K_
BR
X_
PR
)
ed
_T
rv
RT
se
UA
(re
31 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0xa Reset
UART_TX_BRK_NUM This field is used to configure the number of 0 to be sent after the process of
sending data is done. It is active when UART_TXD_BRK is set to 1. (R/W)

Register 22.16. UART_IDLE_CONF_REG (0x0048)
HD
UM
HR
_N
_T
E
E
DL
DL
_I
_I
RX
)
TX
ed
T_
T_
rv
se
R
UA
UA
(re
31 20 19 10 9 0
0 0 0 0 0 0 0 0 0 0 0 0 0x100 0x100 Reset
UART_RX_IDLE_THRHD A frame end signal is generated when the receiver takes more time to re-
ceive one byte data than the value of this field, in the unit of bit time (the time it takes to transfer
one bit). (R/W)
RY
UART_TX_IDLE_NUM This field is used to configure the duration time between transfers, in the unit
of bit time (the time it takes to transfer one bit). (R/W)
A
Register 22.17. UART_RS485_CONF_REG (0x004C)
UA T_D 1_E _R TX_ M

M
RT L0 N X_ EN
R L TX _ NU
NU
EN
UA T_D 485 XBY Y_
Y_
IN
R S R DL
DL
UA _R 85 X_
X_
N
RT S4 _R
_E
_T
S4 N
85
UA _R 85
85
_R _E
S4
RT S4
d)
_R
UA _R
ve
RT
RT
r
se
UA
UA
(re
31 10 9 6 5 4 3 2 1 0
IM
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
UART_RS485_EN Set this bit to choose RS485 mode. (R/W)
UART_DL0_EN Set this bit to delay the stop bit by 1 bit. (R/W)
EL
UART_DL1_EN Set this bit to delay the stop bit by 1 bit. (R/W)
UART_RS485TX_RX_EN Set this bit to enable receiver could receive data when the transmitter is
transmitting data in RS485 mode. (R/W)
UART_RS485RXBY_TX_EN 1: enable RS485 transmitter to send data when RS485 receiver line is
PR
busy. (R/W)
UART_RS485_RX_DLY_NUM This bit is used to delay the receiver’s internal data signal. (R/W)
UART_RS485_TX_DLY_NUM This field is used to delay the transmitter’s internal data signal. (R/W)

Register 22.18. UART_CLK_CONF_REG (0x0078)
UM
UA T_T _SC CO E
RT X_ LK RE
R X T_ R
RT ST LK N
UA SC CO N
_N
_B
A
UA T_R _RS _CO
UA _R SC _E
_ _ _E
RT LK_ RE
V_
L
IV
V
CL N
SE
DI
DI
_D
E
R X T
UA T_T _RS
K_
K_
K_
LK
CL
CL
SC
R X
d)
UA T_R
_S
_S
_S
ve
T_
RT
RT
er
R
s
UA
UA
UA
UA
(re
31 28 27 26 25 24 23 22 21 20 19 12 11 6 5 0
0 0 0 0 0 0 1 1 0 1 3 0x1 0x0 0x0 Reset
UART_SCLK_DIV_B The denominator of the frequency divisor. (R/W)
UART_SCLK_DIV_A The numerator of the frequency divisor. (R/W)
RY
UART_SCLK_DIV_NUM The integral part of the frequency divisor. (R/W)
UART_SCLK_SEL Selects UART clock source. 1: APB_CLK; 2: FOSC_CLK; 3: XTAL_CLK. (R/W)
UART_SCLK_EN Set this bit to enable UART TX/RX clock. (R/W)
UART_RST_CORE Write 1 and then write 0 to this bit, to reset UART TX/RX. (R/W)
A
UART_TX_SCLK_EN Set this bit to enable UART TX clock. (R/W)
UART_RX_SCLK_EN Set this bit to enable UART RX clock. (R/W)

IN
UART_TX_RST_CORE Write 1 and then write 0 to this bit, to reset UART TX. (R/W)
UART_RX_RST_CORE Write 1 and then write 0 to this bit, to reset UART RX. (R/W)
IM
Register 22.19. UART_STATUS_REG (0x001C)
T
NT
N
_C
_C
O
O
EL
N
N
_D N
_D N
F
IF
FI
SR
RT XD
TR
RT TS
RT TS
UA T_R D
XF
RX
)
)
R X
ed
ed
UA _C
UA T_R
UA T_T
_T
T_
rv
rv
RT
se
se
R
R
UA
UA
UA
UA
(re
(re
31 30 29 28 26 25 16 15 14 13 12 10 9 0
1 1 1 0 0 0 0 1 1 0 0 0 0 0 Reset
PR
UART_RXFIFO_CNT Stores the number of valid data bytes in RX FIFO. (RO)
UART_DSRN This bit represents the level of the internal UART DSR signal. (RO)
UART_CTSN This bit represents the level of the internal UART CTS signal. (RO)
UART_RXD This bit represents the level of the internal UART RXD signal. (RO)
UART_TXFIFO_CNT Stores the number of data bytes in TX FIFO. (RO)
UART_DTRN This bit represents the level of the internal UART DTR signal. (RO)
UART_RTSN This bit represents the level of the internal UART RTS signal. (RO)
UART_TXD This bit represents the level of the internal UART TXD signal. (RO)

Register 22.20. UART_MEM_TX_STATUS_REG (0x0064)
DR
AD
R
W
DD
T X_
RA
B_
X_
AP
d)
)
ed
_T
ve
T_
rv
RT
er
se
R
s
UA
UA
(re
(re
31 21 20 11 10 9 0
0 0 0 0 0 0 0 0 0 0 0 0x0 0 0x0 Reset
UART_APB_TX_WADDR This field stores the offset address in TX FIFO when software writes TX FIFO
via APB. (RO)
RY
UART_TX_RADDR This field stores the offset address in TX FIFO when TX FSM reads data via
Tx_FIFO_Ctrl. (RO)
Register 22.21. UART_MEM_RX_STATUS_REG (0x0068)
A
R
DD
RA
DR
X_
AD
_R
W
IN
PB
X_
d)
)
ed
_R
_A
ve
rv
RT
RT
r
se
se
UA
UA
(re
(re
31 21 20 11 10 9 0
0 0 0 0 0 0 0 0 0 0 0 0x200 0 0x200 Reset

IM
UART_APB_RX_RADDR This field stores the offset address in RX FIFO when software reads data
from RX FIFO via APB. UART0 is 0x200. UART1 is 0x280. UART2 is 0x300. (RO)
UART_RX_WADDR This field stores the offset address in RX FIFO when Rx_FIFO_Ctrl writes RX FIFO.
UART0 is 0x200. UART1 is 0x280. UART2 is 0x300. (RO)
EL
Register 22.22. UART_FSM_STATUS_REG (0x006C)

UT
UT
_O
_O
PR
RX
U TX
_U
T_
)
ST
ed
_S
T_
rv
RT
se
R
UA
UA
(re
31 8 7 4 3 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
UART_ST_URX_OUT This is the status field of the receiver. (RO)
UART_ST_UTX_OUT This is the status field of the transmitter. (RO)

Register 22.23. UART_LOWPULSE_REG (0x0028)
NT
_C
IN
M
E_
LS
PU
W
LO
d)
ve
T_
er
R
s
UA
(re
31 12 11 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0xfff Reset
UART_LOWPULSE_MIN_CNT This field stores the value of the minimum duration time of the low
level pulse, in the unit of APB_CLK cycles. It is used in baud rate detection. (RO)
RY
Register 22.24. UART_HIGHPULSE_REG (0x002C)
T
N
_C
A
IN
_M
SE
UL
HP
IG
)
ed
_H
IN
rv
RT
se
UA
(re
31 12 11 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0xfff Reset
IM
UART_HIGHPULSE_MIN_CNT This field stores the value of the maximum duration time for the high
level pulse, in the unit of APB_CLK cycles. It is used in baud rate detection. (RO)
Register 22.25. UART_RXD_CNT_REG (0x0030)

EL
T
CN
E_
DG
_E
XD
d)
_R
e
rv
RT
se
UA
(re
PR
31 10 9 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
UART_RXD_EDGE_CNT This field stores the count of RXD edge change. It is used in baud rate
detection. (RO)

Register 22.26. UART_POSPULSE_REG (0x0070)
NT
_C
IN
M
E_
DG
SE
PO
d)
ve
T_
er
R
s
UA
(re
31 12 11 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0xfff Reset
UART_POSEDGE_MIN_CNT This field stores the minimal input clock count between two positive
edges. It is used in baud rate detection. (RO)
RY
Register 22.27. UART_NEGPULSE_REG (0x0074)
T
_CN
IN
A
M
E_
G
ED
GE
d)
_N
ve
RT
r
se
IN
UA
(re
31 12 11 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0xfff Reset
UART_NEGEDGE_MIN_CNT This field stores the minimal input clock count between two negative
IM
edges. It is used in baud rate detection. (RO)
Register 22.28. UART_AT_CMD_PRECNT_REG (0x0050)

EL
UM
_N
LE
ID
E_
R
)
ed
_P
rv
RT
se
UA
(re
31 16 15 0
PR
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x901 Reset
UART_PRE_IDLE_NUM This field is used to configure the idle duration time before the first AT_CMD
is received by the receiver, in the unit of bit time (the time it takes to transfer one bit). (R/W)

Register 22.29. UART_AT_CMD_POSTCNT_REG (0x0054)
UM
E _N
DL
_I
ST
O
d)
_P
ve
RT
er
s
UA
(re
31 16 15 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x901 Reset
UART_POST_IDLE_NUM This field is used to configure the duration time between the last AT_CMD
and the next data byte, in the unit of bit time (the time it takes to transfer one bit). (R/W)
RY
Register 22.30. UART_AT_CMD_GAPTOUT_REG (0x0058)
UT
O
_T
AP
A _G
X
)
d
_R
ve
RT
er
s
UA
(re
31 16 15 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
IN
0 11 Reset
UART_RX_GAP_TOUT This field is used to configure the duration time between the AT_CMD char-
acters, in the unit of bit time (the time it takes to transfer one bit). (R/W)
IM
Register 22.31. UART_AT_CMD_CHAR_REG (0x005C)
AR
CH
M
EL
NU
D_
R_
CM
HA
T_
)
ed
_C
_A
rv
RT
RT
se
UA
UA
(re
31 16 15 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x3 0x2b Reset

PR
UART_AT_CMD_CHAR This field is used to configure the content of AT_CMD character. (R/W)
UART_CHAR_NUM This field is used to configure the number of continuous AT_CMD characters
received by the receiver. (R/W)

Register 22.32. UART_DATE_REG (0x007C)
E
AT
_D
RT
UA
31 0
0x2008270 Reset
UART_DATE This is the version control register. (R/W)
Register 22.33. UART_ID_REG (0x0080)
RY
RL
E_ E
AT AT
CT
PD PD
_U _U
RT EG
D
UA T_R
_I
RT
R
UA
UA
31 30 29 0
A
0 1 0x000500 Reset
UART_ID This field is used to configure the UART_ID. (R/W)

IN
UART_UPDATE_CTRL This bit is used to control register synchronization mode. 0: After registers
are configured, software needs to write 1 to UART_REG_UPDATE to synchronize registers; 1:
Registers are automatically synchronized into UART Core’s clock domain. (R/W)
UART_REG_UPDATE When this bit is set to 1 by software, registers are synchronized to UART Core’s
IM
clock domain. This bit is cleared by hardware after synchronization is done. (R/W/SC)
22.7.2 UHCI Regsiters

EL
The addresses in this section are relative to UHCI Controller base address provided in Table 3-4 in Chapter 3
System and Memory.
PR

Register 22.34. UHCI_CONF0_REG (0x0000)
EN
F_
C EP EN N EN
O
C R ID N N
UH I_S D_ C_E F_
_E
UH _C T_ _E _E
C EA E EO
CI NC N RK
CI AR OF C R
UH I_H C_R LE_

UH I_E _E _B
UH I_U _E _C
UH I_U T2 N
UH _U T1 E
UH I_R T0 E
_T RS E
CI AR _C
C AR _C
CI X_ _C
C LK RX
C AR _E
C EN E
X_ T
T
UH _L OD
UH I_U ER
UH I_C T_
RS
C AR
d)
UH I_U
ve
er
C
s
UH
(re
31 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 1 1 1 0 0 0 0 0 Reset
UHCI_TX_RST Write 1, then write 0 to this bit to reset decode state machine. (R/W)
RY
UHCI_RX_RST Write 1, then write 0 to this bit to reset encode state machine. (R/W)
UHCI_UART0_CE Set this bit to link up UHCI and UART0. (R/W)
A
UHCI_SEPER_EN Set this bit to separate the data frame using a special character. (R/W)
UHCI_HEAD_EN Set this bit to encode the data packet with a formatting header. (R/W)
IN
UHCI_CRC_REC_EN Set this bit to enable UHCI to receive the 16 bit CRC. (R/W)
UHCI_UART_IDLE_EOF_EN If this bit is set to 1, UHCI will end the payload receiving process when
UART has been in idle state. (R/W)
IM
UHCI_LEN_EOF_EN If this bit is set to 1, UHCI decoder stops receiving payload data when the
number of received data bytes has reached the specified value. The value is payload length indi-
cated by UHCI packet header when UHCI_HEAD_EN is 1 or the value is configuration value when
UHCI_HEAD_EN is 0. If this bit is set to 0, UHCI decoder stops receiving payload data when 0xC0
EL
has been received. (R/W)
UHCI_ENCODE_CRC_EN Set this bit to enable data integrity check by appending a 16 bit CCITT-
CRC to end of the payload. (R/W)
UHCI_CLK_EN 0: Support clock only when application writes registers; 1: Force clock on for regis-
PR
ters. (R/W)
UHCI_UART_RX_BRK_EOF_EN If this bit is set to 1, UHCI will end payload receive process when
NULL frame is received by UART. (R/W)

Register 22.35. UHCI_CONF1_REG (0x0018)
E
_R
UH I_C E_ K_ _RE
RT
N
UH I_C C_D AD M
UM N
_E
_S _E
C R HE SU
TA
HE K_ LE
C AV EC M
CK EQ
UH I_S CH NU
_S
_C C B
UH rve IT_ RT
CI HE ISA
S
C d) SW
C _ _
se A A
K
(re _W ST
UH _T C
CI X_A
CI W_
d)
X
UH I_S
ve
UH I_T
er
C
s
UH
(re
31 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 1 1 Reset
UHCI_CHECK_SUM_EN This is the enable bit to check header checksum when UHCI receives a
data packet. (R/W)
RY
UHCI_CHECK_SEQ_EN This is the enable bit to check sequence number when UHCI receives a data
packet. (R/W)
UHCI_CRC_DISABLE Set this bit to support CRC calculation. Data Integrity Check Present bit in
UHCI packet frame should be 1. (R/W)
A
UHCI_SAVE_HEAD Set this bit to save the packet header when UHCI receives a data packet. (R/W)
UHCI_TX_CHECK_SUM_RE Set this bit to encode the data packet with a checksum. (R/W)
IN
UHCI_TX_ACK_NUM_RE Set this bit to encode the data packet with an acknowledgment when a
reliable packet is to be transmitted. (R/W)
UHCI_WAIT_SW_START The UHCI encoder will jump to ST_SW_WAIT status if this bit is set to 1.
(R/W)
IM
UHCI_SW_START If current UHCI_ENCODE_STATE is ST_SW_WAIT, the UHCI will start to send data
packet out when this bit is set to 1. (R/W/SC)
EL
PR

Register 22.36. UHCI_ESCAPE_CONF_REG (0x0024)
UH I_T 13_ SC N
UH I_T 11_ SC_ N
SC N
N
UH I_R DB SC N
UH I_T C0 SC N
CI X_D ES EN
C0 SC N
C X_ _E _E
C X_ E _E
_E _E
_E
C X_ _E _E
C X_ _E _E
X_ _E _E
UH I_R 11 SC
_T B C
C X_ _E
UH I_R 13
C X_
d)
UH I_R
ve
er
C
s
UH
(re
31 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 1 1 Reset
UHCI_TX_C0_ESC_EN Set this bit to to decode character 0xC0 when DMA receives data. (R/W)
UHCI_TX_DB_ESC_EN Set this bit to to decode character 0xDB when DMA receives data. (R/W)
RY
UHCI_TX_11_ESC_EN Set this bit to to decode flow control character 0x11 when DMA receives data.
(R/W)
UHCI_TX_13_ESC_EN Set this bit to to decode flow control character 0x13 when DMA receives data.
(R/W)
A
UHCI_RX_C0_ESC_EN Set this bit to replace 0xC0 by special characters when DMA sends data.
(R/W)
UHCI_RX_DB_ESC_EN Set this bit to replace 0xDB by special characters when DMA sends data.
(R/W)
IN
UHCI_RX_11_ESC_EN Set this bit to replace flow control character 0x11 by special characters when
DMA sends data. (R/W)
IM
UHCI_RX_13_ESC_EN Set this bit to replace flow control character 0x13 by special characters when
DMA sends data. (R/W)
EL
PR

Register 22.37. UHCI_HUNG_CONF_REG (0x0028)
FT
FT
NA
NA
HI
HI
_S
_E
_S
_E
UT
UT
UT
UT
UT
UT
EO
EO
EO
EO
EO
EO
IM
IM
IM
IM
IM
IM
_T
_T
_T
_T
_T
_T
FO
FO
FO
O
IF
IF
IF
FI
FI
FI
XF
XF
XF
)
RX
RX
X
ed
_R
_T
_T
_T
rv
_
CI
CI
CI
CI
CI
CI
se
UH
UH
UH
UH
UH
UH
(re
31 24 23 22 20 19 12 11 10 8 7 0
0 0 0 0 0 0 0 0 1 0 0x10 1 0 0x10 Reset
UHCI_TXFIFO_TIMEOUT This field stores the timeout value. UHCI will produce the
RY
UHCI_TX_HUNG_INT interrupt when DMA takes more time to receive data. (R/W)
UHCI_TXFIFO_TIMEOUT_SHIFT This field is used to configure the maximum tick count. (R/W)
UHCI_TXFIFO_TIMEOUT_ENA This is the enable bit for TX FIFO receive timeout. (R/W)
UHCI_RXFIFO_TIMEOUT This field stores the timeout value. UHCI will produce the
UHCI_RX_HUNG_INT interrupt when DMA takes more time to read data from RAM. (R/W)
A
UHCI_RXFIFO_TIMEOUT_SHIFT This field is used to configure the maximum tick count. (R/W)
UHCI_RXFIFO_TIMEOUT_ENA This is the enable bit for DMA send timeout. (R/W)
IN
IM
Register 22.38. UHCI_ACK_NUM_REG (0x002C)
AD
O
_L
UM
M
NU
_N
K_
CK
d)
C
_A
_A
e
EL
rv
CI
CI
se
UH
UH
(re
31 4 3 2 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0x0 Reset
UHCI_ACK_NUM This is the ACK number used in software flow control. (R/W)
PR
UHCI_ACK_NUM_LOAD Set this bit to 1, and the value configured by UHCI_ACK_NUM would be
loaded. (WT)

Register 22.39. UHCI_QUICK_SENT_REG (0x0034)
UM
M
N
NU
N
_N
_E
_E
D_
ND
ND
D
EN
EN
SE
SE
_S
_S
S_
S_
LE
LE
AY
AY
G
LW
LW
IN
IN
)
ed
_A
_A
_S
_S
rv
CI
CI
CI
CI
se
UH
UH
UH
UH
(re
31 8 7 6 4 3 2 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 0 0x0 Reset
UHCI_SINGLE_SEND_NUM This field is used to specify single_send mode. (R/W)
RY
UHCI_SINGLE_SEND_EN Set this bit to enable single_send mode to send short packets. (R/W/SC)
UHCI_ALWAYS_SEND_NUM This field is used to specify always_send mode. (R/W)
UHCI_ALWAYS_SEND_EN Set this bit to enable always_send mode to send short packets. (R/W)
A
Register 22.40. UHCI_REG_Q0_WORD0_REG (0x0038)
IN 0
RD
O
W
0_
Q
D_
EN
_S
CI
IM UH
31 0
0x000000 Reset
UHCI_SEND_Q0_WORD0 This register is used as a quick_sent register when mode is specified by

UHCI_ALWAYS_SEND_NUM or UHCI_SINGLE_SEND_NUM. (R/W)
EL
Register 22.41. UHCI_REG_Q0_WORD1_REG (0x003C)

1
PR
RD
O
W
0_
_Q
END
_S
CI
UH
31 0
0x000000 Reset


0
RD
O
W
1_
_Q
END
_S
CI
UH
31 0
0x000000 Reset

RY
1
RD
O
W
1_
A
_Q
END
_S
CI
UH
31
IN
0x000000
0
Reset

IM

EL
0
RD
O
W
2_
_Q
END
_S
CI
UH
31 0
PR
0x000000 Reset


1
RD
O
W
2_
_Q
END
_S
CI
UH
31 0
0x000000 Reset

RY
0
RD
O
W
3_
A
_Q
END
_S
CI
UH
31
IN
0x000000
0
Reset

IM

EL
1
RD
O
W
3_
_Q
END
_S
CI
UH
31 0
PR
0x000000 Reset


0
RD
O
W
4_
_Q
END
_S
CI
UH
31 0
0x000000 Reset

RY
1
RD
O
W
4_
A
_Q
END
_S
CI
UH
31
IN
0x000000
0
Reset

IM

EL
0
RD
O
W
5_
_Q
END
_S
CI
UH
31 0
PR
0x000000 Reset


1
RD
O
W
5_
_Q
END
_S
CI
UH
31 0
0x000000 Reset

RY
0
RD
O
W
6_
A
_Q
END
_S
CI
UH
31
IN
0x000000
0
Reset

IM

EL
1
RD
O
W
6_
_Q
END
_S
CI
UH
31 0
PR
0x000000 Reset


Register 22.54. UHCI_ESC_CONF0_REG (0x0070)
R0
AR
A
H
CH
_C
R
C_
HA
SC
ES
_C
_E
R_
ER
ER
PE
EP
EP
)
E
ed
_S
_S
_S
rv
CI
CI
CI
se
UH
UH
UH
(re
31 24 23 16 15 8 7 0
0 0 0 0 0 0 0 0 0xdc 0xdb 0xc0 Reset
UHCI_SEPER_CHAR This field is used to define separators to encode data packets. The default
value is 0xC0. (R/W)
RY
UHCI_SEPER_ESC_CHAR0 This field is used to define the first character of SLIP escape sequence.
The default value is 0xDB. (R/W)
UHCI_SEPER_ESC_CHAR1 This field is used to define the second character of SLIP escape se-
quence. The default value is 0xDC. (R/W)
A
IN
R1
0
AR
HA
CH
C
0_
0_
0
Q
EQ
EQ
E
_S
_S
_S
SC
SC
SC
ed)
_E
_E
_E
IM
rv
CI
CI
CI
se
UH
UH
UH
(re
31 24 23 16 15 8 7 0
0 0 0 0 0 0 0 0 0xdd 0xdb 0xdb Reset
UHCI_ESC_SEQ0 This field is used to define a character that need to be encoded. The default value
EL
is 0xDB that used as the first character of SLIP escape sequence. (R/W)
UHCI_ESC_SEQ0_CHAR0 This field is used to define the first character of SLIP escape sequence.
UHCI_ESC_SEQ0_CHAR1 This field is used to define the second character of SLIP escape se-
PR
quence. The default value is 0xDD. (R/W)

R1
R0
HA
A
CH
C
1_
1_
1
Q
EQ
E
SE
_S
_S
C_
SC
SC
)
ES
ed
_E
_E
rv
_
CI
CI
CI
se
UH
UH
UH
(re
31 24 23 16 15 8 7 0
0 0 0 0 0 0 0 0 0xde 0xdb 0x11 Reset
UHCI_ESC_SEQ1 This field is used to define a character that need to be encoded. The default value
is 0x11 that used as a flow control character. (R/W)
RY
quence. The default value is 0xDE. (R/W)
A
Register 22.57. UHCI_ESC_CONF3_REG (0x007C)
IN
1
0
AR
AR
CH
CH
2_
2_
2
EQ
EQ
SE
_S
_S
C_
SC
SC
d)
S
e
_E
_E
_E
rv
IM CI
CI
CI
se
UH
UH
UH
(re
31 24 23 16 15 8 7 0
0 0 0 0 0 0 0 0 0xdf 0xdb 0x13 Reset
UHCI_ESC_SEQ2 This field is used to define a character that need to be decoded. The default value
EL
is 0x13 that used as a flow control character. (R/W)
PR
quence. The default value is 0xDF. (R/W)

Register 22.58. UHCI_PKT_THRES_REG (0x0080)
S
HR
_T
KT
)
ed
_P
v
er
CI
s
UH
(re
31 13 12 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x80 Reset
UHCI_PKT_THRS This field is used to configure the maximum value of the packet length when
UHCI_HEAD_EN is 0. (R/W)
A RY
IN
IM
EL
PR

Register 22.59. UHCI_INT_RAW_REG (0x0004)
CI X_S NG NT_ INT AW
W
X_ AR INT AW RA
UH I_T HU _I _Q_ T_R
UH I_S D_ F_IN T_ W
UH I_T D_ RE _RA W
_R T _ R _
W
T_ W
AR IN AW
C EN O _IN RA
C EN A_ T RA
C X_ S_ G W
C X_ NG G IN
RA
IN A
UH I_R HU RE _Q_
UH I_S T_E L0 T_
T_ _R
ST T_ _R
C U TR _IN
T
UH I_O _C L1
C PP TR
UH _A _C
CI PP
)
ed
UH I_A
rv
se
C
UH
(re
31 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
UHCI_RX_START_INT_RAW This is the interrupt raw bit for UHCI_RX_START_INT interrupt. The
RY
interrupt is triggered when a separator has been sent. (R/WTC/SS)
UHCI_TX_START_INT_RAW This is the interrupt raw bit for UHCI_TX_START_INT interrupt. The
interrupt is triggered when UHCI detects a separator. (R/WTC/SS)
UHCI_RX_HUNG_INT_RAW This is the interrupt raw bit for UHCI_RX_HUNG_INT interrupt. The in-
terrupt is triggered when UHCI takes more time to receive data than configure value. (R/WTC/SS)
A
UHCI_TX_HUNG_INT_RAW This is the interrupt raw bit for UHCI_TX_HUNG_INT interrupt. The in-
IN
terrupt is triggered when UHCI takes more time to read data from RAM than the configured value.
(R/WTC/SS)
UHCI_SEND_S_REG_Q_INT_RAW This is the interrupt raw bit for UHCI_SEND_S_REG_Q_INT in-

terrupt. The interrupt is triggered when UHCI has sent out a short packet using single_send mode.
IM
(R/WTC/SS)
UHCI_SEND_A_REG_Q_INT_RAW This is the interrupt raw bit for UHCI_SEND_A_REG_Q_INT in-

terrupt. The interrupt is triggered when UHCI has sent out a short packet using always_send mode.
(R/WTC/SS)
EL
UHCI_OUT_EOF_INT_RAW This is the interrupt raw bit for UHCI_OUT_EOF_INT interrupt. The in-
terrupt is triggered when there are some errors in EOF in the transmit descriptors. (R/WTC/SS)
UHCI_APP_CTRL0_INT_RAW This is the interrupt raw bit for UHCI_APP_CTRL0_INT interrupt. The
PR
interrupt is triggered when UHCI_APP_CTRL0_IN_SET is set. (R/W)
UHCI_APP_CTRL1_INT_RAW This is the interrupt raw bit for UHCI_APP_CTRL1_INT interrupt. The
interrupt is triggered when UHCI_APP_CTRL1_IN_SET is set. (R/W)

Register 22.60. UHCI_INT_ST_REG (0x0008)
UH I_T HU _I _Q_ T_S ST

C X_ NG G IN T_
CI X_S NG NT_ INT T
X_ AR INT T ST
UH I_R HU RE _Q_ _IN
_R T _ S _
C EN K _IN ST
C EN A_ OF ST
C X_ S_ G R
ST
IN T
AR IN T
UH I_T D_ RE _ER
UH I_S TLIN L0 T_
UH I_S D_ _E T_
T_ T_S
ST T_ _S
T_
C U TR _IN
UH I_O _C L1
C PP TR
UH I_A _C
C PP
d)
UH I_A
ve
er
C
s
UH
(re
31 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
UHCI_RX_START_INT_ST This is the masked interrupt bit for UHCI_RX_START_INT interrupt when
RY
UHCI_RX_START_INT_ENA is set to 1. (RO)
UHCI_TX_START_INT_ST This is the masked interrupt bit for UHCI_TX_START_INT interrupt when
UHCI_TX_START_INT_ENA is set to 1. (RO)
UHCI_RX_HUNG_INT_ST This is the masked interrupt bit for UHCI_RX_HUNG_INT interrupt when
UHCI_RX_HUNG_INT_ENA is set to 1. (RO)
A
UHCI_TX_HUNG_INT_ST This is the masked interrupt bit for UHCI_TX_HUNG_INT interrupt when
UHCI_TX_HUNG_INT_ENA is set to 1. (RO)
IN
UHCI_SEND_S_REG_Q_INT_ST This is the masked interrupt bit for UHCI_SEND_S_REG_Q_INT in-
terrupt when UHCI_SEND_S_REG_Q_INT_ENA is set to 1. (RO)
UHCI_SEND_A_REG_Q_INT_ST This is the masked interrupt bit for UHCI_SEND_A_REG_Q_INT in-

IM
terrupt when UHCI_SEND_A_REG_Q_INT_ENA is set to 1. (RO)
UHCI_OUTLINK_EOF_ERR_INT_ST This is the masked interrupt bit for

UHCI_OUTLINK_EOF_ERR_INT interrupt when UHCI_OUTLINK_EOF_ERR_INT_ENA is set
to 1. (RO)
EL
UHCI_APP_CTRL0_INT_ST This is the masked interrupt bit for UHCI_APP_CTRL0_INT interrupt

when UHCI_APP_CTRL0_INT_ENA is set to 1. (RO)
UHCI_APP_CTRL1_INT_ST This is the masked interrupt bit for UHCI_APP_CTRL1_INT interrupt

when UHCI_APP_CTRL1_INT_ENA is set to 1. (RO)
PR

Register 22.61. UHCI_INT_ENA_REG (0x000C)
CI X_S NG NT_ INT NA A

UH I_T HU _I _Q_ T_E EN
A
C X_ NG G IN T_
X_ AR INT NA EN
_R T _ E _
UH I_S D_ _E T_ A
UH I_T D_ RE _ER A
C EN K _IN EN
C EN A_ OF EN
A
T_ A
AR IN NA
C X_ S_ G R
EN
IN N
UH I_S TLIN L0 T_
T_ _E
ST T_ _E
C U TR _IN
T
UH I_O _C L1
C PP TR
UH I_A _C
C PP
d)
UH I_A
ve
er
C
s
UH
(re
31 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
UHCI_RX_START_INT_ENA This is the interrupt enable bit for UHCI_RX_START_INT interrupt. (R/W)
RY
UHCI_TX_START_INT_ENA This is the interrupt enable bit for UHCI_TX_START_INT interrupt. (R/W)
UHCI_RX_HUNG_INT_ENA This is the interrupt enable bit for UHCI_RX_HUNG_INT interrupt. (R/W)
A
UHCI_TX_HUNG_INT_ENA This is the interrupt enable bit for UHCI_TX_HUNG_INT interrupt. (R/W)
IN
UHCI_SEND_S_REG_Q_INT_ENA This is the interrupt enable bit for UHCI_SEND_S_REG_Q_INT
interrupt. (R/W)
UHCI_SEND_A_REG_Q_INT_ENA This is the interrupt enable bit for UHCI_SEND_A_REG_Q_INT

interrupt. (R/W)
IM
UHCI_OUTLINK_EOF_ERR_INT_ENA This is the interrupt enable bit for
UHCI_OUTLINK_EOF_ERR_INT interrupt. (R/W)
UHCI_APP_CTRL0_INT_ENA This is the interrupt enable bit for UHCI_APP_CTRL0_INT interrupt.

(R/W)
EL
UHCI_APP_CTRL1_INT_ENA This is the interrupt enable bit for UHCI_APP_CTRL1_INT interrupt.

(R/W)
PR

Register 22.62. UHCI_INT_CLR_REG (0x0010)
CI X_S NG NT_ INT LR R

UH I_T HU _I _Q_ T_C CL
R
C X_ NG G IN T_
X_ AR INT LR CL
_R T _ C _
UH I_S D_ _E T_ R
UH I_T D_ RE _ER R
C EN K _IN CL
C EN A_ OF CL
R
IN LR
AR IN LR
C X_ S_ G R
CL
UH I_S TLIN L0 T_
T_ _C
ST T_ _C
T_
C U TR _IN
T
UH I_O _C L1
C PP TR
UH _A _C
CI PP
d)
UH I_A
ve
er
C
s
UH
(re
31 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
UHCI_RX_START_INT_CLR Set this bit to clear UHCI_RX_START_INT interrupt. (WT)
RY
UHCI_TX_START_INT_CLR Set this bit to clear UHCI_TX_START_INT interrupt. (WT)
UHCI_RX_HUNG_INT_CLR Set this bit to clear UHCI_RX_HUNG_INT interrupt. (WT)
UHCI_TX_HUNG_INT_CLR Set this bit to clear UHCI_TX_HUNG_INT interrupt. (WT)
A
UHCI_SEND_S_REG_Q_INT_CLR Set this bit to clear UHCI_SEND_S_REG_Q_INT interrupt. (WT)
UHCI_SEND_A_REG_Q_INT_CLR Set this bit to clear UHCI_SEND_A_REG_Q_INT interrupt. (WT)

IN
UHCI_OUTLINK_EOF_ERR_INT_CLR Set this bit to clear UHCI_OUTLINK_EOF_ERR_INT interrupt.
(WT)
UHCI_APP_CTRL0_INT_CLR Set this bit to clear UHCI_APP_CTRL0_INT interrupt. (WT)

IM
UHCI_APP_CTRL1_INT_CLR Set this bit to clear UHCI_APP_CTRL1_INT interrupt. (WT)
Register 22.63. UHCI_APP_INT_SET_REG (0x0014)

EL
NT T
ET
_I SE
_S
L0 T_
TR _IN
_C L1
PP TR
_A _C
CI PP
d)
UH I_A
e
rv
se
C
UH
(re
PR
31 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
UHCI_APP_CTRL0_INT_SET This bit is software interrupt trigger source of UHCI_APP_CTRL0_INT.

(WT)
UHCI_APP_CTRL1_INT_SET This bit is software interrupt trigger source of UHCI_APP_CTRL1_INT.

(WT)

Register 22.64. UHCI_STATE0_REG (0x001C)
SE
E
AT
AU
ST
C
_
R_
DE
ER
CO
X_
)
DE
ed
_R
rv
_
CI
CI
se
UH
UH
(re
31 6 5 3 2 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
UHCI_RX_ERR_CAUSE This field indicates the error type when DMA has received a packet with
error. 3’b001: Checksum error in the HCI packet. 3’b010: Sequence number error in the HCI
packet. 3’b011: CRC bit error in the HCI packet. 3’b100: 0xC0 is found but the received HCI
RY
packet is not end. 3’b101: 0xC0 is not found when the HCI packet has been received. 3’b110:
CRC check error. (RO)
UHCI_DECODE_STATE UHCI decoder status. (RO)
A
Register 22.65. UHCI_STATE1_REG (0x0020)
TE
IN
TA
_S
DE
O
NC
d)
e
_E
rv
CI
se
UH
(re
31 3 2 0
IM
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
UHCI_ENCODE_STATE UHCI encoder status. (RO)

EL
Register 22.66. UHCI_RX_HEAD_REG (0x0030)

AD
HE
X_
_R
CI
UH
PR
31 0
0x000000 Reset
UHCI_RX_HEAD This register stores the header of the current received packet. (RO)

Register 22.67. UHCI_DATE_REG (0x0084)
E
AT
_D
CI
UH
31 0
0x2010090 Reset
UHCI_DATE This is the version control register. (R/W)
A RY
IN
IM
EL
PR

23 I2C Controller (I2C)

The I2C (Inter-Integrated Circuit) bus allows ESP32-S3 to communicate with multiple external devices. These
external devices can share one bus.
23.1 Overview
The I2C bus has two lines, namely a serial data line (SDA) and a serial clock line (SCL). Both SDA and SCL lines
are open-drain. The I2C bus can be connected to a single or multiple master devices and a single or multiple
slave devices. However, only one master device can access a slave at a time via the bus.
The master initiates communication by generating a START condition: pulling the SDA line low while SCL is high,
RY
and sending nine clock pulses via SCL. The first eight pulses are used to transmit a 7-bit address followed by a
read/write (R/W ) bit. If the address of an I2C slave matches the 7-bit address transmitted, this matching slave
can respond by pulling SDA low on the ninth clock pulse. The master and the slave can send or receive data
according to the R/W bit. Whether to terminate the data transfer or not is determined by the logic level of the
acknowledge (ACK) bit. During data transfer, SDA changes only when SCL is low. Once finishing
A
communication, the master sends a STOP condition: pulling SDA up while SCL is high. If a master both reads
and writes data in one transfer, then it should send a RSTART condition, a slave address and a R/W bit before
changing its operation. The RSTART condition is used to change the transfer direction and the mode of the
devices (master mode or slave mode).
IN
23.2 Features
The I2C controller has the following features:
IM
• Master mode and slave mode
• Communication between multiple masters and slaves
• Standard mode (100 Kbit/s)

EL
• Fast mode (400 Kbit/s)
• 7-bit addressing and 10-bit addressing
• Continuous data transfer achieved by pulling SCL low
• Programmable digital noise filtering

PR
• Double addressing mode, which uses slave address and slave memory or register address

23.3 I2C Architecture
A RY
IN
Figure 231. I2C Master Architecture
IM
EL
PR
Figure 232. I2C Slave Architecture
The I2C controller runs either in master mode or slave mode, which is determined by I2C_MS_MODE. Figure
23-1 shows the architecture of a master, while Figure 23-2 shows that of a slave. The I2C controller has the
following main parts:
• transmit and receive memory (TX/RX RAM)
• command controller (CMD_Controller)
• SCL clock controller (SCL_FSM)
• SDA data controller (SCL_MAIN_FSM)

• serial/parallel data converter (DATA_Shifter)
• filter for SCL (SCL_Filter)
• filter for SDA (SDA_Filter)
Besides, the I2C controller also has a clock module which generates I2C clocks, and a synchronization module
which synchronizes the APB bus and the I2C controller.
The clock module is used to select clock sources, turn on and off clocks, and divide clocks. SCL_Filter and
SDA_Filter remove noises on SCL input signals and SDA input signals respectively. The synchronization module
synchronizes signal transfer between different clock domains.
Figure 23-3 and Figure 23-4 are the timing diagram and corresponding parameters of the I2C protocol.
RY
SCL_FSM generates the timing sequence conforming to the I2C protocol.
SCL_MAIN_FSM controls the execution of I2C commands and the sequence of the SDA line. CMD_Controller is
used for an I2C master to generate (R)START, STOP, WRITE, READ and END commands. TX RAM and RX RAM
store data to be transmitted and data received respectively. DATA_Shifter shifts data between serial and parallel
form.
A
IN
IM
EL
Figure 233. I2C Protocol Timing (Cited from Fig.31 in The I2Cbus specification Version 2.1)
PR

A RY
Figure 234. I2C Timing Parameters (Cited from Table 5 in The I2Cbus specification Version 2.1)

IN
Note that operations may differ between the I2C controller in ESP32-S3 and other masters or slaves on the bus.
Please refer to datasheets of individual I2C devices for specific information.
IM
23.4.1 Clock Configuration
Registers, TX RAM, and RX RAM are configured and accessed in the APB_CLK clock domain, whose frequency
is 1 ∼ 80 MHz. The main logic of the I2C controller, including SCL_FSM, SCL_MAIN_FSM, SCL_FILTER,
SDA_FILTER, and DATA_SHIFTER, are in the I2C_SCLK clock domain.
EL
You can choose the clock source for I2C_SCLK from XTAL_CLK or FOSC_CLK via I2C_SCLK_SEL. When
I2C_SCLK_SEL is cleared, the clock source is XTAL_CLK. When I2C_SCLK_SEL is set, the clock source is
FOSC_CLK. The clock source is enabled by configuring I2C_SCLK_ACTIVE as high level, and then passes
through a fractional divider to generate I2C_SCLK according to the following equation:
PR
I2C_SCLK_DIV _A
Divisor = I2C_SCLK_DIV _N U M + 1 +
I2C_SCLK_DIV _B
The frequency of XTAL_CLK is 40 MHz, while the frequency of FOSC_CLK is 17.5 MHz. Limited by timing
parameters, the derived clock I2C_SCLK should operate at a frequency 20 timers larger than SCL’s
frequency.
23.4.2 SCL and SDA Noise Filtering

SCL_Filter and SDA_Filter modules are identical and are used to filter signal noises on SCL and SDA, respectively.
These filters can be enabled or disabled by configuring I2C_SCL_FILTER_EN and I2C_SDA_FILTER_EN.
Take SCL_Filter as an example. When enabled, SCL_Filter samples input signals on the SCL line continuously.
These input signals are valid only if they remain unchanged for consecutive I2C_SCL_FILTER_THRES I2C_SCLK

clock cycles. Given that only valid input signals can pass through the filter, SCL_Filter can remove glitches whose
pulse width is shorter than I2C_SCL_FILTER_THRES I2C_SCLK clock cycles, while SDA_Filter can remove
glitches whose pulse width is shorter than I2C_SDA_FILTER_THRES I2C_SCLK clock cycles.
23.4.3 SCL Clock Stretching

The I2C controller in slave mode (i.e. slave) can hold the SCL line low in exchange for more time to process data.
This function called clock stretching is enabled by setting the I2C_SLAVE_SCL_STRETCH_EN bit. The time
period to release the SCL line from stretching is configured by setting the I2C_STRETCH_PROTECT_NUM field,
in order to avoid timing sequence errors. The slave will hold the SCL line low when one of the following four
events occurs:
RY
1. Address match: The address of the slave matches the address sent by the master via the SDA line, and the
R/W bit is 1.
2. RAM being full: RX RAM of the slave is full. Note that when the slave receives less than 32 bytes, it is not
necessary to enable clock stretching; when the slave receives 32 bytes or more, you may interrupt data
transmission to wrapped around RAM via the FIFO threshold, or enable clock stretching for more time to
process data. When clock stretching is nabled, I2C_RX_FULL_ACK_LEVEL must be cleared, otherwise
A
there will be unpredictable consequences.
3. RAM being empty: The slave is sending data, but its TX RAM is empty.
IN
4. Sending an ACK: If I2C_SLAVE_BYTE_ACK_CTL_EN is set, the slave pulls SCL low when sending an ACK
bit. At this stage, software validates data and configures I2C_SLAVE_BYTE_ACK_LVL to control the level of
the ACK bit. Note that when RX RAM of the slave is full, the level of the ACK bit to be sent is determined by
I2C_RX_FULL_ACK_LEVEL, instead of I2C_SLAVE_BYTE_ACK_LVL. In this case,
IM
I2C_RX_FULL_ACK_LEVEL should also be cleared to ensure proper functioning of clock stretching.
After SCL has been stretched low, the cause of stretching can be read from the I2C_STRETCH_CAUSE bit.
Clock stretching is disabled by setting the I2C_SLAVE_SCL_STRETCH_CLR bit.
EL
23.4.4 Generating SCL Pulses in Idle State

Usually when the I2C bus is idle, the SCL line is held high. The I2C controller in ESP32-S3 can be programmed
to generate SCL pulses in idle state. This function only works when the I2C controller is configured as master. If
the I2C_SCL_RST_SLV_EN bit is set, hardware will send I2C_SCL_RST_SLV_NUM SCL pulses, and then
automatically clear this bit. When software reads 0 in I2C_SCL_RST_SLV_EN, set I2C_CONF_UPGATE to stop
PR
this function.
23.4.5 Synchronization
I2C registers are configured in APB_CLK domain, whereas the I2C controller is configured in asynchronous
I2C_SCLK domain. Therefore, before being used by the I2C controller, register values should be synchronized by
first writing configuration registers and then writing 1 to I2C_CONF_UPGATE. Registers that need
synchronization are listed in Table 23-1.

Table 231. I2C Synchronous Registers
Register Parameter Address

I2C_CTR_REG I2C_SLV_TX_AUTO_START_EN 0x0004
I2C_ADDR_10BIT_RW_CHECK_EN
I2C_ADDR_BROADCASTING_EN
I2C_SDA_FORCE_OUT
I2C_SCL_FORCE_OUT
I2C_SAMPLE_SCL_LEVEL
I2C_RX_FULL_ACK_LEVEL
I2C_MS_MODE
RY
I2C_TX_LSB_FIRST
I2C_RX_LSB_FIRST
I2C_ARBITRATION_EN
I2C_TO_REG I2C_TIME_OUT_EN 0x000C
I2C_TIME_OUT_VALUE
I2C_SLAVE_ADDR_REG I2C_ADDR_10BIT_EN 0x0010
A
I2C_SLAVE_ADDR
I2C_FIFO_CONF_REG I2C_FIFO_ADDR_CFG_EN 0x0018
I2C_SCL_SP_CONF_REG I2C_SDA_PD_EN 0x0080
IN
I2C_SCL_PD_EN
I2C_SCL_RST_SLV_NUM
I2C_SCL_RST_SLV_EN
I2C_SCL_STRETCH_CONF_REG I2C_SLAVE_BYTE_ACK_CTL_EN 0x0084
IM
I2C_SLAVE_BYTE_ACK_LVL
I2C_SLAVE_SCL_STRETCH_EN
I2C_STRETCH_PROTECT_NUM
I2C_SCL_LOW_PERIOD_REG I2C_SCL_LOW_PERIOD 0x0000
I2C_SCL_HIGH_PERIOD_REG I2C_WAIT_HIGH_PERIOD 0x0038
EL
I2C_HIGH_PERIOD
I2C_SDA_HOLD_REG I2C_SDA_HOLD_TIME 0x0030
I2C_SDA_SAMPLE_REG I2C_SDA_SAMPLE_TIME 0x0034
I2C_SCL_START_HOLD_REG I2C_SCL_START_HOLD_TIME 0x0040
I2C_SCL_RSTART_SETUP_REG I2C_SCL_RSTART_SETUP_TIME 0x0044
PR
I2C_SCL_STOP_HOLD_REG I2C_SCL_STOP_HOLD_TIME 0x0048

I2C_SCL_STOP_SETUP_REG I2C_SCL_STOP_SETUP_TIME 0x004C
I2C_SCL_ST_TIME_OUT_REG I2C_SCL_ST_TO_I2C 0x0078
I2C_SCL_MAIN_ST_TIME_OUT_REG I2C_SCL_MAIN_ST_TO_I2C 0x007C
I2C_FILTER_CFG_REG I2C_SCL_FILTER_EN 0x0050
I2C_SCL_FILTER_THRES
I2C_SDA_FILTER_EN
I2C_SDA_FILTER_THRES
23.4.6 OpenDrain Output

SCL and SDA output drivers must be configured as open drain. There are two ways to achieve this:

1. Set I2C_SCL_FORCE_OUT and I2C_SDA_FORCE_OUT, and configure GPIO_PINn_PAD_DRIVER for

corresponding SCL and SDA pads as open-drain.
2. Clear I2C_SCL_FORCE_OUT and I2C_SDA_FORCE_OUT.
Because these lines are configured as open-drain, the low-to-high transition time of each line is longer,
determined together by the pull-up resistor and line capacitance. The output duty cycle of I2C is limited by the
SDA and SCL line’s pull-up speed, mainly SCL’s speed.
In addition, when I2C_SCL_FORCE_OUT and I2C_SCL_PD_EN are set to 1, SCL can be forced low; when
I2C_SDA_FORCE_OUT and I2C_SDA_PD_EN are set to 1, SDA can be forced low.
23.4.7 Timing Parameter Configuration
A RY
IN
Figure 235. I2C Timing Diagram
IM
Figure 23-5 shows the timing diagram of an I2C master. This figure also specifies registers used to configure the
START bit, STOP bit, data hold time, data sample time, waiting time on the rising SCL edge, etc. Timing
parameters are calculated as follows in I2C_SCLK clock cycles:
EL
1. tLOW = (I2C_SCL_LOW _P ERIOD + 1) · TI2C_SCLK
2. tHIGH = (I2C_SCL_HIGH_P ERIOD + 1) · TI2C_SCLK
3. tSU :ST A = (I2C_SCL_RST ART _SET U P _T IM E + 1) · TI2C_SCLK
4. tHD:ST A = (I2C_SCL_ST ART _HOLD_T IM E + 1) · TI2C_SCLK

PR
5. tr = (I2C_SCL_W AIT _HIGH_P ERIOD + 1) · TI2C_SCLK
6. tSU :ST O = (I2C_SCL_ST OP _SET U P _T IM E + 1) · TI2C_SCLK
7. tBU F = (I2C_SCL_ST OP _HOLD_T IM E + 1) · TI2C_SCLK
8. tHD:DAT = (I2C_SDA_HOLD_T IM E + 1) · TI2C_SCLK
9. tSU :DAT = (I2C_SCL_LOW _P ERIOD − I2C_SDA_HOLD_T IM E) · TI2C_SCLK
Timing registers below are divided into two groups, depending on the mode in which these registers are
active:
• Master mode only:

1. I2C_SCL_START_HOLD_TIME: Specifies the interval between pulling SDA low and pulling SCL low
when the master generates a START condition. This interval is (I2C_SCL_START_HOLD_TIME +1) in
I2C_SCLK cycles. This register is active only when the I2C controller works in master mode.
2. I2C_SCL_LOW_PERIOD: Specifies the low period of SCL. This period lasts (I2C_SCL_LOW_PERIOD
+1) in I2C_SCLK cycles. However, it could be extended when SCL is pulled low by peripheral devices
or by an END command executed by the I2C controller, or when the clock is stretched. This register is
active only when the I2C controller works in master mode.
3. I2C_SCL_WAIT_HIGH_PERIOD: Specifies time for SCL to go high in I2C_SCLK cycles. Please make
sure that SCL could be pulled high within this time period. Otherwise, the high period of SCL may be
incorrect. This register is active only when the I2C controller works in master mode.
RY
4. I2C_SCL_HIGH_PERIOD: Specifies the high period of SCL in I2C_SCLK cycles. This register is active
only when the I2C controller works in master mode. When SCL goes high within
(I2C_SCL_WAIT_HIGH_PERIOD + 1) in I2C_SCLK cycles, its frequency is:
fI2C_SCLK
fscl =
I2C_SCL_LOW_PERIOD + I2C_SCL_HIGH_PERIOD + I2C_SCL_WAIT_HIGH_PERIOD+3
A
• Master mode and slave mode:
1. I2C_SDA_SAMPLE_TIME: Specifies the interval between the rising edge of SCL and the level
IN
sampling time of SDA. It is advised to set a value in the middle of SCL’s high period, so as to correctly
sample the level of SCL. This register is active both in master mode and slave mode.
2. I2C_SDA_HOLD_TIME: Specifies the interval between changing the SDA output level and the falling
edge of SCL. This register is active both in master mode and slave mode.
IM
Timing parameters limits corresponding register configuration.
fI2C_SCLK
1. fSCL > 20
2. 3 × fI2C_SCLK ≤ (I2C_SDA_HOLD_T IM E − 4) × fAP B_CLK

EL
3. I2C_SDA_HOLD_TIME + I2C_SCL_START_HOLD_TIME > SDA_FILTER_THRES + 3
4. I2C_SCL_WAIT_HIGH_PERIOD < I2C_SDA_SAMPLE_TIME < I2C_SCL_HIGH_PERIOD
5. I2C_SDA_SAMPLE_TIME < I2C_SCL_WAIT_HIGH_PERIOD + I2C_SCL_START_HOLD_TIME +

I2C_SCL_RSTART_SETUP_TIME
PR
6. I2C_STRETCH_PROTECT_NUM + I2C_SDA_HOLD_TIME > I2C_SCL_LOW_PERIOD
23.4.8 Timeout Control

The I2C controller has three types of timeout control, namely timeout control for SCL_FSM, for SCL_MAIN_FSM,
and for the SCL line. The first two are always enabled, while the third is configurable.
When SCL_FSM remains unchanged for more than 2I2C_SCL_ST _T O_I2C clock cycles, an I2C_SCL_ST_TO_INT
interrupt is triggered, and then SCL_FSM goes to idle state. The value of I2C_SCL_ST_TO_I2C should be less
than or equal to 22, which means SCL_FSM could remain unchanged for 222 I2C_SCLK clock cycles at most
before the interrupt is generated.
When SCL_MAIN_FSM remains unchanged for more than 2I2C_SCL_M AIN _ST _T O_I2C I2C_SCLK clock cycles,
an

I2C_SCL_MAIN_ST_TO_INT interrupt is triggered, and then SCL_MAIN_FSM goes to idle state. The value of
I2C_SCL_MAIN_ST_TO_I2C should be less than or equal to 22, which means SCL_MAIN_FSM could remain
unchanged for 222 clock cycles at most before the interrupt is generated.
Timeout control for SCL is enabled by setting I2C_TIME_OUT_EN. When the level of SCL remains unchanged for
more than I2C_TIME_OUT_VALUE clock cycles, an I2C_TIME_OUT_INT interrupt is triggered, and then the I2C
bus goes to idle state.
23.4.9 Command Configuration

When the I2C controller works in master mode, CMD_Controller reads commands from 8 sequential command
registers and controls SCL_FSM and SCL_MAIN_FSM accordingly.
A RY
Figure 236. Structure of I2C Command Registers
IN
Command registers, whose structure is illustrated in Figure 23-6, are active only when the I2C controller works in
master mode. Fields of command registers are:
IM
1. CMD_DONE: Indicates that a command has been executed. After each command has been executed, the
CMD_DONE bit in the corresponding command register is set to 1 by hardware. By reading this bit,
software can tell if the command has been executed. When writing new commands, this bit must be
cleared by software.
2. op_code: Indicates the command. The I2C controller supports five commands:
EL
• RSTART: op_code = 6. The I2C controller sends a START bit or a RSTART bit defined by the I2C
protocol.
• WRITE: op_code = 1. The I2C controller sends a slave address, a register address (only in double
addressing mode) and data to the slave.
PR
• READ: op_code = 3. The I2C controller reads data from the slave.
• STOP: op_code = 2. The I2C controller sends a STOP bit defined by the I2C protocol. This code also
indicates that the command sequence has been executed, and the CMD_Controller stops reading
commands. After restarted by software, the CMD_Controller resumes reading commands from
command register 0.
• END: op_code = 4. The I2C controller pulls the SCL line down and suspends I2C communication.
This code also indicates that the command sequence has completed, and the CMD_Controller stops
executing commands. Once software refreshes data in command registers and the RAM, the
CMD_Controller can be restarted to execute commands from command register 0 again.
3. ack_value: Used to configure the level of the ACK bit sent by the I2C controller during a read operation.
This bit is ignored in RSTART, STOP, END and WRITE conditions.

4. ack_exp: Used to configure the level of the ACK bit expected by the I2C controller during a write operation.
This bit is ignored during RSTART, STOP, END and READ conditions.
5. ack_check_en: Used to enable the I2C controller during a write operation to check whether the ACK level
sent by the slave matches ack_exp in the command. If this bit is set and the level received does not match
ack_exp in the WRITE command, the master will generate an I2C_NACK_INT interrupt and a STOP
condition for data transfer. If this bit is cleared, the controller will not check the ACK level sent by the slave.
This bit is ignored during RSTART, STOP, END and READ conditions.
6. byte_num: Specifies the length of data (in bytes) to be read or written. Can range from 1 to 255 bytes. This
bit is ignored during RSTART, STOP and END conditions.
Each command sequence is executed starting from command register 0 and terminated by a STOP or an END.
RY
Therefore, there must be a STOP or an END command in the eight command registers.
A complete data transfer on the I2C bus should be initiated by a START and terminated by a STOP. The transfer
process may be completed using multiple sequences, separated by END commands. Each sequence may differ
in the direction of data transfer, clock frequency, slave addresses, data length, etc. This allows efficient use of
available peripheral RAM and also achieves more flexible I2C communication.
A
23.4.10 TX/RX RAM Data Storage
Both TX RAM and RX RAM are 32 × 8 bits, and can be accessed in FIFO or non-FIFO mode. If
IN
I2C_NONFIFO_EN bit is cleared, both RAMs are accessed in FIFO mode; if I2C_NONFIFO_EN bit is set, both
RAMs are accessed in non-FIFO mode.
TX RAM stores data that the I2C controller needs to send. During communication, when the I2C controller needs
IM
to send data (except acknowledgement bits), it reads data from TX RAM and sends them sequentially via SDA.
When the I2C controller works in master mode, all data must be stored in TX RAM in the order they will be sent to
slaves. The data stored in TX RAM include slave addresses, read/write bits, register addresses (only in double
addressing mode) and data to be sent. When the I2C controller works in slave mode, TX RAM only stores data to
be sent.
EL
TX RAM can be read and written by the CPU. The CPU writes to TX RAM either in FIFO mode or in non-FIFO
mode (direct address). In FIFO mode, the CPU writes to TX RAM via the fixed address I2C_DATA_REG, with
addresses for writing in TX RAM incremented automatically by hardware. In non-FIFO mode, the CPU accesses
TX RAM directly via address fields (I2C Base Address + 0x100) ~(I2C Base Address + 0x17C). Each byte in TX
RAM occupies an entire word in the address space. Therefore, the address of the first byte is I2C Base Address
PR
+ 0x100, the second byte is I2C Base Address + 0x104, the third byte is I2C Base Address + 0x108, and so on.
The CPU can only read TX RAM via direct addresses. Addresses for reading TX RAM are the same with
addresses for writing TX RAM.
RX RAM stores data the I2C controller receives during communication. When the I2C controller works in slave
mode, neither slave addresses sent by the master nor register addresses (only in double addressing mode) will
be stored into RX RAM. Values of RX RAM can be read by software after I2C communication completes.
RX RAM can only be read by the CPU. The CPU reads RX RAM either in FIFO mode or in non-FIFO mode (direct
address). In FIFO mode, the CPU reads RX RAM via the fixed address I2C_DATA_REG, with addresses for
reading RX RAM incremented automatically by hardware. In non-FIFO mode, the CPU accesses TX RAM directly
via address fields (I2C Base Address + 0x180) ~(I2C Base Address + 0x1FC). Each byte in RX RAM occupies an
entire word in the address space. Therefore, the address of the first byte is I2C Base Address + 0x180, the

second byte is I2C Base Address + 0x184, the third byte is I2C Base Address + 0x188 and so on.
In FIFO mode, TX RAM of a master may wrap around to send data larger than 32 bytes. Set I2C_FIFO_PRT_EN.
If the size of data to be sent is smaller than I2C_TXFIFO_WM_THRHD (master), an I2C_TXFIFO_WM_INT (master)
interrupt is generated. After receiving the interrupt, software continues writing to I2C_DATA_REG (master).
Please ensure that software writes to or refreshes TX RAM before the master sends data, otherwise it may result
in unpredictable consequences.
In FIFO mode, RX RAM of a slave may also wrap around to receive data larger than 32 bytes. Set
I2C_FIFO_PRT_EN and clear I2C_RX_FULL_ACK_LEVEL. If data already received (to be overwritten) is larger
than I2C_RXFIFO_WM_THRHD (slave), an I2C_RXFIFO_WM_INT (slave) interrupt is generated. After receiving the
interrupt, software continues reading from I2C_DATA_REG (slave).
RY
23.4.11 Data Conversion
DATA_Shifter is used for serial/parallel conversion, converting byte data in TX RAM to an outgoing serial bitstream
or an incoming serial bitstream to byte data in RX RAM. I2C_RX_LSB_FIRST and I2C_TX_LSB_FIRST can be
used to select LSB- or MSB-first storage and transmission of data.
A
23.4.12 Addressing Mode
Besides 7-bit addressing, the ESP32-S3 I2C controller also supports 10-bit addressing and double addressing.
IN
10-bit addressing can be mixed with 7-bit addressing.
Define the slave address as SLV_ADDR. In 7-bit addressing mode, the slave address is SLV_ADDR[6:0]; in 10-bit
addressing mode, the slave address is SLV_ADDR[9:0].
IM
In 7-bit addressing mode, the master only needs to send one byte of address, which comprises SLV_ADDR[6:0]
and a R/W bit. In 7-bit addressing mode, there is a special case called general call addressing (broadcast). It is
enabled by setting I2C_ADDR_BROADCASTING_EN in a slave. When the slave receives the general call address
(0x00) from the master and the R/W bit followed is 0, it responds to the master regardless of its own
address.
EL
In 10-bit addressing mode, the master needs to send two bytes of address. The first byte is
slave_addr_first_7bits followed by a R/W bit, and slave_addr_first_7bits should be configured as (0x78 |
SLV_ADDR[9:8]). The second byte is slave_addr_second_byte, which should be configured as SLV_ADDR[7:0].
The slave can enable 10-bit addressing by configuring I2C_ADDR_10BIT_EN. I2C_SLAVE_ADDR is used to
configure I2C slave address. Specifically, I2C_SLAVE_ADDR[14:7] should be configured as SLV_ADDR[7:0], and
PR
I2C_SLAVE_ADDR[6:0] should be configured as (0x78 | SLV_ADDR[9:8]). Since a 10-bit slave address has one
more byte than a 7-bit address, byte_num of the WRITE command and the number of bytes in the RAM increase
by one.
When working in slave mode, the I2C controller supports double addressing, where the first address is the
address of an I2C slave, and the second one is the slave’s memory address. When using double addressing,
RAM must be accessed in non-FIFO mode. Double addressing is enabled by setting
I2C_FIFO_ADDR_CFG_EN.
23.4.13 R/W Bit Check in 10bit Addressing Mode

In 10-bit addressing mode, when I2C_ADDR_10BIT_RW_CHECK_EN is set to 1, the I2C controller performs a
check on the first byte, which consists of slave_addr_first_7bits and a R/W bit. When the R/W bit does not

indicate a WRITE operation, i.e. not in line with the I2C protocol, the data transfer ends. If the check feature is
not enabled, when the R/W bit does not indicate a WRITE, the data transfer still continues, but transfer failure
may occur.
23.4.14 To Start the I2C Controller

To start the I2C controller in master mode, after configuring the controller to master mode and command
registers, write 1 to I2C_TRANS_START in order that the master starts to parse and execute command
sequences. The master always executes a command sequence starting from command register 0 to a STOP or
an END at the end. To execute another command sequence starting from command register 0, refresh
commands by writing 1 again to I2C_TRANS_START.
RY
To start the I2C controller in slave mode, there are two ways:
• Set I2C_SLV_TX_AUTO_START_EN, and the slave starts automatic transfer upon an address match;
• Clear I2C_SLV_TX_AUTO_START_EN, and always set I2C_TRANS_START before transfer.
23.5 Programming Example
A
This sections provides programming examples for typical communication scenarios. ESP32-S3 has one I2C
controller. For the convenience of description, I2C masters and slaves in all subsequent figures are ESP32-S3
IN
I2C controllers. I2C master is referred to as I2Cmaster , and I2C slave is referred to as I2Cslave .
23.5.1 I2Cmaster Writes to I2Cslave with a 7bit Address in One Command Sequence
IM
EL
PR
Figure 237. I2Cmaster Writing to I2Cslave with a 7bit Address
Figure 23-7 shows how I2Cmaster writes N bytes of data to I2Cslave registers or RAM using 7-bit addressing. As
shown in figure 23-7 , the first byte in the RAM of I2Cmaster is a 7-bit I2Cslave address followed by a R/W bit.
When the R/W bit is 0, it indicates a WRITE operation. The remaining bytes are used to store data ready for
transfer. The cmd box contains related command sequences.

After the command sequence is configured and data in RAM is ready, I2Cmaster enables the controller and initiates
data transfer by setting the I2C_TRANS_START bit. The controller has four steps to take:
1. Wait for SCL to go high, to avoid SCL being used by other masters or slaves.
2. Execute a RSTART command and send a START bit.
3. Execute a WRITE command by taking N+1 bytes from the RAM in order and send them to I2Cslave in the
same order. The first byte is the address of I2Cslave .
4. Send a STOP. Once the I2Cmaster transfers a STOP bit, an I2C_TRANS_COMPLETE_INT interrupt is
generated.
23.5.1.2 Configuration Example
RY
1. Configure the timing parameter registers of I2Cmaster and I2Cslave according to Section 23.4.7.
2. Set I2C_MS_MODE (master) to 1, and I2C_MS_MODE (slave) to 0.
3. Write 1 to I2C_CONF_UPGATE (master) and I2C_CONF_UPGATE (slave) to synchronize registers.
A
4. Configure command registers of I2Cmaster .
Command register op_code ack_value ack_exp ack_check_en byte_num

I2C_COMMAND0 (master) RSTART — — — —
I2C_COMMAND1 (master)
WRITE
STOP —
IN
ack_value ack_exp
—
1
—
N+1
—
IM
5. Write the address of I2Cslave and data to be sent to TX RAM of I2Cmaster in either FIFO mode or non-FIFO
mode according to Section 23.4.10.
6. Write the address of I2Cslave to I2C_SLAVE_ADDR (slave) in I2C_SLAVE_ADDR_REG (slave) register.

EL
8. Write 1 to I2C_TRANS_START (master) and I2C_TRANS_START (slave) to start transfer.
9. I2Cslave compares the slave address sent by I2Cmaster with its own address in I2C_SLAVE_ADDR (slave).
When ack_check_en (master) in I2Cmaster ’s WRITE command is 1, I2Cmaster checks ACK value each time it
sends a byte. When ack_check_en (master) is 0, I2Cmaster does not check ACK value and take I2Cslave as a
matching slave by default.
PR
• Match: If the received ACK value matches ack_exp (master) (the expected ACK value), I2Cmaster
continues data transfer.
• Not match: If the received ACK value does not match ack_exp, I2Cmaster generates an I2C_NACK_INT
(master) interrupt and stops data transfer.
10. I2Cmaster sends data, and checks ACK value or not according to ack_check_en (master).
11. If data to be sent (N) is larger than 32 bytes, TX RAM of I2Cmaster may wrap around in FIFO mode. For
details, please refer to Section 23.4.10.
12. If data to be received (N) is larger than 32 bytes, RX RAM of I2Cslave may wrap around in FIFO mode. For

If data to be received (N) is larger than 32 bytes, the other way is to enable clock stretching by setting the
I2C_SLAVE_SCL_STRETCH_EN (slave), and clearing I2C_RX_FULL_ACK_LEVEL. When RX RAM is full, an
I2C_SLAVE_STRETCH_INT (slave) interrupt is generated. In this way, I2Cslave can hold SCL low, in
exchange for more time to read data. After software has finished reading, you can set
I2C_SLAVE_STRETCH_INT_CLR (slave) to 1 to clear interrupt, and set I2C_SLAVE_SCL_STRETCH_CLR
(slave) to release the SCL line.
13. After data transfer completes, I2Cmaster executes the STOP command, and generates an
I2C_TRANS_COMPLETE_INT (master) interrupt.
23.5.2 I2Cmaster Writes to I2Cslave with a 10bit Address in One Command Sequence
RY
A
IN
IM
Figure 238. I2Cmaster Writing to a Slave with a 10bit Address

EL
Figure 23-8 shows how I2Cmaster writes N bytes of data using 10-bit addressing to an I2C slave. The
configuration and transfer process is similar to what is described in 23.5.1, except that a 10-bit I2Cslave address is
formed from two bytes. Since a 10-bit I2Cslave address has one more byte than a 7-bit I2Cslave address,
byte_num and length of data in TX RAM increase by 1 accordingly.
PR
Command registers op_code ack_value ack_exp ack_check_en byte_num

I2C_COMMAND1 (master) WRITE ack_value ack_exp 1 N+2
I2C_COMMAND2 (master) STOP — — — —

4. Configure I2C_SLAVE_ADDR (slave) in I2C_SLAVE_ADDR_REG (slave) as I2Cslave ’s 10-bit address, and set
I2C_ADDR_10BIT_EN (slave) to 1 to enable 10-bit addressing.
5. Write the address of I2Cslave and data to be sent to TX RAM of I2Cmaster . The first byte of the address of
I2Cslave comprises ((0x78 | I2C_SLAVE_ADDR[9:8])«1) and a R/W bit. The second byte of the address of
I2Cslave is I2C_SLAVE_ADDR[7:0]. These two bytes are followed by data to be sent in FIFO or non-FIFO
mode.
RY
sends a byte. When ack_check_en (master) is 0, I2Cmaster does not check ACK value and take I2Cslave as
A
IN
10. If data to be sent is larger than 32 bytes, TX RAM of I2Cmaster may wrap around in FIFO mode. For details,
11. If data to be received is larger than 32 bytes, RX RAM of I2Cslave may wrap around in FIFO mode. For
IM
If data to be received is larger than 32 bytes, the other way is to enable clock stretching by setting
I2C_SLAVE_SCL_STRETCH_EN (slave), and clearing I2C_RX_FULL_ACK_LEVEL to 0. When RX RAM is
full, an I2C_SLAVE_STRETCH_INT (slave) interrupt is generated. In this way, I2Cslave can hold SCL low, in
EL

PR
23.5.3 I2Cmaster Writes to I2Cslave with Two 7bit Addresses in One Command Sequence

A RY
Figure 239. I2Cmaster Writing to I2Cslave with Two 7bit Addresses
Figure 23-9 shows how I2Cmaster writes N bytes of data to I2Cslave registers or RAM using 7-bit double
IN
addressing. The configuration and transfer process is similar to what is described in Section 23.5.1, except that
in 7-bit double addressing mode I2Cmaster sends two 7-bit addresses. The first address is the address of an I2C
slave, and the second one is I2Cslave ’s memory address (i.e. addrM in Figure 23-9). When using double
addressing, RAM must be accessed in non-FIFO mode. The I2C slave put received byte0 ~ byte(N-1) into its
IM
RAM in an order staring from addrM. The RAM is overwritten every 32 bytes.

EL
2. Set I2C_FIFO_ADDR_CFG_EN (slave) to 1 to enable double addressing mode.

PR

5. Write the address of I2Cslave and data to be sent to TX RAM of I2Cmaster in FIFO or non-FIFO mode.

10. I2Cslave receives the RX RAM address sent by I2Cmaster and adds the offset.
RY
12. If data to be sent is larger than 32 bytes, TX RAM of I2Cmaster may wrap around in FIFO mode. For details,
13. If data to be received is larger than 32 bytes, you may enable clock stretching by setting
I2C_SLAVE_SCL_STRETCH_EN (slave), and clearing I2C_RX_FULL_ACK_LEVEL to 0. When RX RAM is
full, an I2C_SLAVE_STRETCH_INT (slave) interrupt is generated. In this way, I2Cslave can hold SCL low, in
A
IN
23.5.4 I2Cmaster Writes to I2Cslave with a 7bit Address in Multiple Command Sequences
IM
EL
PR

A RY
IN
IM
EL
Figure 2310. I2Cmaster Writing to I2Cslave with a 7bit Address in Multiple Sequences
Given that the I2C Controller RAM holds only 32 bytes, when data are too large to be processed even by the
wrapped RAM, it is advised to transmit them in multiple command sequences. At the end of every command
PR
sequence is an END command. When the controller executes this END command to pull SCL low, software
refreshes command sequence registers and the RAM for next the transfer.
Figure 23-10 shows how I2Cmaster writes to an I2C slave in two or three segments as an example. For the first
segment, the CMD_Controller registers are configured as shown in Segment0. Once data in I2Cmaster ’s RAM is
ready and I2C_TRANS_START is set, I2Cmaster initiates data transfer. After executing the END command,
I2Cmaster turns off the SCL clock and pulls SCL low to reserve the bus. Meanwhile, the controller generates an
I2C_END_DETECT_INT interrupt.
For the second segment, after detecting the I2C_END_DETECT_INT interrupt, software refreshes the
CMD_Controller registers, reloads the RAM and clears this interrupt, as shown in Segment1. If cmd1 in the
second segment is a STOP, then data is transmitted to I2Cslave in two segments. I2Cmaster resumes data transfer
after I2C_TRANS_START is set, and terminates the transfer by sending a STOP bit.

For the third segment, after the second data transfer finishes and an I2C_END_DETECT_INT is detected, the
CMD_Controller registers of I2Cmaster are configured as shown in Segment2. Once I2C_TRANS_START is set,
I2Cmaster generates a STOP bit and terminates the transfer.
Note that other I2Cmaster s will not transact on the bus between two segments. The bus is only released after a
STOP signal is sent. The I2C controller can be reset by setting I2C_FSM_RST field at any time. This field will later
be cleared automatically by hardware.
RY

A
I2C_COMMAND2 (master) END — — — —
4. Write the address of I2Cslave and data to be sent to TX RAM of I2Cmaster in either FIFO mode or non-FIFO
mode according to Section 23.4.10.
IN
5. Write the address of I2Cslave to I2C_SLAVE_ADDR (slave) in I2C_SLAVE_ADDR_REG (slave) register

IM
EL
PR
10. After the I2C_END_DETECT_INT (master) interrupt is generated, set I2C_END_DETECT_INT_CLR (master)
to 1 to clear this interrupt.
11. Update I2Cmaster ’s command registers.

I2C_COMMAND0 (master) WRITE ack_value ack_exp 1 M
I2C_COMMAND1 (master) END/STOP — — — —
12. Write M bytes of data to be sent to TX RAM of I2Cmaster in FIFO or non-FIFO mode.

13. Write 1 to I2C_TRANS_START (master) bit to start transfer and repeat step 9.
14. If the command is a STOP, I2C stops transfer and generates an I2C_TRANS_COMPLETE_INT (master)
interrupt.
15. If the command is an END, repeat step 10.
Command registers of op_code ack_value ack_exp ack_check_en byte_num

I2Cmaster
RY
17. Write 1 to I2C_TRANS_START (master) bit to start transfer.
18. I2Cmaster executes the STOP command and generates an I2C_TRANS_COMPLETE_INT (master) interrupt.
23.5.5 I2Cmaster Reads I2Cslave with a 7bit Address in One Command Sequence
A
IN
IM
EL
PR
Figure 2311. I2Cmaster Reading I2Cslave with a 7bit Address
Figure 23-11 shows how I2Cmaster reads N bytes of data from an I2C slave using 7-bit addressing. cmd1 is a
WRITE command, and when this command is executed I2Cmaster sends the address of I2Cslave . The byte sent
comprises a 7-bit I2Cslave address and a R/W bit. When the R/W bit is 1, it indicates a READ operation. If the
address of an I2C slave matches the sent address, this matching slave starts sending data to I2Cmaster . I2Cmaster
generates acknowledgements according to ack_value defined in the READ command upon receiving a
byte.
As illustrated in Figure 23-11, I2Cmaster executes two READ commands: it generates ACKs for (N-1) bytes of data
in cmd2, and a NACK for the last byte of data in cmd 3. This configuration may be changed as required.

I2Cmaster writes received data into the controller RAM from addr0, whose original content (a the address of
I2Cslave and a R/W bit) is overwritten by byte0 marked red in Figure 23-11.
2. We recommend setting I2C_SLAVE_SCL_STRETCH_EN (slave) to 1, so that SCL can be held low for more
processing time when I2Cslave needs to send data. If this bit is not set, software should write data to be
sent to I2Cslave ’s TX RAM before I2Cmaster initiates transfer. Configuration below is applicable to scenario
where I2C_SLAVE_SCL_STRETCH_EN (slave) is 1.
RY

I2Cmaster
A
I2C_COMMAND1 (master) WRITE 0 0 1 1
I2C_COMMAND2 (master) READ 0 0 1 N-1
I2C_COMMAND3 (master) READ 1 0 1 1
I2C_COMMAND4 (master) STOP —
IN — — —
5. Write the address of I2Cslave to TX RAM of I2Cmaster in either FIFO mode or non-FIFO mode according to
Section 23.4.10.
IM
8. Write 1 to I2C_TRANS_START (master) bit to start I2Cmaster ’s transfer.

EL
9. Start I2Cslave ’s transfer according to Section 23.4.14.
PR
11. After I2C_SLAVE_STRETCH_INT (slave) is generated, the I2C_STRETCH_CAUSE bit is 0. The address of
I2Cslave matches the address sent over SDA, and I2Cslave needs to send data.
12. Write data to be sent to TX RAM of I2Cslave in either FIFO mode or non-FIFO mode according to Section
23.4.10.
13. Set I2C_SLAVE_SCL_STRETCH_CLR (slave) to 1 to release SCL.

14. I2Cslave sends data, and I2Cmaster checks ACK value or not according to ack_check_en (master) in the
READ command.
15. If data to be read by I2Cmaster is larger than 32 bytes, an I2C_SLAVE_STRETCH_INT (slave) interrupt will be
generated when TX RAM of I2Cslave becomes empty. In this way, I2Cslave can hold SCL low, so that
software has more time to pad data in TX RAM of I2Cslave and read data in RX RAM of I2Cmaster . After
software has finished reading, you can set I2C_SLAVE_STRETCH_INT_CLR (slave) to 1 to clear interrupt,
and set I2C_SLAVE_SCL_STRETCH_CLR (slave) to release the SCL line.
16. After I2Cmaster has received the last byte of data, set ack_value (master) to 1. I2Cslave will stop transfer once
receiving the I2C_NACK_INT interrupt.
RY
23.5.6 I2Cmaster Reads I2Cslave with a 10bit Address in One Command Sequence
A
IN
IM
EL
PR
Figure 2312. I2Cmaster Reading I2Cslave with a 10bit Address
Figure 23-12 shows how I2Cmaster reads data from an I2C slave using 10-bit addressing. Unlike 7-bit addressing,
in 10-bit addressing the WRITE command of the I2Cmaster is formed from two bytes, and correspondingly TX
RAM of this master stores a 10-bit address of two bytes. The R/W bit in the first byte is 0, which indicates a
WRITE operation. After a RSTART condition, I2Cmaster sends the first byte of address again to read data from
I2Cslave , but the R/W bit is 1, which indicates a READ operation. The two address bytes can be configured as
described in Section 23.5.2.

RY
I2Cmaster
A
IN
5. Configure I2C_SLAVE_ADDR (slave) in I2C_SLAVE_ADDR_REG (slave) as I2Cslave ’s 10-bit address, and set
I2C_ADDR_10BIT_EN (slave) to 1 to enable 10-bit addressing.
IM
6. Write the address of I2Cslave and data to be sent to TX RAM of I2Cmaster in either FIFO or non-FIFO mode.
The first byte of address comprises ((0x78 | I2C_SLAVE_ADDR[9:8])«1) and a R/W bit, which is 1 and
indicates a WRITE operation. The second byte of address is I2C_SLAVE_ADDR[7:0]. The third byte is
((0x78 | I2C_SLAVE_ADDR[9:8])«1) and a R/W bit, which is 1 and indicates a READ operation.

EL
8. Write 1 to I2C_TRANS_START (master) to start I2Cmaster ’s transfer.
PR
11. I2Cmaster sends a RSTART and the third byte in TX RAM, which is ((0x78 | I2C_SLAVE_ADDR[9:8])«1) and a
R/W bit that indicates READ.
12. I2Cslave repeats step 10. If its address matches the address sent by I2Cmaster , I2Cslave proceed on to the
next steps.

23.4.10.
READ command.
RY
A
IN
23.5.7 I2Cmaster Reads I2Cslave with Two 7bit Addresses in One Command Sequence
IM
EL
PR
Figure 2313. I2Cmaster Reading N Bytes of Data from addrM of I2Cslave with a 7bit Address

Figure 23-13 shows how I2Cmaster reads data from specified addresses in an I2C slave. I2Cmaster sends two bytes
of addresses: the first byte is a 7-bit I2Cslave address followed by a R/W bit, which is 0 and indicates a WRITE;
the second byte is I2Cslave ’s memory address. After a RSTART condition, I2Cmaster sends the first byte of address
again, but the R/W bit is 1 which indicates a READ. Then, I2Cmaster reads data starting from addrM.
RY
3. Set I2C_FIFO_ADDR_CFG_EN (slave) to 1 to enable double addressing mode.
A
I2Cmaster
WRITE
RSTART
0
—
IN 0
—
1
—
2
—
IM
6. Configure I2C_SLAVE_ADDR (slave) in I2C_SLAVE_ADDR_REG (slave) register as I2Cslave ’s 7-bit address,

EL
and set I2C_ADDR_10BIT_EN (slave) to 0 to enable 7-bit addressing.
7. Write the address of I2Cslave and data to be sent to TX RAM of I2Cmaster in either FIFO or non-FIFO mode
according to Section 23.4.10. The first byte of address comprises ( I2C_SLAVE_ADDR[6:0])«1) and a R/W
bit, which is 0 and indicates a WRITE. The second byte of address is memory address M of I2Cslave . The
third byte is ( I2C_SLAVE_ADDR[6:0])«1) and a R/W bit, which is 1 and indicates a READ.
PR

12. I2Cslave receives memory address sent by I2Cmaster and adds the offset.
13. I2Cmaster sends a RSTART and the third byte in TX RAM, which is ((0x78 | I2C_SLAVE_ADDR[9:8])«1) and a
R bit.
14. I2Cslave repeats step 11. If its address matches the address sent by I2Cmaster , I2Cslave proceed on to the
next steps.
RY
23.4.10.
READ command.
A
IN
IM
23.5.8 I2Cmaster Reads I2Cslave with a 7bit Address in Multiple Command Sequences
EL
PR

A RY
IN
IM
EL
PR
Figure 2314. I2Cmaster Reading I2Cslave with a 7bit Address in Segments
Figure 23-14 shows how I2Cmaster reads (N+M) bytes of data from an I2C slave in two/three segments separated
by END commands. Configuration procedures are described as follows:
1. The procedures for Segment0 is similar to 23-11, except that the last command is an END.
2. Prepare data in the TX RAM of I2Cslave , and set I2C_TRANS_START to start data transfer. After executing
the END command, I2Cmaster refreshes command registers and the RAM as shown in Segment1, and
clears the corresponding I2C_END_DETECT_INT interrupt. If cmd2 in Segment1 is a STOP, then data is
read from I2Cslave in two segments. I2Cmaster resumes data transfer by setting I2C_TRANS_START and
terminates the transfer by sending a STOP bit.
3. If cmd2 in Segment1 is an END, then data is read from I2Cslave in three segments. After the second data

transfer finishes and an I2C_END_DETECT_INT interrupt is detected, the cmd box is configured as shown
in Segment2. Once I2C_TRANS_START is set, I2Cmaster terminates the transfer by sending a STOP bit.
RY

I2Cmaster
A
I2C_COMMAND2 (master) READ 0 0 1 N
IN
5. Write the address of I2Cslave to TX RAM of I2Cmaster in FIFO or non-FIFO mode.

IM
EL
PR
23.4.10.
READ command.

15. If data to be read by I2Cmaster in one READ command (N or M) is larger than 32 bytes, an
I2C_SLAVE_STRETCH_INT (slave) interrupt will be generated when TX RAM of I2Cslave becomes empty. In
this way, I2Cslave can hold SCL low, so that software has more time to pad data in TX RAM of I2Cslave and
read data in RX RAM of I2Cmaster . After software has finished reading, you can set
16. Once finishing reading data in the first READ command, I2Cmaster executes the END command and triggers
an I2C_END_DETECT_INT (master) interrupt, which is cleared by setting I2C_END_DETECT_INT_CLR
(master) to 1.
17. Update I2Cmaster ’s command registers using one of the following two methods:
RY
I2Cmaster
I2C_COMMAND0 (master) READ ack_value ack_exp 1 M
A
Or

I2Cmaster
I2C_COMMAND0 (master) READ 0
IN 0 1 M-1
IM
18. Write M bytes of data to be sent to TX RAM of I2Cslave . If M is larger than 32, then repeat step 14 in FIFO or
non-FIFO mode.
19. Write 1 to I2C_TRANS_START (master) bit to start transfer and repeat step 14.
EL
20. If the last command is a STOP, then set ack_value (master) to 1 after I2Cmaster has received the last byte of
data. I2Cslave stops transfer upon the I2C_NACK_INT interrupt. I2Cmaster executes the STOP command to
stop transfer and generates an I2C_TRANS_COMPLETE_INT (master) interrupt.
21. If the last command is an END, then repeat step 16 and proceed on to the next steps.
PR

I2Cmaster
23. Write 1 to I2C_TRANS_START (master) bit to start transfer.
24. I2Cmaster executes the STOP command to stop transfer, and generates an I2C_TRANS_COMPLETE_INT
(master) interrupt.
23.6 Interrupts
• I2C_SLAVE_STRETCH_INT: Generated when one of the four stretching events occurs in slave mode.

• I2C_DET_START_INT: Triggered when the master or the slave detects a START bit.
• I2C_SCL_MAIN_ST_TO_INT: Triggered when the main state machine SCL_MAIN_FSM remains unchanged
for over I2C_SCL_MAIN_ST_TO_I2C[23:0] clock cycles.
• I2C_SCL_ST_TO_INT: Triggered when the state machine SCL_FSM remains unchanged for over
I2C_SCL_ST_TO_I2C[23:0] clock cycles.
• I2C_RXFIFO_UDF_INT: Triggered when the I2C controller reads RX FIFO via the APB bus, but RX FIFO is
empty.
• I2C_TXFIFO_OVF_INT: Triggered when the I2C controller writes TX FIFO via the APB bus, but TX FIFO is full.
• I2C_NACK_INT: Triggered when the ACK value received by the master is not as expected, or when the
RY
ACK value received by the slave is 1.
• I2C_TRANS_START_INT: Triggered when the I2C controller sends a START bit.
• I2C_TIME_OUT_INT: Triggered when SCL stays high or low for more than I2C_TIME_OUT_VALUE clock
cycles during data transfer.
• I2C_TRANS_COMPLETE_INT: Triggered when the I2C controller detects a STOP bit.
A
• I2C_MST_TXFIFO_UDF_INT: Triggered when TX FIFO of the master underflows.
• I2C_ARBITRATION_LOST_INT: Triggered when the SDA’s output value does not match its input value while
the master’s SCL is high.
IN
• I2C_BYTE_TRANS_DONE_INT: Triggered when the I2C controller sends or receives a byte.
• I2C_END_DETECT_INT: Triggered when op_code of the master indicates an END command and an END
IM
condition is detected.
• I2C_RXFIFO_OVF_INT: Triggered when RX FIFO of the I2C controller overflows.
• I2C_TXFIFO_WM_INT: I2C TX FIFO watermark interrupt. Triggered when I2C_FIFO_PRT_EN is 1 and the
pointers of TX FIFO are less than I2C_TXFIFO_WM_THRHD[4:0].
EL
• I2C_RXFIFO_WM_INT: I2C RX FIFO watermark interrupt. Triggered when I2C_FIFO_PRT_EN is 1 and the
pointers of RX FIFO are greater than I2C_RXFIFO_WM_THRHD[4:0].
PR


The addresses in this section are relative to I2C Controller base address provided in Table 3-4 in Chapter 3
System and Memory.

Timing registers
I2C_SCL_LOW_PERIOD_REG Configures the low level width of SCL 0x0000 R/W
Configures the hold time after a negative SCL
I2C_SDA_HOLD_REG 0x0030 R/W
edge
Configures the sample time after a positive SCL
I2C_SDA_SAMPLE_REG 0x0034 R/W
edge
RY
I2C_SCL_HIGH_PERIOD_REG Configures the high level width of SCL 0x0038 R/W
Configures the delay between the SDA and
I2C_SCL_START_HOLD_REG 0x0040 R/W
SCL negative edge for a START condition
Configures the delay between the positive edge
I2C_SCL_RSTART_SETUP_REG 0x0044 R/W
of SCL and the negative edge of SDA
A
Configures the delay after the SCL clock edge
I2C_SCL_STOP_HOLD_REG 0x0048 R/W
for a STOP condition
Configures the delay between the SDA and
I2C_SCL_STOP_SETUP_REG 0x004C R/W
I2C_SCL_ST_TIME_OUT_REG
IN
SCL positive edge for a STOP condition
SCL status timeout register 0x0078 R/W
I2C_SCL_MAIN_ST_TIME_OUT_REG SCL main status timeout register 0x007C R/W
Configuration registers
IM
I2C_CTR_REG Transmission configuration register 0x0004 varies
I2C_TO_REG Timeout control register 0x000C R/W
I2C_SLAVE_ADDR_REG Slave address configuration register 0x0010 R/W
I2C_FIFO_CONF_REG FIFO configuration register 0x0018 R/W
I2C_FILTER_CFG_REG SCL and SDA filter configuration register 0x0050 R/W
EL
I2C_CLK_CONF_REG I2C clock configuration register 0x0054 R/W

I2C_SCL_SP_CONF_REG Power configuration register 0x0080 varies
I2C_SCL_STRETCH_CONF_REG Configures SCL clock stretching 0x0084 varies
Status registers
I2C_SR_REG Describes I2C work status 0x0008 RO
PR
I2C_FIFO_ST_REG FIFO status register 0x0014 RO

I2C_DATA_REG Stores value of RX FIFO data 0x001C RO
Interrupt registers
I2C_INT_RAW_REG Raw interrupt status 0x0020 R/SS/WTC
I2C_INT_CLR_REG Interrupt clear bits 0x0024 WT
I2C_INT_ENA_REG Interrupt enable bits 0x0028 R/W
I2C_INT_STATUS_REG Status of captured I2C communication events 0x002C RO
Command registers
I2C_COMD0_REG I2C command register 0 0x0058 varies
I2C_COMD1_REG I2C command register 1 0x005C varies


I2C_COMD5_REG I2C command register 5 0x006C varies
Version register
I2C_DATE_REG Version control register 0x00F8 R/W
A RY
IN
IM
EL
PR

23.8 Registers
The addresses in this section are relative to I2C Controller base address provided in Table 3-4 in Chapter 3
System and Memory.
Register 23.1. I2C_SCL_LOW_PERIOD_REG (0x0000)
D
IO
ER
_P
W
LO
_
d)
CL
ve
_S
ser
C
(re
I2
31 9 8 0
RY
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
I2C_SCL_LOW_PERIOD This field is used to configure how long SCL remains low in master mode,
in I2C module clock cycles. (R/W)
A
Register 23.2. I2C_SDA_HOLD_REG (0x0030)
E
IN
IM
_T
LD
O
_H
d)
DA
ve
_S
r
se
C
(re
I2
31 9 8 0
IM
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
I2C_SDA_HOLD_TIME This field is used to configure the time to hold the data after the falling edge
of SCL, in I2C module clock cycles. (R/W)
EL
Register 23.3. I2C_SDA_SAMPLE_REG (0x0034)

E
M
TI
E_
PL
PR
M
SA
A_
d)
ve
SD
r
se
C_
(re
I2
31 9 8 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
I2C_SDA_SAMPLE_TIME This field is used to configure how long SDA is sampled, in I2C module
clock cycles. (R/W)

Register 23.4. I2C_SCL_HIGH_PERIOD_REG (0x0038)
D
IO
ER
D
P
IO
H_
ER
G
HI
P
H_
T_
AI
G
HI
W
L_
_
d)
CL
ve
SC
_S
er
C_
s
C
(re
I2
I2
31 16 15 9 8 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
I2C_SCL_HIGH_PERIOD This field is used to configure how long SCL remains high in master mode,
RY
in I2C module clock cycles. (R/W)
I2C_SCL_WAIT_HIGH_PERIOD This field is used to configure the SCL_FSM’s waiting period for SCL
high level in master mode, in I2C module clock cycles. (R/W)
A
Register 23.5. I2C_SCL_START_HOLD_REG (0x0040)
E
M
TI
_
IN
LD
HO
T_
AR
ST
L_
)
ed
C
rv
_S
se
C
(re
I2
IM
31 9 8 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 8 Reset
I2C_SCL_START_HOLD_TIME This field is used to configure the time between the falling edge of
SDA and the falling edge of SCL for a START condition, in I2C module clock cycles. (R/W)
EL
Register 23.6. I2C_SCL_RSTART_SETUP_REG (0x0044)

E
M
TI
P_
PR
TU
SE
R T_
TA
RS
L_
)
ed
SC
rv
se
C_
(re
I2
31 9 8 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 8 Reset
I2C_SCL_RSTART_SETUP_TIME This field is used to configure the time between the rising edge of
SCL and the falling edge of SDA for a RSTART condition, in I2C module clock cycles. (R/W)

Register 23.7. I2C_SCL_STOP_HOLD_REG (0x0048)
E
IM
_T
LD
HO
P_
O
_ST
d)
CL
ve
_S
ser
C
(re
I2
31 9 8 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 8 Reset
I2C_SCL_STOP_HOLD_TIME This field is used to configure the delay after the STOP condition, in
I2C module clock cycles. (R/W)
RY
Register 23.8. I2C_SCL_STOP_SETUP_REG (0x004C)
E
M
TI
P_
A
TU
SE
P_
O
ST
L_
)
ed
C
IN
rv
_S
se
C
(re
I2
31 9 8 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 8 Reset
I2C_SCL_STOP_SETUP_TIME This field is used to configure the time between the rising edge of
IM
SCL and the rising edge of SDA, in I2C module clock cycles. (R/W)
Register 23.9. I2C_SCL_ST_TIME_OUT_REG (0x0078)

EL
C2
_I
O
_T
ST
L_
d)
e
SC
rv
se
C_
(re
I2
PR
31 5 4 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x10 Reset
I2C_SCL_ST_TO_I2C The maximum time that SCL_FSM remains unchanged. It should be no more
than 23. (R/W)

Register 23.10. I2C_SCL_MAIN_ST_TIME_OUT_REG (0x007C)
2C
_I
TO
ST_
N_
AI
_M
d)
CL
ve
S
er
C_
s
(re
I2
31 5 4 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x10 Reset
I2C_SCL_MAIN_ST_TO_I2C The maximum time that SCL_MAIN_FSM remains unchanged. It

should be no more than 23. (R/W)
A RY
IN
IM
EL
PR

Register 23.11. I2C_CTR_REG (0x0004)
_E EN
N
_
C_ M P _ H E
N
C_ B T E R K
I2 FS _U TO _C G_
I2 AR RS AT TA EC
F U W N
FO E EV L
RC _OU EL
A_ RC L_L VE
C_ N A R TI
I2 O X_ IT_ AS
UT
SD FO C LE
E_ T
N
_ G S
_E
C_ _ 0B C
C_ L_ _S _
O
C_ AN _F ST
C_ _F E T
C_ _ ST T
I2 SLV _1 AD
I2 SC LE CK
I2 X N N
I2 RX OD AR
I2 MS S_ RS
SB IR
IO
O
P A
I
C_ L F
C_ M _
C_ K_ T
C_ D R
I2 TX_ SB_
I2 CL RA
I2 SA ULL
I2 AD _B
M
T
T
R
R
C_ _L
d)
I
C_ D
ve
I2 AD
I2 R
C
T
r
se
C_
(re
I2
31 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 0 1 1 Reset
I2C_SDA_FORCE_OUT 0: direct output; 1: open-drain output. (R/W)
RY
I2C_SCL_FORCE_OUT 0: direct output; 1: open-drain output. (R/W)
I2C_SAMPLE_SCL_LEVEL This bit is used to select the sampling mode. 0: samples SDA data on
the SCL high level; 1: samples SDA data on the SCL low level. (R/W)
I2C_RX_FULL_ACK_LEVEL This bit is used to configure the ACK value that need to be sent by
A
master when I2C_RXFIFO_CNT has reached the threshold. (R/W)
I2C_MS_MODE Set this bit to configure the I2C controller as an I2C Master. Clear this bit to configure
the I2C controller as a slave. (R/W)
IN
I2C_TRANS_START Set this bit to start sending the data in TX FIFO. (WT)
I2C_TX_LSB_FIRST This bit is used to control the order to send data. 0: sends data from the most
significant bit; 1: sends data from the least significant bit. (R/W)
IM
I2C_RX_LSB_FIRST This bit is used to control the order to receive data. 0: receives data from the
most significant bit; 1: receives data from the least significant bit. (R/W)
I2C_CLK_EN This field controls APB_CLK clock gating. 0: APB_CLK is gated to save power; 1:
EL
APB_CLK is always on. (R/W)
I2C_ARBITRATION_EN This is the enable bit for I2C bus arbitration function. (R/W)
I2C_FSM_RST This bit is used to reset the SCL_FSM. (WT)
I2C_CONF_UPGATE Synchronization bit. (WT)

PR
I2C_SLV_TX_AUTO_START_EN This is the enable bit for slave to send data automatically. (R/W)
I2C_ADDR_10BIT_RW_CHECK_EN This is the enable bit to check if the R/W bit of 10-bit addressing
is consistent with the I2C protocol. (R/W)
I2C_ADDR_BROADCASTING_EN This is the enable bit for 7-bit general call addressing. (R/W)

Register 23.12. I2C_TO_REG (0x000C)
UE
L
N
VA
_E
_
UT
UT
O
O
E_
E_
d)
IM
IM
ve
T
er
C_
C_
s
(re
I2
I2
31 6 5 4 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x10 Reset
I2C_TIME_OUT_VALUE This field is used to configure the timeout for receiving a data bit in APB clock
cycles. (R/W)
RY
I2C_TIME_OUT_EN This is the enable bit for timeout control. (R/W)
Register 23.13. I2C_SLAVE_ADDR_REG (0x0010)

N
_E
A R
IT
DD
0B
_A
_1
E
DR
AV
)d
ve
AD
SL
er
C_
C_
s
(re
IN
I2
I2
31 30 15 14 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
I2C_SLAVE_ADDR When the I2C controller is in slave mode, this field is used to configure the slave
IM
address. (R/W)
I2C_ADDR_10BIT_EN This field is used to enable the 10-bit addressing mode in master mode. (R/W)
EL
PR

Register 23.14. I2C_FIFO_CONF_REG (0x0018)
HD
HD
N _E
HR
HR
_E FG
_T
_T
IF _C
I2 RX FO EN
T
I2 FIF IFO ST
NO _A S
M
M
NF DDR
C_ O _R
I _
C_ _F _R
_W
_W
C_ F T
O
I2 TX_ PR
FO
FO
_
d)
C_ O
FI
FI
ve
I2 FIF
RX
TX
er
C_
C_
C_
s
(re
I2
I2
I2
31 15 14 13 12 11 10 9 5 4 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0x4 0xb Reset
I2C_RXFIFO_WM_THRHD The watermark threshold of RX FIFO in non-FIFO mode. When

I2C_FIFO_PRT_EN is 1 and RX FIFO counter is bigger than I2C_RXFIFO_WM_THRHD[4:0],
RY
I2C_RXFIFO_WM_INT_RAW bit is valid. (R/W)
I2C_TXFIFO_WM_THRHD The watermark threshold of TX FIFO in non-FIFO mode. When

I2C_FIFO_PRT_EN is 1 and TX FIFO counter is smaller than I2C_TXFIFO_WM_THRHD[4:0],
I2C_TXFIFO_WM_INT_RAW bit is valid. (R/W)
I2C_NONFIFO_EN Set this bit to enable APB non-FIFO mode. (R/W)
A
I2C_FIFO_ADDR_CFG_EN When this bit is set to 1, the byte received after the I2C address byte
represents the offset address in the I2C Slave RAM. (R/W)
I2C_RX_FIFO_RST Set this bit to reset RX FIFO. (R/W)

IN
I2C_TX_FIFO_RST Set this bit to reset TX FIFO. (R/W)
I2C_FIFO_PRT_EN The control enable bit of FIFO pointer in non-FIFO mode. This bit controls the
IM
valid bits and TX/RX FIFO overflow, underflow, full and empty interrupts. (R/W)
Register 23.15. I2C_FILTER_CFG_REG (0x0050)

EL
ES
ES
HR
HR
ER N
N
LT E
_T
_E
_T
FI R_
ER
ER
L_ LTE
LT
LT
SC _FI
FI
FI
A_
L_
)
ed
C_ A
SC
I2 SD
SD
rv
se
C_
C_
C_
(re
I2
I2
I2
PR
31 10 9 8 7 4 3 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 Reset
I2C_SCL_FILTER_THRES When a pulse on the SCL input has smaller width than the value of this
field in I2C module clock cycles, the I2C controller ignores that pulse. (R/W)
I2C_SDA_FILTER_THRES When a pulse on the SDA input has smaller width than the value of this
field in I2C module clock cycles, the I2C controller ignores that pulse. (R/W)
I2C_SCL_FILTER_EN This is the filter enable bit for SCL. (R/W)
I2C_SDA_FILTER_EN This is the filter enable bit for SDA. (R/W)

Register 23.16. I2C_CLK_CONF_REG (0x0054)
M
NU
EL E
_S IV
_A
V_
V_
LK CT
V
DI
DI
DI
SC _A
K_
K_
K_
C_ LK
d)
CL
CL
CL
ve
I2 SC
S
er
C_
C_
C_
s
C
(re
I2
I2
I2
I2
31 22 21 20 19 14 13 8 7 0
0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 Reset
I2C_SCLK_DIV_NUM The integral part of the divisor. (R/W)
I2C_SCLK_DIV_A The numerator of the divisor’s fractional part. (R/W)
RY
I2C_SCLK_DIV_B The denominator of the divisor’s fractional part. (R/W)
I2C_SCLK_SEL The clock selection bit for the I2C controller. 0: XTAL_CLK; 1: FOSC_CLK. (R/W)
I2C_SCLK_ACTIVE The clock switch bit for the I2C controller. (R/W)
A
Register 23.17. I2C_SCL_SP_CONF_REG (0x0080)
IN
M
NU
EN
V_
V_
SL
SL
PD N
N
L_ _E
_E
T_
T_
SC _PD
RS
RS
L_
L_
d)
C_ A
ve
SC
SC
I2 SD
r
se
C_
C_
C_
(re
I2
I2
I2
IM
31 8 7 6 5 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
I2C_SCL_RST_SLV_EN When the master is idle, set this bit to send out SCL pulses. The number of
pulses equals to I2C_SCL_RST_SLV_NUM[4:0]. (R/W/SC)
EL
I2C_SCL_RST_SLV_NUM Configures the pulses of SCL generated in master mode. Valid when
I2C_SCL_RST_SLV_EN is 1. (R/W)
I2C_SCL_PD_EN The power down enable bit for the I2C output SCL line. 0: Not power down; 1:
Power down. Set I2C_SCL_FORCE_OUT and I2C_SCL_PD_EN to 1 to stretch SCL low. (R/W)
PR
I2C_SDA_PD_EN The power down enable bit for the I2C output SDA line. 0: Not power down; 1:
Power down. Set I2C_SDA_FORCE_OUT and I2C_SDA_PD_EN to 1 to stretch SDA low. (R/W)

Register 23.18. I2C_SCL_STRETCH_CONF_REG (0x0084)
H_ LR
RE H N
UM
EN
ST TC _E
TC _C
L_ RE TL
_N
E_ L_ CK VL
SC ST _C
AV SC _A _L
CT
SL E_ TE CK
TE
C_ AV Y A
O
I2 SL E_B TE_
PR
H_
C_ AV Y
I2 SL E_B
TC
RE
C_ AV
)
ed
ST
I2 SL
rv
se
C_
C_
(re
I2
I2
31 14 13 12 11 10 9 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
I2C_STRETCH_PROTECT_NUM Configures the time period to release the SCL line from stretching
RY
to avoid timing violation. Usually it should be larger than the SDA steup time. (R/W)
I2C_SLAVE_SCL_STRETCH_EN The enable bit for SCL clock stretching. 0: Disable; 1: Enable. The
SCL output line will be stretched low when I2C_SLAVE_SCL_STRETCH_EN is 1 and one of the
four stretching events occurs. The cause of stretching can be seen in I2C_STRETCH_CAUSE.
(R/W)
A
I2C_SLAVE_SCL_STRETCH_CLR Set this bit to clear SCL clock stretching. (WT)
I2C_SLAVE_BYTE_ACK_CTL_EN The enable bit for slave to control the level of the ACK bit. (R/W)
IN
I2C_SLAVE_BYTE_ACK_LVL Set the level of the ACK bit when I2C_SLAVE_BYTE_ACK_CTL_EN is
set. (R/W)
IM
EL
PR

Register 23.19. I2C_SR_REG (0x0008)
T
AS
D
_L
SE
SE
E
T
AS
AT
se B_ SY ES
AU
ST
_L
(re AR BU DR
NT
NT
_C
N_
TE
SP RW
EC
T
C_ S D
_C
CH
_C
C_ d S
TA
I2 BU E_A
AI
I2 rve LO
_R
RE E_
O
_M
O
_S
ET
IF
_
F
C_ AV
C_ AV
)
d)
C_ )
)
ed
ed
ed
FI
CL
CL
TR
XF
ve
I2 SL
I2 SL
TX
rv
rv
R
_S
S
er
er
se
se
C_
C_
C_
C_
s
s
C
(re
(re
(re
(re
I2
I2
I2
I2
I2
I2
31 30 28 27 26 24 23 18 17 16 15 14 13 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0x3 0 0 0 0 0 0 0 0 0 Reset
I2C_RESP_REC The received ACK value in master mode or slave mode. 0: ACK; 1: NACK. (RO)
RY
I2C_SLAVE_RW When in slave mode, 0: master writes to slave; 1: master reads from slave. (RO)
I2C_ARB_LOST When the I2C controller loses control of the SCL line, this bit changes to 1. (RO)
I2C_BUS_BUSY 0: the I2C bus is in idle state; 1: the I2C bus is busy transferring data. (RO)
I2C_SLAVE_ADDRESSED When the I2C controller is in slave mode, and the address sent by the
A
master matches the address of the slave, this bit is at high level. (RO)
I2C_RXFIFO_CNT This field represents the number of data bytes to be sent. (RO) IN
I2C_STRETCH_CAUSE The cause of SCL clock stretching in slave mode. 0: stretching SCL low
when the master starts to read data; 1: stretching SCL low when TX FIFO is empty in slave mode;
2: stretching SCL low when RX FIFO is full in slave mode. (RO)
I2C_TXFIFO_CNT This field stores the number of data bytes received in RAM. (RO)
IM
I2C_SCL_MAIN_STATE_LAST This field indicates the status of the state machine. 0: idle; 1: address
shift; 2: ACK address; 3: receive data; 4: transmit data; 5: send ACK; 6: wait for ACK. (RO)
I2C_SCL_STATE_LAST This field indicates the status of the state machine used to produce SCL. 0:
idle; 1: start; 2: falling edge; 3: low; 4: rising edge; 5: high; 6: stop. (RO)
EL
PR

Register 23.20. I2C_FIFO_ST_REG (0x0014)
T
IN
DR
DR
DR
DR
O
_P
AD
AD
AD
AD
W
_W
_W
_R
_R
_R
FO
O
O
E
IF
IF
IF
AV
d)
)
ed
I
XF
XF
XF
XF
ve
SL
rv
R
_T
T
er
se
C_
C_
C_
C_
s
C
(re
(re
I2
I2
I2
I2
I2
31 30 29 22 21 20 19 15 14 10 9 5 4 0
0 0 0 0 0 0 0 0 0 Reset
I2C_RXFIFO_RADDR This is the offset address of the APB reading from RX FIFO. (RO)
I2C_RXFIFO_WADDR This is the offset address of the I2C controller receiving data and writing to RX
RY
FIFO. (RO)
I2C_TXFIFO_RADDR This is the offset address of the I2C controller reading from TX FIFO. (RO)
I2C_TXFIFO_WADDR This is the offset address of APB bus writing to TX FIFO. (RO)
I2C_SLAVE_RW_POINT The received data in I2C slave mode. (RO)
A
Register 23.21. I2C_DATA_REG (0x001C)
IN
TA
DA
_R
d)
O
ve
F
FI
r
se
C_
(re
I2
IM
31 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
I2C_FIFO_RDATA Data read from RX FIFO. (RO)

EL
PR

Register 23.22. I2C_INT_RAW_REG (0x0020)
AW
FI _W _IN _R T_ W
I2 RX DE NS OS T_R AW
RX O VF NT _IN A
W
W
C_ FI T _ AW AW
FO M T AW R
C_ IF O _I E _R
C_ L_ IN NT N W
C_ C O IN AW A
_L IN R
C_ FI TE _D T_ A
I2 NA O_ F_ _R T_R
I2 EN _TR ON F_ NT_
I2 AR TX MP RA AW
I2 SC MA _I H_I RA
I2 TXF O_ CT ON INT
I2 RX ST_ _ST _R _R
M T_ W
W
AW
NT W
_
T
C_ T C T_ _R
C_ IF U NT IN
I D I
C_ AN T IN A
_W _IN _RA
C_ TE T U _
W
C_ L_ R C T
C_ E ST W A
_I RA
I2 BY TRA O_ ETE
I2 TR _IN F_ T_R
I2 SC STA RET _IN
I2 TXF O_ O_I O_
I2 TIM S_ RA _R
_R
I2 MS S_ IN NT
T
T
I
L
C_ AN T T_
F L
C_ T_ T L
I2 DE E_S CA
I2 TR _OU AR
T
_
_
D
_ O
K V
_
A
C_ AV L
C_ B FI
I2 SL RA
E
F
_
d)
I
C_ N
C_ D
ve
I2 GE
er
_
s
C
(re
I2
31 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 Reset
I2C_RXFIFO_WM_INT_RAW The raw interrupt bit for the I2C_RXFIFO_WM_INT interrupt.
RY
(R/SS/WTC)
I2C_TXFIFO_WM_INT_RAW The raw interrupt bit for the I2C_TXFIFO_WM_INT interrupt.

(R/SS/WTC)
I2C_RXFIFO_OVF_INT_RAW The raw interrupt bit for the I2C_RXFIFO_OVF_INT interrupt.
A
(R/SS/WTC)
I2C_END_DETECT_INT_RAW The raw interrupt bit for the I2C_END_DETECT_INT interrupt.

(R/SS/WTC)
IN
I2C_BYTE_TRANS_DONE_INT_RAW The raw interrupt bit for the I2C_END_DETECT_INT interrupt.
(R/SS/WTC)
I2C_ARBITRATION_LOST_INT_RAW The raw interrupt bit for the I2C_ARBITRATION_LOST_INT in-

IM
terrupt. (R/SS/WTC)
I2C_MST_TXFIFO_UDF_INT_RAW The raw interrupt bit for the I2C_TRANS_COMPLETE_INT inter-

rupt. (R/SS/WTC)
I2C_TRANS_COMPLETE_INT_RAW The raw interrupt bit for the I2C_TRANS_COMPLETE_INT in-

EL
terrupt. (R/SS/WTC)
I2C_TIME_OUT_INT_RAW The raw interrupt bit for the I2C_TIME_OUT_INT interrupt. (R/SS/WTC)
I2C_TRANS_START_INT_RAW The raw interrupt bit for the I2C_TRANS_START_INT interrupt.

(R/SS/WTC)
PR
I2C_NACK_INT_RAW The raw interrupt bit for the I2C_SLAVE_STRETCH_INT interrupt. (R/SS/WTC)
I2C_TXFIFO_OVF_INT_RAW The raw interrupt bit for the I2C_TXFIFO_OVF_INT interrupt.

(R/SS/WTC)
I2C_RXFIFO_UDF_INT_RAW The raw interrupt bit for the I2C_RXFIFO_UDF_INT interrupt.

(R/SS/WTC)

Register 23.22. I2C_INT_RAW_REG (0x0020)
I2C_SCL_ST_TO_INT_RAW The raw interrupt bit for the I2C_SCL_ST_TO_INT interrupt.

(R/SS/WTC)
I2C_SCL_MAIN_ST_TO_INT_RAW The raw interrupt bit for the I2C_SCL_MAIN_ST_TO_INT inter-

rupt. (R/SS/WTC)
I2C_DET_START_INT_RAW The raw interrupt bit for the I2C_DET_START_INT interrupt.

(R/SS/WTC)
RY
I2C_SLAVE_STRETCH_INT_RAW The raw interrupt bit for the I2C_SLAVE_STRETCH_INT interrupt.
(R/SS/WTC)
I2C_GENERAL_CALL_INT_RAW The raw interrupt bit for the I2C_GENARAL_CALL_INT interrupt.

(R/SS/WTC)
A
IN
IM
EL
PR

Register 23.23. I2C_INT_CLR_REG (0x0024)
LR
FI _W _IN _C T_ R
I2 RX DE NS OS T_C LR
RX O VF NT _IN L
R
FO M T LR C
R
C_ IF O _I E _C
C_ FI T _ LR LR
_L IN C
C_ C O IN LR L
C_ FI TE _D T_ L
C_ L_ IN NT N R
I2 NA O_ F_ _C T_C
I2 EN _TR ON F_ NT_
I2 TXF O_ CT ON INT
I2 SC MA _I H_I CL
I2 AR TX MP CLR LR
I2 RX ST_ _ST _C _C
M T_ R
R
LR
_
C_ T C T_ _C
T
NT R
C_ IF U NT IN
I D I
C_ AN T IN L
C_ TE T U _
_W _IN _CL
C_ L_ R C T
C_ E ST R L
_I CL
I2 BY TRA O_ ETE
I2 TR _IN F_ T_C
I2 SC STA RET _IN
I2 TXF O_ O_I O_
I2 TIM S_ CL _C
_C
I2 MS S_ IN NT
T
T
I
L
C_ AN T T_
F L
C_ T_ T L
I2 DE E_S CA
I2 TR _OU AR
T
_
_
D
_ O
K V
_
A
C_ AV L
C_ B FI
I2 SL RA
E
F
_
d)
I
C_ N
C_ D
ve
I2 GE
er
_
s
C
(re
I2
31 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
I2C_RXFIFO_WM_INT_CLR Set this bit to clear the I2C_RXFIFO_WM_INT interrupt. (WT)
RY
I2C_TXFIFO_WM_INT_CLR Set this bit to clear the I2C_TXFIFO_WM_INT interrupt. (WT)
I2C_RXFIFO_OVF_INT_CLR Set this bit to clear the I2C_RXFIFO_OVF_INT interrupt. (WT)
I2C_END_DETECT_INT_CLR Set this bit to clear the I2C_END_DETECT_INT interrupt. (WT)
A
I2C_BYTE_TRANS_DONE_INT_CLR Set this bit to clear the I2C_END_DETECT_INT interrupt. (WT)
I2C_ARBITRATION_LOST_INT_CLR Set this bit to clear the I2C_ARBITRATION_LOST_INT inter-

rupt. (WT)
IN
I2C_MST_TXFIFO_UDF_INT_CLR Set this bit to clear the I2C_TRANS_COMPLETE_INT interrupt.
(WT)
IM
I2C_TRANS_COMPLETE_INT_CLR Set this bit to clear the I2C_TRANS_COMPLETE_INT interrupt.
(WT)
I2C_TIME_OUT_INT_CLR Set this bit to clear the I2C_TIME_OUT_INT interrupt. (WT)
I2C_TRANS_START_INT_CLR Set this bit to clear the I2C_TRANS_START_INT interrupt. (WT)

EL
I2C_NACK_INT_CLR Set this bit to clear the I2C_SLAVE_STRETCH_INT interrupt. (WT)
I2C_TXFIFO_OVF_INT_CLR Set this bit to clear the I2C_TXFIFO_OVF_INT interrupt. (WT)
I2C_RXFIFO_UDF_INT_CLR Set this bit to clear the I2C_RXFIFO_UDF_INT interrupt. (WT)

PR
I2C_SCL_ST_TO_INT_CLR Set this bit to clear the I2C_SCL_ST_TO_INT interrupt. (WT)
I2C_SCL_MAIN_ST_TO_INT_CLR Set this bit to clear the I2C_SCL_MAIN_ST_TO_INT interrupt.

(WT)
I2C_DET_START_INT_CLR Set this bit to clear the I2C_DET_START_INT interrupt. (WT)
I2C_SLAVE_STRETCH_INT_CLR Set this bit to clear the I2C_SLAVE_STRETCH_INT interrupt. (WT)
I2C_GENERAL_CALL_INT_CLR Set this bit for the I2C_GENARAL_CALL_INT interrupt. (WT)

Register 23.24. I2C_INT_ENA_REG (0x0028)
A
FI _W _IN _E T_ A
I2 RX DE NS OS T_E NA
FO M T NA EN
RX O VF NT _IN N
A
A
T A A
C_ IF O _I E _E
C_ C O IN A N
_L IN E
C_ FI TE _D T_ N
C_ L_ IN NT N A
N
I2 EN _TR ON F_ NT_
I2 NA O_ F_ _EN T_E
I2 SC MA _I H_I EN
I2 TXF O_ CT ON INT
I2 AR TX MP EN NA
I2 RX ST_ _ST _EN _E
M T_ A
A
NA
_
T
NT A
C_ T C T_ _E
C_ IF U NT IN
I D I
C_ AN T IN N
_W _IN _EN
C_ TE T U _
C_ L_ R C T
C_ E ST A N
_I EN
A
I2 BY TRA O_ ETE
I2 SC STA RET _IN
I2 TR _IN F_ T_E
I2 TXF O_ O_I O_
I2 MS S_ IN NT
I2 TIM S_ EN _E
_E
T
I
L
C_ AN T T_
F L
C_ FI T _
C_ T_ T L
I2 DE E_S CA
I2 TR _OU AR
T
_
_
D
_ O
K V
_
A
C_ AV L
C_ B FI
I2 SL RA
E
F
_
d)
I
C_ N
C_ D
ve
I2 GE
er
_
s
C
(re
I2
31 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
I2C_RXFIFO_WM_INT_ENA The interrupt enable bit for the I2C_RXFIFO_WM_INT interrupt. (R/W)
RY
I2C_TXFIFO_WM_INT_ENA The interrupt enable bit for the I2C_TXFIFO_WM_INT interrupt. (R/W)
I2C_RXFIFO_OVF_INT_ENA The interrupt enable bit for the I2C_RXFIFO_OVF_INT interrupt. (R/W)
I2C_END_DETECT_INT_ENA The interrupt enable bit for the I2C_END_DETECT_INT interrupt. (R/W)
A
I2C_BYTE_TRANS_DONE_INT_ENA The interrupt enable bit for the I2C_BYTE_TRANS_DONE_INT
interrupt. (R/W)
IN
I2C_ARBITRATION_LOST_INT_ENA The interrupt enable bit for the I2C_ARBITRATION_LOST_INT
interrupt. (R/W)
I2C_MST_TXFIFO_UDF_INT_ENA The interrupt enable bit for the I2C_TRANS_COMPLETE_INT in-

IM
terrupt. (R/W)
I2C_TRANS_COMPLETE_INT_ENA The interrupt enable bit for the I2C_TRANS_COMPLETE_INT

interrupt. (R/W)
I2C_TIME_OUT_INT_ENA The interrupt enable bit for the I2C_TIME_OUT_INT interrupt. (R/W)
EL
I2C_TRANS_START_INT_ENA The interrupt enable bit for the I2C_TRANS_START_INT interrupt.

(R/W)
I2C_NACK_INT_ENA The interrupt enable bit for the I2C_SLAVE_STRETCH_INT interrupt. (R/W)
I2C_TXFIFO_OVF_INT_ENA The interrupt enable bit for the I2C_TXFIFO_OVF_INT interrupt. (R/W)
PR
I2C_RXFIFO_UDF_INT_ENA The interrupt enable bit for the I2C_RXFIFO_UDF_INT interrupt. (R/W)
I2C_SCL_ST_TO_INT_ENA The interrupt enable bit for the I2C_SCL_ST_TO_INT interrupt. (R/W)
I2C_SCL_MAIN_ST_TO_INT_ENA The interrupt enable bit for the I2C_SCL_MAIN_ST_TO_INT in-

terrupt. (R/W)
I2C_DET_START_INT_ENA The interrupt enable bit for the I2C_DET_START_INT interrupt. (R/W)
I2C_SLAVE_STRETCH_INT_ENA The interrupt enable bit for the I2C_SLAVE_STRETCH_INT inter-

rupt. (R/W)
I2C_GENERAL_CALL_INT_ENA The interrupt enable bit for the I2C_GENARAL_CALL_INT interrupt.

(R/W)

Register 23.25. I2C_INT_STATUS_REG (0x002C)
T
RX O VF NT _IN T
I2 RX DE NS OS T_S T
FO M T T S
C_ IF O _I E _S
_L IN S
T
FI _W _IN _S T_
C_ FI TE _D T_ T
T
I2 NA O_ F_ _S T_S
I2 EN _TR ON F_ NT_
I2 TXF O_ CT ON INT
I2 SC MA _I H_I ST
I2 RX ST_ _ST _ST _S
I2 AR TX MP ST T
_
T
C_ T C T_ _S
C_ IF U NT IN
I D I
C_ TE T U _
C_ L_ R C T
C_ AN T IN T
_W _IN _ST
C_ L_ IN NT N
T
_I ST
C_ C O IN T
I2 BY TRA O_ ETE
I2 SC STA RET _IN
I2 TR _IN F_ T_S
I2 TXF O_ O_I O_
I2 TIM S_ _ST _S
I2 MS S_ _IN INT
_S
M T_
T
T
NT
L
C_ AN T T_
F L
C_ FI T _
C_ T_ T L
I2 DE E_S CA
I2 TR _OU AR
T
_ O
K V
_
C_ E ST
A
C_ AV L
C_ B FI
I2 SL RA
E
F
_
d)
I
C_ N
C_ D
ve
I2 GE
er
_
s
C
(re
I2
31 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
I2C_RXFIFO_WM_INT_ST The masked interrupt status bit for the I2C_RXFIFO_WM_INT interrupt.
RY
(RO)
I2C_TXFIFO_WM_INT_ST The masked interrupt status bit for the I2C_TXFIFO_WM_INT interrupt.
(RO)
I2C_RXFIFO_OVF_INT_ST The masked interrupt status bit for the I2C_RXFIFO_OVF_INT interrupt.
(RO)
A
I2C_END_DETECT_INT_ST The masked interrupt status bit for the I2C_END_DETECT_INT interrupt.
(RO)
IN
I2C_BYTE_TRANS_DONE_INT_ST The masked interrupt status bit for the I2C_END_DETECT_INT
interrupt. (RO)
I2C_ARBITRATION_LOST_INT_ST The masked interrupt status bit for the

IM
I2C_ARBITRATION_LOST_INT interrupt. (RO)
I2C_MST_TXFIFO_UDF_INT_ST The masked interrupt status bit for the

I2C_TRANS_COMPLETE_INT interrupt. (RO)
I2C_TRANS_COMPLETE_INT_ST The masked interrupt status bit for the

EL
I2C_TRANS_COMPLETE_INT interrupt. (RO)
I2C_TIME_OUT_INT_ST The masked interrupt status bit for the I2C_TIME_OUT_INT interrupt. (RO)
I2C_TRANS_START_INT_ST The masked interrupt status bit for the I2C_TRANS_START_INT inter-
rupt. (RO)
PR
I2C_NACK_INT_ST The masked interrupt status bit for the I2C_SLAVE_STRETCH_INT interrupt.
(RO)
I2C_TXFIFO_OVF_INT_ST The masked interrupt status bit for the I2C_TXFIFO_OVF_INT interrupt.
(RO)
I2C_RXFIFO_UDF_INT_ST The masked interrupt status bit for the I2C_RXFIFO_UDF_INT interrupt.
(RO)

Register 23.25. I2C_INT_STATUS_REG (0x002C)
I2C_SCL_ST_TO_INT_ST The masked interrupt status bit for the I2C_SCL_ST_TO_INT interrupt.
(RO)
I2C_SCL_MAIN_ST_TO_INT_ST The masked interrupt status bit for the I2C_SCL_MAIN_ST_TO_INT

interrupt. (RO)
I2C_DET_START_INT_ST The masked interrupt status bit for the I2C_DET_START_INT interrupt.
(RO)
RY
I2C_SLAVE_STRETCH_INT_ST The masked interrupt status bit for the I2C_SLAVE_STRETCH_INT
interrupt. (RO)
I2C_GENERAL_CALL_INT_ST The masked interrupt status bit for the I2C_GENARAL_CALL_INT in-
terrupt. (RO)
A
Register 23.26. I2C_COMD0_REG (0x0058)
IN
NE
O
_D
D0
D0
AN
AN
M
M
M
M
)
ed
CO
CO
rv
se
C_
C_
IM
(re
I2
I2
31 30 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
I2C_COMMAND0 This is the content of command register 0. It consists of three parts:

EL
• op_code is the command. 0: RSTART; 1: WRITE; 2: READ; 3: STOP; 4: END.
• Byte_num represents the number of bytes that need to be sent or received.
• ack_check_en, ack_exp and ack are used to control the ACK bit. For more information, see
Section 23.4.9.
PR
(R/W)
I2C_COMMAND0_DONE When command 0 has been executed in master mode, this bit changes
to high level. (R/W/SS)

Register 23.27. I2C_COMD1_REG (0x005C)
NE
O
_D
D1
D1
AN
AN
M
M
M
M
d)
CO
CO
ve
er
C_
C_
s
(re
I2
I2
31 30 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
I2C_COMMAND1 This is the content of command register 1. It is the same as that of

I2C_COMMAND0. (R/W)
RY
A
NE
O
_D
D2
D2
AN
AN
IN
M
M
M
M
d)
O
CO
ve
_C
r
se
C_
C
(re
I2
I2
31 30 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
IM
I2C_COMMAND0. (R/W)
to high Level. (R/W/SS)
EL

NE
PR _D
D3
O
D3
AN
AN
M
M
M
M
d )
CO
CO
r ve
se
C_
C_
(re
I2
I2
31 30 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset

I2C_COMMAND0. (R/W)

NE
O
_D
D4
D4
AN
AN
M
M
M
M
d)
CO
CO
ve
er
C_
C_
s
(re
I2
I2
31 30 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset

I2C_COMMAND0. (R/W)
RY
Register 23.31. I2C_COMD5_REG (0x006C)
A
NE
O
_D
D5
D5
AN
AN
IN
M
M
M
M
d)
O
CO
ve
_C
r
se
C_
C
(re
I2
I2
31 30 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
IM
I2C_COMMAND0. (R/W)
EL

NE
PR _D
D6
O
D6
AN
AN
M
M
M
M
d )
CO
CO
r ve
se
C_
C_
(re
I2
I2
31 30 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset

I2C_COMMAND0. (R/W)

NE
O
_D
D7
D7
AN
AN
M
M
M
M
d)
CO
CO
ve
er
C_
C_
s
(re
I2
I2
31 30 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset

I2C_COMMAND0. (R/W)
RY
Register 23.34. I2C_DATE_REG (0x00F8)
A
E
AT
C_D
I2
31
IN
0x20070201
0
Reset
I2C_DATE This is the version control register. (R/W)

IM
EL
PR

24 Two-wire Automotive Interface (TWAI®)
24 Twowire Automotive Interface (TWAI®)
24.1 Overview
The Two-wire Automotive Interface (TWAI)® is a multi-master, multi-cast communication protocol with error
detection and signaling and inbuilt message priorities and arbitration.The TWAI protocol is suited for automotive
and industrial applications (see Section 24.3 for more details).
ESP32-S3 contains a TWAI controller that can be connected to a TWAI bus via an external transceiver. The TWAI
controller contains numerous advanced features, and can be utilized in a wide range of use cases such as
automotive products, industrial automation controls, building automation etc.
RY
24.2 Features
ESP32-S3 TWAI controller supports the following features:
• Compatible with ISO 11898-1 protocol (CAN Specification 2.0)
• Supports Standard Frame Format (11-bit ID) and Extended Frame Format (29-bit ID)
A
• Bit rates from 1 Kbit/s to 1 Mbit/s
• Multiple modes of operation
– Normal
IN
– Listen-only (no influence on bus)
– Self-test (no acknowledgment required during data transmission)

IM
• 64-byte Receive FIFO
• Special transmissions
– Single-shot transmissions (does not automatically re-transmit upon error)

EL
– Self Reception (the TWAI controller transmits and receives messages simultaneously)
• Acceptance Filter (supports single and dual filter modes)
• Error detection and handling
– Error Counters
PR
– Configurable Error Warning Limit
– Error Code Capture
– Arbitration Lost Capture
24.3 Functional Protocol

24.3.1 TWAI Properties
The TWAI protocol connects two or more nodes in a bus network, and allows nodes to exchange messages in a
latency bounded manner. A TWAI bus has the following properties.

Single Channel and NonReturntoZero: The bus consists of a single channel to carry bits, thus
communication is half-duplex. Synchronization is also implemented in this channel, so extra channels (e.g., clock
or enable) are not required. The bit stream of a TWAI message is encoded using the Non-Return-to-Zero (NRZ)
method.
Bit Values: The single channel can either be in a dominant or recessive state, representing a logical 0 and a
logical 1 respectively. A node transmitting data in a dominant state will always override another node transmitting
data in a recessive state. The physical implementation on the bus is left to the application level to decide (e.g.,
differential pair or a single wire).
Bit Stuffing: Certain fields of TWAI messages are bit-stuffed. A transmitter that transmits five consecutive bits of
the same value should automatically insert a complementary bit. Likewise, a receiver that receives five
RY
consecutive bits should treat the next bit as a stuffed bit. Bit stuffing is applied to the following fields: SOF,
arbitration field, control field, data field, and CRC sequence (see Section 24.3.2 for more details).
Multicast: All nodes receive the same bits as they are connected to the same bus. Data is consistent across all
nodes unless there is a bus error (see Section 24.3.3 for more details).
Multimaster: Any node can initiate a transmission. If a transmission is already ongoing, a node will wait until the
A
current transmission is over before beginning its own transmission.
Message Priorities and Arbitration: If two or more nodes simultaneously initiate a transmission, the TWAI
protocol ensures that one node will win arbitration of the bus. The arbitration field of the message transmitted by
IN
each node is used to determine which node will win arbitration.
Error Detection and Signaling: Each node will actively monitor the bus for errors, and signal the detection
errors by transmitting an error frame.
IM
Fault Confinement: Each node will maintain a set of error counts that are incremented/decremented according
to a set of rules. When the error counts surpass a certain threshold, a node will automatically eliminate itself from
the network by switching itself off.
Configurable Bit Rate: The bit rate for a single TWAI bus is configurable. However, all nodes within the same
bus must operate at the same bit rate.
EL
Transmitters and Receivers: At any point in time, a TWAI node can either be a transmitter or a receiver.
• A node originating a message is a transmitter. The node remains a transmitter until the bus is idle or until
the node loses arbitration. Note that multiple nodes can be transmitters if they have yet to lose arbitration.
• All nodes that are not transmitters are receivers.

PR
24.3.2 TWAI Messages

TWAI nodes use messages to transmit data, and signal errors to other nodes. Messages are split into various
frame types, and some frame types will have different frame formats.
The TWAI protocol has of the following frame types:
• Data frames
• Remote frames
• Error frames
• Overload frames

• Interframe space
The TWAI protocol has the following frame formats:
• Standard Frame Format (SFF) that consists of a 11-bit identifier
• Extended Frame Format (EFF) that consists of a 29-bit identifier
24.3.2.1 Data Frames and Remote Frames
Data frames are used by nodes to send data to other nodes, and can have a payload of 0 to 8 data bytes.
Remote frames are used for nodes to request a data frame with the same identifier from another node, thus they
do not contain any data bytes. However, data frames and remote frames share many common fields. Figure
RY
24-1 illustrates the fields and sub-fields of different frames and formats.
A
IN
IM
EL
PR
Figure 241. Bit Fields in Data Frames and Remote Frames
Arbitration Field
When two or more nodes transmits a data or remote frame simultaneously, the arbitration field is used to
determine which node will win arbitration of the bus. During the arbitration field, if a node transmits a recessive bit
while observes a dominant bit, this indicates that another node has overridden its recessive bit. Therefore, the
node transmitting the recessive bit has lost arbitration of the bus and should immediately switch to be a
receiver.
The arbitration field primarily consists of the frame identifier that is transmitted from the most significant bit first.
Given that a dominant bit represents a logical 0, and a recessive bit represents a logical 1:
• A frame with the smallest ID value will always win arbitration.

• Given the same ID and format, data frames will always prevail over remote frames.
• Given the same first 11 bits of ID, a Standard Format Data Frame will prevail over an Extended Format Data
Frame due to the SRR being recessive.
Control Field
The control field primarily consists of the DLC (Data Length Code) which indicates the number of payload data
bytes for a data frame, or the number of requested data bytes for a remote frame. The DLC is transmitted from
the most significant bit first.
Data Field
The data field contains the actual payload data bytes of a data frame. Remote frames do not contain a data
field.
RY
CRC Field
The CRC field primarily consists of a CRC sequence. The CRC sequence is a 15-bit cyclic redundancy code
calculated form the de-stuffed contents (everything from the SOF to the end of the data field) of a data or remote
frame.
ACK Field
A
The ACK field primarily consists of an ACK Slot and an ACK Delim. The ACK field is mainly intended for the
receiver to indicate to a transmitter that it has received an effective message.
IN
Table 241. Data Frames and Remote Frames in SFF and EFF
Data/Remote Frames Description

SOF The SOF (Start of Frame) is a single dominant bit used to synchronize nodes on
the bus.
IM
Base ID The Base ID (ID.28 to ID.18) is the 11-bit identifier for SFF, or the first 11-bits of
the 29-bit identifier for EFF.
RTR The RTR (Remote Transmission Request) bit indicates whether the message is a
data frame (dominant) or a remote frame (recessive). This means that a remote
EL
frame will always lose arbitration to a data frame given they have the same ID.
SRR The SRR (Substitute Remote Request) bit is transmitted in EFF to substitute for
the RTR bit at the same position in SFF.
IDE The IDE (Identifier Extension) bit indicates whether the message is SFF (dominant)
or EFF (recessive). This means that a SFF frame will always win arbitration over
PR
an EFF frame given they have the same Base ID.

Extd ID The Extended ID (ID.17 to ID.0) is the remaining 18-bits of the 29-bit identifier for
EFF.
r1 The r1 bit (reserved bit 1) is always dominant.
r0 The r0 bit (reserved bit 0) is always dominant.
DLC The DLC (Data Length Code) is 4-bit long and should contain any value from 0
to 8. Data frames use the DLC to indicate the number of data bytes in the data
frame. Remote frames used the DLC to indicate the number of data bytes to
request from another node.
Data Bytes The data payload of data frames. The number of bytes should match the value
of DLC. Data byte 0 is transmitted first, and each data byte is transmitted from
the most significant bit first.


Data/Remote Frames Description
CRC Sequence The CRC sequence is a 15-bit cyclic redundancy code.
CRC Delim The CRC Delim (CRC Delimiter) is a single recessive bit that follows the CRC
sequence.
ACK Slot The ACK Slot (Acknowledgment Slot) is intended for receiver nodes to indicate
that the data or remote frame was received without an issue. The transmitter
node will send a recessive bit in the ACK Slot and receiver nodes should override
the ACK Slot with a dominant bit if the frame was received without errors.
ACK Delim The ACK Delim (Acknowledgment Delimiter) is a single recessive bit.
EOF The EOF (End of Frame) marks the end of a data or remote frame, and consists
RY
of seven recessive bits.
24.3.2.2 Error and Overload Frames
Error Frames
A
Error frames are transmitted when a node detects a bus error. Error frames notably consist of an Error Flag which
is made up of 6 consecutive bits of the same value, thus violating the bit-stuffing rule. Therefore, when a
particular node detects a bus error and transmits an error frame, all other nodes will then detect a stuff error and
IN
transmit their own error frames in response. This has the effect of propagating the detection of a bus error across
all nodes on the bus.
When a node detects a bus error, it will transmit an error frame starting from the next bit. However, if the type of
bus error was a CRC error, then the error frame will start at the bit following the ACK Delim (see Section 24.3.3
IM
for more details). The following Figure 24-2 shows different fields of an error frame:
EL
Figure 242. Fields of an Error Frame
Table 242. Error Frame

PR
Error Frame Description

Error Flag The Error Flag has two forms, the Active Error Flag consisting of 6 domi-
nant bits and the Passive Error Flag consisting of 6 recessive bits (unless
overridden by dominant bits of other nodes). Active Error Flags are sent
by error active nodes, whilst Passive Error Flags are sent by error passive
nodes.
Error Flag Superposition The Error Flag Superposition field meant to allow for other nodes on the
bus to transmit their respective Active Error Flags. The superposition field
can range from 0 to 6 bits, and ends when the first recessive bit is detected
(i.e., the first it of the Delimiter).
Error Delimeter The Delimiter field marks the end of the error/overload frame, and consists
of 8 recessive bits.

Overload Frames
An overload frame has the same bit fields as an error frame containing an Active Error Flag. The key difference is
in the conditions that can trigger the transmission of an overload frame. Figure 24-3 below shows the bit fields of
an overload frame.
Figure 243. Fields of an Overload Frame
RY
Table 243. Overload Frame
Overload Flag Description

Overload Flag Consists of 6 dominant bits. Same as an Active Error Flag.
Overload Flag Superposition Allows for the superposition of Overload Flags from other nodes, similar to an
Error Flag Superposition.
A
Overload Delimiter Consists of 8 recessive bits. Same as an Error Delimiter.
IN
Overload frames will be transmitted under the following conditions:
1. A receiver requires a delay of the next data or remote frame.
2. A dominant bit is detected at the first and second bit of intermission.

IM
3. A dominant bit is detected at the eighth (last) bit of an Error Delimiter. Note that in this case, TEC and REC
will not be incremented (see Section 24.3.3 for more details).
Transmitting an overload frame due to one of the conditions must also satisfy the following rules:
• Transmitting an overload frame due to condition 1 must only be started at the first bit of intermission.
EL
• Transmitting an overload frame due to condition 2 and 3 must start one bit after the detecting the dominant
bit of the condition.
• A maximum of two overload frames may be generated in order to delay the next data or remote frame.
24.3.2.3 Interframe Space

PR
The Interframe Space acts as a separator between frames. Data frames and remote frames must be separated
from preceding frames by an Interframe Space, regardless of the preceding frame’s type (data frame, remote
frame, error frame, overload frame). However, error frames and overload frames do not need to be separated
from preceding frames.
Figure 24-4 shows the fields within an Interframe Space:
Table 244. Interframe Space
Interframe Space Description

Intermission The Intermission consists of 3 recessive bits.


Interframe Space Description
Suspend Transmission An Error Passive node that has just transmitted a message must include
a Suspend Transmission field. This field consists of 8 recessive bits. Error
Active nodes should not include this field.
Bus Idle The Bus Idle field is of arbitrary length. Bus Idle ends when an SOF is
transmitted. If a node has a pending transmission, the SOF should be
transmitted at the first bit following Intermission.
24.3.3 TWAI Errors
RY
24.3.3.1 Error Types
Bus Errors in TWAI are categorized into one of the following types:
Bit Error
A Bit Error occurs when a node transmits a bit value (i.e., dominant or recessive) but the opposite bit is detected
(e.g., a dominant bit is transmitted but a recessive is detected). However, if the transmitted bit is recessive and is
A
located in the Arbitration Field or ACK Slot or Passive Error Flag, then detecting a dominant bit will not be
considered a Bit Error.
Stuff Error
IN
A stuff error is detected when 6 consecutive bits of the same value are detected (thus violating the bit-stuffing
encoding rules).
CRC Error
IM
A receiver of a data or remote frame will calculate a CRC based on the bits it has received. A CRC error occurs
when the CRC calculated by the receiver does not match the CRC sequence in the received data or remote
Frame.
Format Error
EL
A Format Error is detected when a fixed-form bit field of a message contains an illegal bit. For example, the r1
and r0 fields must be dominant.
ACK Error
An ACK Error occurs when a transmitter does not detect a dominant bit at the ACK Slot.
PR
24.3.3.2 Error States
TWAI nodes implement fault confinement by each maintaining two error counters, where the counter values
determine the error state. The two error counters are known as the Transmit Error Counter (TEC) and Receive
Error Counter (REC). TWAI has the following error states.
Error Active
An Error Active node is able to participate in bus communication and transmit an Active Error Flag when it
detects an error.
Error Passive
An Error Passive node is able to participate in bus communication, but can only transmit an Passive Error Flag
when it detects an error. Error Passive nodes that have transmitted a data or remote frame must also include the
Suspend Transmission field in the subsequent Interframe Space.

Figure 244. The Fields within an Interframe Space
Bus Off
A Bus Off node is not permitted to influence the bus in any way (i.e., is not allowed to transmit anything).
24.3.3.3 Error Counters
RY
The TEC and REC are incremented/decremented according to the following rules. Note that more than one
rule can apply for a given message transfer.
1. When a receiver detects an error, the REC is increased by 1, except when the detected error was a Bit
Error during the transmission of an Active Error Flag or an Overload Flag.
A
2. When a receiver detects a dominant bit as the first bit after sending an Error Flag, the REC is increased by 8.
3. When a transmitter sends an Error Flag, the TEC is increased by 8. However, the following scenarios are
exempt from this rule:
IN
• If a transmitter is Error Passive that detects an Acknowledgment Error due to not detecting a
dominant bit in the ACK Slot, it should send a Passive Error Flag. If no dominant bit is detected in that
Passive Error Flag, the TEC should not be increased.
IM
• A transmitter transmits an Error Flag due to a Stuff Error during Arbitration. If the offending bit should
have been recessive but was monitored as dominant, then the TEC should not be increased.
4. If a transmitter detects a Bit Error whilst sending an Active Error Flag or Overload Flag, the TEC is increased
by 8.
EL
5. If a receiver detects a Bit Error while sending an Active Error Flag or Overload Flag, the REC is increased by
8.
6. A node can tolerate up to 7 consecutive dominant bits after sending an Active/Passive Error Flag, or
Overload Flag. After detecting the 14th consecutive dominant bit (when sending an Active Error Flag or
Overload Flag), or the 8th consecutive dominant bit following a Passive Error Flag, a transmitter will
PR
increase its TEC by 8 and a receiver will increase its REC by 8. Every additional eight consecutive dominant
bits will also increase the TEC (for transmitters) or REC (for receivers) by 8 as well.
7. When a transmitter successfully transmits a message (getting ACK and no errors until the EOF is complete),
the TEC is decremented by 1, unless the TEC is already at 0.
8. When a receiver successfully receives a message (no errors before ACK Slot, and successful sending of
ACK), the REC is decremented.
• If the REC was between 1 and 127, the REC is decremented by 1.
• If the REC was greater than 127, the REC is set to 127.
• If the REC was 0, the REC remains 0.

9. A node becomes Error Passive when its TEC and/or REC is greater than or equal to 128. The error
condition that causes a node to become Error Passive will cause the node to send an Active Error Flag.
Note that once the REC has reached to 128, any further increases to its value are invalid until the REC
returns to a value less than 128.
10. A node becomes Bus Off when its TEC is greater than or equal to 256.
11. An Error Passive node becomes Error Active when both the TEC and REC are less than or equal to 127.
12. A Bus Off node can become Error Active (with both its TEC and REC reset to 0) after it monitors 128
occurrences of 11 consecutive recessive bits on the bus.
24.3.4 TWAI Bit Timing
RY
24.3.4.1 Nominal Bit
The TWAI protocol allows a TWAI bus to operate at a particular bit rate. However, all nodes within a TWAI bus
must operate at the same bit rate.
• The Nominal Bit Rate is defined as the number of bits transmitted per second from an ideal transmitter
A
and without any synchronization.
• The Nominal Bit Time is defined as 1/Nominal Bit Rate.

IN
A single Nominal Bit Time is divided into multiple segments, and each segment is made up of multiple Time
Quanta. A Time Quantum is a fixed unit of time, and is implemented as some form of prescaled clock signal in
each node. Figure 24-5 illustrates the segments within a single Nominal Bit Time.
TWAI controllers will operate in time steps of one Time Quanta where the state of the TWAI bus is analyzed. If
IM
two consecutive Time Quantas have different bus states (i.e., recessive to dominant or vice versa), this will be
considered an edge. When the bus is analyzed at the intersection of PBS1 and PBS2, this is considered the
Sample Point and the sampled bus value is considered the value of that bit.
EL
PR
Figure 245. Layout of a Bit
Table 245. Segments of a Nominal Bit Time
Segment Description
SS The SS (Synchronization Segment) is 1 Time Quantum long. If all nodes are perfectly
synchronized, the edge of a bit will lie in the SS.
PBS1 PBS1 (Phase Buffer Segment 1) can be 1 to 16 Time Quanta long. PBS1 is meant
to compensate for the physical delay times within the network. PBS1 can also be
lengthened for synchronization purposes.


Segment Description
PBS2 PBS2 (Phase Buffer Segment 2) can be 1 to 8 Time Quanta long. PBS2 is meant to
compensate for the information processing time of nodes. PBS2 can also be shortened
for synchronization purposes.
24.3.4.2 Hard Synchronization and Resynchronization
Due to clock skew and jitter, the bit timing of nodes on the same bus may become out of phase. Therefore, a bit
edge may come before or after the SS. To ensure that the internal bit timing clocks of each node are kept in
phase, TWAI has various methods of synchronization. The Phase Error “e” is measured in the number of Time
RY
Quanta and relative to the SS.
• A positive Phase Error (e > 0) is when the edge lies after the SS and before the Sample Point (i.e., the edge
is late).
• A negative Phase Error (e < 0) is when the edge lies after the Sample Point of the previous bit and before
SS (i.e., the edge is early).
A
To correct for Phase Errors, there are two forms of synchronization, known as Hard Synchronization and
Resynchronization. Hard Synchronization and Resynchronization obey the following rules:
IN
• Only one synchronization may occur in a single bit time.
• Synchronizations only occurs on recessive to dominant edges.
Hard Synchronization
IM
Hard Synchronization occurs on the recessive to dominant edges when the bus is idle (i.e., the first SOF bit after
Bus Idle). All nodes will restart their internal bit timings so that the recessive to dominant edge lies within the SS
of the restarted bit timing.
Resynchronization
Resynchronization occurs on recessive to dominant edges not during Bus Idle. If the edge has a positive Phase
EL
Error (e > 0), PBS1 is lengthened by a certain number of Time Quanta. If the edge has a negative Phase Error (e
< 0), PBS2 will be shortened by a certain number of Time Quanta.
The number of Time Quanta to lengthen or shorten depends on the magnitude of the Phase Error, and is also
limited by the Synchronization Jump Width (SJW) value which is programmable.
PR
• When the magnitude of the Phase Error (e) is less than or equal to the SJW, PBS1/PBS2 are
lengthened/shortened by the e number of Time Quanta. This has a same effect as Hard Synchronization.
• When the magnitude of the Phase Error is greater to the SJW, PBS1/PBS2 are lengthened/shortened by
the SJW number of Time Quanta. This means it may take multiple bits of synchronization before the Phase
Error is entirely corrected.
24.4 Architectural Overview

The major functional blocks of the TWAI controller are shown in Figure 24-6.

A RY
IN
Figure 246. TWAI Overview Diagram
24.4.1 Registers Block

IM
The ESP32-S3 CPU accesses peripherals using 32-bit aligned words. However, the majority of registers in the
TWAI controller only contain useful data at the least significant byte (bits [7:0]). Therefore, in these registers, bits
[31:8] are ignored on writes, and return 0 on reads.
EL
The configuration registers store various configuration items for the TWAI controller such as bit rates, operation
mode, Acceptance Filter etc. Configuration registers can only be modified whilst the TWAI controller is in Reset
Mode (See Section 24.5.1).
Command Registers
The command register is used by the CPU to drive the TWAI controller to initiate certain actions such as
PR
transmitting a message or clearing the Receive Buffer. The command register can only be modified when the
TWAI controller is in Operation Mode (see section 24.5.1).
Interrupt & Status Registers

The interrupt register indicates what events have occurred in the TWAI controller (each event is represented by a
separate bit). The status register indicates the current status of the TWAI controller.
Error Management Registers

The error management registers include error counters and capture registers. The error counter registers
represent TEC and REC values. The capture registers will record information about instances where TWAI
controller detects a bus error, or when it loses arbitration.
Transmit Buffer Registers

The transmit buffer is a 13-byte buffer used to store a TWAI message to be transmitted.

Receive Buffer Registers

The Receive Buffer is a 13-byte buffer which stores a single message. The Receive Buffer acts as a window of
Receive FIFO, whose first message will be mapped into the Receive Buffer.
Note that the Transmit Buffer registers, Receive Buffer registers, and the Acceptance Filter registers share the
same address range (offset 0x0040 to 0x0070). Their access is governed by the following rules:
• When the TWAI controller is in Reset Mode, all reads and writes to the address range maps to the
Acceptance Filter registers.
• When the TWAI controller is in Operation Mode:
– All reads to the address range maps to the Receive Buffer registers.
RY
– All writes to the address range maps to the Transmit Buffer registers.
24.4.2 Bit Stream Processor

The Bit Stream Processing (BSP) module frames data from the Transmit Buffer (e.g. bit stuffing and additional
CRC fields) and generating a bit stream for the Bit Timing Logic (BTL) module. At the same time, the BSP module
A
is also responsible for processing the received bit stream (e.g., de-stuffing and verifying CRC) from the BTL
module and placing the message into the Receive FIFO. The BSP will also detect errors on the TWAI bus and
report them to the Error Management Logic (EML).
24.4.3 Error Management Logic

IN
The Error Management Logic (EML) module updates the TEC and REC, recording error information like error
types and positions, and updating the error state of the TWAI controller such that the BSP module generates the
IM
correct Error Flags. Furthermore, this module also records the bit position when the TWAI controller loses
arbitration.
24.4.4 Bit Timing Logic

EL
The Bit Timing Logic (BTL) module transmits and receives messages at the configured bit rate. The BTL module
also handles synchronization of out of phase bits so that communication remains stable. A single bit time
consists of multiple programmable segments that allows users to set the length of each segment to account for
factors such as propagation delay and controller processing time etc.
PR
24.4.5 Acceptance Filter

The Acceptance Filter is a programmable message filtering unit that allows the TWAI controller to accept or reject
a received message based on the message’s ID field. Only accepted messages will be stored in the Receive
FIFO. The Acceptance Filter’s registers can be programmed to specify a single filter, or two separate filters (dual
filter mode).
24.4.6 Receive FIFO

The Receive FIFO is a 64-byte buffer (inside the TWAI controller) that stores received messages accepted by the
Acceptance Filter. Messages in the Receive FIFO can vary in size (between 3 to 13-bytes). When the Receive
FIFO is full (or does not have enough space to store the next received message in its entirety), the Overrun
Interrupt will be triggered, and any subsequent received messages will be lost until adequate space is cleared in
the Receive FIFO. The first message in the Receive FIFO will be mapped to the 13-byte Receive Buffer until that

message is cleared (using the Release Receive Buffer command bit). After clearing, the Receive Buffer will map
to the next message in the Receive FIFO, and the space occupied by the previous message in the Receive FIFO
can be used to receive new messages.

24.5.1 Modes
The ESP32-S3 TWAI controller has two working modes: Reset Mode and Operation Mode. Reset Mode and
Operation Mode are entered by setting or clearing the TWAI_RESET_MODE bit.
24.5.1.1 Reset Mode
RY
Entering Reset Mode is required in order to modify the various configuration registers of the TWAI controller.
When entering Reset Mode, the TWAI controller is essentially disconnected from the TWAI bus. When in Reset
Mode, the TWAI controller will not be able to transmit any messages (including error signals). Any transmission in
progress is immediately terminated. Likewise, the TWAI controller will not be able to receive any messages
either.
A
24.5.1.2 Operation Mode IN
In operation mode, the TWAI controller connects to the bus and write-protect all configuration registers to ensure
consistency during operation. When in Operation Mode, the TWAI controller can transmit and receive messages
(including error signaling) depending on which operation sub-mode the TWAI controller was configured with. The
TWAI controller supports the following operation sub-modes:
IM
• Normal Mode: The TWAI controller can transmit and receive messages including error signaling (such as
error and overload Frames).
• Selftest Mode: Self-test mode is similar to normal Mode, but the TWAI controller will consider the
transmission of a data or RTR frame successful and do not generate ACK error even if it was not
EL
acknowledged. This is commonly used when self-testing the TWAI controller.
• Listenonly Mode: The TWAI controller will be able to receive messages, but will remain completely
passive on the TWAI bus. Thus, the TWAI controller will not be able to transmit any messages,
acknowledgments, or error signals. The error counters will remain frozen. This mode is useful for TWAI bus
monitoring.
PR
Note that when exiting Reset Mode (i.e., entering Operation Mode), the TWAI controller must wait for 11
consecutive recessive bits to occur before being able to fully connect the TWAI bus (i.e., be able to transmit or
receive).
24.5.2 Bit Timing

The operating bit rate of the TWAI controller must be configured whilst the TWAI controller is in Reset Mode. The
bit rate is configured using TWAI_BUS_TIMING_0_REG and TWAI_BUS_TIMING_1_REG, and the two registers
contain the following fields:
The following Table 24-6 illustrates the bit fields of TWAI_BUS_TIMING_0_REG.

Table 246. Bit Information of TWAI_BUS_TIMING_0_REG (0x18)
Bit 3116 Bit 15 Bit 14 Bit 13 Bit 12 ...... Bit 1 Bit 0

Reserved SJW.1 SJW.0 Reserved BRP.12 ...... BRP.1 BRP.0
Notes:
• BRP: The TWAI Time Quanta clock is derived from the APB clock that is usually 80 MHz. The Baud Rate
Prescaler (BRP) field is used to define the prescaler according to the equation below, where tT q is the Time
Quanta clock cycle and tCLK is APB clock cycle:
tT q = 2 × tCLK × (212 × BRP.12 + 211 × BRP.11 + ... + 21 × BRP.1 + 20 × BRP.0 + 1)
• SJW: Synchronization Jump Width (SJW) is configured in SJW.0 and SJW.1 where SJW = (2 x SJW.1 +
RY
SJW.0 + 1)�
The following Table 24-7 illustrates the bit fields of TWAI_BUS_TIMING_1_REG.
Table 247. Bit Information of TWAI_BUS_TIMING_1_REG (0x1c)
Bit 318 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
A
Reserved SAM PBS2.2 PBS2.1 PBS2.0 PBS1.3 PBS1.2 PBS1.1 PBS1.0
Notes: IN
• PBS1: The number of Time Quanta in Phase Buffer Segment 1 is defined according to the following
equation: (8 x PBS1.3 + 4 x PBS1.2 + 2 x PBS1.1 + PBS1.0 + 1)�
• PBS2: The number of Time Quanta in Phase Buffer Segment 2 is defined according to the following
equation: (4 x PBS2.2 + 2 x PBS2.1 + PBS2.0 + 1)�
IM
• SAM: Enables triple sampling if set to 1. This is useful for low/medium speed buses to filter spikes on the
bus line.
24.5.3 Interrupt Management

EL
The ESP32-S3 TWAI controller provides eight interrupts, each represented by a single bit in the
TWAI_INT_RAW_REG. For a particular interrupt to be triggered, the corresponding enable bit in TWAI_INT
ENA_REG must be set.
The TWAI controller provides the following interrupts:

PR
• Receive Interrupt
• Transmit Interrupt
• Error Warning Interrupt
• Data Overrun Interrupt
• Error Passive Interrupt
• Arbitration Lost Interrupt
• Bus Error Interrupt
• Bus Status Interrupt
The TWAI controller’s interrupt signal to the interrupt matrix will be asserted whenever one or more interrupt bits
are set in the TWAI_INT_RAW_REG, and deasserted when all bits in TWAI_INT_RAW_REG are cleared. The

majority of interrupt bits in TWAI_INT_RAW_REG are automatically cleared when the register is read, except for
the Receive Interrupt which can only be cleared when all the messages are released by setting the
TWAI_RELEASE_BUF bit.
24.5.3.1 Receive Interrupt (RXI)
The Receive Interrupt (RXI) is asserted whenever the TWAI controller has received messages that are pending to
be read from the Receive Buffer (i.e., when TWAI_RX_MESSAGE_CNT_REG > 0). Pending received messages
includes valid messages in the Receive FIFO and also overrun messages. The RXI will not be deasserted until all
pending received messages are cleared using the TWAI_RELEASE_BUF command bit.
24.5.3.2 Transmit Interrupt (TXI)
RY
The Transmit Interrupt (TXI) is triggered whenever Transmit Buffer becomes free, indicating another message can
be loaded into the Transmit Buffer to be transmitted. The Transmit Buffer becomes free under the following
scenarios:
• A message transmission has completed successfully, i.e., acknowledged without any errors. (Any failed
A
messages will automatically be resent.)
• A single shot transmission has completed (successfully or unsuccessfully, indicated by the

TWAI_TX_COMPLETE bit).
IN
• A message transmission was aborted using the TWAI_ABORT_TX command bit.
24.5.3.3 Error Warning Interrupt (EWI)

IM
The Error Warning Interrupt (EWI) is triggered whenever there is a change to the TWAI_ERR_ST and
TWAI_BUS_OFF_ST bits of the TWAI_STATUS_REG (i.e., transition from 0 to 1 or vice versa). Thus, an EWI
could indicate one of the following events, depending on the values TWAI_ERR_ST and TWAI_BUS_OFF_ST at
the moment when the EWI is triggered.
EL
• If TWAI_ERR_ST = 0 and TWAI_BUS_OFF_ST = 0:
– If the TWAI controller was in the Error Active state, it indicates both the TEC and REC have returned
below the threshold value set by TWAI_ERR_WARNING_LIMIT_REG.
– If the TWAI controller was previously in the Bus Off Recovery state, it indicates that Bus Recovery has
PR
completed successfully.
• If TWAI_ERR_ST = 1 and TWAI_BUS_OFF_ST = 0: The TEC or REC error counters have exceeded the
threshold value set by TWAI_ERR_WARNING_LIMIT_REG.
• If TWAI_ERR_ST = 1 and TWAI_BUS_OFF_ST = 1: The TWAI controller has entered the BUS_OFF state
(due to the TEC >= 256).
• If TWAI_ERR_ST = 0 and TWAI_BUS_OFF_ST = 1: The TWAI controller’s TEC has dropped below the
threshold value set by TWAI_ERR_WARNING_LIMIT_REG during BUS_OFF recovery.
24.5.3.4 Data Overrun Interrupt (DOI)
The Data Overrun Interrupt (DOI) is triggered whenever the Receive FIFO has overrun. The DOI indicates that the
Receive FIFO is full and should be cleared immediately to prevent any further overrun messages.

The DOI is only triggered by the first message that causes the Receive FIFO to overrun (i.e., the transition from
the Receive FIFO not being full to the Receive FIFO overrunning). Any subsequent overrun messages will not
trigger the DOI again. The DOI could be triggered again when all received messages (valid or overrun) have been
cleared.
24.5.3.5 Error Passive Interrupt (TXI)
The Error Passive Interrupt (EPI) is triggered whenever the TWAI controller switches from Error Active to Error
Passive, or vice versa.
24.5.3.6 Arbitration Lost Interrupt (ALI)
RY
The Arbitration Lost Interrupt (ALI) is triggered whenever the TWAI controller is attempting to transmit a message
and loses arbitration. The bit position where the TWAI controller lost arbitration is automatically recorded in
Arbitration Lost Capture register (TWAI_ARB LOST CAP_REG). When the ALI occurs again, the Arbitration Lost
Capture register will no longer record new bit location until it is cleared (via reading this register through the
CPU).
A
24.5.3.7 Bus Error Interrupt (BEI)
The Bus Error Interrupt (BEI) is triggered whenever TWAI controller detects an error on the TWAI bus. When a
IN
bus error occurs, the Bus Error type and its bit position are automatically recorded in the Error Code Capture
register (TWAI_ERR_CODE_CAP_REG). When the BEI occurs again, the Error Code Capture register will no
longer record new error information until it is cleared (via a read from the CPU).
IM
24.5.3.8 Bus Status Interrupt (BSI)
The Bus Status Interrupt (BSI) is triggered whenever TWAI controller is switching between receive/transmit status
and idle status. When a BSI occurs, the current status of TWAI controller can be measured by reading
TWAI_RX_ST and TWAI_TX_ST in TWAI_STATUS_REG register.
EL
24.5.4 Transmit and Receive Buffers
24.5.4.1 Overview of Buffers

PR
Table 248. Buffer Layout for Standard Frame Format and Extended Frame Format
Standard Frame Format (SFF) Extended Frame Format (EFF)

TWAI Address Content TWAI Address Content
0x40 TX/RX frame information 0x40 TX/RX frame information
0x44 TX/RX identifier 1 0x44 TX/RX identifier 1
0x48 TX/RX identifier 2 0x48 TX/RX identifier 2
0x4c TX/RX data byte 1 0x4c TX/RX identifier 3
0x50 TX/RX data byte 2 0x50 TX/RX identifier 4
0x54 TX/RX data byte 3 0x54 TX/RX data byte 1
0x5c TX/RX data byte 5 0x5c TX/RX data byte 3


Standard Frame Format (SFF) Extended Frame Format (EFF)
TWAI Address Content TWAI Address Content
0x6c reserved 0x6c TX/RX data byte 7
0x70 reserved 0x70 TX/RX data byte 8
Table 24-8 illustrates the layout of the Transmit Buffer and Receive Buffer registers. Both the Transmit and
RY
Receive Buffer registers share the same address space and are only accessible when the TWAI controller is in
Operation Mode. CPU write operations access the Transmit Buffer registers, and CPU read operations access
the Receive Buffer registers. However, both buffers share the exact same register layout and fields to represent a
message (received or to be transmitted). The Transmit Buffer registers are used to configure a TWAI message to
be transmitted. The CPU would write to the Transmit Buffer registers specifying the message’s frame type, frame
format, frame ID, and frame data (payload). Once the Transmit Buffer is configured, the CPU would then initiate
A
the transmission by setting the TWAI_TX_REQ bit in TWAI_CMD_REG.
• For a self-reception request, set the TWAI_SELF_RX_REQ bit instead.

IN
• For a single-shot transmission, set both the TWAI_TX_REQ and the TWAI_ABORT_TX simultaneously.
The Receive Buffer registers map the first message in the Receive FIFO. The CPU would read the Receive Buffer
registers to obtain the first message’s frame type, frame format, frame ID, and frame data (payload). Once the
message has been read from the Receive Buffer registers, the CPU can set the TWAI_RELEASE_BUF bit in
IM
TWAI_CMD_REG to clear the Receive Buffer registers. If there are still messages in the Receive FIFO, the
Receive Buffer registers will map the first message again.
24.5.4.2 Frame Information

EL
The frame information is one byte long and specifies a message’s frame type, frame format, and length of data.
The frame information fields are shown in Table 24-9.
Table 249. TX/RX Frame Information (SFF/EFF)�TWAI Address 0x40
PR
1 2 3 3 4 4 4
Reserved FF RTR X X DLC.3 DLC.2 DLC.1 DLC.04
Notes:
1. FF: The Frame Format (FF) bit specifies whether the message is Extended Frame Format (EFF) or Standard
Frame Format (SFF). The message is EFF when FF bit is 1, and SFF when FF bit is 0.
2. RTR: The Remote Transmission Request (RTR) bit specifies whether the message is a data frame or a
remote frame. The message is a remote frame when the RTR bit is 1, and a data frame when the RTR bit is
0.
3. X: Don’t care, can be any value.
4. DLC: The Data Length Code (DLC) field specifies the number of data bytes for a data frame, or the number
of data bytes to request in a remote frame. TWAI data frames are limited to a maximum payload of 8 data

bytes, and thus the DLC should range anywhere from 0 to 8.
24.5.4.3 Frame Identifier
The Frame Identifier fields is two-byte (11-bit) long if the message is SFF, and four-byte (29-bit) long if the
message is EFF.
The Frame Identifier fields for an SFF (11-bit) message is shown in Table 24-10-24-11.
Table 2410. TX/RX Identifier 1 (SFF); TWAI Address 0x44
Reserved ID.10 ID.9 ID.8 ID.7 ID.6 ID.5 ID.4 ID.3
RY
Table 2411. TX/RX Identifier 2 (SFF); TWAI Address 0x48
1 2 2 2
Reserved ID.2 ID.1 ID.0 X X X X X2
A
Notes:
1. Don’t care. Recommended to be compatible with receive buffer (i.e., set to RTR ) in case of using the self
IN
reception functionality (or together with self-test functionality).
2. Don’t care. Recommended to be compatible with receive buffer (i.e., set to 0 ) in case of using the self
The Frame Identifier fields for an EFF (29-bits) message is shown in Table 24-12-24-15.
IM
Table 2412. TX/RX Identifier 1 (EFF); TWAI Address 0x44
EL
PR
Table 2414. TX/RX Identifier 3 (EFF); TWAI Address 0x4c
1 2
Reserved ID.4 ID.3 ID.2 ID.1 ID.0 X X X2
Notes:

1. Don’t care. Recommended to be compatible with receive buffer (i.e., set to RTR ) in case of using the self
2. Don’t care. Recommended to be compatible with receive buffer (i.e., set to 0 ) in case of using the self
24.5.4.4 Frame Data
The Frame Data field contains the payloads of transmitted or received data frame, and can range from 0 to eight
bytes. The number of valid bytes should be equal to the DLC. However, if the DLC is larger than eight, the
number of valid bytes would still be limited to eight. Remote frames do not have data payloads, thus their Frame
Data fields will be unused.
RY
For example, when transmitting a data frame with five bytes, the CPU should write five to the DLC field, and then
write data to the corresponding register of the first to the fifth data field. Likewise, when receiving a data frame
with a DLC of five data bytes, only the first to the fifth data byte will contain valid payload data for the CPU to
read.
A
24.5.5 Receive FIFO and Data Overruns
The Receive FIFO is a 64-byte internal buffer used to store received messages in First In First Out order. A single
received message can occupy between three to 13 bytes of space in the Receive FIFO, and their endianness is
IN
identical to the register layout of the Receive Buffer registers. The Receive Buffer registers are mapped to the
bytes of the first message in the Receive FIFO.
When the TWAI controller receives a message, it will increment the value of TWAI_RX_MESSAGE_COUNTER up
to a maximum of 64. If there is adequate space in the Receive FIFO, the message contents will be written into
IM
the Receive FIFO. Once a message has been read from the Receive Buffer, the TWAI_RELEASE_BUF bit should
be set. This will decrement TWAI_RX_MESSAGE_COUNTER and free the space occupied by the first message
in the Receive FIFO. The Receive Buffer will then map to the next message in the Receive FIFO.
A data overrun occurs when the TWAI controller receives a message, but the Receive FIFO lacks the adequate
EL
free space to store the received message in its entirety (either due to the message contents being larger than the
free space in the Receive FIFO, or the Receive FIFO being completely full).
When a data overrun occurs:
• The free space left in the Receive FIFO is filled with the partial contents of the overrun message. If the
PR
Receive FIFO is already full, then none of the overrun message’s contents will be stored.
• When data in the Receive FIFO overruns for the first time, a Data Overrun Interrupt will be triggered.
• Each overrun message will still increment the TWAI_RX_MESSAGE_COUNTER up to a maximum of 64.
• The RX FIFO will internally mark overrun messages as invalid. The TWAI_MISS_ST bit can be used to
determine whether the message currently mapped to by the Receive Buffer is valid or overrun.
To clear an overrun Receive FIFO, the TWAI_RELEASE_BUF must be called repeatedly until
TWAI_RX_MESSAGE_COUNTER is 0. This has the effect of freeing all valid messages in the Receive FIFO and
clearing all overrun messages.
The Acceptance Filter allows the TWAI controller to filter out received messages based on their ID (and optionally
their first data byte and frame type). Only accepted messages are passed on to the Receive FIFO. The use of

Acceptance Filters allows a more lightweight operation of the TWAI controller (e.g., less use of Receive FIFO,
fewer Receive Interrupts) since the TWAI Controller only need to handle a subset of messages.
The Acceptance Filter configuration registers can only be accessed whilst the TWAI controller is in Reset Mode,
since they share the same address spaces as the Transmit Buffer and Receive Buffer registers.
The configuration registers consist of a 32-bit Acceptance Code Value and a 32-bit Acceptance Mask Value. The
Acceptance Code value specifies a bit pattern which each filtered bit of the message must match in order for the
message to be accepted. The Acceptance Mask Value is able to mask out certain bits of the Code value (i.e., set
as “Don’t Care” bits). Each filtered bit of the message must either match the acceptance code or be masked in
order for the message to be accepted, as demonstrated in Figure 24-7.
RY
Figure 247. Acceptance Filter
A
The TWAI controller Acceptance Filter allows the 32-bit Acceptance Code and Mask Values to either define a
single filter (i.e., Single Filter Mode), or two filters (i.e., Dual Filter Mode). How the Acceptance Filter interprets the
32-bit code and mask values is dependent on whether Single Filter Mode is enabled, and the received message
format (i.e., SFF or EFF).
IN
24.5.5.1 Single Filter Mode
IM
Single Filter Mode is enabled by setting the TWAI_RX_FILTER_MODE bit to 1. This will cause the 32-bit code and
mask values to define a single filter. The single filter can filter the following bits of a data or remote frame:
• SFF
– The entire 11-bit ID

EL
– RTR bit
– Data byte 1 and Data byte 2
• EFF

PR
– RTR bit
The following Figure 24-8 illustrates how the 32-bit code and mask values will be interpreted under Single Filter
Mode.
24.5.5.2 Dual FIlter Mode
Dual Filter Mode is enabled by clearing the TWAI_RX_FILTER_MODE bit to 0. This will cause the 32-bit code and
mask values to define a two separate filters referred to as filter 1 or filter 2. Under Dual Filter Mode, a message
will be accepted if it is accepted by one of the two filters.
The two filters can filter the following bits of a data or remote frame:
• SFF

RY
Figure 248. Single Filter Mode
A
– RTR bit
– Data byte 1 (for filter 1 only) IN

• EFF
– The first 16 bits of the 29-bit ID
The following Figure 24-9 illustrates how the 32-bit code and mask values will be interpreted in Dual Filter
IM
Mode.
24.5.6 Error Management

The TWAI protocol requires that each TWAI node maintains the Transmit Error Count (TEC) and Receive Error
Count (REC). The value of both error counts determines the current error state of the TWAI controller (i.e., Error
EL
Active, Error Passive, Bus-Off). The TWAI controller stores the TEC and REC values in the
TWAI_TX_ERR_CNT_REG and TWAI_RX_ERR_CNT_REG respectively, and they can be read by the CPU
anytime. In addition to the error states, the TWAI controller also offers an Error Warning Limit (EWL) feature that
can warn the user of the occurrence of severe bus errors before the TWAI controller enters the Error Passive
state.
PR
The current error state of the TWAI controller is indicated via a combination of the following values and status bits:
TEC, REC, TWAI_ERR_ST, and TWAI_BUS_OFF_ST. Certain changes to these values and bits will also trigger
interrupts, thus allowing the users to be notified of error state transitions (see section 24.5.3). The following figure
24-10 shows the relation between the error states, values and bits, and error state related interrupts.
24.5.6.1 Error Warning Limit
The Error Warning Limit (EWL) feature is a configurable threshold value for the TEC and REC, which will trigger an
interrupt when exceeded. The EWL is intended to serve as a warning about severe TWAI bus errors, and is
triggered before the TWAI controller enters the Error Passive state. The EWL is configured in the
TWAI_ERR_WARNING_LIMIT_REG and can only be configured whilst the TWAI controller is in Reset Mode. The
TWAI_ERR_WARNING_LIMIT_REG has a default value of 96. When the values of TEC and/or REC are larger than

A RY
IN
IM
Figure 249. Dual Filter Mode
EL
PR
Figure 2410. Error State Transition
or equal to the EWL value, the TWAI_ERR_ST bit is immediately set to 1. Likewise, when the values of both the
TEC and REC are smaller than the EWL value, the TWAI_ERR_ST bit is immediately reset to 0. The Error Warning
Interrupt is triggered whenever the value of the TWAI_ERR_ST bit (or the TWAI_BUS_OFF_ST) changes.

24.5.6.2 Error Passive
The TWAI controller is in the Error Passive state when the TEC or REC value exceeds 127. Likewise, when both
the TEC and REC are less than or equal to 127, the TWAI controller enters the Error Active state. The Error
Passive Interrupt is triggered whenever the TWAI controller transitions from the Error Active state to the Error
Passive state or vice versa.
24.5.6.3 BusOff and BusOff Recovery
The TWAI controller enters the Bus-Off state when the TEC value exceeds 255. On entering the Bus-Off state,
the TWAI controller will automatically do the following:
RY
• Set REC to 0
• Set TEC to 127
• Set the TWAI_BUS_OFF_ST bit to 1
• Enter Reset Mode
A
The Error Warning Interrupt is triggered whenever the value of the TWAI_BUS_OFF_ST bit (or the TWAI_ERR_ST
bit) changes.
To return to the Error Active state, the TWAI controller must undergo Bus-Off Recovery. Bus-Off Recovery
IN
requires the TWAI controller to observe 128 occurrences of 11 consecutive recessive bits on the bus. To initiate
Bus-Off Recovery (after entering the Bus-Off state), the TWAI controller should enter Operation Mode by setting
the TWAI_RESET_MODE bit to 0. The TEC tracks the progress of Bus-Off Recovery by decrementing the TEC
each time when the TWAI controller observes 11 consecutive recessive bits. When Bus-Off Recovery has
IM
completed (i.e., TEC has decremented from 127 to 0), the TWAI_BUS_OFF_ST bit will automatically be reset to
0, thus triggering the Error Warning Interrupt.
24.5.7 Error Code Capture

EL
The Error Code Capture (ECC) feature allows the TWAI controller to record the error type and bit position of a
TWAI bus error in the form of an error code. Upon detecting a TWAI bus error, the Bus Error Interrupt is triggered
and the error code is recorded in the TWAI_ERR_CODE_CAP_REG. Subsequent bus errors will trigger the Bus
Error Interrupt, but their error codes will not be recorded until the current error code is read from the
TWAI_ERR_CODE_CAP_REG.
PR
The following Table 24-16 shows the fields of the TWAI_ERR_CODE_CAP_REG:
Table 2416. Bit Information of TWAI_ERR_CODE_CAP_REG (0x30)
1 1 2 3 3 3 3
Reserved ERRC.1 ERRC.0 DIR SEG.4 SEG.3 SEG.2 SEG.1 SEG.03
Notes:
• ERRC: The Error Code (ERRC) indicates the type of bus error: 00 for bit error, 01 for format error, 10 for
stuff error, 11 for other types of error.
• DIR: The Direction (DIR) indicates whether the TWAI controller was transmitting or receiving when the bus
error occurred: 0 for transmitter, 1 for receiver.
• SEG: The Error Segment (SEG) indicates which segment of the TWAI message (i.e., bit position) the bus

error occurred at.
The following Table 24-17 shows how to interpret the SEG.0 to SEG.4 bits.
Table 2417. Bit Information of Bits SEG.4 SEG.0
Bit SEG.4 Bit SEG.3 Bit SEG.2 Bit SEG.1 Bit SEG.0 Description
0 0 0 1 1 start of frame
0 0 0 1 0 ID.28 ~ ID.21
0 0 1 1 0 ID.20 ~ ID.18
0 0 1 0 0 bit SRTR
0 0 1 0 1 bit IDE
RY
0 0 1 1 1 ID.17 ~ ID.13
0 1 1 1 1 ID.12 ~ ID.5
0 1 1 1 0 ID.4 ~ ID.0
0 1 1 0 0 bit RTR
0 1 1 0 1 reserved bit 1
0 1 0 0 1 reserved bit 0
A
0 1 0 1 1 data length code
0 1 0 1 0 data field
0 1 0 0 0 CRC sequence
1
1
1
1
0
0
IN 0
0
0
1
CRC delimiter
ACK slot
1 1 0 1 1 ACK delimiter
1 1 0 1 0 end of frame
IM
1 0 0 1 0 intermission
1 0 0 0 1 active error flag
1 0 1 1 0 passive error flag
1 0 0 1 1 tolerate dominant bits
EL
1 0 1 1 1 error delimiter
1 1 1 0 0 overload flag
Notes:
• Bit SRTR: under Standard Frame Format.

PR
• Bit IDE: Identifier Extension Bit, 0 for Standard Frame Format.
24.5.8 Arbitration Lost Capture

The Arbitration Lost Capture (ALC) feature allows the TWAI controller to record the bit position where it loses
arbitration. When the TWAI controller loses arbitration, the bit position is recorded in the TWAI_ARB LOST
CAP_REG and the Arbitration Lost Interrupt is triggered.
Subsequent loses in arbitration will trigger the Arbitration Lost Interrupt, but will not be recorded in the TWAI_ARB
LOST CAP_REG until the current Arbitration Lost Capture is read from the TWAI_ERR_CODE_CAP_REG.
Table 24-18 illustrates bits and fields of the TWAI_ERR_CODE_CAP_REG whilst Figure 24-11 illustrates the bit
positions of a TWAI message.

Table 2418. Bit Information of TWAI_ARB LOST CAP_REG (0x2c)
Bit 315 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0

1 1 1 1
Reserved BITNO.4 BITNO.3 BITNO.2 BITNO.1 BITNO.01
Notes:
• BITNO: Bit Number (BITNO) indicates the nth bit of a TWAI message where arbitration was lost.
RY
Figure 2411. Positions of Arbitration Lost Bits
A
IN
IM
EL
PR


’|’ here means separate line. The left describes the access in Operation Mode. The right belongs to Reset Mode.
The addresses in this section are relative to the [Two-wire Automotive Interface] base address provided in Table

TWAI_MODE_REG Mode Register 0x0000 R/W
TWAI_BUS_TIMING_0_REG Bus Timing Register 0 0x0018 RO | R/W
TWAI_BUS_TIMING_1_REG Bus Timing Register 1 0x001C RO | R/W
TWAI_ERR_WARNING_LIMIT_REG Error Warning Limit Register 0x0034 RO | R/W
RY
TWAI_DATA_0_REG Data Register 0 0x0040 WO | R/W
TWAI_DATA_3_REG Data Register 3 0x004C WO | R/W
A
TWAI_DATA_7_REG Data Register 7 0x005C WO | R/W
TWAI_DATA_8_REG
TWAI_DATA_9_REG
IN
Data Register 8
Data Register 9
0x0060
0x0064
WO | RO
WO | RO
TWAI_DATA_10_REG Data Register 10 0x0068 WO | RO
TWAI_DATA_11_REG Data Register 11 0x006C WO | RO
IM
TWAI_DATA_12_REG Data Register 12 0x0070 WO | RO
TWAI_CLOCK_DIVIDER_REG Clock Divider Register 0x007C varies
Contro Registers
TWAI_CMD_REG Command Register 0x0004 WO
Status Register
EL
TWAI_STATUS_REG Status Register 0x0008 RO

TWAI_ARB LOST CAP_REG Arbitration Lost Capture Register 0x002C RO
TWAI_ERR_CODE_CAP_REG Error Code Capture Register 0x0030 RO
TWAI_RX_ERR_CNT_REG Receive Error Counter Register 0x0038 RO | R/W
TWAI_TX_ERR_CNT_REG Transmit Error Counter Register 0x003C RO | R/W
PR
TWAI_RX_MESSAGE_CNT_REG Receive Message Counter Register 0x0074 RO

Interrupt Registers
TWAI_INT_RAW_REG Interrupt Register 0x000C RO
TWAI_INT ENA_REG Interrupt Enable Register 0x0010 R/W

24.7 Registers
’|’ here means separate line. The left describes the access in Operation Mode. The right belongs to Reset Mode
with red color. The addresses in this section are relative to the Two-wire Automotive Interface base address
Register 24.1. TWAI_MODE_REG (0x0000)
DE
_M LY E
DE O
ES _O _M E
ET N OD
O _M
_R EN T D
AI IST ES MO
TW I_L F_ R_
A EL TE
T
TW I_S FIL
A X_
d)
TW I_R
ve
RY
er
A
s
TW
(re
31 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 Reset
TWAI_RESET_MODE This bit is used to configure the operation mode of the TWAI Controller. 1:
Reset mode; 0: Operation mode (R/W)
A
TWAI_LISTEN_ONLY_MODE 1: Listen only mode. In this mode the nodes will only receive messages
from the bus, without generating the acknowledge signal nor updating the RX error counter. (R/W)
IN
TWAI_SELF_TEST_MODE 1: Self test mode. In this mode the TX nodes can perform a successful
transmission without receiving the acknowledge signal. This mode is often used to test a single
node with the self reception request command. (R/W)
IM
TWAI_RX_FILTER_MODE This bit is used to configure the filter mode. 0: Dual filter mode; 1: Single
filter mode (R/W)
EL
Register 24.2. TWAI_BUS_TIMING_0_REG (0x0018)

TH
ID
_W
SC
P
ed JUM
RE
_P
_
UD
se NC
d)
BA
Y
PR
_S
e
rv
rv
_
AI
AI
se
TW
TW
(re
(re
31 16 15 14 13 12 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 0x0 0x00 Reset
TWAI_BAUD_PRESC Baud Rate Prescaler value, determines the frequency dividing ratio. (RO | R/W)
TWAI_SYNC_JUMP_WIDTH Synchronization Jump Width (SJW), 1 ~ 14 Tq wide. (RO | R/W)

Register 24.3. TWAI_BUS_TIMING_1_REG (0x001C)
1
M
G
SA
SE
SE
E_
E_
E_
M
IM
IM
)
ed
I
_T
_T
_T
rv
AI
AI
AI
se
TW
TW
TW
(re
31 8 7 6 4 3 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 0x0 Reset
TWAI_TIME_SEG1 The width of PBS1. (RO | R/W)
TWAI_TIME_SEG2 The width of PBS2. (RO | R/W)
RY
TWAI_TIME_SAMP The number of sample points. 0: the bus is sampled once; 1: the bus is sampled
three times (RO | R/W)
Register 24.4. TWAI_ERR_WARNING_LIMIT_REG (0x0034)
A
IT
IM
_L
NG
NI
AR
IN
W
R_
d)
R
ve
_E
r
AI
se
TW
(re
31 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x60 Reset
IM
TWAI_ERR_WARNING_LIMIT Error warning threshold. In the case when any of an error counter
value exceeds the threshold, or all the error counter values are below the threshold, an error warning
interrupt will be triggered (given the enable signal is valid). (RO | R/W)
EL
PR

Register 24.5. TWAI_DATA_0_REG (0x0040)
_0
DE
O
E_C
NC
TA
EP
CC
_A
AI
W
|T
0
E_
YT
_B
)
ed
X
_T
rv
AI
se
TW
(re
31 8 7 0
RY
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
TWAI_TX_BYTE_0 Stored the 0th byte information of the data to be transmitted in operation mode.
(WO)
TWAI_ACCEPTANCE_CODE_0 Stored the 0th byte of the filter code in reset mode. (R/W)
A
IN
_1
DE
O
_C
CE
N
TA
EP
IM
CC
_A
AI
W
|T
1
E_
YT
_B
d)
X
ve
_T
r
AI
se
TW
(re
EL
31 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
TWAI_TX_BYTE_1 Stored the 1st byte information of the data to be transmitted in operation mode.
(WO)
PR
TWAI_ACCEPTANCE_CODE_1 Stored the 1st byte of the filter code in reset mode. (R/W)

_2
DE
O
E_C
NC
TA
EP
CC
_A
AI
W
|T
2
E_
YT
_B
)
ed
X
_T
rv
AI
se
TW
(re
31 8 7 0
RY
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
TWAI_TX_BYTE_2 Stored the 2nd byte information of the data to be transmitted in operation mode.
(WO)
TWAI_ACCEPTANCE_CODE_2 Stored the 2nd byte of the filter code in reset mode. (R/W)
A
Register 24.8. TWAI_DATA_3_REG (0x004C)
IN
_3
DE
O
_C
CE
N
TA
EP
IM
CC
_A
AI
W
|T
3
E_
YT
_B
d)
X
ve
_T
r
AI
se
TW
(re
EL
31 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
TWAI_TX_BYTE_3 Stored the 3rd byte information of the data to be transmitted in operation mode.
(WO)
PR
TWAI_ACCEPTANCE_CODE_3 Stored the 3rd byte of the filter code in reset mode. (R/W)

0
K_
AS
E_M
NC
TA
EP
CC
_A
AI
W
|T
4
E_
YT
_B
d)
X
ve
_T
er
AI
s
TW
(re
31 8 7 0
RY
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
(WO)
TWAI_ACCEPTANCE_MASK_0 Stored the 0th byte of the filter code in reset mode. (R/W)
A
IN
1
K_
AS
_M
CE
N
TA
EP
IM
CC
_A
AI
W
|T
5
E_
YT
_B
d)
X
ve
_T
r
AI
se
TW
(re
EL
31 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
(WO)
PR
TWAI_ACCEPTANCE_MASK_1 Stored the 1st byte of the filter code in reset mode. (R/W)

2
K_
AS
E_M
NC
TA
EP
CC
_A
AI
W
|T
6
E_
YT
_B
d)
X
ve
_T
er
AI
s
TW
(re
31 8 7 0
RY
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
(WO)
TWAI_ACCEPTANCE_MASK_2 Stored the 2nd byte of the filter code in reset mode. (R/W)
A
IN
3
K_
AS
_M
CE
N
TA
EP
IM
CC
_A
AI
W
|T
7
E_
YT
_B
d)
X
ve
_T
r
AI
se
TW
(re
EL
31 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
(WO)
PR
TWAI_ACCEPTANCE_MASK_3 Stored the 3rd byte of the filter code in reset mode. (R/W)

8
E_
YT
_B
d)
X
ve
_T
r
AI
se
TW
(re
31 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
(WO)
RY
9
E_
YT
_B
d)
X
ve
_T
er
AI
s
TW
(re
A
31 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
IN 0 0 0 0 0 0 0 0 0x0 Reset
(WO)
IM
10
E_
YT
_B
d)
X
ve
_T
r
AI
se
EL
TW
(re
31 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
(WO)
PR

11
E_
YT
_B
)
ed
X
_T
rv
AI
se
TW
(re
31 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
(WO)
RY
12
E_
YT
_B
d)
X
e
_T
rv
AI
se
A TW
(re
31 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
IN
(WO)
IM
Register 24.18. TWAI_CLOCK_DIVIDER_REG (0x007C)
FF
_O
CK
O
d)
D
L
_C
_C
ve
EL r
AI
AI
se
TW
TW
(re
31 9 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
TWAI_CD These bits are used to configure the divisor of the external CLKOUT pin. (R/W)
PR
TWAI_CLOCK_OFF This bit can be configured in reset mode. 1: Disable the external CLKOUT pin;
0: Enable the external CLKOUT pin (RO | R/W)

Register 24.19. TWAI_CMD_REG (0x0004)
AI BO SE UN
X_ T_ UF
A L VE Q
E
TW I_A EA RR
_T R _B
TW I_R _O _R
RE TX
A LR X
Q
R
TW _C _
AI ELF
)
E
ed
TW I_S
rv
se
A
TW
(re
31 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
TWAI_TX_REQ Set the bit to 1 to drive nodes to start transmission. (WO)
TWAI_ABORT_TX Set the bit to 1 to cancel a pending transmission request. (WO)
RY
TWAI_RELEASE_BUF Set the bit to 1 to release the RX buffer. (WO)
TWAI_CLR_OVERRUN Set the bit to 1 to clear the data overrun status bit. (WO)
TWAI_SELF_RX_REQ Self reception request command. Set the bit to 1 to allow a message be
transmitted and received simultaneously. (WO)
A
Register 24.20. TWAI_STATUS_REG (0x0008)
IN
AI VE F_S TE
F_ ST
A X_ T T
TW I_O BU PLE
TW I_T _S _S
ST
_R RR T
BU N_
A RR FF
A US ST
X_ U
A X_ M
TW I_E _O
TW I_T CO
TW I_T ST
TW I_R ST
TW _B _
AI ISS
A X_
A X_
)
ed
TW I_M
rv
se
A
IM
TW
(re
31 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 Reset
TWAI_RX_BUF_ST 1: The data in the RX buffer is not empty, with at least one received data packet.
(RO)
EL
TWAI_OVERRUN_ST 1: The RX FIFO is full and data overrun has occurred. (RO)
TWAI_TX_BUF_ST 1: The TX buffer is empty, the CPU may write a message into it. (RO)
TWAI_TX_COMPLETE 1: The TWAI controller has successfully received a packet from the bus. (RO)
PR
TWAI_RX_ST 1: The TWAI Controller is receiving a message from the bus. (RO)
TWAI_TX_ST 1: The TWAI Controller is transmitting a message to the bus. (RO)
TWAI_ERR_ST 1: At least one of the RX/TX error counter has reached or exceeded the value set in
register TWAI_ERR_WARNING_LIMIT_REG. (RO)
TWAI_BUS_OFF_ST 1: In bus-off status, the TWAI Controller is no longer involved in bus activities.
(RO)
TWAI_MISS_ST This bit reflects whether the data packet in the RX FIFO is complete. 1: The current
packet is missing; 0: The current packet is complete (RO)

Register 24.21. TWAI_ARB LOST CAP_REG (0x002C)
AP
_C
ST
O
_L
RB
)
ed
_A
rv
AI
se
TW
(re
31 5 4 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
TWAI_ARB_LOST_CAP This register contains information about the bit position of lost arbitration.
(RO)
RY
Register 24.22. TWAI_ERR_CODE_CAP_REG (0x0030)
T
O
EN
TI
EC
M
E
EG
_E TYP
IR
_D
_S
A TW CC
CC
_
CC
d)
ve
_E
_E
r
AI
AI
AI
se
TW
TW
(re
31 8 7 6 5 4 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
IN0 0 0 0 0 0 0 0 0 0x0 0 0x0 Reset
TWAI_ECC_SEGMENT This register contains information about the location of errors, see Table 24-
16 for details. (RO)
IM
TWAI_ECC_DIRECTION This register contains information about transmission direction of the node
when error occurs. 1: Error occurs when receiving a message; 0: Error occurs when transmitting
a message (RO)
TWAI_ECC_TYPE This register contains information about error types: 00: bit error; 01: form error;
EL
10: stuff error; 11: other type of error (RO)
Register 24.23. TWAI_RX_ERR_CNT_REG (0x0038)

PR
T
CN
R_
ER
X_
d)
_R
ve
r
AI
se
TW
(re
31 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
TWAI_RX_ERR_CNT The RX error counter register, reflects value changes in reception status. (RO |
R/W)

Register 24.24. TWAI_TX_ERR_CNT_REG (0x003C)
NT
_C
RR
_E
d)
X
ve
_T
er
AI
s
TW
(re
31 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
TWAI_TX_ERR_CNT The TX error counter register, reflects value changes in transmission status. (RO
| R/W)
RY
Register 24.25. TWAI_RX_MESSAGE_CNT_REG (0x0074)
R
TE
UN
CO
E_
G
A
SA
ES
M
X_
d)
_R
e
rv
AI
se
TW
(re
31
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
IN
0 0 0 0 0 0 0 0 0
7
0
6
0x0
0
Reset
TWAI_RX_MESSAGE_COUNTER This register reflects the number of messages available within the
RX FIFO. (RO)
IM
EL
PR

Register 24.26. TWAI_INT_RAW_REG (0x000C)
T
_S
ST
se RR OS T ST
VE ST
X_ _S _IN T
NT
TW rve _P T_ _ST
IN T T_
(re I_E _L _IN T_
_R T N S
SI _
AI X_I AR NT_
_I
A d) AS INT
A RB RR _IN
TW _T _W _I
TW I_A _E TE
ST
AI RR UN
A US TA
T_
TW _E RR
TW _B _S
N
AI US
AI VE
d)
TW I_O
TW I_B
ve
er
A
s
TW
(re
31 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
TWAI_RX_INT_ST Receive interrupt. If this bit is set to 1, it indicates there are messages to be
handled in the RX FIFO. (RO)
RY
TWAI_TX_INT_ST Transmit interrupt. If this bit is set to 1, it indicates the message transmission is
finished and a new transmission is able to start. (RO)
TWAI_ERR_WARN_INT_ST Error warning interrupt. If this bit is set to 1, it indicates the error status
signal and the bus-off status signal of Status register have changed (e.g., switched from 0 to 1 or
A
from 1 to 0). (RO)
TWAI_OVERRUN_INT_ST Data overrun interrupt. If this bit is set to 1, it indicates a data overrun
interrupt is generated in the RX FIFO. (RO)
IN
TWAI_ERR_PASSIVE_INT_ST Error passive interrupt. If this bit is set to 1, it indicates the TWAI
Controller is switched between error active status and error passive status due to the change of
error counters. (RO)
IM
TWAI_ARB_LOST_INT_ST Arbitration lost interrupt. If this bit is set to 1, it indicates an arbitration
lost interrupt is generated. (RO)
TWAI_BUS_ERR_INT_ST Error interrupt. If this bit is set to 1, it indicates an error is detected on the
bus. (RO)
EL
TWAI_BUS_STATE_INT_ST Bus state interrupt. If this bit is set to 1, it indicates the status of TWAI
controller has changed. (RO)
PR

Register 24.27. TWAI_INT ENA_REG (0x0010)
NA
A
TW rve _P T_ _EN A
_E
_I A
EN
se RR OS T EN
X_ _E _IN NA
A d) AS INT A
VE EN
NT
IN N T_
(re I_E _L _IN T_
_R T N E
SI _
AI X_I AR NT_
A RB RR _IN
A
T_ A
TW _T _W _I
TW I_A _E TE
EN
AI RR UN
A US TA
TW _E RR
TW _B _S
N
AI US
AI VE
d)
TW I_O
TW I_B
ve
er
A
s
TW
(re
31 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
TWAI_RX_INT_ENA Set this bit to 1 to enable receive interrupt. (R/W)
RY
TWAI_TX_INT_ENA Set this bit to 1 to enable transmit interrupt. (R/W)
TWAI_ERR_WARN_INT_ENA Set this bit to 1 to enable error warning interrupt. (R/W)
TWAI_OVERRUN_INT_ENA Set this bit to 1 to enable data overrun interrupt. (R/W)
TWAI_ERR_PASSIVE_INT_ENA Set this bit to 1 to enable error passive interrupt. (R/W)
A
TWAI_ARB_LOST_INT_ENA Set this bit to 1 to enable arbitration lost interrupt. (R/W)
TWAI_BUS_ERR_INT_ENA Set this bit to 1 to enable bus error interrupt. (R/W)

IN
TWAI_BUS_STATE_INT_ENA Set this bit to 1 to enable bus state interrupt. (R/W)
IM
EL
PR

25 USB On-The-Go (USB)
25 USB OnTheGo (USB)
25.1 Overview
The ESP32-S3 features a USB On-The-Go peripheral (henceforth referred to as OTG_FS) along with an
integrated transceiver. The OTG_FS can operate as either a USB Host or Device and supports 12 Mbit/s
full-speed (FS) and 1.5 Mbit/s low-speed (LS) data rates of the USB1.1 specification. The Host Negotiation
Protocol (HNP) and the Session Request Protocol (SRP) are also supported.
25.2 Features
RY
25.2.1 General Features
• FS and LS data rates
• HNP and SRP as A-device or B-device
• Dynamic FIFO (DFIFO) sizing
A
• Multiple modes of memory access
– Scatter/Gather DMA mode
– Buffer DMA mode

IN
– Slave mode
• Can choose integrated transceiver or external transceiver

IM
• Utilizing integrated transceiver with USB Serial/JTAG by time-division multiplexing when only integrated
transceiver is used
• Support USB OTG using one of the transceivers while USB Serial/JTAG using the other one when both
integrated transceiver or external transceiver are used
EL
• Can be used as a light sleep wake-up source
25.2.2 Device Mode Features

• Endpoint number 0 always present (bi-directional, consisting of EP0 IN and EP0 OUT)
PR
• Six additional endpoints (endpoint numbers 1 to 6), configurable as IN or OUT
• Maximum of five IN endpoints concurrently active at any time (including EP0 IN)
• All OUT endpoints share a single RX FIFO
• Each IN endpoint has a dedicated TX FIFO
25.2.3 Host Mode Features

• Eight channels (pipes)
– A control pipe consists of two channels (IN and OUT), as IN and OUT transactions must be handled
separately. Only Control transfer type is supported.

– Each of the other seven channels is dynamically configurable to be IN or OUT, and supports Bulk,
Isochronous, and Interrupt transfer types.
• All channels share an RX FIFO, non-periodic TX FIFO, and periodic TX FIFO. The size of each FIFO is
configurable.

25.3.1 Controller Core and Interfaces
A RY
IN
Figure 251. OTG_FS System Architecture
The core part of the OTG_FS peripheral is the USB Controller Core. The controller core has the following
interfaces (see Figure 25-1):
IM
• CPU Interface
Provides the CPU with read/write access to the controller core’s various registers and FIFOs. This interface
is internally implemented as an AHB Slave Interface. The way to access the FIFOs through the CPU
interface is called Slave mode.
EL
• APB Interface
Allows the CPU to control the USB controller core via the USB external controller.
• DMA Interface
Provides the controller core’s internal DMA with read/write access to system memory (e.g., fetching and
PR
writing data payloads when operating in DMA mode). This interface is internally implemented as an AHB
Master interface.
• USB1.1 Interface
This interface is used to connect the controller core to a USB1.1 FS serial transceiver. Aside from USB
OTG, ESP32-S3 also includes a USB Serial/JTAG controller (see Chapter 26 USB Serial/JTAG Controller
(USB_SERIAL_JTAG)). These two USB controllers can utilize the integrated internal transceiver by
time-division multiplexing or one USB controller connects to internal transceiver and the other one
connects to an external transceiver.
When only internal transceiver is used, it is shared by USB OTG and USB Serial/JTAG. In default, internal
transceiver is connected to USB Serial/JTAG. When RTC_CNTL_SW _HW_USB_PHY_SEL_CFG is 0, the
connection of internal transceiver is controlled by efuse bit EFUSE_USB_PHY_SEL. When
EFUSE_USB_PHY_SEL is 0, internal transceiver is connected with USB Serial/JTAG. Otherwise, it is

connected to USB OTG. When RTC_CNTL_SW _HW_USB_PHY_SEL_CFG is 1, the connection switching

is controlled by RTC_CNTL_SW _USB_PHY_SEL_CFG(it has the same meaning with
EFUSE_USB_PHY_SEL).
When both internal transceiver and external transceiver are used, one USB controller select one of
transceivers, the other would select the other transceiver. The specific connection mapping please refer to
Chapter 26 USB Serial/JTAG Controller (USB_SERIAL_JTAG).
• USB External Controller

The USB External Controller is primarily used to control the routing of the USB1.1 FS serial interface to
either the internal or external transceiver. The External Controller can also enable a power saving mode by
gating the controller core’s clock (AHB clock) or powering down the connected SPRAM. Note that this
RY
power saving mode is different for the power savings via SRP.
• Data FIFO RAM Interface

The multiple FIFOs used by the controller core are not actually located within the controller core itself, but
on the SPRAM (Single-Port RAM). FIFOs are dynamically sized, thus are allocated at run-time in the
SPRAM. When the CPU, DMA, or the controller core attempts to read/write to FIFOs, those accesses are
routed through the data FIFO RAM interface.
A
25.3.2 Memory Layout IN
The following diagram illustrates the memory layout of the OTG_FS registers which are used to configure and
control the USB Controller Core. Note that USB External Controller uses a separate set of registers (called wrap
registers).
IM
EL
PR
Figure 252. OTG_FS Register Layout

25.3.2.1 Control & Status Registers
• Global CSRs
These registers are responsible for the configuration/control/status of the global features of OTG_FS (i.e.,
features which are common to both Host and Device modes). These features include OTG control (HNP,
SRP, and A/B-device detection), USB configuration (selecting Host or Device mode and PHY selection),
and system-level interrupts. Software can access these registers whilst in Host or Device modes.
• Host Mode CSRs

These registers are responsible for the configuration/control/status when operating in Host mode, thus
should only be accessed when operating in Host mode. Each channel will have its own set of registers
within the Host mode CSRs.
RY
• Device Mode CSRs
These registers are responsible for the configuration/control/status when operating in Device mode, thus
should only be accessed when operating in Device mode. Each Endpoint will have its own set of registers
within the Device mode CSRs.
• Power and Clock Gating
A
A single register used to control power-down and gate various clocks.
25.3.2.2 FIFO Access

IN
The OTG_FS makes use of multiple FIFOs to buffer transmitted or received data payloads. The number and type
of FIFOs are dependent on Host or Device mode, and the number of channels or endpoints used (see Section
25.3.3). There are two ways to access the FIFOs: DMA mode and Slave mode. When using Slave mode, the
IM
CPU will need to access to these FIFOs by reading and writing to either the DFIFO push/pop regions or the
DFIFO read/write debug region. FIFO access is governed by the following rules:
• Read access to any address in any one of the 4 KB push/pop regions will result in a pop from the shared
RX FIFO.
EL
• Write access to a particular 4 KB push/pop region will result in a push to the corresponding endpoint or
channel’s TX FIFO given that the endpoint is an IN endpoint, or the channel is an OUT channel.
– In Device mode, data is pushed to the corresponding IN endpoint’s dedicated TX FIFO.
– In Host mode, data is pushed to the non-periodic TX FIFO or the periodic TX FIFO depending on
whether the channel is a non-periodic channel, or a periodic channel.
PR
• Access to the 128 KB read/write region will result in direct read/write instead of a push/pop. This is
generally used for debugging purposes only.
Note that pushing and popping data to and from the FIFOs by the CPU is only required when operating in Slave
mode. When operating in DMA mode, the internal DMA will handle all pushing/popping of data to and from the
TX and RX FIFOs.
25.3.3 FIFO and Queue Organization

The FIFOs in OTG_FS are primarily used to hold data packet payloads (the data field of USB Data packets). TX
FIFOs are used to store data payloads that will be transmitted by OUT transactions in Host mode or IN
transactions in Device mode. RX FIFOs are used to store received data payloads of IN transactions in Host mode

or OUT transactions in Device mode. In addition to storing data payloads, RX FIFOs also store a status entry for
each data payload. Each status entry contains information about a data payload such as channel number, byte
count, and validity status. When operating in slave mode, status entries are also used to indicate various channel
events.
The portion of SPRAM that can be used for FIFO allocation has a depth of 256 and a width of 35 bits (32 data
bits plus 3 control bits). The multiple FIFOs used by each channel (in Host mode) or endpoint (in Device mode)
are allocated into the SPRAM and can be dynamically sized.
25.3.3.1 Host Mode FIFOs and Queues
The following FIFOs are used when operating in Host mode (see Figure 25-3):
RY
• Nonperiodic TX FIFO: Stores data payloads of bulk and control OUT transactions for all channels.
• Periodic TX FIFO: Stores data payloads of interrupt or isochronous OUT transactions for all channels.
• RX FIFO: Stores data payloads of all IN transactions, and status entries that are used to indicate size of
data payloads and transaction/channel events such as transfer complete or channel halted.
A
IN
IM
EL
Figure 253. Host Mode FIFOs

PR
In addition to FIFOs, Host mode also contains two request queues used to queue up the various transaction
request from the multiple channels. Each entry in a request queue holds the IN/OUT channel number along with
other information to perform the transaction (such as transaction type). Request queues are also used to queue
other types of requests such as a channel halt request.
Unlike FIFOs, request queues are fixed in size and cannot be accessed directly by software. Rather, once a
channel is enabled, requests will be automatically written to the request queue by the Host core. The order in
which the requests are written into the queue determines the sequence of transactions on the USB.
Host mode contains the following request queues:
• Nonperiodic request queue: Request queue for all non-periodic channels (bulk and control). The queue
has a depth of four entries.

• Periodic request queue: Request queue for all periodic channels (interrupt and isochronous). The queue
has a depth of eight entries.
When scheduling transactions, hardware will execute all requests on the periodic request queue first before
executing requests on the non-periodic request queue.
25.3.3.2 Device Mode FIFOs
A RY
IN
IM
EL
Figure 254. Device Mode FIFOs
The following FIFOs are used when operating in Device mode (See Figure 25-4):
• RX FIFO: Stores data payloads received in Data packet, and status entries (used to indicate size of those
data payloads).
PR
• Dedicated TX FIFO: Each active IN endpoint will have a dedicated TX FIFO used to store all IN data
payloads of that endpoint, regardless of the transaction type (both periodic and non-periodic IN
transactions).
Due to the dedicated FIFOs, Device mode does not use any request queues. Instead, the order of IN
transactions are determined by the Host.
25.3.4 Interrupt Hierarchy

OTG_FS provides a single interrupt line which can be routed via the interrupt matrix to one of the CPUs. The
interrupt signal can be unmasked by setting USB_GLBLINTRMSK. The OTG_FS interrupt is an OR of all bits in
the USB_GINTSTS_REG register, and the bits in USB_GINTSTS_REG can be unmasked by setting the
corresponding bits in the USB_GINTMSK_REG register. USB_GINTSTS_REG contains system level interrupts,

and also specific bits for Host or Device mode interrupts, and OTG specific interrupts. OTG_FS interrupt sources
are organized as Figure 25-5 shows.
The following bits of the USB_GINTSTS_REG register indicate an interrupt source lower in the hierarchy:
• USB_PRTINT indicates that the Host port has a pending interrupt. The USB_HPRT_REG register indicates
the interrupt source.
• USB_HCHINT indicates that one or more Host channels have a pending interrupt. Read the
USB_HAINT_REG register to determine which channel(s) have a pending interrupt, then read the pending
channel’s USB_HCINTn_REG register to determine the interrupt source.
• USB_OEPINT indicates that one or more OUT endpoints have a pending interrupt. Read the
USB_DAINT_REG register to determine which OUT endpoint(s) have a pending interrupt, then read the
RY
USB_DOEPINTn_REG register to determine the interrupt source.
• USB_IEPINT indicates that one or more IN endpoints have a pending interrupt. Read the
USB_DAINT_REG register to determine which IN endpoint(s) are pending, then read the pending IN
endpoint’s USB_DIEPINTn_REG register to determine the interrupt source.
• USB_OTGINT indicates an On-The-Go event has triggered an interrupt. Read the USB_GOTGINT_REG
A
register to determine which OTG event(s) triggered the interrupt.
IN
IM
EL
PR
Figure 255. OTG_FS Interrupt Hierarchy

25.3.5 DMA Modes and Slave Mode

USB On-The-Go supports three ways to access memory: Scatter/Gather DMA mode, Buffer DMA mode, and
Slave mode.
25.3.5.1 Slave Mode
When operating in Slave mode, all data payloads must be pushed/popped to and from the FIFOs by the
CPU.
• When transmitting a packet using IN endpoints or OUT channels, the data payload must be pushed into
the corresponding endpoint or channel’s TX FIFO.
RY
• When receiving a packet, the packet’s status entry must first be popped off the RX FIFO by reading
USB_GRXSTSP_REG. The status entry should be used to determine the length of the packet’s payload (in
bytes). The corresponding number of bytes must then be manually popped off the RX FIFO by reading from
the RX FIFO’s memory region.
25.3.5.2 Buffer DMA Mode
A
Buffer mode is similar to Slave mode but utilizes the internal DMA to push and pop data payloads to the
FIFOs.
IN
• When transmitting a packet using IN endpoints or OUT channels, the data payload’s address in memory
should be written to the USB_HCDMAn_REG (in Host mode) or USB_DOEPDMAn_REG (in Device mode)
registers. When the endpoint or channel is enabled, the internal DMA will push the data payload from
memory into the TX FIFO of the channel or endpoint.
IM
• When receiving a packet using OUT endpoints or IN channels, the address of an empty buffer in memory
should be written to the USB_HCDMAn_REG (in Host mode) or USB_DOEPDMAn_REG (in Device mode)
registers. When the endpoint or channel is enabled, the internal DMA will pop the data payload from RX
FIFO into the buffer.
EL
25.3.5.3 Scatter/Gather DMA Mode

PR
Figure 256. Scatter/Gather DMA Descriptor List

When operating in Scatter/Gather DMA mode, buffers containing data payloads can be scattered throughout
memory. Each endpoint or channel will have a contiguous DMA descriptor list, where each descriptor contains a
32-bit pointer to the data payload or buffer and a 32-bit buffer descriptor (BufferStatus Quadlet). The data
payloads and buffers can correspond to a single transaction (i.e., < 1 MPS bytes) or an entire transfer (> 1 MPS
bytes). (MPS: maximum packet size) The list is implemented as a ring buffer meaning that the DMA will return to
the first entry when it encounters the last entry on the list.
• When transmitting a transfer/transaction using IN endpoints or OUT channels, the DMA will gather the data
payloads from the multiple buffers and push them into a TX FIFO.
• When receiving a transfer/transaction using OUT endpoints or IN channels, the DMA will pop the received
data payloads from the RX FIFO and scatter them to the multiple buffers pointed to by the DMA list entries.
RY
25.3.6 Transaction and Transfer Level Operation
When operating in either Host or Device mode, communication can operate either at the transaction level or the
transfer level.
25.3.6.1 Transaction and Transfer Level in DMA Mode
A
When operating at the transfer level in DMA Host mode, software is interrupted only when a channel has been
halted. Channels are halted when their programmed transfer size has completed successfully, has received a
IN
STALL, or if there are excessive transaction errors (i.e., 3 consecutive transaction errors). When operating in DMA
Device mode, all errors are handled by the controller core itself.
When operating at the transaction level in DMA mode, the transfer size is set to the size of one data packet
(either a maximum packet size or a short packet size).
IM
25.3.6.2 Transaction and Transfer Level in Slave Mode
When operating at the transaction level in Slave Mode, transfers are handled one transaction at a time. Each
data payload should correspond to a single data packet, and software must determine whether a retry of the
EL
transaction is necessary based on the handshake response received on the USB (e.g., ACK or NAK).
The following table describes transaction level operation in Slave mode for both IN and OUT transactions.
PR

Table 251. IN and OUT Transactions in Slave Mode
Host Mode Device Mode

OUT Transactions
1. Software specifies the size of the data packet 1. Software specifies the expected size of
and the number of data packets (1 data the data packet (1 MPS) and the num-
packet) in the USB_HCTSIZn_REG regis- ber of data packets (1 data packet) in the
ter, enables the channel, then copies the USB_DIEPTSIZn_REG register. Once the
packet’s data payload into the TX FIFO. endpoint is enabled, it will wait for the host
2. When the last DWORD of the data payload to transmit a packet to it.
RY
has been pushed, the controller core will au- 2. The received packet will be pushed into the
tomatically write a request into the appropri- RX FIFO along with a packet status entry.
ate request queue. 3. If the transaction was unsuccessful (e.g., due
3. If the transaction was successful, the to a full RX FIFO), the endpoint will automat-
USB_XFERCOMPL interrupt will be gener- ically NAK the incoming packet.
ated. If the transaction was unsuccessful,
A
an error interrupt (e.g. USB_H_NACKn) will
occur. IN
IN Transactions
1. Software specifies the expected size of the 1. Software specifies the size of the data packet
data packet and the number of packets (1 and the number of data packets (1 data
IM
data packet) in the USB_HCTSIZn_REG reg- packet) in the USB_DIEPTSIZn_REG regis-
ister, then enables the channel. ter. Once the endpoint is enabled, it will wait
2. The controller core will automatically write a for the host to read the packet.
request into the appropriate request queue. 2. When the packet has been transmitted, the
3. If the transaction was successful, the re- USB_XFERCOMPL interrupt will be gener-
EL
ceived data along with a status entry should ated.

be written to the RX FIFO. If the transaction
was unsuccessful, an error interrupt (e.g.,
USB_H_NACKn) will occur.
PR
When operating at the transfer level in Slave mode, one or more transaction-level operations can be pipelined
thus being analogous to transfer level operation in DMA mode. Within pipelined transactions, multiple packets of
the same transfer can be read/written from the FIFOs in single instance, thus preventing the need for interrupting
the software on a per-packet basis.
Operating on a transfer level in Slave mode is similar to operating on the transaction-level, except the transfer size
and packet count for each transfer in the USB_HCTSIZn_REG or USB_DIEPTSIZn_REG register will need to be
set to reflect the entire transfer. After the channel or endpoint is enabled, multiple data packets worth of payloads
should be written to or read from the TX or RX FIFOs respectively (given that there is enough space or enough
data).

25.4 OTG
USB OTG allows OTG devices to act in the USB Host role or the USB Device role. Thus, OTG devices will
typically have a Mini-AB or Micro-AB receptacle so that it can receive an A-plug or B-plug. OTG devices will
become either an A-device or a B-device depending on whether an A-plug or a B-plug is connected.
• A-device defaults to the Host role (A-Host) whilst B-device defaults to the Device role (B-Peripheral).
• A-device and B-device may exchange roles by using the Host Negotiation Protocol (HNP), thus becoming
A-peripheral and B-Host.
• A-device can turn off Vbus to save power. B-device can then wake up the A-device by requesting it to turn
on Vbus and start a new session. This mechanism is called session request protocol (SRP).
RY
• A-device always powers Vbus even if it is an A-peripheral.
OTG devices are able to determine whether they are connected to an A plug or a B plug using the ID pin of the
plugs. The ID pin in A-plugs are pulled to ground whilst B-plugs have the ID pin left floating.
25.4.1 OTG Interface
A
The OTG_FS supports both the Session Request Protocol (SRP) and Host Negotiation Protocol (HNP) of the
OTG Revision 1.3 specification. The OTG_FS controller core interfaces with the transceiver (internal or external)
IN
using the UTMI+ OTG interface. The UTMI+ OTG interface allows the controller core to manipulate the
transceiver for OTG purposes (e.g., enabling/disabling pull-ups and pull-downs in HNP), and also allows the
transceiver to indicate OTG related events. If an external transceiver is used instead, the UTMI+ OTG interface
signals will be routed to the ESP32-S3’s GPIOs instead through GPIO Matrix, please refer to Chapter 5 IO MUX
and GPIO Matrix (GPIO, IO MUX). The UTMI+ OTG interface signals are described in Table 25-2.
IM
Table 252. UTMI OTG Interface
Signal Name I/O Description

Mini A/B Plug Indicator. Indicates whether the connected plug is mini-A or
EL
mini-B. Valid only when usb_otg_idpullup is sampled asserted.

usb_otg_iddig_in I
1’b0: Mini-A connected
1’b1: Mini-B connected
A-Peripheral Session Valid. Indicates if the voltage Vbus is at a valid level
for an A-peripheral session. The comparator thresholds are:
usb_otg_avalid_in I
PR
1’b0: Vbus <0.8 V

1’b1: Vbus = 0.2 V to 2.0 V
B-Peripheral Session Valid. Indicates if the voltage Vbus is at a valid level
for a B-peripheral session. The comparator thresholds are:
usb_otg_bvalid_in I
1’b0: Vbus <0.8 V
1’b1: Vbus = 0.8 V to 4 V
Vbus Valid. Indicates if the voltage Vbus is valid for A/B-device/peripheral
operation. The comparator thresholds are:
usb_otg_vbusvalid_in I
1’b0: Vbus <4.4 V
1’b1: Vbus >4.75 V

Signal Name I/O Description

B-device Session End. Indicates if the voltage Vbus is below the B-device
Session End threshold. The comparator thresholds are:
usb_srp_sessend_in I
1’b0: Vbus >0.8 V
1’b1: Vbus <0.2 V
Analog ID input Sample Enable. Enables sampling the analog ID line.
usb_otg_idpullup O
1’b0: ID pin sampling disabled
1’b1: ID pin sampling enabled
D+ Pull-down Resistor Enable. Enables the 15 kΩ pull-down resistor on
usb_otg_dppulldown O
the D+ line.
D- Pull-down Resistor Enable. Enables the 15 kΩ pull-down resistor on
RY
usb_otg_dmpulldown O
the D- line.
Drive Vbus. Enables driving Vbus to 5 V.
usb_otg_drvvbus O 1’b0: Do not drive Vbus
1’b1: Drive Vbus
Vbus Input Charge Enable. Directs the PHY to charge Vbus.
usb_srp_chrgvbus O 1’b0: Do not charge Vbus through a resistor
A
1’b1: Charge Vbus through a resistor (must be active for at least 30 ms)
Vbus Input Discharge Enable. Directs the PHY to discharge Vbus.
IN
1’b0: Do not discharge Vbus through a resistor.
usb_srp_dischrgvbus O
1’b1: Discharge Vbus through a resistor (must be active for at least 50
ms).
IM
25.4.2 ID Pin Detection
Bit USB_CONIDSTS in register USB_GOTGCTL_REG indicates whether the OTG controller is an A-device (1’b0)
or a B-device (1’b1). The USB_CONIDSTSCHNG interrupt will trigger whenever there is a change to
USB_CONIDSTS (i.e., when a plug is connected or disconnected).
EL
25.4.3 Session Request Protocol (SRP)
25.4.3.1 ADevice SRP
Figure 25-7 illustrates the flow of SRP when the OTG_FS is acting as an A-device (i.e., default host and the
PR
device that powers Vbus).
1. To save power, the application suspends and turns off port power when the bus is idle by writing to the
Port Suspend (USB_PRTSUSP to 1’b0) and Port Power (USB_PRTPWR to 1’b0) bits in the Host Port
Control and Status register.
2. PHY indicates port power off by deasserting the usb_otg_vbusvalid_in signal.
3. The A-device must detect SE0 for at least 2 ms to start SRP when Vbus power is off.
4. To initiate SRP, the B-device turns on its data line pull-up resistor for 5 to 10 ms. The OTG_FS core detects
data-line pulsing.
5. The device drives Vbus above the A-device session valid (2.0 V minimum) for Vbus pulsing. The OTF_FS
core interrupts the application on detecting SRP. The Session Request Detected bit (USB_SESSREQINT) is
set in Global Interrupt Status register.

RY
Figure 257. ADevice SRP
6. The application must service the Session Request Detected interrupt and turn on the Port Power bit by
writing the Port Power bit in the Host Port Control and Status register. The PHY indicates port power-on by
asserting usb_otg_vbusvalid_in signal.
A
7. When the USB is powered, the B-device connects, completing the SRP process.
25.4.3.2 BDevice SRP

IN
Figure 25-8 illustrates the flow of SRP when the OTG_FS is acting as a B-device (i.e., does not power
Vbus).
IM
EL
PR
Figure 258. BDevice SRP
1. To save power, the host (A-device) suspends and turns off port power when the bus is idle. PHY indicates
port power off by deasserting the usb_otg_vbusvalid_in signal. The OTG_FS core sets the Early Suspend
bit in the Core Interrupt register (USB_ERLYSUSP interrupt) after detecting 3 ms of bus idleness. Following
this, the OTF_FS core sets the USB Suspend bit (USB_USBSUSP) in the Core Interrupt register. The PHY

indicates the end of the B-device session by deasserting the usb_otg_bvalid_in signal.
2. The OTG_FS core asserts the usb_otg_dischrgvbus signal to indicate to the PHY to speed up Vbus
discharge.
3. The PHY indicates the session’s end by asserting the usb_otg_sessend_in signal. This is the initial condition
for SRP. The OTG_FS core requires 2 ms of SE0 before initiating SRP. For a USB 1.1 full-speed serial
transceiver, the application must wait until Vbus discharges to 0.2 V after USB_BSESVLD is deasserted.
4. The application waits for 1.5 seconds (TB_SE0_SRP time) before initiating SRP by writing the Session
Request bit (USB_SESREQ) in the OTG Control and Status register. The OTG_FS core performs data-line
pulsing followed by Vbus pulsing.
5. The host (A-device) detects SRP from either the data-line or Vbus pulsing, and turns on Vbus. The PHY
RY
indicates Vbus power-on by asserting usb_otg_vbusvalid_in.
6. The OTG_FS core performs Vbus pulsing by asserting usb_srp_chrgvbus. The host (A-device) starts a new
session by turning on Vbus, indicating SRP success. The OTG_FS core interrupts the application by setting
the Session Request Success Status Change bit (USB_SESREQSC) in the OTG Interrupt Status register.
The application reads the Session Request Success bit in the OTG Control and Status register.
A
7. When the USB is powered, the OTG_FS core connects, completing the SRP process.
25.4.4 Host Negotiation Protocol (HNP)
25.4.4.1 ADevice HNP

IN
Figure 25-9 illustrates the flow of HNP when the OTG_FS is acting as an A-device.
IM
EL
PR
Figure 259. ADevice HNP
1. The OTG_FS core sends the B-device a SetFeature b_hnp_enable descriptor to enable HNP support. The
B-device’s ACK response indicates that the B-device supports HNP. The application must set Host Set
HNP Enable bit (USB_HSTSETHNPEN) in the OTG Control and Status register to indicate to the OTG_FS
core that the B-device supports HNP.
2. When it has finished using the bus, the application suspends by writing the Port Suspend bit
(USB_PRTSUSP) in the Host Port Control and Status register.
3. When the B-device observes a USB suspend, it disconnects, indicating the initial condition for HNP. The
B-device initiates HNP only when it must switch to the host role; otherwise, the bus continues to be

suspended. The OTG_FS core sets the Host Negotiation Detected interrupt (USB_HSTNEGDET) in the
OTG Interrupt Status register, indicating the start of HNP. The OTG_FS core deasserts the
usb_otg_dppulldown and usb_otg_dmpulldown signals to indicate a device role. The PHY enables the D+
pull-up resistor, thus indicates a connection for the B-device. The application must read the Current Mode
bit (USB_CURMOD_INT) in the OTG Control and Status register to determine Device mode operation.
4. The B-device detects the connection, issues a USB reset, and enumerates the OTG_FS core for data traffic.
5. The B-device continues the host role, initiating traffic, and suspends the bus when done. The OTG_FS core
sets the Early Suspend bit (USB_ERLYSUSP) in the Core Interrupt register after detecting 3 ms of bus
idleness. Following this, the OTG_FS core sets the USB Suspend bit (USB_USBSUSP) in the Core Interrupt
register.
RY
6. In Negotiated mode, the OTG_FS core detects the suspend, disconnects, and switches back to the host
role. The OTG_FS core asserts the usb_otg_dppulldown and usb_otg_dmpulldown signals to indicate its
assumption of the host role.
7. The OTG_FS core sets the Connector ID Status Change interrupt (USB_CONIDSTS) in the OTG Interrupt
Status register. The application must read the connector ID status in the OTG Control and Status register to
A
determine the OTG_FS core’s operation as an A-device. This indicates the completion of HNP to the
application. The application must read the Current Mode bit in the OTG Control and Status register to
determine Host mode operation.
IN
8. The B-device connects, completing the HNP process.
25.4.4.2 BDevice HNP

IM
Figure 25-10 illustrates the flow of HNP when the OTG_FS is acting as an B-device.
EL
PR
Figure 2510. BDevice HNP
1. The A-device sends the SetFeature b_hnp_enable descriptor to enable HNP support. The OTG_FS core’s
ACK response indicates that it supports HNP. The application must set the Device HNP Enable bit
(USB_DEVHNPEN) in the OTG Control and Status register to indicate HNP support. The application sets
the HNP Request bit (USB_DEVHNPEN) in the OTG Control and Status register to indicate to the OTG_FS
core to initiate HNP.
2. When A-device has finished using the bus, it suspends the bus.

(a) The OTG_FS core sets the Early Suspend bit (USB_ERLYSUSP) in the Core Interrupt register after 3
ms of bus idleness. Following this, the OTG_FS core sets the USB Suspend bit (USB_USBSUSP) in
the Core Interrupt register. The OTG_FS core disconnects and the A-device detects SE0 on the bus,
indicating HNP.
(b) The OTG_FS core asserts the usb_otg_dppulldown and usb_otg_dmpulldown signals to indicate its
assumption of the host role.
(c) The A-device responds by activating its D+ pull-up resistor within 3 ms of detecting SE0. The
OTG_FS core detects this as a connect.
(d) The OTG_FS core sets the Host Negotiation Success Status Change interrupt in the OTG Interrupt
Status register (USB_CONIDSTS), indicating the HNP status. The application must read the Host
RY
Negotiation Success bit (USB_HSTNEGSCS) in the OTG Control and Status register to determine
host negotiation success. The application must read the Current Mode bit (USB_CURMOD_INT) in
the Core Interrupt register to determine Host mode operation.
3. Program the USB_PRTPWR bit to 1’b1. This drives Vbus on the USB.
4. Wait for the USB_PRTCONNDET interrupt. This indicates that a device is connected to the port.
A
5. The application sets the reset bit (USB_PRTRST) and the OTG_FS core issues a USB reset and
enumerates the A-device for data traffic.
6. Wait for the USB_PRTENCHNG interrupt.

IN
7. The OTG_FS core continues the host role of initiating traffic, and when done, suspends the bus by writing
the Port Suspend bit (USB_PRTSUSP) in the Host Port Control and Status register.
IM
8. In Negotiated mode, when the A-device detects a suspend, it disconnects and switches back to the host
role. The OTG_FS core deasserts the usb_otg_dppulldown and usb_otg_dmpulldown signals to indicate
the assumption of the device role.
9. The application must read the Current Mode bit (USB_CURMOD_INT) in the Core Interrupt register to
determine the Host mode operation.
EL
10. The OTG_FS core connects, completing the HNP process.

PR

26 USB Serial/JTAG Controller (USB_SERIAL_JTAG)

The ESP32-S3 contains an USB Serial/JTAG Controller. This unit can be used to program the SoC’s flash, read
program output, as well as attach a debugger to the running program. All of these are possible for any computer
with a USB host (’host’ in the rest of this text) without any active external components.
26.1 Overview
The workflow of developing on previous versions of Espressif chips generally use two methods of communication
with the SoC: one is a serial port and the other is the JTAG debugging port. The serial port is a two-wire interface
traditionally used to push new firmware-under-development to the chip (’programming’). As most modern
RY
computers do not have a compatible serial port anymore, interfacing to this serial port requires an USB-to-serial
converter IC or board. After programming is finished, the port is used to monitor any debugging output from the
program, in order to keep an eye on the general state of program execution. When program execution is not
what the developer expects (i.e. the program crashes), the JTAG debugging port is then used to inspect the
state of the program and its variables and set break- and watchpoints. This requires interfacing with the JTAG
debug port, which generally requires an external JTAG adapter.
A
All these external interfaces take up six pins in total, which cannot be used for other purposes while debugging.
Especially on devices with small packages, like the ESP32-S3, not being able to use these pins can be limiting to
a design.
IN
In order to alleviate this issue, as well as to negate the need for external devices, the ESP32-S3 contains an USB
Serial/JTAG Controller, which integrates the functionality of both an USB-to-serial converter as well as those of an
USB-to-JTAG adapter. As this device directly interfaces to an external USB host using only the two data lines
IM
required by USB Specification 1.1, debugging the ESP32-S3 only requires two pins to be dedicated to this
functionality.
26.2 Features
EL
• USB Full-speed device.
• Can be configured to either use internal USB PHY of ESP32-S3 or external PHY via GPIO matrix.
• Fixed function device, hardwired for CDC-ACM (Communication Device Class - Abstract Control Model)
and JTAG adapter functionality.
PR
• 2 OUT Endpoints, 3 IN Endpoints in addition to Control Endpoint 0; Up to 64-byte data payload size.
• Internal PHY, so no or very few external components needed to connect to a host computer.
• CDC-ACM adherent serial port emulation is plug-and-play on most modern OSes.
• JTAG interface allows fast communication with CPU debug core using a compact representation of JTAG
instructions.
• CDC-ACM supports host controllable chip reset and entry into download mode.
As shown in Figure 26-1, the USB Serial/JTAG Controller consists of an USB PHY, a USB device interface, a
JTAG command processor and a response capture unit, as well as the CDC-ACM registers. The PHY and part of
the device interface are clocked from a 48 MHz clock derived from the main PLL, the rest of the logic is clocked
from APB_CLK. The JTAG command processor is connected to the JTAG debug unit of the main processor; the

RY
Figure 261. USB Serial/JTAG High Level Diagram
CDC-ACM registers are connected to the APB bus and as such can be read from and written to by software
running on the main CPU.
A
Note that while the USB Serial/JTAG device is a USB 2.0 device, it only supports Full-speed (12 Mbps) and not
the High-speed (480 Mbps) mode the USB2.0 standard introduced.
Figure 26-2 shows the internal details of the USB Serial/JTAG controller on the USB side. The USB Serial/JTAG
IN
Controller consists of an USB 2.0 Full Speed device. It contains a control endpoint, a dummy interrupt endpoint,
two bulk input endpoints as well as two bulk output endpoints. Together, these form an USB Composite device,
which consists of an CDC-ACM USB class device as well as a vendor-specific device implementing the JTAG
interface. On the SoC side, the JTAG interface is directly connected to the debugging interface of the two Xtensa
IM
CPUs, allowing debugging of programs running on that core. Meanwhile, the CDC-ACM device is exposed as a
set of registers, allowing a program on the CPU to read and write from this. Additionally, the ROM startup code of
the SoC contains code allowing the user to reprogram attached flash memory using this interface.
EL
PR

A RY
Figure 262. USB Serial/JTAG Block Diagram

IN
The USB Serial/JTAG Controller interfaces with an USB host processor on one side, and the CPU debug
IM
hardware as well as the software running on the USB port on the other side.
26.3.1 USB Serial/JTAG host connection

As shown in Figure 26-3, interfacing with an USB host connection on the physical level is done with a PHY. The
ESP32-S3 has an internal PHY, which is shared between the USB-OTG and the USB Serial/JTAG hardware.
EL
Either one of these can use the internal PHY. Optionally, the signals from the unit not using the internal PHY can
be routed out via the GPIO matrix to IO pads. Adding an external USB PHY to these pads results in a second
usable USB port.
The actual routing from USB Serial/JTAG Controller and USB-OTG to internal and external PHYs initially is
PR
decided using eFuses as described in Table 26-6. This configuration can later be modified using register
writes.

A RY
IN
Figure 263. USB Serial/JTAG and USBOTG Internal/External PHY Routing Diagram
IM
The CPU JTAG signals can be routed to the USB Serial/JTAG Controller or external GPIO pads using eFuses and
when the user program has started, software control as well. At that time, the JTAG signals from the USB
Serial/JTAG can also be routed to the GPIO matrix. This allows debugging a secondary SoC via JTAG using the
EL
ESP32-S3 USB Serial/JTAG Controller.

PR

A RY
Figure 264. JTAG Routing Diagram
IN
26.3.2 CDCACM USB Interface Functional Description
The CDC-ACM interface adheres to the standard USB CDC-ACM class for serial port emulation. It contains a
IM
dummy interrupt endpoint (which will never send any events, as they are not implemented nor needed) and a Bulk
IN as well as a Bulk OUT endpoint for the host’s received and sent serial data respectively. These endpoints can
handle 64-byte packets at a time, allowing for high throughput. As CDC-ACM is a standard USB device class, a
host generally does not need any special installation procedures for it to function: when the USB debugging
device is properly connected to a host, the operating system should show a new serial port moments later.
EL
The CDC-ACM interface accepts the following standard CDC-ACM control requests:
Table 261. Standard CDCACM Control Requests
Command Action
PR
SEND_BREAK Accepted but ignored (dummy)

SET_LINE_CODING Accepted but ignored (dummy)
GET_LINE_CODING Always returns 9600 baud, no parity, 8 databits, 1 stopbit
SET_CONTROL_LINE_STATE Set the state of the RTS/DTR lines, see Table 26-2
Aside from general-purpose communication, the CDC-ACM interface also can be used to reset the ESP32-S3
and optionally make it go into download mode in order to flash new firmware. This is done by setting the RTS
and DTR lines on the virtual serial port.

Table 262. CDCACM Settings with RTS and DTR
RTS DTR Action

0 0 Clear download mode flag
0 1 Set download mode flag
1 0 Reset ESP32-S3
1 1 No action
Note that if the download mode flag is set when the ESP32-S3 is reset, the ESP32-S3 will reboot into download
mode. When this flag is cleared and the chip is reset, the ESP32-S3 will boot from flash. For specific sequences,
please refer to Section 26.4. All these functions can also be disabled by programming various eFuses, please
RY
refer to Chapter 4 eFuse Controller for more details.
26.3.3 CDCACM Firmware Interface Functional Description

As the USB Serial/JTAG Controller is connected to the internal APB bus of the ESP32-S3, the CPU can interact
with it. This is mainly used to read and write data from and to the virtual serial port on the attached host.
A
USB CDC-ACM serial data is sent to and received from the host in packets of 0 to 64 bytes in size. When
enough CDC-ACM data has accumulated in the host, the host will send a packet to the CDC-ACM receive
endpoint, and when the USB Serial/JTAG Controller has a free buffer, it will accept this packet. Conversely, the
IN
host will check periodically if the USB Serial/JTAG Controller has a packet ready to be sent to the host, and if so,
receive this packet.
Firmware can get notified of new data from the host in one of two ways. First of all, the
IM
USB_SERIAL_JTAG_SERIAL_OUT_EP_DATA_AVAIL bit will remain set to 1 as long as there still is unread host
data in the buffer. Secondly, the availability of data will trigger the
USB_SERIAL_JTAG_SERIAL_OUT_RECV_PKT_INT interrupt as well.
When data is available, it can be read by firmware by repeatedly reading bytes from
USB_SERIAL_JTAG_EP1_REG. The amount of bytes to read can be determined by checking the
EL
USB_REG_SERIAL_OUT_EP_DATA_AVAIL bit after reading each byte to see if there is more data to read. After all
data is read, the USB debug device is automatically readied to receive a new data packet from the host.
When the firmware has data to send, it can do so by putting it in the send buffer and triggering a flush, allowing
the host to receive the data in a USB packet. In order to do so, there needs to be space available in the send
PR
buffer. Firmware can check this by reading USB_REG_SERIAL_IN_EP_DATA_FREE; a 1 in this register field
indicates there is still free room in the buffer. While this is the case, firmware can fill the buffer by writing bytes to
the USB_SERIAL_JTAG_EP1_REG register.
Writing the buffer doesn’t immediately trigger sending data to the host. This does not happen until the buffer is
flushed; a flush causes the entire buffer to be readied for reception by the USB host at once. A flush can be
triggered in two ways: after the 64th byte is written to the buffer, the USB hardware will automatically flush the
buffer to the host. Alternatively, firmware can trigger a flush by writing a 1 to
USB_REG_SERIAL_WR_DONE.
Regardless of how a flush is triggered, the send buffer will be unavailable for firmware to write into until it has
been fully read by the host. As soon as this happens, the USB_SERIAL_JTAG_SERIAL_IN_EMPTY_INT interrupt
will be triggered, indicating the send buffer can receive another 64 bytes.

26.3.4 USBtoJTAG Interface

The USB-to-JTAG interface uses a vendor-specific class for its implementation. It consists of two endpoints, one
to receive commands and one to send responses. Additionally, some less time-sensitive commands can be
given as control requests.
26.3.5 JTAG Command Processor

Commands from the host to the JTAG interface are interpreted by the JTAG command processor. Internally, the
JTAG command processor implements a full four-wire JTAG bus, consisting of the TCK, TMS and TDI output
lines to the Xtensa CPUs, as well as the TDO line signalling back from the CPU to the JTAG response capture
unit. These signals adhere to the IEEE 1149.1 JTAG standards. Additionally, there is a SRST line to reset the
RY
SoC.
The JTAG command processor parses each received nibble (4-bit value) as a command. As USB data is
received in 8-bit bytes, this means each byte contains two commands. The USB command processor will
execute high-nibble first and low-nibble second. The commands are used to control the TCK, TMS, TDI, and
SRST lines of the internal JTAG bus, as well as signal the JTAG response capture unit that the state of the TDO
A
line (which is driven by the CPU debug logic) needs to be captured.
Of this internal JTAG bus, TCK, TMS, TDI and TDO are connected directly to the JTAG debugging logic of the
Xtensa CPUs. SRST is connected to the reset logic of the digital circuitry in the SoC and a high level on this line
IN
will cause a digital system reset. Note that the USB Serial/JTAG Controller itself is not affected by SRST.
A nibble can contain the following commands:
Table 263. Commands of a Nibble

IM
bit 3 2 1 0
CMD_CLK 0 cap tms tdi
CMD_RST 1 0 0 srst
CMD_FLUSH 1 0 1 0
EL
CMD_RSV 1 0 1 1
CMD_REP 1 1 R1 R0
• CMD_CLK will set the TDI and TMS to the indicated values and emit one clock pulse on TCK. If the CAP bit
is 1, it will also instruct the JTAG response capture unit to capture the state of the TDO line. This instruction
PR
forms the basis of JTAG communication.
• CMD_RST will set the state of the SRST line to the indicated value. This can be used to reset the
ESP32-S3.
• CMD_FLUSH will instruct the JTAG response capture unit to flush the buffer of all bits it collected so the
host is able to read them. Note that in some cases, a JTAG transaction will end in an odd number of
commands and as such an odd number of nibbles. In this case, it is allowable to repeat the CMD_FLUSH
to get an even number of nibbles fitting an integer number of bytes.
• CMD_RSV is reserved in the current implementation. The ESP32-S3 will ignore this command when it
receives it.
• CMD_REP repeats the last (non-CMD_REP) command a certain number of times. It’s intended goal is to
compress command streams which repeat the same CMD_CLK instruction multiple times. A command like

CMD_CLK can be followed by multiple CMD_REP commands. The number of repetitions done by one
CMD_REP can be expressed as no_repetitions = (R1 × 2 + R0) × (4cmd_rep_count ), where
cmd_rep_count is how many CMD_REP instructions went directly before it. Note that the CMD_REP is
only intended to repeat a CMD_CLK command. Specifically, using it on a CMD_FLUSH command may
lead to an unresponsive USB device, needing an USB reset to recover.
26.3.6 USBtoJTAG Interface: CMD_REP usage example

Here is a list of commands as an illustration of the use of CMD_REP. Note each command is a nibble; in this
example the bytewise command stream would be 0x0D 0x5E 0xCF.
1. 0x0 (CMD_CLK: cap=0, tdi=0, tms=0)
RY
2. 0xD (CMD_REP: R1=0, R0=1)
3. 0x5 (CMD_CLK: cap=1, tdi=0, tms=1)
4. 0xE (CMD_REP: R1=1, R0=0)
5. 0xC (CMD_REP: R1=0, R0=0)
A
6. 0xF (CMD_REP: R1=1, R0=1)
This is what happens at every step: IN

1. TCK is clocked with the TDI and TMS lines set to 0. No data is captured.
2. TCK is clocked another (0 × 2 + 1) × (42 ) = 1 time with the same settings as step 1.
3. TCK is clocked with the TDI and TMS lines set to 0. Data on the TDO line is captured.
IM
4. TCK is clocked another (1 × 2 + 0) × (40 ) = 2 times with the same settings as step 3.
5. Nothing happens: (0 × 2 + 0) × (41 ) = 0. Note that this does increase cmd_rep_count for the next step.
6. TCK is clocked another (1 × 2 + 1) × (42 ) = 48 times with the same settings as step 3.
In other words: This example stream has the same net effect as command 1 twice, then repeating command 3
EL
for 51 times.
26.3.7 USBtoJTAG Interface: Response Capture Unit

The response capture unit reads the TDO line of the internal JTAG bus and captures its value when the command
PR
parser executes a CMD_CLK with cap=1. It puts this bit into an internal shift register, and writes a byte into the
USB buffer when 8 bits have been collected. Of these 8 bits, the least significant one is the one that is read from
TDO the earliest.
As soon as either 64 bytes (512 bits) have been collected or a CMD_FLUSH command is executed, the response
capture unit will make the buffer available for the host to receive. Note that the interface to the USB logic is
double-buffered. This way, as long as USB throughput is sufficient, the response capture unit can always receive
more data: while one of the buffers is waiting to be sent to the host, the other one can receive more data. When
the host has received data from its buffer and the response capture unit flushes its buffer, the two buffers change
position.
This also means that a command stream can cause at most 128 bytes of capture data to be generated (less if
there are flush commands in the stream) without the host acting to receive the generated data. If more data is

generated anyway, the command stream is paused and the device will not accept more commands before the
generated capture data is read out.
Note that in general, the logic of the response capture unit tries not to send zero-byte responses: for instance,
sending a series of CMD_FLUSH commands will not cause a series of zero-byte USB responses to be sent.
However, in the current implementation, some zero-byte responses may be generated in extraordinary
circumstances. It’s recommended to ignore these responses.
26.3.8 USBtoJTAG Interface: Control Transfer Requests

Aside from the command processor and the response capture unit, the USB-to-JTAG interface also understands
some control requests, as documented in the table below:
RY
Table 264. USBtoJTAG Control Requests
bmRequestType bRequest wValue wIndex wLength Data

01000000b 0 (VEND_JTAG_SETDIV) [divider] interface 0 None
01000000b 1 (VEND_JTAG_SETIO) [iobits] interface 0 None
11000000b 2 (VEND_JTAG_GETTDO) 0 interface 1 [iostate]
A
10000000b 6 (GET_DESCRIPTOR) 0x2000 0 256 [jtag cap desc]
IN
• VEND_JTAG_SETDIV sets the divider used. This directly affects the duration of a TCK clock pulse. The
TCK clock pulses are derived from APB_CLK, which is divided down using an internal divider. This control
request allows the host to set this divider. Note that on startup, the divider is set to 2, meaning the TCK
clock rate will generally be 40 MHz.
IM
• VEND_JTAG_SETIO can bypass the JTAG command processor to set the internal TDI, TDO, TMS and
SRST lines to given values. These values are encoded in the wValue field in the format of 11’b0, srst, trst,
tck, tms, tdi.
• VEND_JTAG_GETTDO can bypass the JTAG response capture unit to read the internal TDO signal directly.
EL
This request returns one byte of data, of which the least significant bit represents the status of the TDO line.
• GET_DESCRIPTOR is a standard USB request, however it can also be used with a vendor-specific wValue
of 0x2000 to get the JTAG capabilities descriptor. This returns a certain amount of bytes representing the
following fixed structure, which describes the capabilities of the USB-to-JTAG adapter. This structure
allows host software to automatically support future revisions of the hardware without needing an update.
PR
The JTAG capabilities descriptor of the ESP32-S3 is as follows. Note that all 16-bit values are little-endian.
Table 265. JTAG Capabilities Descriptor
Byte Value Description

0 1 JTAG protocol capabilities structure version
1 10 Total length of JTAG protocol capabilities
2 1 Type of this struct: 1 for speed capabilities struct
3 8 Length of this speed capabilities struct
4~5 8000 APB_CLK speed in 10 kHz increments. Note that the maximal TCK speed is half of this
6~7 1 Minimum divisor
8~9 255 Maximum divisor

26.4 Recommended Operation

26.4.1 Internal/external PHY selection
As the ESP32-S3 only has a single internal PHY, at first programming you may need to decide how that is going
to be used in the intended application by burning eFuses to affect the initial USB configuration. This affects ROM
download mode as well: while both USB-OTG as well as the USB Serial/JTAG controller allows serial
programming, only USB-OTG supports the DFU protocol and only the USB Serial/JTAG controller supports JTAG
debugging over USB. Even when not using USB, eFuse configuration is required when an external JTAG adapter
will be used.
Table 26-6 indicates which eFuse to burn to get a certain boot-up configuration. Note that this is mostly relevant
RY
for the configuration in download mode and the bootloader as the configuration can be altered at runtime as
soon as user code is running.
Table 266. Use cases and eFuse settings
Use case eFuses Note

USB serial/JTAG on internal PHY only None -
A
USB OTG on internal PHY only EFUSE_USB_PHY_SEL + JTAG on GPIO pins
EFUSE_DIS_USB_JTAG
USB serial/JTAG on internal PHY, OTG on external
PHY
IN None -
USB OTG on internal PHY, USB serial/JTAG on exter- EFUSE_USB_PHY_SEL -

nal
IM
After the user program is running, it can modify the initial configuration by setting registers. Specifically,
RTC_CNTL_SW_HW_USB_PHY_SEL can be used to have software override the effect of
EFUSE_USB_PHY_SEL: if this bit is set, the USB PHY selection logic will use the value of the
RTC_CNTL_SW_USB_PHY_SEL bit in place of that of EFUSE_USB_PHY_SEL.
EL
26.4.2 Runtime operation

There is very little setup needed in order to use the USB Serial/JTAG Device. The USB-to-JTAG hardware itself
does not need any setup aside from the standard USB initialization the host operating system already does. The
PR
CDC-ACM emulation, on the host side, also is plug-and-play.
On the firmware side, very little initialization should be needed either: the USB hardware is self-initializing and after
boot-up, if a host is connected and listening on the CDC-ACM interface, data can be exchanged as described
above without any specific setup aside from the firmware optionally setting up an interrupt service handler.
One thing to note is that there may be situations where the host is either not attached or the CDC-ACM virtual
port is not opened. In this case, the packets that are flushed to the host will never be picked up and the transmit
buffer will never be empty. It is important to detect this and time out, as this is the only way to reliably detect that
the port on the host side is closed.
Another thing to note is that the USB device is dependent on both the PLL for the 48 MHz USB PHY clock, as
well as APB_CLK. Specifically, an APB_CLK of 40 MHz or more is required for proper USB compliant operation,
although the USB device will still function with most hosts with an APB_CLK as low as 10 MHz. Behaviour

shown when this happens is dependent on the host USB hardware and drivers, and can include the device being
unresponsive and it disappearing when first accessed.
More specifically, the APB_CLK will be affected by clock gating the USB Serial/JTAG Controller, which may
happen in Light-sleep. Additionally, the USB serial/JTAG Controller (as well as the attached Xtensa CPUs) will be
entirely powered down in Deep-sleep mode. If a device needs to be debugged in either of these two modes, it
may be preferable to use an external JTAG debugger and serial interface instead.
The CDC-ACM interface can also be used to reset the SoC and take it into or out of download mode. Generating
the correct sequence of handshake signals can be a bit complicated: Most operating systems only allow setting
or resetting DTR and RTS separately, and not in tandem. Additionally, some drivers (e.g. the standard CDC-ACM
driver on Windows) do not set DTR until RTS is set and the user needs to explicitly set RTS in order to
RY
’propagate’ the DTR value. These are the recommended procedures:
To reset the SoC into download mode:
Table 267. Reset SoC into Download Mode
Action Internal state Note
A
Clear DTR RTS=?, DTR=0 Initialize to known values
Clear RTS RTS=0, DTR=0 -
Set DTR RTS=0, DTR=1 Set download mode flag
Clear RTS
Set RTS
IN
RTS=0, DTR=1
RTS=1, DTR=1
Propagate DTR
-
Clear DTR RTS=1, DTR=0 Reset SoC
Set RTS RTS=1, DTR=0 Propagate DTR
IM
Clear RTS RTS=0, DTR=0 Clear download flag
To reset the SoC into booting from flash:
Table 268. Reset SoC into Booting

EL
Action Internal state Note

Clear DTR RTS=?, DTR=0 -
Clear RTS RTS=0, DTR=0 Clear download flag
Set RTS RTS=1, DTR=0 Reset SoC
PR
Clear RTS RTS=0, DTR=0 Exit reset


The addresses in this section are relative to USB Serial/JTAG Controller base address provided in Table 3-4 in

USB_SERIAL_JTAG_EP1_REG Endpoint 1 FIFO register 0x0000 R/W
USB_SERIAL_JTAG_EP1_CONF_REG Endpoint 1 configure and status register 0x0004 varies
USB_SERIAL_JTAG_CONF0_REG Configure 0 register 0x0018 R/W
USB_SERIAL_JTAG_MISC_CONF_REG MISC register 0x0044 R/W
USB_SERIAL_JTAG_MEM_CONF_REG Memory power control 0x0048 R/W
RY
USB_SERIAL_JTAG_TEST_REG USB Internal PHY test register 0x001C varies
Interrupt Registers
USB_SERIAL_JTAG_INT_RAW_REG Raw status interrupt 0x0008 R/WTC/SS
USB_SERIAL_JTAG_INT_ST_REG Masked interrupt 0x000C RO
USB_SERIAL_JTAG_INT_ENA_REG Interrupt enable bits 0x0010 R/W
A
USB_SERIAL_JTAG_INT_CLR_REG Interrupt clear bits 0x0014 WT
Status Registers
USB_SERIAL_JTAG_JFIFO_ST_REG USB-JTAG FIFO status 0x0020 varies
USB_SERIAL_JTAG_FRAM_NUM_REG
USB_SERIAL_JTAG_IN_EP0_ST_REG
IN
SOF frame number
IN Endpoint 0 status
0x0024
0x0028
RO
RO
USB_SERIAL_JTAG_IN_EP1_ST_REG IN Endpoint 1 status 0x002C RO
USB_SERIAL_JTAG_IN_EP2_ST_REG IN Endpoint 2 status 0x0030 RO
IM
USB_SERIAL_JTAG_IN_EP3_ST_REG IN Endpoint 3 status 0x0034 RO
USB_SERIAL_JTAG_OUT_EP0_ST_REG OUT Endpoint 0 status 0x0038 RO
USB_SERIAL_JTAG_OUT_EP1_ST_REG OUT Endpoint 1 status 0x003C RO
USB_SERIAL_JTAG_OUT_EP2_ST_REG OUT Endpoint 2 status 0x0040 RO
Version Register
EL
USB_SERIAL_JTAG_DATE_REG Version control register 0x0080 R/W

PR

26.6 Registers
The addresses in this section are relative to USB Serial/JTAG Controller base address provided in Table 3-4 in
Register 26.1. USB_SERIAL_JTAG_EP1_REG (0x0000)
TE
BY
R_
DW
_R
G
TA
_J
AL
RI
d)
E
ve
_S
RY
er
B
s
US
(re
31 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
USB_SERIAL_JTAG_RDWR_BYTE Write and read byte data to/from UART Tx/Rx

FIFO through this field. When USB_SERIAL_JTAG_SERIAL_IN_EMPTY_INT
A
is set, then user can write data (up to 64 bytes) into UART Tx FIFO.
When USB_SERIAL_JTAG_SERIAL_OUT_RECV_PKT_INT is set, user can check
USB_SERIAL_JTAG_OUT_EP1_WR_ADDR USB_SERIAL_JTAG_OUT_EP0_RD_ADDR to know
how many data is received, then read data from UART Rx FIFO. (R/W)
IN
Register 26.2. USB_SERIAL_JTAG_EP1_CONF_REG (0x0004)
IM
R I
_F VA
TA _A
DA TA
NE P_ DA
DO _E P_
R_ L_IN T_E
_W A U
G RI _O
EL
TA SE L
_J G_ RIA
AL A E
RI _JT _S
SE AL AG
B_ RI _JT
US _SE IAL
B R
d)
US _SE
e
rv
se
B
US
(re
PR
31 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 Reset
USB_SERIAL_JTAG_WR_DONE Set this bit to indicate writing byte data to UART Tx FIFO is done.
(WT)
USB_SERIAL_JTAG_SERIAL_IN_EP_DATA_FREE 1’b1: Indicate UART Tx FIFO is not full and can

write data into in. After writing USB_SERIAL_JTAG_WR_DONE, this bit would be 1’b0 until data
in UART Tx FIFO is read by USB Host. (RO)
USB_SERIAL_JTAG_SERIAL_OUT_EP_DATA_AVAIL 1’b1: Indicate there is data in UART Rx FIFO.

(RO)

Register 26.3. USB_SERIAL_JTAG_CONF0_REG (0x0018)
US _SE IAL TAG DM UP_ ENA SEL N
ID
DE DE
B R _J _ LL _ _ _E
RR
US _SE IAL TAG PU PAD GE GE
RI RI
US _SE IAL TAG DM UL LU LE
VE
RE VER VER
B R _J _ B_ ED ID
B R _J _ _P VA B
US ER _JT G_D _PU LU N
O
AL G_ D_ LU N
B_ RI _JT _D _P LD E
S AL A P UL OW
US _SE IAL TAG US TX_ _BR
A A L W
EL S_
HY _ S
_ O _O
B_ IAL AG P_ LL P
SE _JT _P PU DO
V PU P
_ P G IN
_S PIN
B R _J _ Y _ G
TA REF LL
G CH _P
US _SE IAL TAG PH JTA
TA EX G
SE AL AG EFH
FL
_J G_ CH
B R _J _ B _
US _SE IAL TAG US
AL A X
_V
US _SE IAL G_V
RI JT _E
B R _J _
US SE AL AG
A
B_ RI _JT
JT
B_ RI _JT
_J
_
US _SE IAL
B_ IAL
RI
B R
B R
d)
US _SE
SE
US SE
ve
B_
r
se
B
US
US
US
(re
31 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 Reset
RY
USB_SERIAL_JTAG_PHY_SEL Select internal/external PHY. 1’b0: internal PHY, 1’b1: external PHY.
(R/W)
USB_SERIAL_JTAG_EXCHG_PINS_OVERRIDE Enable software control USB D+ D- exchange.

(R/W)
A
USB_SERIAL_JTAG_EXCHG_PINS USB D+ D- exchange. (R/W)
USB_SERIAL_JTAG_VREFH Control single-end input high threshold, 1.76 V to 2 V, step 80 mV. (R/W)
IN
USB_SERIAL_JTAG_VREFL Control single-end input low threshold, 0.8 V to 1.04 V, step 80 mV.
(R/W)
IM
USB_SERIAL_JTAG_VREF_OVERRIDE Enable software control input threshold. (R/W)
USB_SERIAL_JTAG_PAD_PULL_OVERRIDE Enable software control USB D+ D- pullup pulldown.

(R/W)
USB_SERIAL_JTAG_DP_PULLUP Control USB D+ pull up. (R/W)

EL
USB_SERIAL_JTAG_DP_PULLDOWN Control USB D+ pull down. (R/W)
USB_SERIAL_JTAG_DM_PULLUP Control USB D- pull up. (R/W)
USB_SERIAL_JTAG_DM_PULLDOWN Control USB D- pull down. (R/W)

PR
USB_SERIAL_JTAG_PULLUP_VALUE Control pull up value. (R/W)
USB_SERIAL_JTAG_USB_PAD_ENABLE Enable USB pad function. (R/W)
USB_SERIAL_JTAG_PHY_TX_EDGE_SEL 0: TX output at clock negedge. 1: Tx output at clock

posedge. (R/W)
USB_SERIAL_JTAG_USB_JTAG_BRIDGE_EN Set this bit usb_jtag, the connection between

usb_jtag and internal JTAG is disconnected, and MTMS, MTDI, MTCK are output through GPIO
Matrix, MTDO is input through GPIO Matrix. (R/W)

Register 26.4. USB_SERIAL_JTAG_MISC_CONF_REG (0x0044)
EN
_
LK
_C
G
TA
J
L_
IA
ER
d)
ve
_S
er
B
s
US
(re
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
USB_SERIAL_JTAG_CLK_EN 1’h1: Force clock on for register. 1’h0: Support clock only when
application writes registers. (R/W)
RY
Register 26.5. USB_SERIAL_JTAG_MEM_CONF_REG (0x0048)
D N
_P K_E
A
EM CL
_M M_
SB E
_U _M
G B
TA US
_J G_
IN
AL A
RI _JT
SE AL
B_ RI
)
ed
US _SE
rv
se
B
US
(re
31 2 1 0
IM
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 Reset
USB_SERIAL_JTAG_USB_MEM_PD 1: power down usb memory. (R/W)
USB_SERIAL_JTAG_USB_MEM_CLK_EN 1: Force clock on for usb memory. (R/W)

EL
PR

Register 26.6. USB_SERIAL_JTAG_INT_RAW_REG (0x0008)
B R _J _ C5 R T E AW T_R W
AW
US _SE IAL TAG CR 6_E _IN IN_ _R _IN RA
AW
B R _J _ C1 RR C_ NT D T_
_R
US _SE IAL TAG CR F_E RE T_I OA _IN
NT
KT W
B_ RI _JT _S _E R NT W INT
_P A
B R _J _ F N_ SE YL D
_I
N_ W V _R
US _SE IAL TAG STU KE RE _PA OA
US _SE IAL TAG PID _ER R_I _RA P1_
_I A C T
RI _JT _S IA _IN T_ AW
B R _J _ TO S_ O YL
G _R RE I N
_J G_ RIA IN _R W
US _SE IAL TAG IN_ BU ZER _PA
TA T T_ Y_
AL A E L_ T RA
SE AL AG ER RR _IN _R
TA SO L _E AW
I
H_
_J _IN U T
B R _J _ B_ _ O
G F _O MP
US
US _SE IAL TAG US EP1 ZER
FL
B R _J _ T_ _
US _SE IAL TAG OU EP2
B R _J _ T_
US _SE IAL TAG OU
B R _J _
US _SE IAL TAG
B R _J
US SE AL
B_ RI
)
ed
US _SE
rv
se
RY
US
(re
31 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 Reset
USB_SERIAL_JTAG_JTAG_IN_FLUSH_INT_RAW The raw interrupt bit turns to high level when flush
cmd is received for IN endpoint 2 of JTAG. (R/WTC/SS)
A
USB_SERIAL_JTAG_SOF_INT_RAW The raw interrupt bit turns to high level when SOF frame is
received. (R/WTC/SS)
USB_SERIAL_JTAG_SERIAL_OUT_RECV_PKT_INT_RAW The raw interrupt bit turns to high level

IN
when Serial Port OUT Endpoint received one packet. (R/WTC/SS)
USB_SERIAL_JTAG_SERIAL_IN_EMPTY_INT_RAW The raw interrupt bit turns to high level when

Serial Port IN Endpoint is empty. (R/WTC/SS)
IM
USB_SERIAL_JTAG_PID_ERR_INT_RAW The raw interrupt bit turns to high level when pid error is
detected. (R/WTC/SS)
USB_SERIAL_JTAG_CRC5_ERR_INT_RAW The raw interrupt bit turns to high level when CRC5
error is detected. (R/WTC/SS)
EL
USB_SERIAL_JTAG_CRC16_ERR_INT_RAW The raw interrupt bit turns to high level when CRC16
error is detected. (R/WTC/SS)
USB_SERIAL_JTAG_STUFF_ERR_INT_RAW The raw interrupt bit turns to high level when stuff error
is detected. (R/WTC/SS)
PR
USB_SERIAL_JTAG_IN_TOKEN_REC_IN_EP1_INT_RAW The raw interrupt bit turns to high level

when IN token for IN endpoint 1 is received. (R/WTC/SS)
USB_SERIAL_JTAG_USB_BUS_RESET_INT_RAW The raw interrupt bit turns to high level when

usb bus reset is detected. (R/WTC/SS)
USB_SERIAL_JTAG_OUT_EP1_ZERO_PAYLOAD_INT_RAW The raw interrupt bit turns to high

level when OUT endpoint 1 received packet with zero palyload. (R/WTC/SS)
USB_SERIAL_JTAG_OUT_EP2_ZERO_PAYLOAD_INT_RAW The raw interrupt bit turns to high

level when OUT endpoint 2 received packet with zero palyload. (R/WTC/SS)

Register 26.7. USB_SERIAL_JTAG_INT_ST_REG (0x000C)
US _SE IAL TAG CR 6_E _IN IN_ _S _IN ST

T
B R _J _ C5 R T E T T_S
T
_S
T
T
IN
IN
PK T
T_
V_ _S
US _SE IAL TAG PID _ER R_I _ST P1_
_I T C T
B R _J _ TO S_ O YL
G _S RE IN
RI _JT _S IA _IN T_ T
TA T T_ Y_
SE L AG ER R IN S
AL A E L_ T ST
I
_
H_
_J _IN U T
TA SO L _E T
B_ RI _JT _S _E R NT
B R _J _ B_ _ O
G F _O MP
_J G_ RIA IN _S
US
FL
B R _J _ T_ _
N_
R
B R _J _ T_
US _SE IAL TAG OU
B R _J _
US _SE IAL TAG
B R _J
US SE AL
A
B_ RI
d)
US _SE
ver
se
B
US
(re
RY
31 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
USB_SERIAL_JTAG_JTAG_IN_FLUSH_INT_ST The raw interrupt status bit for the

USB_SERIAL_JTAG_JTAG_IN_FLUSH_INT interrupt. (RO)
USB_SERIAL_JTAG_SOF_INT_ST The raw interrupt status bit for the USB_SERIAL_JTAG_SOF_INT
A
interrupt. (RO)
USB_SERIAL_JTAG_SERIAL_OUT_RECV_PKT_INT_ST The raw interrupt status bit for the

USB_SERIAL_JTAG_SERIAL_OUT_RECV_PKT_INT interrupt. (RO)
IN
USB_SERIAL_JTAG_SERIAL_IN_EMPTY_INT_ST The raw interrupt status bit for the
USB_SERIAL_JTAG_SERIAL_IN_EMPTY_INT interrupt. (RO)
IM
USB_SERIAL_JTAG_PID_ERR_INT_ST The raw interrupt status bit for the
USB_SERIAL_JTAG_PID_ERR_INT interrupt. (RO)
USB_SERIAL_JTAG_CRC5_ERR_INT_ST The raw interrupt status bit for the

USB_SERIAL_JTAG_CRC5_ERR_INT interrupt. (RO)
EL
USB_SERIAL_JTAG_CRC16_ERR_INT_ST The raw interrupt status bit for the

USB_SERIAL_JTAG_CRC16_ERR_INT interrupt. (RO)
USB_SERIAL_JTAG_STUFF_ERR_INT_ST The raw interrupt status bit for the

USB_SERIAL_JTAG_STUFF_ERR_INT interrupt. (RO)
PR
USB_SERIAL_JTAG_IN_TOKEN_REC_IN_EP1_INT_ST The raw interrupt status bit for the

USB_SERIAL_JTAG_IN_TOKEN_REC_IN_EP1_INT interrupt. (RO)
USB_SERIAL_JTAG_USB_BUS_RESET_INT_ST The raw interrupt status bit for the

USB_SERIAL_JTAG_USB_BUS_RESET_INT interrupt. (RO)
USB_SERIAL_JTAG_OUT_EP1_ZERO_PAYLOAD_INT_ST The raw interrupt status bit for the

USB_SERIAL_JTAG_OUT_EP1_ZERO_PAYLOAD_INT interrupt. (RO)
USB_SERIAL_JTAG_OUT_EP2_ZERO_PAYLOAD_INT_ST The raw interrupt status bit for the

USB_SERIAL_JTAG_OUT_EP2_ZERO_PAYLOAD_INT interrupt. (RO)

Register 26.8. USB_SERIAL_JTAG_INT_ENA_REG (0x0010)
B R _J _ C5 R T E NA T_E A
NA
US _SE IAL TAG CR 6_E _IN IN_ _E _IN EN
NA
_E
NT
KT A
B_ RI _JT _S _E R NT A INT
_P N
_I
N_ A V _E
US _SE IAL TAG PID _ER R_I _EN P1_
_I N C T
B R _J _ TO S_ O YL
RI _JT _S IA _IN T_ NA
G _E RE IN
_J G_ RIA IN _EN A
TA T T_ Y_
AL A E L_ T EN
SE L AG ER R IN E
TA SO L _E A
I
_
H_
_J _IN U T
B R _J _ B_ _ O
G F _O MP
US
FL
B R _J _ T_ _
R
B R _J _ T_
US _SE IAL TAG OU
B R _J _
US _SE IAL TAG
B R _J
US SE AL
A
B_ RI
)
ed
US _SE
rv
se
B
US
(re
RY
31 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
USB_SERIAL_JTAG_JTAG_IN_FLUSH_INT_ENA The interrupt enable bit for the

USB_SERIAL_JTAG_JTAG_IN_FLUSH_INT interrupt. (R/W)
A
USB_SERIAL_JTAG_SOF_INT_ENA The interrupt enable bit for the USB_SERIAL_JTAG_SOF_INT
interrupt. (R/W)
USB_SERIAL_JTAG_SERIAL_OUT_RECV_PKT_INT_ENA The interrupt enable bit for the

USB_SERIAL_JTAG_SERIAL_OUT_RECV_PKT_INT interrupt. (R/W)
IN
USB_SERIAL_JTAG_SERIAL_IN_EMPTY_INT_ENA The interrupt enable bit for the
USB_SERIAL_JTAG_SERIAL_IN_EMPTY_INT interrupt. (R/W)
IM
USB_SERIAL_JTAG_PID_ERR_INT_ENA The interrupt enable bit for the
USB_SERIAL_JTAG_PID_ERR_INT interrupt. (R/W)
USB_SERIAL_JTAG_CRC5_ERR_INT_ENA The interrupt enable bit for the

USB_SERIAL_JTAG_CRC5_ERR_INT interrupt. (R/W)
EL
USB_SERIAL_JTAG_CRC16_ERR_INT_ENA The interrupt enable bit for the

USB_SERIAL_JTAG_CRC16_ERR_INT interrupt. (R/W)
USB_SERIAL_JTAG_STUFF_ERR_INT_ENA The interrupt enable bit for the

USB_SERIAL_JTAG_STUFF_ERR_INT interrupt. (R/W)
PR
USB_SERIAL_JTAG_IN_TOKEN_REC_IN_EP1_INT_ENA The interrupt enable bit for the

USB_SERIAL_JTAG_IN_TOKEN_REC_IN_EP1_INT interrupt. (R/W)
USB_SERIAL_JTAG_USB_BUS_RESET_INT_ENA The interrupt enable bit for the

USB_SERIAL_JTAG_USB_BUS_RESET_INT interrupt. (R/W)
USB_SERIAL_JTAG_OUT_EP1_ZERO_PAYLOAD_INT_ENA The interrupt enable bit for the

USB_SERIAL_JTAG_OUT_EP1_ZERO_PAYLOAD_INT interrupt. (R/W)
USB_SERIAL_JTAG_OUT_EP2_ZERO_PAYLOAD_INT_ENA The interrupt enable bit for the

USB_SERIAL_JTAG_OUT_EP2_ZERO_PAYLOAD_INT interrupt. (R/W)

Register 26.9. USB_SERIAL_JTAG_INT_CLR_REG (0x0014)
B R _J _ C5 R T E LR T_C R
LR
US _SE IAL TAG CR 6_E _IN IN_ _C _IN CL
LR
_C
NT
B_ RI _JT _S _E R NT R INT
KT R
_P L
_I
N_ R V _C
US _SE IAL TAG PID _ER R_I _CL P1_
_I L C T
B R _J _ TO S_ O YL
RI _JT _S IA _IN T_ LR
G _C RE IN
_J G_ RIA IN _C R
TA T T_ Y_
SE AL AG ER RR _IN _C
AL A E L_ T CL
TA SO L _E LR
I
H_
_J _IN U T
B R _J _ B_ _ O
G F _O MP
US
FL
B R _J _ T_ _
B R _J _ T_
US _SE IAL TAG OU
B R _J _
US _SE IAL TAG
B R _J
US SE AL
B_ RI
d)
US _SE
ve
er
B
s
US
(re
RY
31 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
USB_SERIAL_JTAG_JTAG_IN_FLUSH_INT_CLR Set this bit to clear the

USB_SERIAL_JTAG_JTAG_IN_FLUSH_INT interrupt. (WT)
A
USB_SERIAL_JTAG_SOF_INT_CLR Set this bit to clear the USB_SERIAL_JTAG_JTAG_SOF_INT
interrupt. (WT)
USB_SERIAL_JTAG_SERIAL_OUT_RECV_PKT_INT_CLR Set this bit to clear the

USB_SERIAL_JTAG_SERIAL_OUT_RECV_PKT_INT interrupt. (WT)
IN
USB_SERIAL_JTAG_SERIAL_IN_EMPTY_INT_CLR Set this bit to clear the
USB_SERIAL_JTAG_SERIAL_IN_EMPTY_INT interrupt. (WT)
IM
USB_SERIAL_JTAG_PID_ERR_INT_CLR Set this bit to clear the
USB_SERIAL_JTAG_PID_ERR_INT interrupt. (WT)
USB_SERIAL_JTAG_CRC5_ERR_INT_CLR Set this bit to clear the

USB_SERIAL_JTAG_CRC5_ERR_INT interrupt. (WT)
EL
USB_SERIAL_JTAG_CRC16_ERR_INT_CLR Set this bit to clear the

USB_SERIAL_JTAG_CRC16_ERR_INT interrupt. (WT)
USB_SERIAL_JTAG_STUFF_ERR_INT_CLR Set this bit to clear the

USB_SERIAL_JTAG_STUFF_ERR_INT interrupt. (WT)
PR
USB_SERIAL_JTAG_IN_TOKEN_REC_IN_EP1_INT_CLR Set this bit to clear the

USB_SERIAL_JTAG_IN_TOKEN_IN_EP1_INT interrupt. (WT)
USB_SERIAL_JTAG_USB_BUS_RESET_INT_CLR Set this bit to clear the

USB_SERIAL_JTAG_USB_BUS_RESET_INT interrupt. (WT)
USB_SERIAL_JTAG_OUT_EP1_ZERO_PAYLOAD_INT_CLR Set this bit to clear the

USB_SERIAL_JTAG_OUT_EP1_ZERO_PAYLOAD_INT interrupt. (WT)
USB_SERIAL_JTAG_OUT_EP2_ZERO_PAYLOAD_INT_CLR Set this bit to clear the

USB_SERIAL_JTAG_OUT_EP2_ZERO_PAYLOAD_INT interrupt. (WT)

Register 26.10. USB_SERIAL_JTAG_TEST_REG (0x001C)
AB E
LE
_J G_ ST _D V
US _SE IAL TAG TES _RX M
EN O
TA TE _T M
AL A E TX C
SE AL AG ES RX P
ES US P
T_ B_
B R _ J _ T _D
B_ RI _JT _T T_ _D
RI _JT _T T_ _R
_T _ D
G ST X_
US _SE IAL TAG TES _RX
B R _J _ T
US _SE IAL TAG TES
B R _J _
US _SE IAL TAG
B R _J
US SE AL
B_ RI
d)
US _SE
ve
er
B
s
US
(re
31 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
USB_SERIAL_JTAG_TEST_ENABLE Enable test of the USB pad. (R/W)
RY
USB_SERIAL_JTAG_TEST_USB_OE USB pad oe in test. (R/W)
USB_SERIAL_JTAG_TEST_TX_DP USB D+ tx value in test. (R/W)
USB_SERIAL_JTAG_TEST_TX_DM USB D- tx value in test. (R/W)
A
USB_SERIAL_JTAG_TEST_RX_RCV USB differential rx value in test. (RO)
USB_SERIAL_JTAG_TEST_RX_DP USB D+ rx value in test. (RO) IN

USB_SERIAL_JTAG_TEST_RX_DM USB D- rx value in test. (RO)
Register 26.11. USB_SERIAL_JTAG_JFIFO_ST_REG (0x0020)

IM
Y
U IF SE T
PT
_O _F E E
_ L
_C Y
AG T_ O_ T
T
G T _R ES
FO L
FO PT
B_ IAL AG T_F EM
AL G_ _FIF _CN
N_ _EM L
FI FU
NT
FO L
TA OU O R
FI _FU
_J _ FIF _
B_ IAL AG N_ IFO
O
IF
N_ O
US ER _JT G_I T_F
FI
S AL A U
US ER _JT OU
A N
B_ RI _JT _O
SE _JT _I
_I
_
US SE AL AG
G
TA
B_ RI _JT
JT
EL
_J
L_
US _SE IAL
S AL
I A
B_ RI
RI
B R
US ER
d )
US _SE
US SE
ve
S
B_
r
se
B
US
(re
31 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 Reset
PR
USB_SERIAL_JTAG_IN_FIFO_CNT JTAT in fifo counter. (RO)
USB_SERIAL_JTAG_IN_FIFO_EMPTY 1: JTAG in fifo is empty. (RO)
USB_SERIAL_JTAG_IN_FIFO_FULL 1: JTAG in fifo is full. (RO)
USB_SERIAL_JTAG_OUT_FIFO_CNT JTAG out fifo counter. (RO)
USB_SERIAL_JTAG_OUT_FIFO_EMPTY 1: JTAG out fifo is empty. (RO)
USB_SERIAL_JTAG_OUT_FIFO_FULL 1: JTAG out fifo is full. (RO)
USB_SERIAL_JTAG_IN_FIFO_RESET Write 1 to reset JTAG in fifo. (R/W)
USB_SERIAL_JTAG_OUT_FIFO_RESET Write 1 to reset JTAG out fifo. (R/W)

Register 26.12. USB_SERIAL_JTAG_FRAM_NUM_REG (0x0024)
X
DE
IN
E_
AM
FR
F_
O
_S
G
TA
_J
AL
RI
d)
SE
ve
B_
ser
US
(re
31 11 10 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
USB_SERIAL_JTAG_SOF_FRAME_INDEX Frame index of received SOF frame. (RO)
Register 26.13. USB_SERIAL_JTAG_IN_EP0_ST_REG (0x0028)
A
DR
DR
AD
D
E
_A
AT
R_
D
ST
_W
_R
0_
P0
P0
EP
_E
_E
N_
N
N
IN _I
_I
_I
G
G
TA
TA
TA
_J
_J
_J
AL
AL
AL
RI
RI
RI
d)
SE
SE
SE
e
rv
B_
B_
B_
se
US
US
US
(re
31 16 15 9 8 2 1 0
IM
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 Reset
USB_SERIAL_JTAG_IN_EP0_STATE State of IN Endpoint 0. (RO)
USB_SERIAL_JTAG_IN_EP0_WR_ADDR Write data address of IN endpoint 0. (RO)

EL
USB_SERIAL_JTAG_IN_EP0_RD_ADDR Read data address of IN endpoint 0. (RO)

PR

Register 26.14. USB_SERIAL_JTAG_IN_EP1_ST_REG (0x002C)
R
DR
DD
AD
E
A
AT
R_
D_
ST
_W
_R
1_
P1
P1
EP
E
E
N_
N_
N_
_I
_I
_I
G
G
TA
TA
TA
_J
_J
_J
AL
AL
IA
RI
RI
ER
d)
SE
E
ve
_S
_S
B_
er
B
s
US
US
US
(re
31 16 15 9 8 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 Reset
RY
A
IN
DR
DR
AD
D
E
_A
AT
R_
D
ST
_W
_R
2_
P2
P2
EP
_E
_E
N_
N
N
_I
_I
_I
G
G
TA
TA
TA
_J
_J
_J
IM
AL
AL
AL
RI
RI
RI
d)
SE
SE
SE
ve
B_
B_
B_
r
se
US
US
US
(re
31 16 15 9 8 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 Reset
EL

PR

R
DR
DD
AD
E
A
AT
R_
D_
ST
_W
_R
3_
P3
P3
EP
E
E
N_
N_
N_
_I
_I
_I
G
G
TA
TA
TA
_J
_J
_J
AL
AL
IA
RI
RI
ER
d)
SE
E
ve
_S
_S
B_
er
B
s
US
US
US
(re
31 16 15 9 8 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 Reset
RY
A
Register 26.17. USB_SERIAL_JTAG_OUT_EP0_ST_REG (0x0038)
IN
DR
DR
AD
AD
TE
R_
D_
TA
W
_R
_S
0_
P0
P0
P
_E
_E
_E
UT
UT
UT
_O
_O
_O
G
G
TA
TA
TA
IM
_J
_J
_J
AL
AL
AL
RI
RI
RI
d)
SE
SE
SE
ve
B_
B_
B_
r
se
US
US
US
(re
31 16 15 9 8 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
EL
USB_SERIAL_JTAG_OUT_EP0_STATE State of OUT Endpoint 0. (RO)
USB_SERIAL_JTAG_OUT_EP0_WR_ADDR Write data address of OUT endpoint 0.

When USB_SERIAL_JTAG_SERIAL_OUT_RECV_PKT_INT is detected, there are
USB_SERIAL_JTAG_OUT_EP0_WR_ADDR-2 bytes data in OUT EP0. (RO)
PR
USB_SERIAL_JTAG_OUT_EP0_RD_ADDR Read data address of OUT endpoint 0. (RO)

Register 26.18. USB_SERIAL_JTAG_OUT_EP1_ST_REG (0x003C)
NT
_C
TA
DR
R
DD
DA
AD
E
_A
C_
AT
R_
RD
RE
ST
W
1_
1_
1_
1_
P
EP
EP
_E
_E
_
_
UT
UT
UT
UT
_O
_O
_O
_O
G
G
TA
TA
TA
TA
J
_J
_J
L_
L_
AL
AL
IA
IA
RI
RI
ER
ER
)
ed
SE
E
_S
_S
_S
rv
B_
se
B
US
US
US
US
(re
31 23 22 16 15 9 8 2 1 0
RY
0 0 0 0 0 0 0 0 0 0 0 0 0 Reset

A
USB_SERIAL_JTAG_OUT_EP1_REC_DATA_CNT Data count in OUT endpoint 1 when one packet

is received. (RO)
IN
Register 26.19. USB_SERIAL_JTAG_OUT_EP2_ST_REG (0x0040)
IM
DR
DR
AD
AD
TE
R_
D_
TA
W
_R
_S
2_
P2
P2
P
_E
_E
_E
UT
UT
UT
EL
_O
_O
_O
AG
G
TA
TA
JT
_J
_J
L_
AL
AL
IA
RI
RI
R
d)
SE
SE
SE
e
rv
B_
B_
B_
se
US
US
US
(re
31 16 15 9 8 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
PR


Register 26.20. USB_SERIAL_JTAG_DATE_REG (0x0080)
E
AT
_D
G
TA
_J
AL
RI
SE
B_
US
31 0
0x2101200 Reset
USB_SERIAL_JTAG_DATE register version. (R/W)
A RY
IN
IM
EL
PR

27 SD/MMC Host Controller (SDHOST)
27.1 Overview
The ESP32-S3 memory card interface controller provides a hardware interface between the Advanced Peripheral
Bus (APB) and an external memory device. The memory card interface allows the ESP32-S3 to be connected to
SDIO memory cards, MMC cards and devices with a CE-ATA interface. It supports two external cards (Card0
and Card1). And all SD/MMC module interface signal only connect to GPIO pad by GPIO matrix.
27.2 Features
RY
This module supports the following features:
• Two external cards
• SD Memory Card standard: V3.0 and V3.01
• MMC: V4.41, V4.5, and V4.51
A
• CE-ATA: V1.1
• 1-bit, 4-bit, and 8-bit modes IN

The SD/MMC controller topology is shown in Figure 27-1. The controller supports two peripherals which cannot
be functional at the same time.
IM
EL
PR
Figure 271. SD/MMC Controller Topology
27.3 SD/MMC External Interface Signals

The primary external interface signals, which enable the SD/MMC controller to communicate with an external
device, are clock (sdhost_cclk_out_1.eg:card1), command (sdhost_ccmd_out_1) and data signals
(sdhost_cdata_in_1[7:0]/sdhost_cdata_out_1[7:0]). Additional signals include the card interrupt, card detect, and
write-protect signals. The direction of each signal is shown in Figure 27-2. The direction and description of each
pin are listed in Table 27-1.

RY
Figure 272. SD/MMC Controller External Interface Signals
Table 271. SD/MMC Signal Description
Pin Direction Description
A
sdhost_cclk_out Output Clock signals for slave device
sdhost_ccmd Duplex Duplex command/response lines
sdhost_cdata Duplex Duplex data read/write lines
sdhost_card_detect_n
sdhost_card_write_prt
Input
Input
IN Card detection input line
Card write protection status input
sdhost_rst_n Output Hardware reset for MMC4.4 cards
sdhost_ccmd_od_pullup_en_n output Card Cmd Open-Drain Pullup
IM
sdhost_card_int_n Input Interrupt pin for eSDIO devices
sdhost_data_strobe_n Input Card HS400 Data Strobe

EL
27.4.1 SD/MMC Host Controller Architecture

The SD/MMC host controller consists of two main functional blocks, as shown in Figure 27-3:
• Bus Interface Unit (BIU): It provides APB interfaces for registers, data access method for RMA, and data
PR
read and write operation by DMA.
• Card Interface Unit (CIU): It handles external memory card interface protocols. It also provides clock control.

RY
Figure 273. SDIO Host Block Diagram
27.4.1.1 Bus Interface Unit (BIU)
A
The BIU provides the access to registers and RAM data through the Host Interface Unit (HIU). Additionally, it
provides a method to access to memory data through a DMA interface. Figure 27-3 illustrates the internal
components of the BIU. Figure 27-9 illustrates the clcok slection. The BIU provides the following functions:
• Host interface
IN
• DMA interface
• Interrupt control
IM
• Register access
• FIFO access
• Power/pull-up control and card detection

EL
27.4.1.2 Card Interface Unit (CIU)
The CIU module implements the card-specific protocols. Within the CIU, the command path control unit and
data path control unit are used to interface with the command and data ports, respectively, of the
SD/MMC/CE-ATA cards. The CIU also provides clock control. Figure 27-3 illustrates the internal structure of the
PR
CIU, which consists of the following primary functional blocks:
• Command path
• Data path
• SDIO interrupt control
• Clock control
• Mux/De-Mux unit
27.4.2 Command Path

The command path performs the following functions:

• Configures clock parameters
• Configures card command parameters
• Sends commands to card bus (sdhost_ccmd_out line)
• Receives responses from card bus (sdhost_ccmd_in line)
• Sends responses to BIU
• Drives the P-bit on the command line
The command path State Machine is shown in Figure 27-4.
A RY
IN
Figure 274. Command Path State Machine
27.4.3 Data Path

IM
The data path block pops RAM data and transmits them on sdhost_cdata_out during a write-data transfer, or it
receives data on sdhost_cdata_in and pushes them into RAM during a read-data transfer. The data path loads
new data parameters, i.e., expected data, read/write data transfer, stream/block transfer, block size, byte count,
card type, timeout registers, etc., whenever a data transfer command is not in progress.
EL
If the SDHOST_DATA_EXPECTED bit is set in SDHOST_CMD_REG register, the new command is a data-transfer
command and the data path starts one of the following operations:
• Transmitting data if the SDHOST_READ_WRITE bit is 1
• Receiving data if the SDHOST_READ_WRITE bit is 0

PR
27.4.3.1 Data Transmit Operation
The module starts data transmission two clock cycles after a response for the data-write command is received.
This occurs even if the command path detects a response error or a cyclic redundancy check (CRC) error in a
response. If no response is received from the card until the response timeout, no data are transmitted.
Depending on the value of the SDHOST_TRANSFER_MODE bit in SDHOST_CMD_REG register, the
data-transmit state machine adds data to the card’s data bus in a stream or in block(s). The data transmit state
machine is shown in Figure 27-5.

Figure 275. Data Transmit State Machine
RY
27.4.3.2 Data Receive Operation
The module receives data two clock cycles after the end bit of a data-read command, even if the command path
detects a response error or a CRC error. If no response is received from the card and a response timeout occurs,
A
the BIU does not receive a signal about the completion of the data transfer. If the command sent by the CIU is an
illegal operation for the card, it would prevent the card from starting a read-data transfer, and the BIU will not
receive a signal about the completion of the data transfer.
IN
If no data is received by the data timeout, the data path signals a data timeout to the BIU, which marks an end to
the data transfer. Based on the value of the SDHOST_TRANSFER_MODE bit in SDHOST_CMD_REG register,
the data-receive state machine gets data from the card’s data bus in a stream or block(s). The data receive state
machine is shown in Figure 27-6.
IM
EL
PR
Figure 276. Data Receive State Machine
27.5 Software Restrictions for Proper CIU Operation

• Only one card at a time can be selected to execute a command or data transfer. For example, when data
are being transferred to or from a card, a new command must not be issued to another card. A new
command, however, can be issued to the same card, allowing it to read the device status or stop the
transfer.
• Only one command at a time can be issued for data transfers.

• During an open-ended card-write operation, if the card clock is stopped due to RAM being empty, the
software must fill RAM with data first, and then start the card clock. Only then can it issue a stop/abort
command to the card.
• During an SDIO/Combo card transfer, if the card function is suspended and the software wants to resume
the suspended transfer, it must first reset RAM, setting SDHOST_FIFO_RESET bits and then issue the
resume command as if it were a new data-transfer command.
• When issuing card reset commands (CMD0, CMD15 or CMD52_reset), while a card data transfer is in
progress, the software must set the SDHOST_STOP_ABORT_CMD bit in SDHOST_CMD_REG register, so
that the CIU can stop the data transfer after issuing the card reset command.
• When the data’s end bit error is set in the SDHOST_RINTSTS_REG register, the CIU does not guarantee
RY
SDIO interrupts. In such a case, the software ignores SDIO interrupts and issues a stop/abort command to
the card, so that the card stops sending read-data.
• If the card clock is stopped due to RAM being full during a card read, the software will read at least two
RAM locations to restart the card clock.
• Only one CE-ATA device at a time can be selected for a command or data transfer. For example, when
A
data are transferred from a CE-ATA device, a new command should not be sent to another CE-ATA device.
• If a CE-ATA device’s interrupts are enabled (nIEN=0), a new SDHOST_RW_BLK command should not be
IN
sent to the same device if the execution of a SDHODT_RW_BLK command is already in progress. Only the
CCSD can be sent while waiting for the CCS.
• If, however, a CE-ATA device’s interrupts are disabled (nIEN=1), a new command can be issued to the
same device, allowing it to read status information.
IM
• Open-ended transfers are not supported in CE-ATA devices.
• The sdhost_send_auto_stop signal is not supported (software should not set the sdhost_send_auto_stop
bit) in CE-ATA transfers.
After configuring the command start bit to 1, the values of the following registers cannot be changed before a
EL
command has been issued:
• CMD - command
• CMDARG - command argument
• BYTCNT - byte count

PR
• BLKSIZ - block size
• CLKDIV - clock divider
• CKLENA - clock enable
• CLKSRC - clock source
• TMOUT - timeout
• CTYPE - card type

27.6 RAM for Receiving and Sending Data

The submodule RAM is a buffer area for sending and receiving data. It can be divided into two units: the one is for
sending data, and the other is for receiving data. The process of sending and receiving data can also be achieved
by the CPU and DMA for reading and writing. The latter method is described in detail in Section 27.8.
27.6.1 TX RAM Module

There are two ways to enable a write operation: DMA and CPU read/write.
If SDIO-sending is enabled, data can be written to the TX RAM module by APB interface. Data will be written to
register SDHOST_BUFFIFO_REG from the CPU, directly, by an APB interface.
RY
Another way of data transmission is by DMA.
27.6.2 RX RAM Module

There are two ways to enable a read operation: DMA and CPU read/write.
When the data path receives data, the data will be written to the RX RAM. Then, these data can be read with the
A
APB method at the reading end. Register SDHOST_BUFFIFO_REG can be read by the APB directly.
Another way of receiving data is by DMA.
27.7 DMA Descriptor Chain

IN
Each linked list module consists of two parts: the linked list itself and a data buffer. In other words, each module
points to a unique data buffer and the linked list that follows the module. Figure 27-7 shows the descriptor
IM
chain.
EL
PR
Figure 277. Descriptor Chain
27.8 The Structure of DMA descriptor chain

Each linked list consists of four words. As is shown below, Figure 27-8 demonstrates the linked list’s structure,
and Table 27-2, Table 27-3, Table 27-4, Table 27-5 provide the descriptions of linked lists.

RY
Figure 278. The Structure of a Linked List
The DES0 element contains control and status information.
Table 272. Word DES0 of SD/MMC GDMA Linked List
Bits Name Description
A
When set, this bit indicates that the descriptor is
owned by the DMA Controller. When reset, it indi-
31 OWNER
IN cates that the descriptor is owned by the Host. The
DMA clears this bit when it completes the data trans-
fer.
These error bits indicate the status of the transition to
or from the card.
IM
The following bits are also present in SD-
HOST_RINTSTS_REG, which indicates their digital
logic OR gate.
30 CES (Card Error Summary) • EBE: End Bit Error
EL
• RTO: Response Time out

• RCRC: Response CRC
• SBE: Start Bit Error
• DRTO: Data Read Timeout
• DCRC: Data CRC for Receive
PR
• RE: Response Error
29:6 Reserved Reserved

When set, this bit indicates that the descriptor list has
reached its final descriptor. The DMA Controller then
5 ER (End of Ring)
returns to the base address of the list, creating a De-
scriptor Chain.
When set, this bit indicates that the second address in
CH
4 the descriptor is the Next Descriptor address. When
(Second Address Chained)
this bit is set, BS2 (DES1[25:13]) should be all zeros.


When set, this bit indicates that this descriptor con-
tains the first buffer of the data. If the size of the first
3 FD (First Descriptor)
buffer is 0, the Next Descriptor contains the beginning
of the data.
This bit is associated with the last block of a DMA
transfer. When set, the bit indicates that the buffers
pointed by this descriptor are the last buffers of the
2 LD (Last Descriptor) data. After this descriptor is completed, the remain-
ing byte count is 0. In other words, after the descriptor
with the LD bit set is completed, the remaining byte
RY
count should be 0.
When set, this bit will prevent the setting of the TI/RI
DIC (Disable Interrupt
1 bit of the DMA Status Register (IDSTS) for the data
on Completion)
that ends in the buffer pointed by this descriptor.
0 Reserved Reserved
A
The DES1 element contains the buffer size.
Bits Name
IN Description
IM
Indicates the size of the data buffer (in Byte), which
must be a multiple of four. In the case where the buffer
12:0 BS (Buffer Size)
size is not a multiple of four, the resulting behavior is
undefined. This field should not be zero.
EL
The DES2 element contains the address pointer to the data buffer.

PR
These bits indicate the physical address of the data

31:0 Buffer Address Pointer
buffer. And the buffer address must be word-aligned.
The DES3 element contains the address pointer to the next descriptor if the present descriptor is not the last one
in a chained descriptor structure.

If CH (DES0[4]) is set, this bit contains the address
pointer to the next descriptor.
31:0 Next Descriptor Address


If this is not the last descriptor in a chained descriptor
structure, the address pointer to the next descriptor
should be: DES3[1:0] = 0.
27.9 Initialization
27.9.1 DMA Initialization
The DMA Controller initialization should proceed as follows:
1. Write to the DMA Bus Mode Register (SDHOST_BMOD_REG) will set the Host bus’s access parameters.
RY
2. Write to the DMA Interrupt Enable Register (SDHOST_IDINTEN_REG) will mask any unnecessary interrupt
causes.
3. The software driver creates either the inlink or the outlink descriptors. Then, it writes to the DMA Descriptor
List Base Address Register (SDHOST_DBADDR_REG), providing the DMA Controller with the starting
A
address of the list.
4. The DMA Controller engine attempts to acquire descriptors from descriptor lists.
IN
27.9.2 DMA Transmission Initialization
The DMA transmission occurs as follows:
1. The Host sets up the elements (DES0-DES3) for transmission, and sets the OWNER bit (DES0[31]). The
IM
Host also prepares the data buffer.
2. The Host programs the write-data command in the CMD register in BIU.
3. The Host also programs the required transmit threshold (SDHOST_TX_WMARK field in
SDHOST_FIFOTH_REG register).
EL
4. The DMA Controller engine fetches the descriptor and checks the OWNER bit. If the OWNER bit is not set,
it means that the host owns the descriptor. In this case, the DMA Controller enters a suspend-state and
asserts the Descriptor Unable interrupt in the SDHOST_IDSTS_REG register. In such a case, the host
needs to release the DMA Controller by writing any value to SDHOST_PLDMND_REG.
5. It then waits for the Command Done (CD) bit in DHOST_RINTSTS_REG register and no errors from BIU,
PR
which indicates that a transfer has completed.
6. Subsequently, the DMA Controller engine waits for a DMA interface request from BIU. This request will be
generated, based on the programmed transmit-threshold value. For the last bytes of data which cannot be
accessed using a burst, single transfers are performed on the AHB Master Interface.
7. The DMA Controller fetches the transmit data from the data buffer in the Host memory and transfers them
to RAM for transmission to card.
8. When data span across multiple descriptors, the DMA Controller fetches the next descriptor and extends
its operation using the following descriptor. The last descriptor bit indicates whether the data span multiple
descriptors or not.

9. When data transmission is complete, the status information is updated in the SDHOST_IDSTS_REG
register by setting the SDHOST_IDSTS_TI, if it has already been enabled. Also, the OWNER bit is cleared
by the DMA Controller by performing a write transaction to DES0.
27.9.3 DMA Reception Initialization

The DMA reception occurs as follows:
1. The Host sets up the element (DES0-DES3) for reception, and sets the OWNER bit (DES0[31]).
2. The Host programs the read-data command in the CMD register in BIU.
3. Then, the Host programs the required level of the receive-threshold (SDHOST_RX_WMARK field in
SDHOST_FIFOTH_REG register).
RY
4. The DMA Controller engine fetches the descriptor and checks the OWNER bit. If the OWNER bit is not set,
it means that the host owns the descriptor. In this case, the DMA enters a suspend-state and asserts the
Descriptor Unable interrupt in the SDHOST_IDSTS_REG register. In such a case, the host needs to release
the DMA Controller by writing any value to SDHOST_PLDMND_REG.
A
5. It then waits for the Command Done (CD) bit and no errors from BIU, which indicates that a reception can
be done.
6. The DMA Controller engine then waits for a DMA interface request from BIU. This request will be generated,
IN
based on the programmed receive-threshold value. For the last bytes of the data which cannot be
accessed using a burst, single transfers are performed on the AHB.
7. The DMA Controller fetches the data from RAM and transfers them to the Host memory.
IM
8. When data span across multiple descriptors, the DMA Controller will fetch the next descriptor and extend
its operation using the following descriptor. The last descriptor bit indicates whether the data span multiple
descriptors or not.
9. When data reception is complete, the status information is updated in the SDHOST_IDSTS_REG register
by setting SDHOST_IDSTS_RI, if it has already been enabled. Also, the OWNER bit is cleared by the DMA
EL
Controller by performing a write-transaction to DES0.
27.10 Clock Phase Selection

If the setup time requirements for the input or output data signal are not met, users can specify the clock phase,
PR
as shown in the figure 27-9.

A RY
Figure 279. Clock Phase Selection
IN
This issue can be fixed by configuring register SDHOST_CLK_DIV_EDGE_REG. For example, set
CCLKIN_EDGE_DRV_SEL bit to 0 to drive the output data in phase0, and set the CCLKIN_EDGE_SAM_SEL bit
to 1 to select phase90 to sample the data from SDIO slave, if there are still timing issue, please set bit 4 or 6 to
IM
use phase180 or phase 270 to sample the data from SDIO slave.
Please find detailed information on the clock phase selection register SDHOST_CLK_DIV_EDGE_REG in Section
Registers.
Table 276. SDHOST Clk Phase Selection

EL
Clock phase phase_select value

0 0
90 1
180 4
PR
270 6
27.11 Interrupt
Interrupts can be generated as a result of various events. The SDHOST_IDSTS_REG register contains all the bits
that might cause an interrupt. The SDHOST_IDINTEN_REG register contains an enable bit for each of the events
that can cause an interrupt.
There are two groups of summary interrupts, ”Normal” ones (bit8 SDHOST_IDSTS_NIS) and ”Abnormal” ones
(bit9 SDHOST_IDSTS_AIS), as outlined in the SDHOST_IDSTS_REG register. Interrupts are cleared by writing 1
to the position of the corresponding bit. When all the enabled interrupts within a group are cleared, the
corresponding summary bit is also cleared. When both summary bits are cleared, the interrupt signal connected
to CPU is de-asserted (stops signalling).

Interrupts are not queued up, and if a new interrupt-event occurs before the driver has responded to it, no
additional interrupts are generated. For example, the SDHOST_IDSTS_RI indicates that one or more data were
transferred to the Host buffer.
An interrupt is generated only once for concurrent events. The driver must scan the SDHOST_IDSTS_REG
register for the interrupt cause.
A RY
IN
IM
EL
PR


The addresses in this section are relative to SD/MMC Host Controller base address provided in Table 3-4 in

SDHOST_CTRL_REG Control register 0x0000 R/W
SDHOST_CLKDIV_REG Clock divider configuration register 0x0008 R/W
SDHOST_CLKSRC_REG Clock source selection register 0x000C R/W
SDHOST_CLKENA_REG Clock enable register 0x0010 R/W
SDHOST_TMOUT_REG Data and response timeout configuration register 0x0014 R/W
SDHOST_CTYPE_REG Card bus width configuration register 0x0018 R/W
RY
SDHOST_BLKSIZ_REG Card data block size configuration register 0x001C R/W
SDHOST_BYTCNT_REG Data transfer length configuration register 0x0020 R/W
SDHOST_INTMASK_REG SDIO interrupt mask register 0x0024 R/W
SDHOST_CMDARG_REG Command argument data register 0x0028 R/W
SDHOST_CMD_REG Command and boot configuration register 0x002C R/W
A
SDHOST_RESP0_REG Response data register 0x0030 RO
SDHOST_RESP1_REG Long response data register 0x0034 RO
SDHOST_RESP2_REG Long response data register 0x0038 RO
SDHOST_RESP3_REG
SDHOST_MINTSTS_REG
IN
Long response data register
Masked interrupt status register
0x003C
0x0040
RO
RO
SDHOST_RINTSTS_REG Raw interrupt status register 0x0044 R/W
SDHOST_STATUS_REG SD/MMC status register 0x0048 RO
IM
SDHOST_FIFOTH_REG FIFO configuration register 0x004C R/W
SDHOST_CDETECT_REG Card detect register 0x0050 RO
SDHOST_WRTPRT_REG Card write protection (WP) status register 0x0054 RO
SDHOST_TCBCNT_REG Transferred byte count register 0x005C RO
SDHOST_TBBCNT_REG Transferred byte count register 0x0060 RO
EL
SDHOST_DEBNCE_REG Debounce filter time configuration register 0x0064 R/W

SDHOST_USRID_REG User ID (scratchpad) register 0x0068 R/W
SDHOST_VERID_REG Version ID (scratchpad) register 0x006C RO
SDHOST_HCON_REG Hardware feature register 0x0070 RO
SDHOST_UHS_REG UHS-1 register 0x0074 R/W
PR
SDHOST_RST_N_REG Card reset register 0x0078 R/W

SDHOST_BMOD_REG Burst mode transfer configuration register 0x0080 R/W
SDHOST_PLDMND_REG Poll demand configuration register 0x0084 WO
SDHOST_DBADDR_REG Descriptor base address register 0x0088 R/W
SDHOST_IDSTS_REG IDMAC status register 0x008C R/W
SDHOST_IDINTEN_REG IDMAC interrupt enable register 0x0090 R/W
SDHOST_DSCADDR_REG Host descriptor address pointer 0x0094 RO
SDHOST_BUFADDR_REG Host buffer address pointer register 0x0098 RO
SDHOST_CARDTHRCTL_REG Card Threshold Control register 0x0100 R/W
SDHOST_EMMCDDR_REG eMMC DDR register 0x010C R/W
SDHOST_ENSHIFT_REG Enable Phase Shift register 0x0110 R/W


SDHOST_BUFFIFO_REG CPU write and read transmit data by FIFO 0x0200 R/W
SDHOST_CLK_DIV_EDGE_REG Clock phase selection register 0x0800 R/W
A RY
IN
IM
EL
PR

27.13 Registers
The addresses in this section are relative to SD/MMC Host Controller base address provided in Table 3-4 in
Register 27.1. SDHOST_CTRL_REG (0x0000)
S
TU
D STA
CS T_
_C P
(re OS SE T_ D OP RRU
ET
NS
H T_ OR CS ST E
AI ES A
SD OS AB _C O_ INT
ES
_W R AT
T PO
_R
HO d) AD Q_ _D
H T_ ND UT E_
ER
SD rve RE _IR AD
SD OS SE _A VIC
O ES T
RO T
LL
_C _R SE
BL
se T_ ND RE
NT E
H T_ ND E
RY
SD OS SE A_D
NA
ST IFO E
R
HO T_F A_
HO d) _E
H T_ AT
SD S M
SD rve INT
SD S E
HO T_C
HO T_D
se T_
)
)
ed
ed
ve
SD OS
(re S
SD S
rv
rv
r
se
se
se
H
SD
(re
(re
(re
31 25 24 23 12 11 10 9 8 7 6 5 4 3 2 1 0
0x00 1 0x000 0 0 0 0 0 0 0 0 0 0 0 0 Reset
A
SDHOST_CEATA_DEVICE_INTERRUPT_STATUS Software should appropriately write to this bit af-
ter the power-on reset or any other reset to the CE-ATA device. After reset, the CE-ATA device’s
interrupt is usually disabled (nIEN = 1). If the host enables the CE-ATA device’s interrupt, then
software should set this bit. (R/W)
IN
SDHOST_SEND_AUTO_STOP_CCSD Always set SDHOST_SEND_AUTO_STOP_CCSD and SD-
HOST_SEND_CCSD bits together; SDHOST_SEND_AUTO_STOP_CCSD should not be set inde-
pendently of send_ccsd. When set, SD/MMC automatically sends an internally-generated STOP
IM
command (CMD12) to the CE-ATA device. After sending this internally-generated STOP command,
the Auto Command Done (ACD) bit in SDHOST_RINTSTS_REG is set and an interrupt is generated
for the host, in case the ACD interrupt is not masked. After sending the Command Completion
Signal Disable (CCSD), SD/MMC automatically clears the SDHOST_SEND_AUTO_STOP_CCSD
EL
bit. (R/W)
SDHOST_SEND_CCSD When set, SD/MMC sends CCSD to the CE-ATA device. Software sets
this bit only if the current command is expecting CCS (that is, RW_BLK), and if interrupts are
enabled for the CE-ATA device. Once the CCSD pattern is sent to the device, SD/MMC auto-
matically clears the SDHOST_SEND_CCSD bit. It also sets the Command Done (CD) bit in the
PR
SDHOST_RINTSTS_REG register, and generates an interrupt for the host, in case the Command
Done interrupt is not masked.
NOTE: Once the SDHOST_SEND_CCSD bit is set, it takes two card clock cycles to drive the CCSD
on the CMD line. Due to this, within the boundary conditions the CCSD may be sent to the CE-ATA
device, even if the device has signalled CCS. (R/W)

Register 27.1. SDHOST_CTRL_REG (0x0000)
SDHOST_ABORT_READ_DATA After a suspend-command is issued during a read-operation, soft-

ware polls the card to find when the suspend-event occurred. Once the suspend-event has oc-
curred, software sets the bit which will reset the data state machine that is waiting for the next
block of data. This bit is automatically cleared once the data state machine is reset to idle. (R/W)
SDHOST_SEND_IRQ_RESPONSE Bit automatically clears once response is sent. To wait for MMC
card interrupts, host issues CMD40 and waits for interrupt response from MMC card(s). In the
meantime, if host wants SD/MMC to exit waiting for interrupt state, it can set this bit, at which
RY
time SD/MMC command state-machine sends CMD40 response on bus and returns to idle state.
(R/W)
SDHOST_READ_WAIT For sending read-wait to SDIO cards. (R/W)
SDHOST_INT_ENABLE Global interrupt enable/disable bit. 0: Disable; 1: Enable. (R/W)
A
SDHOST_DMA_RESET To reset DMA interface, firmware should set bit to 1. This bit is auto-cleared
after two AHB clocks. (R/W) IN
SDHOST_FIFO_RESET To reset FIFO, firmware should set bit to 1. This bit is auto-cleared after
completion of reset operation.
Note: FIFO pointers will be out of reset after 2 cycles of system clocks in addition to synchronization
delay (2 cycles of card clock), after the fifo_reset is cleared. (R/W)
IM
SDHOST_CONTROLLER_RESET To reset controller, firmware should set this bit. This bit is auto-
cleared after two AHB and two sdhost_cclk_in clock cycles. (R/W)
EL
Register 27.2. SDHOST_CLKDIV_REG (0x0008)

3
R1
0
ER
ER
ER
DE
ID
ID
ID
VI
IV
IV
IV
I
_D
_D
_D
_D
LK
LK
LK
LK
_C
_C
_C
_C
ST
ST
ST
ST
HO
HO
HO
HO
PR SD
SD
SD
SD
31 24 23 16 15 8 7 0
0x000 0x000 0x000 0x000 Reset
SDHOST_CLK_DIVIDERm Clock divider (m) value. Clock divisor is 2*n, where n = 0 bypasses the
divider (divisor of 1). For example, a value of 1 means divided by 2*1 = 2, a value of 0xFF means
divided by 2*255 = 510, and so on. The range of m is 0 ~ 3. (R/W)

Register 27.3. SDHOST_CLKSRC_REG (0x000C)
EG
_R
S RC
LK
_C
d)
ST
ve
HO
er
s
SD
(re
31 4 3 0
0x0000000 0x0 Reset
SDHOST_CLKSRC_REG Clock divider source for two SD cards is supported. Each card has two
bits assigned to it. For example, bit[1:0] are assigned for card 0, bit[3:2] are assigned for card 1.
RY
Card 0 maps and internally routes clock divider[0:3] outputs to cclk_out[1:0] pins, depending on
bit value. (R/W)
00 : Clock divider 0;
11 : Clock divider 3.
A
Register 27.4. SDHOST_CLKENA_REG (0x0010)
IN
EL
AB
L
BE
EN
NA
K_
_E
CL
P
_C
_L
d)
)
ed
ST
ST
IM
ve
rv
HO
HO
er
se
s
SD
SD
(re
(re
31 18 17 16 15 2 1 0
0x0000 0x0 0x0000 0x0 Reset
SDHOST_LP_ENABLE Disable clock when the card is in IDLE state. One bit per card. (R/W)
EL
0: clock disabled;
1: clock enabled.
SDHOST_CCLK_ENABLE Clock-enable control for two SD card clocks and one MMC card clock is
supported. One bit per card. (R/W)
PR
0: Clock disabled;
1: Clock enabled.

Register 27.5. SDHOST_TMOUT_REG (0x0014)
UT
EO
IM
UT
_T
EO
E
NS
M
TI
PO
A_
ES
AT
_D
_R
ST
ST
HO
HO
SD
SD
31 8 7 0
0xFFFFFF 0x40 Reset
SDHOST_DATA_TIMEOUT Value for card data read timeout. This value is also used for data starva-
RY
tion by host timeout. The timeout counter is started only after the card clock is stopped. This value
is specified in number of card output clocks, i.e. sdhost_cclk_out of the selected card. (R/W)
NOTE: The software timer should be used if the timeout value is in the order of 100 ms. In this
case, read data timeout interrupt needs to be disabled.
SDHOST_RESPONSE_TIMEOUT Response timeout value. Value is specified in terms of number of
A
card output clocks, i.e., sdhost_cclk_out. (R/W)
IN
Register 27.6. SDHOST_CTYPE_REG (0x0018)
H8
4
TH
T
ID
ID
_W
W
D_
RD
AR
IM _C
A
_C
)
)
ed
ed
ST
ST
rv
rv
HO
HO
se
se
SD
SD
(re
(re
31 18 17 16 15 2 1 0
0x0000 0x0 0x0000 0x0 Reset

EL
SDHOST_CARD_WIDTH8 One bit per card indicates if card is in 8-bit mode. (R/W)
0: Non 8-bit mode;
1: 8-bit mode.
Bit[17:16] correspond to card[1:0] respectively.
SDHOST_CARD_WIDTH4 One bit per card indicates if card is 1-bit or 4-bit mode. (R/W)
PR
0: 1-bit mode;
1: 4-bit mode.
Bit[1:0] correspond to card[1:0] respectively.

Register 27.7. SDHOST_BLKSIZ_REG (0x001C)
E
IZ
_S
CK
LO
_B
)
ed
ST
rv
HO
se
SD
(re
31 16 15 0
0 x 0 0 0 0 0x200 Reset
SDHOST_BLOCK_SIZE Block size. (R/W)
RY
Register 27.8. SDHOST_BYTCNT_REG (0x0020)
31 0
0x200 Reset
SDHOST_BYTCNT_REG Number of bytes to be transferred, should be an integral multiple of Block
A
Size for block transfers. For data transfers of undefined byte lengths, byte count should be set to
0. When byte count is set to 0, it is the responsibility of host to explicitly send stop/abort command
to terminate data transfer. (R/W)
IN
IM
EL
PR

Register 27.9. SDHOST_INTMASK_REG (0x0024)
K
AS
M_
K
NT
AS
_I
M
O
_
DI
NT
_S
_I
)
ed
ST
ST
rv
HO
HO
se
SD
SD
31 (re 18 17 16 15 0
0x0000 0x0 0x0000 Reset
SDHOST_SDIO_INT_MASK SDIO interrupt mask, one bit for each card. Bit[17:16] correspond to
card[15:0] respectively. When masked, SDIO interrupt detection for that card is disabled. 0 masks
RY
an interrupt, and 1 enables an interrupt. (R/W)
SDHOST_INT_MASK These bits used to mask unwanted interrupts. A value of 0 masks interrupt,
and a value of 1 enables the interrupt. (R/W)
Bit 15 (EBE): End-bit error/no CRC error;
Bit 14 (ACD): Auto command done;
A
Bit 13 (SBE/BCI): Rx Start Bit Error;
Bit 12 (HLE): Hardware locked write error;
Bit 11 (FRUN): FIFO underrun/overrun error;
Bit 10 (HTO): Data starvation-by-host timeout;
Bit 9 (DRTO): Data read timeout;
IN
Bit 8 (RTO): Response timeout;
Bit 7 (DCRC): Data CRC error;
IM
Bit 6 (RCRC): Response CRC error;
Bit 5 (RXDR): Receive FIFO data request;
Bit 4 (TXDR): Transmit FIFO data request;
Bit 3 (DTO): Data transfer over;
Bit 2 (CD): Command done;
EL
Bit 1 (RE): Response error;

Bit 0 (CD): Card detect.
Register 27.10. SDHOST_CMDARG_REG (0x0028)

PR
31 0
0x00000000 Reset
SDHOST_CMDARG_REG Value indicates command argument to be passed to the card. (R/W)

Register 27.11. SDHOST_CMD_REG (0x002C)
Y
NL
_O
RS
E
ET
TE
EX TH RC
SD OS DA _W _M OP PL
IS
E_ NG _C
EG
_R E
H T_ AD ER ST M
H T_ ND V _C N
CK C
CT
SD OS SE _PR RT ATIO
SD OS TR _A DAT MD
NS _LE SE
SD OS RE SF O_ _CO
O VI
SD OS CH _EX ITE DE
PE
CL DE
PO SE ON
_R PO E ED
AT AT D
H T_ AN UT A
H T_ TA R O
H T_ IT BO IZ
PD CE TE
BE
E_ A_
ST ES K_R CT
ES N SP
SD OS WA _A IAL
D
_U D_ EC
X
M
HO _R C E
M
LE
DE
H T_ P IT
P
NU
ST EA EXP
_C
SD S T _IN
HO
IN
D_
H d) RT
D_
HO _S D
HO T_R S_
se d) E_
AR
E
N
O
SD rve STA
M
SD OS CC
(re rve US
SD S E
_C
_C
HO T_S
se T_
se T_
H T_
se d)
se d)
se d)
H d)
ST
ST
(re rve
(re rve
(re rve
SD rve
(re OS
(re OS
SD OS
SD OS
HO
HO
H
H
SD
SD
SD
SD
31 30 29 28 27 26 25 24 23 22 21 20 16 15 14 13 12 11 10 9 8 7 6 5 0
0 0 1 0 0 0 0 0 0 0 0 0x00 0 0 0 0 0 0 0 0 0 0 0x00 Reset
RY
SDHOST_START_CMD Start command. Once command is served by the CIU, this bit is automati-
cally cleared. When this bit is set, host should not attempt to write to any command registers. If a
write is attempted, hardware lock error is set in raw interrupt register. Once command is sent and
a response is received from SD_MMC_CEATA cards, Command Done bit is set in the raw interrupt
Register. (R/W)
A
SDHOST_USE_HOLE Use Hold Register. (R/W)
0: CMD and DATA sent to card bypassing HOLD Register;
1: CMD and DATA sent to card through the HOLD Register.
IN
SDHOST_CCS_EXPECTED Expected Command Completion Signal (CCS) configuration. (R/W)
0: Interrupts are not enabled in CE-ATA device (nIEN = 1 in ATA control register), or command
does not expect CCS from device;
IM
1: Interrupts are enabled in CE-ATA device (nIEN = 0), and RW_BLK command expects command
completion signal from CE-ATA device.
If the command expects Command Completion Signal (CCS) from the CE-ATA device, the software
should set this control bit. SD/MMC sets Data Transfer Over (DTO) bit in RINTSTS register and
EL
generates interrupt to host if Data Transfer Over interrupt is not masked.
SDHOST_READ_CEATA_DEVICE Read access flag. (R/W)

0: Host is not performing read access (RW_REG or RW_BLK)towards CE-ATA device;
1: Host is performing read access (RW_REG or RW_BLK) towards CE-ATA device.
Software should set this bit to indicate that CE-ATA device is being accessed for read transfer.
PR
This bit is used to disable read data timeout indication while performing CE-ATA read transfers.
Maximum value of I/O transmission delay can be no less than 10 seconds. SD/MMC should not
indicate read data timeout while waiting for data from CE-ATA device.

SDHOST_UPDATE_CLOCK_REGISTERS_ONLY 0: Normal command sequence; 1: Do not send

commands, just update clock register value into card clock domain. (R/W)
Following register values are transferred into card clock domain: CLKDIV, CLRSRC, and CLKENA.
Changes card clocks (change frequency, truncate off or on, and set low-frequency mode). This
is provided in order to change clock frequency or stop clock without having to send command to
cards.
During normal command sequence, when sdhost_update_clock_registers_only = 0, following con-
RY
trol registers are transferred from BIU to CIU: CMD, CMDARG, TMOUT, CTYPE, BLKSIZ, and
BYTCNT. CIU uses new register values for new command sequence to card(s). When bit is set,
there are no Command Done interrupts because no command is sent to SD_MMC_CEATA cards.
SDHOST_CARD_NUMBER Card number in use. Represents physical slot number of card being
accessed. In SD-only mode, up to two cards are supported. (R/W)
A
SDHOST_SEND_INITIALIZATION 0: Do not send initialization sequence (80 clocks of 1) before
sending this command; 1: Send initialization sequence before sending this command. (R/W)
After powered on, 80 clocks must be sent to card for initialization before sending any commands
IN
to card. Bit should be set while sending first command to card so that controller will initialize clocks
before sending command to card.
SDHOST_STOP_ABORT_CMD 0: Neither stop nor abort command can stop current data transfer.
IM
If abort is sent to function-number currently selected or not in data-transfer mode, then bit should
be set to 0; 1: Stop or abort command intended to stop current data transfer in progress. (R/W)
When open-ended or predefined data transfer is in progress, and host issues stop or abort com-
mand to stop data transfer, bit should be set so that command/data state-machines of CIU can
return correctly to idle state.
EL
SDHOST_WAIT_PRVDATA_COMPLETE 0: Send command at once, even if previous data transfer

has not completed; 1: Wait for previous data transfer to complete before sending Command. (R/W)
The SDHOST_WAIT_PRVDATA_COMPLETE] = 0 option is typically used to query status of card
during data transfer or to stop current data transfer. SDHOST_CARD_NUMBERr should be same
as in previous command.
PR
SDHOST_SEND_AUTO_STOP 0: No stop command is sent at the end of data transfer; 1: Send

stop command at the end of data transfer. (R/W)

Continued from the previous page ...
SDHOST_TRANSFER_MODE 0: Block data transfer command; 1: Stream data transfer command.

(R/W)
Don’t care if no data expected.
SDHOST_READ_WRITE 0: Read from card; 1: Write to card.

Don’t care if no data is expected from card. (R/W)
SDHOST_DATA_EXPECTED 0: No data transfer expected; 1: Data transfer expected. (R/W)
RY
SDHOST_CHECK_RESPONSE_CRC 0: Do not check; 1: Check response CRC.
Some of command responses do not return valid CRC bits. Software should disable CRC checks
for those commands in order to disable CRC checking by controller. (R/W)
SDHOST_RESPONSE_LENGTH 0: Short response expected from card; 1: Long response expected

from card. (R/W)
A
SDHOST_RESPONSE_EXPECT 0: No response expected from card; 1: Response expected from
card. (R/W)
SDHOST_CMD_INDEX Command index. (R/W)

IN
Register 27.12. SDHOST_RESP0_REG (0x0030)
IM
31 0
0x00000000 Reset
SDHOST_RESP0_REG Bit[31:0] of response. (RO)

EL
31 0
PR
0x00000000 Reset
SDHOST_RESP1_REG Bit[63:32] of long response. (RO)
31 0
0x00000000 Reset

Register 27.15. SDHOST_RESP3_REG (0x003C)
31 0
0x00000000 Reset
Register 27.16. SDHOST_MINTSTS_REG (0x0040)
SK
_M
SK
T
RY
UP
M
RR
_
US
E
NT
T
TA
_I
_S
O
DI
NT
_S
_I
)
ed
ST
ST
rv
HO
HO
se
SD
SD
(re
31 18 17 16 15 0
A
0x0000 0x0 0x0000 Reset
SDHOST_SDIO_INTERRUPT_MSK Interrupt from SDIO card, one bit for each card. Bit[17:16] cor-
respond to card1 and card0, respectively. SDIO interrupt for card is enabled only if corresponding
IN
sdhost_sdio_int_mask bit is set in Interrupt mask register (Setting mask bit enables interrupt). (RO)
SDHOST_INT_STATUS_MSK Interrupt enabled only if corresponding bit in interrupt mask register is

set. (RO)
IM
Bit 13 (SBE/BCI): RX Start Bit Error;
EL
Bit 10 (HTO): Data starvation by host timeout (HTO);

Bit 9 (DTRO): Data read timeout;
PR


Register 27.17. SDHOST_RINTSTS_REG (0x0044)
AW
_R
W
T
UP
RA
RR
_
US
E
NT
AT
ST
_I
O
_
DI
NT
_S
_I
d)
ST
ST
ve
HO
HO
er
s
SD
SD
(re
31 18 17 16 15 0
0x0000 0x0 0x0000 Reset
SDHOST_SDIO_INTERRUPT_RAW Interrupt from SDIO card, one bit for each card. Bit[17:16] cor-
RY
respond to card1 and card0, respectively. Setting a bit clears the corresponding interrupt bit and
writing 0 has no effect. (R/W)
0: No SDIO interrupt from card;
1: SDIO interrupt from card.
SDHOST_INT_STATUS_RAW Setting a bit clears the corresponding interrupt and writing 0 has no
A
effect. Bits are logged regardless of interrupt mask status. (R/W)
Bit 13 (SBE/BCI): RX Start Bit Error;
IN
Bit 10 (HTO): Data starvation by host timeout (HTO);
IM
Bit 9 (DTRO): Data read timeout;
EL

PR

Register 27.18. SDHOST_STATUS_REG (0x0048)
S
TE
Y
K
US
M K
TA
AR
ER R
_B
AT MA
_S
X
DE
A_ SY C
M
S
W R
AT BU E_M
TU
FS
X_ TE
IN
T
IF X_ Y
E_
_R WA
A
D_
UN
_F _T T
ST
_D A_ AT
HO T_F O_ LL
NS
P
AN
ST AT ST
O
ST IFO M
3_
SD S IF FU
PO
_C
E
M
HO T_D TA_
HO T_F O_
M
O
O
ES
O
SD S A
IF
SD S IF
_C
HO T_D
_R
_F
HO T_F
se d)
)
ed
ST
ST
ST
(re rve
SD S
SD OS
rv
HO
HO
HO
HO
se
H
SD
SD
SD
SD
SD
(re
31 30 29 17 16 11 10 9 8 7 4 3 2 1 0
0 0 0x000 0x00 1 1 1 0x1 0 1 1 0 Reset
SDHOST_FIFO_COUNT FIFO count, number of filled locations in FIFO. (RO)
RY
SDHOST_RESPONSE_INDEX Index of previous response, including any auto-stop sent by core.
(RO)
SDHOST_DATA_STATE_MC_BUSY Data transmit or receive state-machine is busy. (RO)
SDHOST_DATA_BUSY Inverted version of raw selected sdhost_card_data[0].
A
0: Card data not busy;
1: Card data busy. (RO) IN
SDHOST_DATA_3_STATUS Raw selected sdhost_card_data[3], checks whether card is present.
0: card not present;
1: card present. (RO)
SDHOST_COMMAND_FSM_STATES Command FSM states. (RO)

IM
0: Idle;
1: Send init sequence;
2: Send cmd start bit;
3: Send cmd tx bit;
4: Send cmd index + arg;
EL
5: Send cmd crc7;

6: Send cmd end bit;
7: Receive resp start bit;
8: Receive resp IRQ response;
9: Receive resp tx bit;
PR
10: Receive resp cmd idx;

11: Receive resp data;
12: Receive resp crc7;
13: Receive resp end bit;
14: Cmd path wait NCC;
15: Wait, cmd-to-response turnaround.

Register 27.18. SDHOST_STATUS_REG (0x0048)
Continued from the previous page ...
SDHOST_FIFO_FULL FIFO is full status. (RO)
SDHOST_FIFO_EMPTY FIFO is empty status. (RO)
SDHOST_FIFO_TX_WATERMARK FIFO reached Transmit watermark level, not qualified with data
transfer. (RO)
SDHOST_FIFO_RX_WATERMARK FIFO reached Receive watermark level, not qualified with data
transfer. (RO)
A RY
IN
IM
EL
PR

Register 27.19. SDHOST_FIFOTH_REG (0x004C)
ZE
SI
N_
IO
A CT
ANS
TR
E_
PL
K
TI
K
AR
UL
AR
M
M
A_
_W
X_
M
X
_D
_R
_T
d)
d)
d)
ST
ST
ST
ve
ve
ve
HO
HO
HO
er
er
r
se
s
s
SD
SD
SD
(re
(re
(re
31 30 28 27 26 16 15 12 11 0
RY
0 0x0 0 x x x x x x x x x x x 0 0 0 0 0x000 Reset
SDHOST_DMA_MULTIPLE_TRANSACTION_SIZE Burst size of multiple transaction, should be pro-

grammed same as DMA controller multiple-transaction-size SDHOST_SRC/DEST_MSIZE. (R/W)
000: 1-byte transfer;
A
IN
111: 256-byte transfer.
SDHOST_RX_WMARK FIFO threshold watermark level when receiving data to card.When FIFO data
IM
count reaches greater than this number , DMA/FIFO request is raised. During end of packet,
request is generated regardless of threshold programming in order to complete any remaining
data.In non-DMA mode, when receiver FIFO threshold (RXDR) interrupt is enabled, then interrupt
is generated instead of DMA request.During end of packet, interrupt is not generated if threshold
programming is larger than any remaining data. It is responsibility of host to read remaining bytes
EL
on seeing Data Transfer Done interrupt.In DMA mode, at end of packet, even if remaining bytes
are less than threshold, DMA request does single transfers to flush out any remaining bytes before
Data Transfer Done interrupt is set. (R/W)
SDHOST_TX_WMARK FIFO threshold watermark level when transmitting data to card. When FIFO
PR
data count is less than or equal to this number, DMA/FIFO request is raised. If Interrupt is en-
abled, then interrupt occurs. During end of packet, request or interrupt is generated, regardless of
threshold programming.In non-DMA mode, when transmit FIFO threshold (TXDR) interrupt is en-
abled, then interrupt is generated instead of DMA request. During end of packet, on last interrupt,
host is responsible for filling FIFO with only required remaining bytes (not before FIFO is full or after
CIU completes data transfers, because FIFO may not be empty). In DMA mode, at end of packet,
if last transfer is less than burst size, DMA controller does single cycles until required bytes are
transferred. (R/W)

Register 27.20. SDHOST_CDETECT_REG (0x0050)
_ N
CT
TE
DE
D_
AR
_C
)
ed
ST
v
HO
er
s
SD
(re
31 2 1 0
0x0000000 0x0 Reset
SDHOST_CARD_DETECT_N Value on sdhost_card_detect_n input ports (1 bit per card), read-only

bits. 0 represents presence of card. Only NUM_CARDS number of bits are implemented. (RO)
RY
Register 27.21. SDHOST_WRTPRT_REG (0x0054)
CT
TE
RO
A
_P
TE
RI
_W
)
ed
ST
rv
HO
se
IN
SD
(re
31 2 1 0
0x0000000 0x0 Reset
SDHOST_WRITE_PROTECT Value on sdhost_card_write_prt input ports (1 bit per card). 1 repre-

IM
sents write protection. Only NUM_CARDS number of bits are implemented. (RO)
Register 27.22. SDHOST_TCBCNT_REG (0x005C)

EL
31 0
0x00000000 Reset
SDHOST_TCBCNT_REG Number of bytes transferred by CIU unit to card. (RO)

PR
Register 27.23. SDHOST_TBBCNT_REG (0x0060)
31 0
0x00000000 Reset
SDHOST_TBBCNT_REG Number of bytes transferred between Host/DMA memory and BIU FIFO.
(RO)

Register 27.24. SDHOST_DEBNCE_REG (0x0064)
T
UN
CO
_
CE
UN
O
EB
_D
d)
ST
ve
HO
er
s
SD
(re
31 24 23 0
0 0 0 0 0 0 0 0 0x000000 Reset
SDHOST_DEBOUNCE_COUNT Number of host clocks (clk) used by debounce filter logic. The typi-
RY
cal debounce time is 5 ~ 25 ms to prevent the card instability when the card is inserted or removed.
(R/W)
Register 27.25. SDHOST_USRID_REG (0x0068)
A
31 0
0x00000000 Reset
IN
SDHOST_USRID_REG User identification register, value set by user. Can also be used as a scratch-
pad register by user. (R/W)
IM
Register 27.26. SDHOST_VERID_REG (0x006C)
31 0
0x5432270A Reset
EL
SDHOST_VERSIONID_REG Hardware version register. Can also be read by fireware. (RO)

PR

Register 27.27. SDHOST_HCON_REG (0x0070)
)
EG
)
EG
)
)
EG
)
EG
EG
)
EG
_R
EG
)
_R
EG
_R
_R
_R
IV
_R
_R
TH
_R
TH
_D
TH
SE
)
PE
M REG
ID
PE
ID
LK
NU
DI
ID
_W
TY
W
TY
N
W
_C
D_
RA _
D_
A_
_I
D
DR
A_
_
(S rve UM
AR
ST L
US
AT
AR
M
O HO
D
N
_C
_D
_D
_B
_A
_C
(re ST_
_
_
DH T
ST
ST
ST
ST
ST
)
DH )
)
DH d)
ed
ed
ST
(S OS
ve
O
rv
rv
HO
er
DH
DH
DH
DH
DH
se
se
sv
s
SD
(re
(re
(re
(S
(S
(S
(S
(S
(S
31 27 26 25 24 23 22 21 20 18 17 16 15 10 9 7 6 5 1 0
0x0 0x0 0x3 0x1 0x1 0x0 0x1 0x0 0x13 0x1 0x1 0x1 0x1 Reset
SDHOST_NUM_CLK_DIV_REG Have 4 clk divider in design . (RO)
RY
SDHOST_HOLD_REG Have a hold regiser in data path . (RO)
SDHOST_RAM_INDISE_REG Inside RAM in SDMMC module. (RO)
SDHOST_DMA_WIDTH_REG DMA data witdth is 32. (RO)
SDHOST_ADDR_WIDTH_REG Register address width is 32. (RO)
A
SDHOST_DATA_WIDTH_REG Regisger data widht is 32. (RO)
SDHOST_BUS_TYPE_REG Register config is APB bus. (RO)
SDHOST_CARD_NUM_REG Support card number is 2. (RO)

IN
SDHOST_CARD_TYPE_REG Hardware support SDIO and MMC. (RO)
IM
Register 27.28. SDHOST_UHS_REG (0x0074)
)
EG
_R
DR
EL
_D
ST
ed
d
O
ve
rv
DH
er
se
s
(S
re
re
31 18 17 16 15 0
0x0000 0x0 0x0000 Reset

PR
SDHOST_DDR_REG DDR mode selecton,1 bit for each card. (R/W)

0-Non-DDR mdoe.
1-DDR mdoe.

Register 27.29. SDHOST_RST_N_REG (0x0078)
ET
S
RE
D_
AR
_C
ST
_R
d)
ST
ve
HO
er
s
SD
(re
31 2 1 0
0x00000000 0x1 Reset
SDHOST_RST_CARD_RESET Hardware reset.

1: Active mode;
RY
0: Reset.
These bits cause the cards to enter pre-idle state, which requires them to be re-
initialized. SDHOST_RST_CARD_RESET[0] should be set to 1’b0 to reset card0, SD-
HOST_RST_CARD_RESET[1] should be set to 1’b0 to reset card1. (R/W)
A
IN
IM
EL
PR

Register 27.30. SDHOST_BMOD_REG (0x0080)
R
L
SW
PB
DE
O B
M _F
D_
D_
D_
_B OD
O
O
M
ST M
_B
_B
HO T_B
d)
)
ed
ST
ST
ve
SD OS
rv
HO
HO
er
se
H
s
SD
SD
SD
(re
(re
31 11 10 8 7 6 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 0 0x00 0 0 Reset
SDHOST_BMOD_PBL Programmable Burst Length. These bits indicate the maximum number of
beats to be performed in one IDMAC�Internal DMA Control�transaction. The IDMAC will always
attempt to burst as specified in PBL each time it starts a burst transfer on the host bus. The
RY
permissible values are 1, 4, 8, 16, 32, 64, 128 and 256. This value is the mirror of MSIZE of
FIFOTH register. In order to change this value, write the required value to FIFOTH register. This is
an encode value as follows: (RO)
A
IN
111: 256-byte transfer.
PBL is a read-only value and is applicable only for data access, it does not apply to descriptor
IM
access.
SDHOST_BMOD_DE IDMAC Enable. When set, the IDMAC is enabled. (RO)
SDHOST_BMOD_FB Fixed Burst. Controls whether the AHB Master interface performs fixed burst
transfers or not. When set, the AHB will use only SINGLE, INCR4, INCR8 or INCR16 during start of
EL
normal burst transfers. When reset, the AHB will use SINGLE and INCR burst transfer operations.
(R/W)
SDHOST_BMOD_SWR Software Reset. When set, the DMA Controller resets all its internal registers.
It is automatically cleared after one clock cycle. (R/W)
PR
Register 27.31. SDHOST_PLDMND_REG (0x0080)
31 0
0x00000000 Reset
SDHOST_PLDMND_REG Poll Demand. If the OWNER bit of a descriptor is not set, the FSM goes
to the Suspend state. The host needs to write any value into this register for the IDMAC FSM to
resume normal descriptor fetch operation. This is a write only . (WO)

Register 27.32. SDHOST_DBADDR_REG (0x0088)
31 0
0x00000000 Reset
SDHOST_DBADDR_REG Start of Descriptor List. Contains the base address of the First Descriptor.
The LSB bits [1:0] are ignored and taken as all-zero by the IDMAC internally. Hence these LSB bits
may be treated as read-only. (R/W)
A RY
IN
IM
EL
PR

Register 27.33. SDHOST_IDSTS_REG (0x008C)
DE
O
_C
M
H d) TS ES
BE
_I T S E
S
S_ S
ST DS _FB
S
NI
TS I
I
I
SD rve IDS _C
_D
DS _R
DS _A
_T
_F
_F
TS
TS
_I TS
se T_ TS
HO T_I TS
T
DS
DS
ST S
(re S DS
SD OS IDS
D
_I
_I
HO _I
HO T_I
H T_
)
)
ed
ed
ST
ST
T
SD S
SD OS
SD OS
rv
rv
HO
HO
HO
se
se
H
SD
SD
SD
SD
(re
(re
31 17 16 13 12 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 0x0 0 0 0 0 0 0 0 0 0 0 Reset
SDHOST_IDSTS_FSM DMAC FSM present state. (RO)

0: DMA_IDLE (idle state);
RY
1: DMA_SUSPEND (suspend state);
2: DESC_RD (descriptor reading state);
3: DESC_CHK (descriptor checking state);
4: DMA_RD_REQ_WAIT (read-data request waiting state);
5: DMA_WR_REQ_WAIT (write-data request waiting state);
A
6: DMA_RD (data-read state);
7: DMA_WR (data-write state);
8: DESC_CLOSE (descriptor close state).
IN
SDHOST_IDSTS_FBE_CODE Fatal Bus Error Code. Indicates the type of error that caused a Bus
Error. Valid only when the Fatal Bus Error bit IDSTS[2] is set. This field does not generate an
interrupt. (RO)
001: Host Abort received during transmission;
IM
010: Host Abort received during reception;
Others: Reserved.
SDHOST_IDSTS_AIS Abnormal Interrupt Summary. Logical OR of the following: IDSTS[2] : Fatal

Bus Interrupt, IDSTS[4] : DU bit Interrupt. Only unmasked bits affect this bit. This is a sticky bit
EL
and must be cleared each time a corresponding bit that causes AIS to be set is cleared. Writing 1
clears this bit. (R/W)
SDHOST_IDSTS_NIS Normal Interrupt Summary. Logical OR of the following: IDSTS[0] : Transmit

Interrupt, IDSTS[1] : Receive Interrupt. Only unmasked bits affect this bit. This is a sticky bit and
must be cleared each time a corresponding bit that causes NIS to be set is cleared. Writing 1
PR
clears this bit. (R/W)

Register 27.33. SDHOST_IDSTS_REG (0x008C)
SDHOST_IDSTS_CES Card Error Summary. Indicates the status of the transaction to/from the card,
also present in RINTSTS. Indicates the logical OR of the following bits: (R/W)
EBE : End Bit Error;
RTO : Response Timeout/Boot Ack Timeout;
RCRC : Response CRC;
SBE : Start Bit Error;
DRTO : Data Read Timeout/BDS timeout;
RY
DCRC : Data CRC for Receive;
RE : Response Error.
Writing 1 clears this bit. The abort condition of the IDMAC depends on the setting of this CES bit.
If the CES bit is enabled, then the IDMAC aborts on a response error.
SDHOST_IDSTS_DU Descriptor Unavailable Interrupt. This bit is set when the descriptor is unavail-
A
able due to OWNER bit = 0 (DES0[31] = 0). Writing 1 clears this bit. (R/W)
SDHOST_IDSTS_FBE Fatal Bus Error Interrupt. Indicates that a Bus Error occurred (IDSTS[12:10]) .
When this bit is set, the DMA disables all its bus accesses. Writing 1 clears this bit. (R/W)
IN
SDHOST_IDSTS_RI Receive Interrupt. Indicates the completion of data reception for a descriptor.
Writing 1 clears this bit. (R/W)
SDHOST_IDSTS_TI Transmit Interrupt. Indicates that data transmission is finished for a descriptor.
IM
Writing 1 clears this bit. (R/W)
EL
PR

Register 27.34. SDHOST_IDINTEN_REG (0x0090)
N_ ES
DI N E
DU
_I TE FB
I
EN I
EN I
I
_N
H d) NTE _C
NT _R
NT _A
_T
ST DIN N_
DI N
SD rve IDI EN
_I TE
HO T_I NTE
se T_ NT
ST DIN
(re S DI
SD S DI
HO T_I
HO T_I
HO T_I
)
SD d)
ed
e
SD OS
SD S
SD OS
rv
rv
HO
se
se
H
SD
(re
(re
31 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
SDHOST_IDINTEN_AI Abnormal Interrupt Summary Enable. When set, an abnormal interrupt is en-
abled. This bit enables the following bits:
IDINTEN[2]: Fatal Bus Error Interrupt; (R/W)
RY
IDINTEN[4]: DU Interrupt.
SDHOST_IDINTEN_NI Normal Interrupt Summary Enable. When set, a normal interrupt is enabled.
When reset, a normal interrupt is disabled. This bit enables the following bits: (R/W)
IDINTEN[0]: Transmit Interrupt;
IDINTEN[1]: Receive Interrupt.
A
SDHOST_IDINTEN_CES Card Error summary Interrupt Enable. When set, it enables the Card Inter-
rupt summary. (R/W)
IN
SDHOST_IDINTEN_DU Descriptor Unavailable Interrupt. When set along with Abnormal Interrupt
Summary Enable, the DU interrupt is enabled. (R/W)
SDHOST_IDINTEN_FBE Fatal Bus Error Enable. When set with Abnormal Interrupt Summary Enable,
IM
the Fatal Bus Error Interrupt is enabled. When reset, Fatal Bus Error Enable Interrupt is disabled.
(R/W)
SDHOST_IDINTEN_RI Receive Interrupt Enable. When set with Normal Interrupt Summary Enable,
Receive Interrupt is enabled. When reset, Receive Interrupt is disabled. (R/W)
EL
SDHOST_IDINTEN_TI Transmit Interrupt Enable. When set with Normal Interrupt Summary Enable,
Transmit Interrupt is enabled. When reset, Transmit Interrupt is disabled. (R/W)
Register 27.35. SDHOST_DSCADDR_REG (0x0094)

PR
31 0
0x00000000 Reset
SDHOST_DSCADDR_REG Host Descriptor Address Pointer, updated by IDMAC during operation

and cleared on reset. This register points to the start address of the current descriptor read by the
IDMAC. (RO)

Register 27.36. SDHOST_BUFADDR_REG (0x0098)
31 0
0x00000000 Reset
SDHOST_BUFADDR_REG Host Buffer Address Pointer, updated by IDMAC during operation and
cleared on reset. This register points to the current Data Buffer Address being accessed by the
IDMAC. (RO)
Register 27.37. SDHOST_CARDTHRCTL_REG (0x0100)
RY
)
EG
HR N_ G)
_R G)
)
EG
_R
DT TE RE
EN RE
LD
DR RIN N_
HO
AR CL RE
ES
_C D TH
R
ST R R
TH
O _CA DW
RD
DH T R
A
(S OS _CA
_C
ST
DH T
)
ed
(S OS
O
rv
A
DH
DH
se
(re
(S
(S
31 16 15 3 2 1 0
0x000 0x00 0 0 0 Reset

IN
SDHOST_CARDTHRESHOLD_REG The inside FIFO size is 512,This register is applicable when SD-
HOST_CARDERTHREN_REG is set to 1 or SDHOST_CARDRDTHREN_REG set to 1. (R/W)
SDHOST_CARDWRTHREN_REG Applicable when HS400 mode is enabled. (R/W)

IM
1’b0-Card write Threshold disabled.
1’b1-Card write Threshold enabled.
SDHOST_CARDCLRINTEN_REG Busy clear interrupt generation: (R/W)

1’b0-Busy clear interrypt disabled.
EL
1’b1-Busy clear interrypt enabled.
SDHOST_CARDRDTHREN_REG Card read threshold enable. (R/W)

1’b0-Card read threshold disabled.
1’b1-Card read threshold enabled.
PR

Register 27.38. SDHOST_EMMC_DDR_REG (0x010C)
)
EG
)
EG
_R
_R
IT
DE
TB
O
R
_M
TA
FS
00
S4
AL
_H
_H
ST
ST
d)
ve
O
O
er
DH
DH
s
(re
(S
(S
31 30 2 1 0
0x0 0x000000 0x0 Reset
SDHOST_HS400_MODE_REG Set 1 to enable HS400 mode. (R/W)
RY
SDHOST_HALFSTARTBIT_REG Control for start bit detection mechanism duration of start bit.Each
bit refers to one slot.Set this bit to 1 for eMMC4.5 and above,set to 0 for SD applications.For
eMMC4.5,start bit can be: (R/W)
1’b0-Full cycle.
1’b1-less than one full cycle.
A
Register 27.39. SDHOST_ENSHIFT_REG (0x0110)
IN
)
EG
_R
T
IF
SH
E_
BL
NA
IM
_E
ST
)
ed
O
rv
DH
se
(re
(S
31 4 3 0
0x0000000 0x0 Reset

EL
DHOST_ENABLE_SHIFT_REG Control for the amount of phase shift provided on the default enables
in the design.Two bits assigned for each card. (R/W)
2’b00-Default phase shift.
2’b01-Enables shifted to next immediate positive edge.
2’b10-Enables shifted to next immediate negative edge.
PR
2’b11-Reserved.
Register 27.40. SDHOST_BUFFIFO_REG (0x0200)
31 0
0x000000000 Reset
SDHOST_BUFFIFO_REG CPU write and read transmit data by FIFO. This register points to the cur-
rent Data FIFO . (RO)

Register 27.41. SDHOST_CLK_DIV_EDGE_REG (0x0800)
EL
L
E
SE
_S
_S
)
F_
M
EG
V
DR
SA
SL
_R
H
L
E_
E_
E_
E_
E_
E_
CE
DG
DG
DG
DG
DG
UR
D
E
_E
_E
_E
_E
_E
O
N_
IN
IN
IN
IN
IN
S
KI
ve LK_
K
CL
CL
CL
CL
CL
CL
_C
_C
_C
_C
_C
_C
_C
ST
d)
d)
ST
ST
ST
ST
ST
ST
ve
HO
HO
HO
HO
HO
HO
HO
er
er
D
s
SD
SD
SD
SD
SD
SD
(re
(re
(S
32 24 23 22 21 20 17 16 13 12 9 8 6 5 3 2 0
0x000 0x0 0x0 0x1 0x0 0x1 0x0 0x0 0x0 Reset
SDHOST_CLK_SOURCE_REG Set to 1 to use 160M PLL clock ,Set to 0 to use 40M XLTAL clock.
RY
(R/W)
CCLKIN_EDGE_N This value should be equal to CCLKIN_EDGE_L. (R/W)
CCLKIN_EDGE_L The low level of the divider clock. The value should be larger than
CCLKIN_EDGE_H. (R/W)
A
CCLKIN_EDGE_H The high level of the divider clock. The value should be smaller than
CCLKIN_EDGE_L. (R/W) IN
CCLKIN_EDGE_SLF_SEL It is used to select the clock phase of the internal signal from phase90,
phase180, or phase270. (R/W)
CCLKIN_EDGE_SAM_SEL It is used to select the clock phase of the input signal from phase90,
IM
CCLKIN_EDGE_DRV_SEL It is used to select the clock phase of the output signal from phase90,
Note: SD/MMC use this register to divide the 160M clock(CCLKIN_EDGE_H/CCLKIN_EDGE_L). The output
EL
clock connect to sdio slave divider by this register and SDHOST_CLKDIV_REG,there are 4 clock source to
seleced by SDHOST_CLKSRC_REG register.
PR

28 LED PWM Controller (LEDC)
28.1 Overview
The LED PWM Controller is a peripheral designed to generate PWM signals for LED control. It has specialized
features such as automatic duty cycle fading. However, the LED PWM Controller can also be used to generate
PWM signals for other purposes.
28.2 Features
The LED PWM Controller has the following features:
RY
• Eight independent PWM generators (i.e. eight channels)
• Four independent timers that support division by fractions
• Automatic duty cycle fading (i.e. gradual increase/decrease of a PWM’s duty cycle without interference
from the processors) with interrupt generation on fade completion
A
• Adjustable phase of PWM signal output
• PWM signal output in low-power mode (Light-sleep mode)

IN
• Maximum PWM resolution: 14 bits
Note that the four timers are identical regarding their features and operation. The following sections refer to the
timers collectively as Timerx (where x ranges from 0 to 3). Likewise, the eight PWM generators are also identical
in features and operation, and thus are collectively referred to as PWMn (where n ranges from 0 to 7).
IM
EL
PR
Figure 281. LED PWM Architecture

28.3.1 Architecture
Figure 28-1 shows the architecture of the LED PWM Controller.
The four timers can be independently configured (i.e. clock divider, and counter overflow value) and each
internally maintains a timebase counter (i.e. a counter that counts on cycles of a reference clock). Each PWM

generator will select one of the timers and uses the timer’s counter value as a reference to generate its PWM
signal.
Figure 28-2 illustrates the main functional blocks of the timer and the PWM generator.
A RY
Figure 282. LED PWM Generator Diagram
IN
28.3.2 Timers
Each timer in LED PWM Controller internally maintains a timebase counter. Referring to Figure 28-2, this clock
IM
signal used by the timebase counter is named ref_pulsex. All timers use the same clock source LEDC_CLKx,
which is then passed through a clock divider to generate ref_pulsex for the counter.
28.3.2.1 Clock Source

EL
Software configuring registers for LED PWM is clocked by APB_CLK. For more information about APB_CLK, see
Chapter 6 Reset and Clock. To use the LED PWM pheripheral, the APB_CLK signal to the LED PWM has to be
enabled. The APB_CLK signal to LED PWM can be enabled by setting the SYSTEM_LEDC_CLK_EN field in the
register SYSTEM_PERIP_CLK_EN0_REG and be reset via software by setting the SYSTEM_LEDC_RST field in
the register SYSTEM_PERIP_RST_EN0_REG. For more information, please refer to Table 13-1 in Chapter 13
PR
System Registers.
Timers in the LED PWM Controller choose their common clock source from one of the following clock signals:
APB_CLK, FOSC_CLK and XTAL_CLK (see Chapter 6 Reset and Clock for more details about each clock signal).
The procedure for selecting a clock source signal for LEDC_CLKx is described below:
• APB_CLK: Set LEDC_APB_CLK_SEL[1:0] to 1
• FOSC_CLK: Set LEDC_APB_CLK_SEL[1:0] to 2
• XTAL_CLK: Set LEDC_APB_CLK_SEL[1:0] to 3
The LEDC_CLKx signal will then be passed through the clock divider.

28.3.2.2 Clock Divider Configuration
The LEDC_CLKx signal is passed through a clock divider to generate the ref_pulsex signal for the counter. The
frequency of ref_pulsex is equal to the frequency of LEDC_CLKx divided by the LEDC_CLK_DIV_TIMERx divider
value (see Figure 28-2).
The LEDC_CLK_DIV_TIMERx divider value is a fractional clock divider. Thus, it supports non-integer divider
values. LEDC_CLK_DIV_TIMERx is configured via the LEDC_CLK_DIV_TIMERx field according to the following
equation.
B
LEDC_CLK_DIV _T IM ERx = A + 256
• A corresponds to the most significant 10 bits of LEDC_CLK_DIV_TIMERx (i.e.
RY
LEDC_TIMERx_CONF_REG[21:12])
• The fractional part B corresponds to the least significant 8 bits of LEDC_CLK_DIV_TIMERx

(i.e. LEDC_TIMERx_CONF_REG[11:4])
When the fractional part B is zero, LEDC_CLK_DIV_TIMERx is equivalent to an integer divider value (i.e. an
integer prescaler). In other words, a ref_pulsex clock pulse is generated after every A number of LEDC_CLKx
A
clock pulses.
However, when B is nonzero, LEDC_CLK_DIV_TIMERx becomes a non-integer divider value. The clock divider
implements non-integer frequency division by alternating between A and (A+1) LEDC_CLKx clock pulses per
IN
ref_pulsex clock pulse. This will result in the average frequency of ref_pulsex clock pulse being the desired
frequency (i.e. the non-integer divided frequency). For every 256 ref_pulsex clock pulses:
• A number of B ref_pulsex clock pulses will consist of (A+1) LEDC_CLKx clock pulses
IM
• A number of (256-B) ref_pulsex clock pulses will consist of A LEDC_CLKx clock pulses
• The ref_pulsex clock pulses consisting of (A+1) pulses are evenly distributed amongst those consisting of A
pulses
Figure 28-3 illustrates the relation between LEDC_CLKx clock pulses and ref_pulsex clock pulses when dividing
EL
by a non-integer LEDC_CLK_DIV_TIMERx.
PR
Figure 283. Frequency Division When LEDC_CLK_DIV_TIMERx is a NonInteger Value
To change the timer’s clock divider value at runtime, first set the LEDC_CLK_DIV_TIMERx field, and then set the
LEDC_TIMERx_PARA_UP field to apply the new configuration. This will cause the newly configured values to
take effect upon the next overflow of the counter. LEDC_TIMERx_PARA_UP field will be automatically cleared by
hardware.

28.3.2.3 14bit Counter
Each timer contains a 14-bit timebase counter that uses ref_pulsex as its reference clock (see Figure 28-2). The
LEDC_TIMERx_DUTY_RES field configures the overflow value of this 14-bit counter. Hence, the maximum
resolution of the PWM signal is 14 bits. The counter counts up to 2LEDC_T IM ERx_DU T Y _RES − 1, overflows and
begins counting from 0 again. The counter’s value can be read, reset, and suspended by software.
The counter can trigger LEDC_TIMERx_OVF_INT interrupt (generated automatically by hardware without
configuration) every time the counter overflows. It can also be configured to trigger LEDC_OVF_CNT_CHn_INT
interrupt after the counter overflows LEDC_OV F _N U M _CHn + 1 times. To configure
LEDC_OVF_CNT_CHn_INT interrupt, please:
1. Configure LEDC_TIMER_SEL_CHn as the counter for the PWM generator
RY
2. Enable the counter by setting LEDC_OVF_CNT_EN_CHn
3. Set LEDC_OVF_NUM_CHn to the number of counter overflows to generate an interrupt, minus 1
4. Enable the overflow interrupt by setting LEDC_OVF_CNT_CHn_INT_ENA
5. Set LEDC_TIMERx_DUTY_RES to enable the timer and wait for a LEDC_OVF_CNT_CHn_INT interrupt
A
Referring to Figure 28-2, the frequency of a PWM generator output signal (sig_outn) is dependent on the
frequency of the timer’s clock source (LEDC_CLKx), the clock divider value (LEDC_CLK_DIV_TIMERx), and the
range of the counter (LEDC_TIMERx_DUTY_RES):
IN
fLEDC_CLKx
fPWM =
LEDC_CLK_DIVx · 2LEDC_TIMERx_DUTY_RES
IM
To change the overflow value at runtime, first set the LEDC_TIMERx_DUTY_RES field, and then set the
LEDC_TIMERx_PARA_UP field. This will cause the newly configured values to take effect upon the next overflow
of the counter. If LEDC_OVF_CNT_EN_CHn field is reconfigured, LEDC_TIMERx_PARA_UP should also be set to
apply the new configuration. In summary, these configuration values need to be updated by setting
LEDC_TIMERx_PARA_UP. LEDC_TIMERx_PARA_UP field will be automatically cleared by hardware.
EL
28.3.3 PWM Generators

To generate a PWM signal, a PWM generator (PWMn) selects a timer (Timerx). Each PWM generator can be
configured separately by setting LEDC_TIMER_SEL_CHn to use one of four timers to generate the PWM
output.
PR
As shown in Figure 28-2, each PWM generator has a comparator and two multiplexers. A PWM generator
compares the timer’s 14-bit counter value (Timerx_cnt) to two trigger values Hpointn and Lpointn. When the
timer’s counter value is equal to Hpointn or Lpointn, the PWM signal is high or low, respectively, as described
below:
• If Timerx_cnt == Hpointn, sig_outn is 1.
• If Timerx_cnt == Lpointn, sig_outn is 0.
Figure 28-4 illustrates how Hpointn or Lpointn are used to generate a fixed duty cycle PWM output signal.
For a particular PWM generator (PWMn), its Hpointn is sampled from the LEDC_HPOINT_CHn field each time the
selected timer’s counter overflows. Likewise, Lpointn is also sampled on every counter overflow and is calculated
from the sum of the LEDC_DUTY_CHn[18:4] and LEDC_HPOINT_CHn fields. By setting Hpointn and Lpointn via

Figure 284. LED_PWM Output Signal Diagram
the LEDC_HPOINT_CHn and LEDC_DUTY_CHn[18:4] fields, the relative phase and duty cycle of the PWM
output can be set.
RY
The PWM output signal (sig_outn) is enabled by setting LEDC_SIG_OUT_EN_CHn. When
LEDC_SIG_OUT_EN_CHn is cleared, PWM signal output is disabled, and the output signal (sig_outn) will output
a constant level as specified by LEDC_IDLE_LV_CHn.
The bits LEDC_DUTY_CHn[3:0] are used to dither the duty cycles of the PWM output signal (sig_outn) by
periodically altering the duty cycle of sig_outn. When LEDC_DUTY_CHn[3:0] is set to a non-zero value, then for
A
every 16 cycles of sig_outn, LEDC_DUTY_CHn[3:0] of those cycles will have PWM pulses that are one timer tick
longer than the other (16- LEDC_DUTY_CHn[3:0]) cycles. For instance, if LEDC_DUTY_CHn[18:4] is set to 10
and LEDC_DUTY_CHn[3:0] is set to 5, then 5 of 16 cycles will have a PWM pulse with a duty value of 11 and the
IN
rest of the 16 cycles will have a PWM pulse with a duty value of 10. The average duty cycle after 16 cycles is
10.3125.
If fields LEDC_TIMER_SEL_CHn, LEDC_HPOINT_CHn, LEDC_DUTY_CHn[18:4] and LEDC_SIG_OUT_EN_CHn

are reconfigured, LEDC_PARA_UP_CHn must be set to apply the new configuration. This will cause the newly
IM
configured values to take effect upon the next overflow of the counter. LEDC_PARA_UP_CHn field will be
automatically cleared by hardware.
28.3.4 Duty Cycle Fading

EL
The PWM generators can fade the duty cycle of a PWM output signal (i.e. gradually change the duty cycle from
one value to another). If Duty Cycle Fading is enabled, the value of Lpointn will be incremented/decremented
after a fixed number of counter overflows occurs. Figure 28-5 illustrates Duty Cycle Fading.
PR
Figure 285. Output Signal Diagram of Fading Duty Cycle
Duty Cycle Fading is configured using the following register fields:
• LEDC_DUTY_CHn is used to set the initial value of Lpointn
• LEDC_DUTY_START_CHn will enable/disable duty cycle fading when set/cleared

• LEDC_DUTY_CYCLE_CHn sets the number of counter overflow cycles for every Lpointn
increment/decrement. In other words, Lpointn will be incremented/decremented after
LEDC_DUTY_CYCLE_CHn counter overflows.
• LEDC_DUTY_INC_CHn configures whether Lpointn is incremented/decremented if set/cleared
• LEDC_DUTY_SCALE_CHn sets the amount that Lpointn is incremented/decremented
• LEDC_DUTY_NUM_CHn sets the maximum number of increments/decrements before duty cycle fading
stops.
If the fields LEDC_DUTY_CHn, LEDC_DUTY_START_CHn, LEDC_DUTY_CYCLE_CHn, LEDC_DUTY_INC_CHn,

LEDC_DUTY_SCALE_CHn, and LEDC_DUTY_NUM_CHn are reconfigured, LEDC_PARA_UP_CHn must be set
to apply the new configuration. After this field is set, the values for duty cycle fading will take effect at once.
RY
LEDC_PARA_UP_CHn field will be automatically cleared by hardware.
28.3.5 Interrupts
• LEDC_OVF_CNT_CHn_INT: Triggered when the timer counter overflows for (LEDC_OVF_NUM_CHn + 1)
times and the register LEDC_OVF_CNT_EN_CHn is set to 1.
A
• LEDC_DUTY_CHNG_END_CHn_INT: Triggered when a fade on an LED PWM generator has finished.
• LEDC_TIMERx_OVF_INT: Triggered when an LED PWM timer has reached its maximum counter value.
IN
IM
EL
PR


The addresses in this section are relative to LED PWM Controller base address provided in Table 3-4 in Chapter 3
System and Memory.

LEDC_CH0_CONF0_REG Configuration register 0 for channel 0 0x0000 varies
LEDC_CH0_CONF1_REG Configuration register 1 for channel 0 0x000C R/W
LEDC_CH1_CONF1_REG Configuration register 1 for channel 1 0x0020 R/W
RY
LEDC_CH3_CONF0_REG Configuration register 0 for channel 3 0x003C varies
LEDC_CH4_CONF1_REG Configuration register 1 for channel 4 0x005C R/W
A
LEDC_CH6_CONF1_REG
LEDC_CH7_CONF0_REG
IN
Configuration register 1 for channel 6
0x0084
0x008C
R/W
varies
LEDC_CONF_REG Global ledc configuration register 0x00D0 R/W
IM
Hpoint Register
LEDC_CH0_HPOINT_REG High point register for channel 0 0x0004 R/W
LEDC_CH2_HPOINT_REG High point register for channel 2 0x002C R/W
EL

LEDC_CH6_HPOINT_REG High point register for channel 6 0x007C R/W
Duty Cycle Register
PR
LEDC_CH0_DUTY_REG Initial duty cycle for channel 0 0x0008 R/W

LEDC_CH0_DUTY_R_REG Current duty cycle for channel 0 0x0010 RO
LEDC_CH1_DUTY_REG Initial duty cycle for channel 1 0x001C R/W
LEDC_CH3_DUTY_R_REG Current duty cycle for channel 3 0x004C RO
LEDC_CH5_DUTY_REG Initial duty cycle for channel 5 0x006C R/W


LEDC_CH7_DUTY_R_REG Current duty cycle for channel 7 0x009C RO
Timer Register
LEDC_TIMER0_CONF_REG Timer 0 configuration 0x00A0 varies
LEDC_TIMER0_VALUE_REG Timer 0 current counter value 0x00A4 RO
LEDC_TIMER1_CONF_REG Timer 1 configuration 0x00A8 varies
LEDC_TIMER1_VALUE_REG Timer 1 current counter value 0x00AC RO
RY
LEDC_TIMER2_CONF_REG Timer 2 configuration 0x00B0 varies
LEDC_TIMER2_VALUE_REG Timer 2 current counter value 0x00B4 RO
LEDC_TIMER3_CONF_REG Timer 3 configuration 0x00B8 varies
LEDC_TIMER3_VALUE_REG Timer 3 current counter value 0x00BC RO
Interrupt Register
A
LEDC_INT_RAW_REG Raw interrupt status 0x00C0 RO
LEDC_INT_ST_REG Masked interrupt status 0x00C4 RO
LEDC_INT_ENA_REG Interrupt enable bits 0x00C8 R/W
LEDC_INT_CLR_REG
Version Register
IN
Interrupt clear bits 0x00CC WO
LEDC_DATE_REG Version control register 0x00FC R/W

IM
EL
PR

28.5 Registers
The addresses in this section are relative to LED PWM Controller base address provided in Table 3-4 in Chapter 3
System and Memory.
Register 28.1. LEDC_CHn_CONF0_REG (n: 07) (0x0000+0x14*n)
CH H n
N_ _C CH
n n
_E ET T_
NT ES _S
n
_C _R ET
_S _CH
Hn
Hn
VF NT ES
DC _O CH n
_C
LE SIG LV_ CH
U n
N
_C
_O F_C T_R
IM T_E
EL
_ E_ _
UM
DC DL UP
DC V N
LE C_O F_C
_N
LE C_I RA_
ER
VF
D V
)
D A
ed
LE C_O
_O
LE C_P
_T
rv
RY
DC
se
D
LE
LE
LE
(re
31 18 17 16 15 14 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 0 0 0 0x0 Reset
LEDC_TIMER_SEL_CHn This field is used to select one of timers for channel n.
0: select timer0
A
1: select timer1
2: select timer2
3: select timer3 (R/W)

IN
LEDC_SIG_OUT_EN_CHn Set this bit to enable signal output on channel n. (R/W)
IM
LEDC_IDLE_LV_CHn This bit is used to control the output value when channel n is inactive (when
LEDC_SIG_OUT_EN_CHn is 0). (R/W)
LEDC_PARA_UP_CHn This bit is used to update the listed fields below for channel n, and will be
automatically cleared by hardware. (WO)
EL
• LEDC_HPOINT_CHn
• LEDC_DUTY_START_CHn
• LEDC_SIG_OUT_EN_CHn
• LEDC_TIMER_SEL_CHn
PR
• LEDC_DUTY_NUM_CHn
• LEDC_DUTY_CYCLE_CHn
• LEDC_DUTY_SCALE_CHn
• LEDC_DUTY_INC_CHn
• LEDC_OVF_CNT_EN_CHn

Register 28.1. LEDC_CHn_CONF0_REG (n: 07) (0x0000+0x14*n)
LEDC_OVF_NUM_CHn This register is used to configure the maximum times of overflow minus
1. The LEDC_OVF_CNT_CHn_INT interrupt will be triggered when channel n overflows for
(LEDC_OVF_NUM_CHn + 1) times. (R/W)
LEDC_OVF_CNT_EN_CHn This bit is used to count the number of times when the timer selected by
channel n overflows.(R/W)
LEDC_OVF_CNT_RESET_CHn Set this bit to reset the timer-overflow counter of channel n. (WO)
RY
LEDC_OVF_CNT_RESET_ST_CHn This is the status bit of LEDC_OVF_CNT_RESET_CHn. (RO)
Register 28.2. LEDC_CHn_CONF1_REG (n: 07) (0x000C+0x14*n)
A n
Hn
CH Hn
CH
Hn
_C
C_ C
n
E_
IN T_
_C
LE
CL
Y_ AR
CA
NU
CY
UT ST
_S
_D TY_
Y_
Y_
TY
UT
UT
DC U
DU
IN
LE C_D
_D
_D
C_
DC
DC
D
D
LE
LE
LE
LE
31 30 29 20 19 10 9 0
0 1 0x0 0x0 0x0 Reset

IM
LEDC_DUTY_SCALE_CHn This register is used to configure the changing step scale of duty on chan-
nel n. (R/W)
LEDC_DUTY_CYCLE_CHn The duty will change every LEDC_DUTY_CYCLE_CHn on channel n.

(R/W)
EL
LEDC_DUTY_NUM_CHn This register is used to control the number of times the duty cycle will be
changed. (R/W)
LEDC_DUTY_INC_CHn This register is used to increase or decrease the duty of output signal on
channel n. 1: Increase; 0: Decrease. (R/W)
PR
LEDC_DUTY_START_CHn Other configured fields in LEDC_CHn_CONF1_REG will start to take ef-

fect upon the next timer overflow when this bit is set to 1. (R/W)

Register 28.3. LEDC_CONF_REG (0x00D0)
L
_SE
LK
EN
_C
K_
PB
L
d)
_C
_A
ve
DC
DC
ser
LE
LE
(re
31 30 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
LEDC_APB_CLK_SEL This field is used to select the common clock source for all the 4 timers.
1: APB_CLK; 2: FOSC_CLK; 3: XTAL_CLK. (R/W)
RY
LEDC_CLK_EN This bit is used to control clock.
1: Force clock on for register. 0: Support clock only when application writes registers. (R/W)
Register 28.4. LEDC_CHn_HPOINT_REG (n: 07) (0x0004+0x14*n)
A IN
CH
T_
n
IN
PO
d)
_H
e
rv
DC
se
LE
(re
31 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x00 Reset
IM
LEDC_HPOINT_CHn The output value changes to high when the selected timers has reached the
value specified by this register. (R/W)
EL
Register 28.5. LEDC_CHn_DUTY_REG (n: 07) (0x0008+0x14*n)

Hn
_C
U TY
)
ed
_D
rv
DC
se
LE
(re
PR
31 19 18 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0x000 Reset
LEDC_DUTY_CHn This register is used to change the output duty by controlling the Lpoint. The
output value turns to low when the selected timers has reached the Lpoint. (R/W)

Register 28.6. LEDC_CHn_DUTY_R_REG (n: 07) (0x0010+0x14*n)
H n
_C
_R
TY
U
d)
_D
ve
DC
s er
LE
(re
31 19 18 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0x000 Reset
LEDC_DUTY_R_CHn This register stores the current duty of output signal on channel n. (RO)
RY
Register 28.7. LEDC_TIMERx_CONF_REG (x: 03) (0x00A0+0x8*x)
ES
P
_R
_U
ER
E
TY
US
RA
M
x_ T
TI
DU
ER S
PA
PA
R
V_
D d) x_
IM x_
x_
I
_D
LE rve ER
_T ER
ER
LK
se IM
DC IM
M
)
ed
TI
_C
(re C_T
LE C_T
A
C_
rv
DC
se
D
LE
LE
LE
(re
31 26 25 24 23 22 21 4 3 0
0 0 0 0 0 0 0 0 1 0 0x000 0x0 Reset

IN
LEDC_TIMERx_DUTY_RES This register is used to control the range of the counter in timer x. (R/W)
LEDC_CLK_DIV_TIMERx This register is used to configure the divisor for the divider in timer x. The
IM
least significant eight bits represent the fractional part. (R/W)
LEDC_TIMERx_PAUSE This bit is used to suspend the counter in timer x. (R/W)
LEDC_TIMERx_RST This bit is used to reset timer x. The counter will show 0 after reset. (R/W)
EL
LEDC_TIMERx_PARA_UP Set this bit to update LEDC_CLK_DIV_TIMERx and

LEDC_TIMERx_DUTY_RES. (WO)
Register 28.8. LEDC_TIMERx_VALUE_REG (x: 03) (0x00A4+0x8*x)

PR
T
CN
x_
ER
IM
d)
_T
e
rv
DC
se
LE
(re
31 14 13 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x00 Reset
LEDC_TIMERx_CNT This register stores the current counter value of timer x. (RO)

0
0
31
31
0
0
0
0
0
0
(RO)
0
0
Espressif Systems
0
0
(re (re
set to 1. (RO)
0
0
se se
r
PR
ve rv
ed
0
0
d) )
0
0
0
0
0
0
0
20
0
20
0
0
19
19
LE LE
LEDC_OVF_CNT_CHn_INT_ST This
DC D
EL
0
0
18
18
ual change of duty has finished. (RO)

LE _O LE C_O
D V DC V
is
0
0
17
17
LE C_O F_C LE _O F_C

D V N D V N
0
0
16
16
LE C_O F_C T_C LE C_O F_C T_C

DC V N H DC V N H
the
0
0
15
15
LE _O F_C T_C 7_I LE _O F_C T_C 7_I

D V N H NT D V N H NT
660
IM
0
0
14
14
LE C_O F_C T_C 6_I _S LE C_O F_C T_C 6_I _R

D V N H NT T D V N H NT AW
0
0
13
13

DC V N H NT T DC V N H NT AW
0
0
12
12
LE _O F_C T_C 4_I _S LE _O F_C T_C 4_I _R
masked
0
0
11
11

reached the value specified by LEDC_OVF_NUM_CHn. (RO)

0
0
interrupt when LEDC_TIMERx_OVF_INT_ENA is set to 1. (RO)

10
10
LE C_D F_C T_C 2_I _S LE C_D F_C T_C 2_I _R

D U N H NT T D U N H NT AW
9
9
0
0
LE C_D TY_ T_C 1_I _S

D U C H NT T
IN LE C_D TY_ T_C 1_I _R
D U C H NT AW
8
8
0
0
interrupt
LE C_D TY_ HN 0_I _S LE C_D TY_ HN 0_I _R
D U C G_ NT T D U C G_ NT AW
Register 28.10. LEDC_INT_ST_REG (0x00C4)
Register 28.9. LEDC_INT_RAW_REG (0x00C0)
7
7
0
0
LE C_D TY_ HN EN _S LE C_D TY_ HN EN _R

D U C G_ D_ T D U C G_ D_ AW
6
6
0
0
LE C_D TY_ HN EN CH LE C_D TY_ HN EN CH

D U C G_ D_ 7_ D U C G_ D_ 7_
A
5
5
0
0
status
LE C_D TY_ HN EN CH IN LE C_D TY_ HN EN CH IN
D U C G_ D_ 6_ T_ D U C G_ D_ 6_ T_
4
4
0
0
LE C_D TY_ HN EN CH IN ST LE C_D TY_ HN EN CH IN RAW

D U C G_ D_ 5_ T_ D U C G _ D _ 5_ T_
3
3
bit
0
0
LE C_D TY_ HN EN CH IN ST LE C_D TY_ HN EN CH IN RAW

D U C G_ D_ 4_ T_ D U C G_ D_ 4_ T_
2
2
0
0
LE C_T TY_ HN EN CH IN ST LE C_T TY_ HN EN CH IN RAW

D IM C G_ D_ 3_ T_ D IM C G_ D_ 3_ T_
for
1
1
0
0
LE C_T ER HN EN CH IN ST LE C_T ER HN EN CH IN RAW
LEDC_OVF_CNT_CHn_INT interrupt when LEDC_OVF_CNT_CHn_INT_ENA is set to 1. (RO)

D IM 3_ G_ D_ 2_ T_ D IM 3_ G_ D_ 2_ T_
0
0
LE C_T ER OV EN CH IN ST LE C_T ER OV EN CH IN RAW

DC IM 2_ F_ D_ 1_ T_S DC IM 2_ F_ D_ 1_ T_R
the
LEDC_DUTY_CHNG_END_CHn_INT interrupt when LEDC_DUTY_CHNG_END_CHn_INT_ENAIS
LEDC_DUTY_CHNG_END_CHn_INT_ST This is the masked interrupt status bit for the
LEDC_TIMERx_OVF_INT_ST This is the masked interrupt status bit for the LEDC_TIMERx_OVF_INT
LEDC_OVF_CNT_CHn_INT_RAW Interrupt raw bit for channel n. Triggered when the ovf_cnt has
LEDC_DUTY_CHNG_END_CHn_INT_RAW Interrupt raw bit for channel n. Triggered when the grad-
LEDC_TIMERx_OVF_INT_RAW Triggered when the timerx has reached its maximum counter value.
_T ER OV INT CH INT T _T ER OV INT CH INT AW

RY
IM 1_ F_ _S 0_ _S IM 1_ F_ _R 0_ _R
0 Reset
0 Reset
ER OV IN T IN T ER OV IN AW IN A
0_ F_ T_S T_ 0_ F_ T_R T_ W

O IN T ST O IN A RA
VF T_ VF T_ W W
_I ST _I R
NT NT AW
_S _R
T AW
0
0
31
31
0
0
0
0
0
0
(R/W)
0
0
Espressif Systems
0
0
rupt. (R/W)
(re (re
s
0
0
se er
PR
rv ve
ed
0
0
) d)
0
0
0
0
0
0
0
20
0
20
0
0
19
19
LE LE
DC D
EL
0
0
18
18
LE _O LE C_O
D V DC V
0
0
17
17
LE C_O F_C LE _O F_C

D V N D V N
0
0
16
16
LE C_O F_C T_C LE C_O F_C T_C

D V N H
LEDC_DUTY_CHNG_END_CHn_INT_CLR Set
DC V N H
LEDC_DUTY_CHNG_END_CHn_INT_ENA The
0
0
15
15
LE C_O F_C T_C 7_I LE _O F_C T_C 7_I

D V N H NT D V N H NT
661
IM
0
0
14
14
LE C_O F_C T_C 6_I _C LE C_O F_C T_C 6_I _E

D V N H NT LR D V N H NT NA
LEDC_DUTY_CHNG_END_CHn_INT interrupt. (WO)

0
0
13
13
LEDC_DUTY_CHNG_END_CHn_INT interrupt. (R/W)

DC V N H NT LR D V N H NT NA
0
0
this
12
12
LE _O F_C T_C 4_I _C LE C_O F_C T_C 4_I _E

0
0
11
11
interrupt


0
0
10
10
LE C_D F_C T_C 2_I _C LE C_D F_C T_C 2_I _E

D U N H NT LR D U N H NT NA
9
9
0
0
bit
LE C_D TY_ T_C 1_I _C
D U C H NT LR
IN LE C_D TY_ T_C 1_I _E
D U C H NT NA
8
8
0
0
LE C_D TY_ HN 0_I _C LE C_D TY_ HN 0_I _E

D U C G_ NT LR D U C G_ NT NA
Register 28.11. LEDC_INT_ENA_REG (0x00C8)
7
7
Register 28.12. LEDC_INT_CLR_REG (0x00CC)
0
0
enable
LE C_D TY_ HN EN _C LE C_D TY_ HN EN _E

D U C G_ D_ LR D U C G_ D_ NA
to
6
6
0
0
LE C_D TY_ HN EN CH LE C_D TY_ HN EN CH

DC U C G_ D_ 7_ D U C G_ D_ 7_
A
5
5
0
0
LE _D TY_ HN EN CH IN LE C_D TY_ HN EN CH IN

bit
D U C G_ D_ 6_ T_ D U C G_ D_ 6_ T_
4
4
0
0
LE C_D TY_ HN EN CH IN CLR LE C_D TY_ HN EN CH IN ENA

D U C G_ D_ 5_ T_ D U C G _ D _ 5_ T_
3
3
0
0
LE C_D TY_ HN EN CH IN CLR LE C_D TY_ HN EN CH IN ENA

D U C G_ D_ 4_ T_ D U C G_ D_ 4_ T_
clear
2
2
0
0
for
LE C_T TY_ HN EN CH IN CLR LE C_T TY_ HN EN CH IN ENA

D IM C G_ D_ 3_ T_ D IM C G_ D_ 3_ T_
1
1
0
0
LE C_T ER HN EN CH IN CLR LE C_T ER HN EN CH IN ENA
LEDC_TIMERx_OVF_INT_CLR Set this bit to clear the LEDC_TIMERx_OVF_INT interrupt. (WO)

D IM 3_ G_ D_ 2_ T_ D IM 3_ G_ D_ 2_ T_
0
0
LE C_T ER OV EN CH IN CLR LE C_T ER OV EN CH IN ENA

DC IM 2_ F_ D_ 1_ T_C DC IM 2_ F_ D_ 1_ T_E
LEDC_OVF_CNT_CHn_INT_CLR Set this bit to clear the LEDC_OVF_CNT_CHn_INT interrupt. (WO)

the
the
LEDC_OVF_CNT_CHn_INT_ENA The interrupt enable bit for the LEDC_OVF_CNT_CHn_INT inter-

LEDC_TIMERx_OVF_INT_ENA The interrupt enable bit for the LEDC_TIMERx_OVF_INT interrupt.
_T ER OV INT CH INT LR _T ER OV INT CH INT NA

RY
IM 1_ F_ _C 0_ _C IM 1_ F_ _E 0_ _E
0 Reset
0 Reset
ER OV IN LR IN L ER OV IN NA IN N
0_ F_ T_C T_ R 0_ F_ T_E T_ A

O IN L CL O IN N EN
VF T_ R R VF T_ A A
_I C _I EN
NT LR NT A
_C _E
LR NA
Register 28.13. LEDC_DATE_REG (0x00FC)
TE
DA
C_
D
LE
31 0
0x19072601 Reset
LEDC_DATE This is the version control register. (R/W)
A RY
IN
IM
EL
PR

29 Motor Control PWM (MCPWM)
29.1 Overview
The Motor Control Pulse Width Modulator (MCPWM) peripheral is intended for motor and power control. It
provides six PWM outputs that can be set up to operate in several topologies. One common topology uses a pair
of PWM outputs driving an H-bridge to control motor rotation speed and rotation direction.
The timing and control resources inside are allocated into two major types of submodules: PWM timers and
PWM operators. Each PWM timer provides timing references that can either run freely or be synced to other
timers or external sources. Each PWM operator has all necessary control resources to generate waveform pairs
RY
for one PWM channel. The MCPWM peripheral also contains a dedicated capture submodule that is used in
systems where accurate timing of external events is important.
ESP32-S3 contains two MCPWM peripherals: MCPWM0 and MCPWM1.
29.2 Features
A
Each MCPWM peripheral has one clock divider (prescaler), three PWM timers, three PWM operators, and a
capture module. Figure 29-1 shows the submodules inside and the signals on the interface. PWM timers are
used for generating timing references. The PWM operators generate desired waveform based on the timing
IN
references. Any PWM operator can be configured to use the timing references of any PWM timers. Different
PWM operators can use the same PWM timer’s timing references to produce related PWM signals. PWM
operators can also use different PWM timers’ values to produce the PWM signals that work alone. Different PWM
timers can also be synchronized together.
IM
EL
PR
Figure 291. MCPWM Module Overview
An overview of the submodules’ function in Figure 29-1 is shown below:

• PWM Timers 0, 1 and 2
– Every PWM timer has a dedicated 8-bit clock prescaler.
– The 16-bit counter in the PWM timer can work in count-up mode, count-down mode or
count-up-down mode.
– A hardware sync or software sync can trigger a reload on the PWM timer with a phase register. It will
also trigger the prescaler’s restart, so that the timer’s clock can also be synced. The source of the
hard sync can come from any GPIO or any other PWM timer’s sync_out. The source of the soft sync
comes from writing toggle value to the MCPWM_TIMERx_SYNC_SW bit.
• PWM Operators 0, 1 and 2
RY
– Every PWM operator has two PWM outputs: PWMxA and PWMxB. They can work independently, in
symmetric and asymmetric configuration.
– Software, asynchronously override control of PWM signals.
– Configurable dead-time on rising and falling edges; each set up independently.
– All events can trigger CPU interrupts.
A
– Modulating of PWM output by high-frequency carrier signals, useful when gate drivers are insulated
with a transformer.
IN
– Period, time stamps and important control registers have shadow registers with flexible updating
methods.
• Fault Detection Module

IM
– Programmable fault handling allocated on fault condition in both cycle-by-cycle mode and one-shot
mode.
– A fault condition can force the PWM output to either high or low logic levels.
• Capture Module
EL
– Speed measurement of rotating machinery (for example, toothed sprockets sensed with Hall sensors)
– Measurement of elapsed time between position sensor pulses
– Period and duty-cycle measurement of pulse train signals
– Decoding current or voltage amplitude derived from duty-cycle-encoded signals of current/voltage

PR
sensors
– Three individual capture channels, each of which has a time-stamp register (32 bits)
– Selection of edge polarity and prescaling of input capture signal
– The capture timer can sync with a PWM timer or external signals.
– Interrupt on each of the three capture channels

29.3 Submodules
29.3.1 Overview
This section lists the configuration parameters of key submodules. For information on adjusting a specific
parameter, e.g. synchronization source of PWM timer, please refer to Section 29.3.2 for details.
29.3.1.1 Prescaler Submodule
RY
Figure 292. Prescaler Submodule
Configuration option:
• Scale the CRYPTO_PWM_CLK.
A
29.3.1.2 Timer Submodule
IN
IM
EL
Figure 293. Timer Submodule
Configuration options:
PR
• Set the PWM timer frequency or period.
• Configure the working mode for the timer:
– Count-Up Mode: for asymmetric PWM outputs
– Count-Down Mode: for asymmetric PWM outputs
– Count-Up-Down Mode: for symmetric PWM outputs
• Configure the the reloading phase (including the value and the direction) used during software and
hardware synchronization.
• Synchronize the PWM timers with each other. Either hardware or software synchronization may be used.
• Configure the source of the PWM timer’s the synchronization input to one of the seven sources below:

– The three PWM timer’s synchronization outputs.
– Three synchronization signals from the GPIO matrix: PWMn_SYNC0_IN, PWMn_SYNC1_IN,

PWMn_SYNC2_IN.
– No synchronization input signal selected
• Configure the source of the PWM timer’s synchronization output to one of the four sources below:
– Synchronization input signal
– Event generated when value of the PWM timer is equal to zero
– Event generated when value of the PWM timer is equal to period
RY
– Event generated when writing toggling value to MCPWM_TIMERx_SYNC_SW bit
• Configure the method of period updating.
29.3.1.3 Operator Submodule
A
IN
IM
EL
Figure 294. Operator Submodule
The configuration parameters of the operator submodule are shown in Table 29-1.
PR

Table 291. Configuration Parameters of the Operator Submodule
Submodule Configuration Parameter or Option
• Set up the PWM duty cycle for PWMxA and/or PWMxB out-
put.
• Set up at which time the timing events occur.
• Define what action should be taken on timing events:
– Switch high or low of PWMxA and/or PWMxB outputs
PWM Generator – Toggle PWMxA and/or PWMxB outputs
– Take no action on outputs
• Use direct s/w control to force the state of PWM outputs
RY
• Add a dead time to raising edge and/or failing edge on PWM
outputs.
• Configure update method for this submodule.
• Control of complementary dead time relationship between

upper and lower switches.
A
• Specify the dead time on rising edge.
• Specify the dead time on falling edge.
Dead Time Generator • Bypass the dead time generator module. The PWM wave-
IN
form will pass through without inserting dead time.
• Allow PWMxB phase shifting with respect to the PWMxA out-
put.
• Configure updating method for this submodule.
IM
• Enable carrier and set up carrier frequency.
• Configure duration of the first pulse in the carrier waveform.
PWM Carrier • Set up the duty cycle of the following pulses.
• Bypass the PWM carrier module. The PWM waveform will be
EL
passed through without modification.
• Configure if and how the PWM module should react the fault
event signals.
• Specify the action taken when a fault event occurs:
PR
– Force PWMxA and/or PWMxB high.

– Force PWMxA and/or PWMxB low.
– Configure PWMxA and/or PWMxB to ignore any fault
event.
Fault Handler • Configure how often the PWM should react to fault events:
– One-shot
– Cycle-by-cycle
• Generate interrupts.
• Bypass the fault handler submodule entirely.
• Set up an option for cycle-by-cycle actions clearing.
• If desired, independently-configured actions can be taken
when time-base counter is counting down or up.

29.3.1.4 Fault Detection Submodule
Figure 295. Fault Detection Submodule
RY
• Enable fault event generation and configure the polarity of fault event generation for every fault signal
• Generate fault event interrupts
29.3.1.5 Capture Submodule
A
IN
IM
Figure 296. Capture Submodule
• Select the edge polarity and prescaling of the capture input.

EL
• Set up a software-triggered capture.
• Configure the capture timer’s sync trigger and sync phase.
• Software syncs the capture timer.

PR
29.3.2 PWM Timer Submodule

Each MCPWM module has three PWM timer submodules. Any of them can determine the necessary event
timing for any of the three PWM operator submodules. Built-in synchronization logic allows multiple PWM timer
submodules, in one or more MCPWM modules, to work together as a system, when using synchronization
signals from the GPIO matrix.
29.3.2.1 Configurations of the PWM Timer Submodule
Users can configure the following functions of the PWM timer submodule:
• Control how often events occur by specifying the PWM timer frequency or period.
• Configure a particular PWM timer to synchronize with other PWM timers or modules.

• Get a PWM timer in phase with other PWM timers or modules.
• Set one of the following timer counting modes: count-up, count-down, count-up-down.
• Change the rate of the PWM timer clock (PT_clk) with a prescaler. Each timer has its own prescaler
configured with MCPWM_TIMERx_PRESCALE of the register MCPWM_TIMER0_CFG0_REG. The PWM
timer increments or decrements at a slower pace, depending on the setting of this field.
29.3.2.2 PWM Timer’s Working Modes and Timing Event Generation
The PWM timer has three working modes, selected by the PWMx timer mode field:
• Count-Up Mode:
RY
In this mode, the PWM timer increments from zero until reaching the value configured in the period field.
Once done, the PWM timer returns to zero and starts increasing again. PWM period is equal to the value of
the period field + 1.
Note: The period field is MCPWM_TIMERx_PERIOD (x = 0, 1, 2), i.e., MCPWM_TIMER0_PERIOD,
MCPWM_TIMER1_PERIOD, MCPWM_TIMER2_PERIOD.
• Count-Down Mode:
A
The PWM timer decrements to zero, starting from the value configured in the period field. After reaching
zero, it is set back to the period value. Then it starts to decrement again. In this case, the PWM period is
IN
also equal to the value of period field + 1.
• Count-Up-Down Mode:
This is a combination of the two modes mentioned above. The PWM timer starts increasing from zero until
the period value is reached. Then, the timer decreases back to zero. This pattern is then repeated. The
IM
PWM period is the result of (the value of the period field × 2 + 1).
Figures 29-7 to 29-10 show PWM timer waveforms in different modes, including timer behavior during
synchronization events. In Count-Up mode, the counting direction after synchronization is always counting up.
while in Count-Down mode, the counting direction after synchronization is always counting down. In
Count-Up-Down Mode, the counting direction after synchronization can be chosen by setting the
EL
MCPWM_TIMERx_PHASE_DIRECTION.
PR
Figure 297. CountUp Mode Waveform

RY
Figure 298. CountDown Mode Waveforms
A
IN
IM
EL
Figure 299. CountUpDown Mode Waveforms, CountDown at Synchronization Event

PR
Figure 2910. CountUpDown Mode Waveforms, CountUp at Synchronization Event

When the PWM timer is running, it generates the following timing events periodically and automatically:
• UTEP
The timing event generated when the PWM timer’s value equals to the value of the period field
(MCPWM_TIMERx_PERIOD) and when the PWM timer is increasing.
• UTEZ
The timing event generated when the PWM timer’s value equals to zero and when the PWM timer is
increasing.
• DTEP
The timing event generated when the PWM timer’s value equals to the value of the period field
(MCPWM_TIMERx_PERIOD) and when the PWM timer is decreasing.
RY
• DTEZ
The timing event generated when the PWM timer’s value equals to zero and when the PWM timer is
decreasing.
Figures 29-11 to 29-13 show the timing waveforms of U/DTEP and U/DTEZ.
A
IN
IM
EL
PR
Figure 2911. UTEP and UTEZ Generation in CountUp Mode

A RY
IN
Figure 2912. DTEP and DTEZ Generation in CountDown Mode
IM
EL
PR
Figure 2913. DTEP and UTEZ Generation in CountUpDown Mode

29.3.2.3 PWM Timer Shadow Register
The PWM timer’s period register and the PWM timer’s clock prescaler register have shadow registers. The
purpose of a shadow register is to save a copy of the value to be written into the active register at a specific
moment synchronized with the hardware. Both register types are defined as follows:
• Active Register
This register is directly responsible for controlling all actions performed by hardware.
• Shadow Register
It acts as a temporary buffer for a value to be written to the active register. At a specific, user-configured
point in time, the value saved in the shadow register is copied to the active register. Before this happens,
the content of the shadow register has no direct effect on the controlled hardware. This helps to prevent
RY
spurious operation of the hardware, which may happen when a register is asynchronously modified by
software. Both the shadow register and the active register have the same memory address. The software
always writes into, or reads from the shadow register.
The moment of updating the clock prescaler’s active register is at the time when the timer starts operating.
When MCPWM_GLOBAL_UP_EN is set to 1, the moment of updating the period active register can be
A
selected by the following ways. By setting the update method register of
MCPWM_TIMERx_PERIOD_UPMETHOD, the update can start when the PWM timer is equal to zero, when
the PWM timer is equal to period, at a synchronization moment, or immediately. Software can also trigger a
globally forced update bit
IN
MCPWM_GLOBAL_FORCE_UP which will prompt all registers in the module to be updated according to
shadow registers.
IM
29.3.2.4 PWM Timer Synchronization and Phase Locking
The PWM modules adopt a flexible synchronization method. Each PWM timer has a synchronization input and a
synchronization output. The synchronization input can be selected from three synchronization outputs and three
synchronization signals from the GPIO matrix. The synchronization output can be generated from the
EL
synchronization input signal, when the PWM timer’s value is equal to period or zero, or software synchronization.
Thus, the PWM timers can be chained together with their phase locked. During synchronization, the PWM timer
clock prescaler will reset its counter in order to synchronize the PWM timer clock.
29.3.3 PWM Operator Submodule

PR
The PWM Operator submodule has the following functions:
• Generates a PWM signal pair, based on timing references obtained from the corresponding PWM timer.
• Each signal out of the PWM signal pair includes a specific pattern of dead time.
• Superimposes a carrier on the PWM signal, if configured to do so.
• Handles response under fault conditions.
Figure 29-14 shows the block diagram of a PWM operator.

RY
Figure 2914. Submodules Inside the PWM Operator
A
29.3.3.1 PWM Generator Submodule
Purpose of the PWM Generator Submodule

IN
In this submodule, important timing events are generated or imported. The events are then converted into
specific actions to generate the desired waveforms at the PWMxA and PWMxB outputs.
The PWM generator submodule performs the following actions:

IM
• Generation of timing events based on time stamps configured using the A and B registers. Events happen
when the following conditions are satisfied:
– UTEA: the PWM timer is counting up and its value is equal to register A.
– UTEB: the PWM timer is counting up and its value is equal to register B.
EL
– DTEA: the PWM timer is counting down and its value is equal to register A.
– DTEB: the PWM timer is counting down and its value is equal to register B.
• Generation of U/DT1, U/DT2 timing events based on fault or synchronization events.

PR
• Management of priority when these timing events occur concurrently.
• Qualification and generation of set, clear and toggle actions, based on the timing events.
• Controlling of the PWM duty cycle, depending on configuration of the PWM generator submodule.
• Handling of new time stamp values, using shadow registers to prevent glitches in the PWM cycle.
PWM Operator Shadow Registers
The time stamp registers A and B, as well as action configuration registers MCPWM_GENx_A_REG and
MCPWM_GENx_B_REG are shadowed. Shadowing provides a way of updating registers in sync with the
hardware.
When MCPWM_GLOBAL_UP_EN is set to 1, the shadow registers can be written to the active register at a

specified time. The update method fields for time stamp registers A and B are MCPWM_GEN_A_UPMETHOD
and MCPWM_GEN_B_UPMETHOD. The update method field for MCPWM_GENx_A_REG and
MCPWM_GENx_B_REG is MCPWM_GEN_CFG_UPMETHOD. Software can also trigger a globally forced update
bit
MCPWM_GLOBAL_FORCE_UP which will prompt all registers in the module to be updated according to shadow
registers. For a description of the shadow registers, please see 29.3.2.3.
Timing Events
For convenience, all timing signals and events are summarized in Table 29-2.
Table 292. Timing Events Used in PWM Generator
RY
Signal Event Description PWM Timer Operation
DTEP PWM timer value is equal to the period register value
DTEZ PWM timer value is equal to zero
DTEA PWM timer value is equal to A register
PWM timer counts down.
DTEB PWM timer value is equal to B register
A
DT0 event Based on fault or synchronization events
DT1 event Based on fault or synchronization events
UTEP PWM timer value is equal to the period register value
UTEZ
UTEA
IN
PWM timer value is equal to zero
PWM timer value is equal to A register
PWM timer counts up.
UTEB PWM timer value is equal to B register
UT0 event Based on fault or synchronization events
IM
UT1 event Based on fault or synchronization events
Software-force event Software-initiated asynchronous event N/A
The purpose of a software-force event is to impose non-continuous or continuous changes on the PWMxA and
EL
PWMxB outputs. The change is done asynchronously. Software-force control is handled by the
MCPWM_GENx_FORCE_REG registers.
The selection and configuration of T0/T1 in the PWM generator submodule is independent of the configuration of
fault events in the fault handler submodule. A particular trip event may or may not be configured to cause trip
action in the fault handler submodule, but the same event can be used by the PWM generator to trigger T0/T1
PR
for controlling PWM waveforms.
It is important to know that when the PWM timer is in count-up-down mode, it will always decrement after a TEP
event, and will always increment after a TEZ event. So when the PWM timer is in count-up-down mode, DTEP
and UTEZ events will occur, while the events UTEP and DTEZ will never occur.
The PWM generator can handle multiple events at the same time. Events are prioritized by the hardware and
relevant details are provided in Table 29-3 and Table 29-4. Priority levels range from 1 (the highest) to 7 (the
lowest). Please note that the priority of TEP and TEZ events depends on the PWM timer’s direction.
If the value of A or B is set to be greater than the period, then U/DTEA and U/DTEB will never occur.

Table 293. Timing Events Priority When PWM Timer Increments
Priority Level Event

1 (highest) Software-force event
2 UTEP
3 UT0
4 UT1
5 UTEB
6 UTEA
7 (lowest) UTEZ
RY
Table 294. Timing Events Priority when PWM Timer Decrements
Priority level Event

1 (highest) Software-force event
2 DTEZ
3 DT0
A
4 DT1
5 IN DTEB
6 DTEA
7 (lowest) DTEP
Notes:
IM
1. UTEP and UTEZ do not happen simultaneously. When the PWM timer is in count-up mode, UTEP will
always happen one cycle earlier than UTEZ, as demonstrated in Figure 29-11, so their action on PWM
signals will not interrupt each other. When the PWM timer is in count-up-down mode, UTEP will not occur.
2. DTEP and DTEZ do not happen simultaneously. When the PWM timer is in count-down mode, DTEZ will
EL
always happen one cycle earlier than DTEP, as demonstrated in Figure 29-12, so their action on PWM
signals will not interrupt each other. When the PWM timer is in count-up-down mode, DTEZ will not occur.
PWM Signal Generation
The PWM generator submodule controls the behavior of outputs PWMxA and PWMxB when a particular timing
PR
event occurs. The timing events are further qualified by the PWM timer’s counting direction (up or down).
Knowing the counting direction, the submodule may then perform an independent action at each stage of the
PWM timer counting up or down.
The following actions may be configured on outputs PWMxA and PWMxB:
• Set High:
Set the output of PWMxA or PWMxB to a high level.
• Clear Low:
Clear the output of PWMxA or PWMxB by setting it to a low level.
• Toggle:

Change the current output level of PWMxA or PWMxB to the opposite value. If it is currently pulled high,
pull it low, or vice versa.
• Do Nothing:
Keep both outputs PWMxA and PWMxB unchanged. In this state, interrupts can still be triggered.
The configuration of actions on outputs is done by using registers MCPWN_GENx_A_REG and

MCPWN_GENx_B_REG. So, the action to be taken on each output is set independently. Also there is great
flexibility in selecting actions to be taken on a given output based on events. More specifically, any event listed in
Table 29-2 can operate on either output PWMxA or PWMxB. To check out registers for particular generator 0, 1
or 2, please refer to register description in Section 29.4.
Waveforms for Common Configurations
RY
Figure 29-15 presents the symmetric PWM waveform generated when the PWM timer is counting up and down.
DC 0%–100% modulation can be calculated via the formula below:
Duty = (P eriod − A) ÷ P eriod
If A matches the PWM timer value and the PWM timer is incrementing, then the PWM output is pulled up. If A
A
matches the PWM timer value while the PWM timer is decrementing, then the PWM output is pulled low.
IN
IM
EL
PR
Figure 2915. Symmetrical Waveform in CountUpDown Mode
The PWM waveforms in Figures 29-16 to 29-19 show some common PWM operator configurations. The
following conventions are used in the figures:
• Period A and B refer to the values written in the corresponding registers.
• PWMxA and PWMxB are the output signals of PWM Operator x.

A RY
IN
IM
EL
Figure 2916. CountUp, Single Edge Asymmetric Waveform, with Independent Modulation on PWMxA
and PWMxB — Active High
PR
The duty modulation for PWMxA is set by B, active high and proportional to B.
The duty modulation for PWMxB is set by A, active high and proportional to A.
P eriod = (M CP W M _T IM ERx_P ERIOD + 1) × TP T _clk

A RY
IN
IM
Figure 2917. CountUp, Pulse Placement Asymmetric Waveform with Independent Modulation on PWMxA
EL
Pulses may be generated anywhere within the PWM cycle (zero – period).
PWMxA’s high time duty is proportional to (B – A).
P eriod = (M CP W M _T IM ERx_P ERIOD + 1) × TP T _clk

PR

A RY
IN
IM
EL
PR
Figure 2918. CountUpDown, Dual Edge Symmetric Waveform, with Independent Modulation on PWMxA
and PWMxB — Active High
The duty modulation for PWMxA is set by A, active high and proportional to A.
The duty modulation for PWMxB is set by B, active high and proportional to B.
Outputs PWMxA and PWMxB can drive independent switches.
P eriod = (2 × M CP W M _T IM ERx_P ERIOD) × TP T _clk

A RY
IN
IM
EL
PR
Figure 2919. CountUpDown, Dual Edge Symmetric Waveform, with Independent Modulation on PWMxA
and PWMxB — Complementary
The duty modulation of PWMxA is set by A, is active high and proportional to A.

The duty modulation of PWMxB is set by B, is active low and proportional to B.
Outputs PWMx can drive upper/lower (complementary) switches.
Dead-time = B – A; Edge placement is fully programmable by software. Use the dead-time generator module if
another edge delay method is required.
P eriod = (2 × M CP W M _T IM ERx_P ERIOD) × TP T _clk

SoftwareForce Events
There are two types of software-force events inside the PWM generator:
• Non-continuous-immediate (NCI) software-force events

Such types of events are immediately effective on PWM outputs when triggered by software. The forcing is
non-continuous, meaning the next active timing events will be able to alter the PWM outputs.
• Continuous (CNTU) software-force events

Such types of events are continuous. The forced PWM outputs will continue until they are released by
software. The events’ triggers are configurable. They can be timing events or immediate events.
Figure 29-20 shows a waveform of NCI software-force events. NCI events are used to force PWMxA output low.
RY
Forcing on PWMxB is disabled in this case.
A
IN
IM
EL
PR
Figure 2920. Example of an NCI SoftwareForce Event on PWMxA

Figure 29-21 shows a waveform of CNTU software-force events. UTEZ events are selected as triggers for CNTU
software-force events. CNTU is used to force the PWMxB output low. Forcing on PWMxA is disabled.
A RY
IN
IM
EL
PR
Figure 2921. Example of a CNTU SoftwareForce Event on PWMxB

29.3.3.2 Dead Time Generator Submodule
Purpose of the Dead Time Generator Submodule
Several options to generate signals on PWMxA and PWMxB outputs, with a specific placement of signal edges,
have been discussed in section 29.3.3.1. The required dead time is obtained by altering the edge placement
between signals and by setting the signal’s duty cycle. Another option is to control the dead time using a
specialized submodule – the Dead Time Generator.
The key functions of the dead time generator submodule are as follows:
• Generating signal pairs (PWMxA and PWMxB) with a dead time from a single PWMxA input
RY
• Creating a dead time by adding delay to signal edges:
– Rising edge delay (RED)
– Falling edge delay (FED)
• Configuring the signal pairs to be:
– Active high complementary (AHC)
A
– Active low complementary (ALC)
– Active high (AH)
– Active low (AL)

IN
• This submodule may also be bypassed, if the dead time is configured directly in the generator submodule.
IM
Dead Time Generator’s Shadow Registers
Delay registers RED and FED are shadowed with registers MCPWM_DTx_RED_CFG_REG and
MCPWM_DTx_FED_CFG_REG. When MCPWM_GLOBAL_UP_EN is set to 1, the shadow registers can be
written to the active register at specified time. The update method register for MCPWM_DTx_RED_CFG_REG
EL
is
MCPWM_DT_RED_UPMETHOD. The update method register for MCPWM_DTx_FED_CFG_REG is
MCPWM_DT_FED_UPMETHOD. The Software can also trigger a globally forced update bit
MCPWM_GLOBAL_FORCE_UP which will prompt all registers in the module to be updated according to shadow
registers.For the description of shadow registers, please see section 29.3.2.3.
PR
Highlights for Operation of the Dead Time Generator
Options for setting up the dead-time submodule are shown in Figure 29-22.

RY
Figure 2922. Options for Setting up the Dead Time Generator Submodule
S0-S8 in the figure above are switches controlled by fields in register MCPWM_DTx_CFG_REG shown in Table
29-5.
A
Table 295. Dead Time Generator Switches Control Fields
Switch Field
S0
S1
IN
MCPWM_DTx_B_OUTBYPASS
MCPWM_DTx_A_OUTBYPASS
S2 MCPWM_DTx_RED_OUTINVERT
S3 MCPWM_DTx_FED_OUTINVERT
IM
S4 MCPWM_DTx_RED_INSEL
S5 MCPWM_DTx_FED_INSEL
S6 MCPWM_DTx_A_OUTSWAP
S7 MCPWM_DTx_B_OUTSWAP
S8 MCPWM_DTx_DEB_MODE
EL
All switch combinations are supported, but not all of them represent the typical modes of use. Table 29-6
documents some typical dead time configurations. In these configurations the position of S4 and S5 sets
PWMxA as the common source of both falling-edge and rising-edge delay. The modes presented in table 29-6
may be categorized as follows:
PR
Table 296. Typical Dead Time Generator Operating Modes
Mode Mode Description S0 S1 S2 S3

1 PWMxA and PWMxB Pass Through/No Delay 1 1 X X
2 Active High Complementary (AHC), see Figure 29-23 0 0 0 1
3 Active Low Complementary (ALC), see Figure 29-24 0 0 1 0
4 Active High (AH), see Figure 29-25 0 0 0 0
5 Active Low (AL), see Figure 29-26 0 0 1 1
6 PWMxA Output = PWMxA In (No Delay) 0 1 0 or 1 0 or 1
PWMxB Output = PWMxA Input with Falling Edge Delay
7 PWMxA Output = PWMxA Input with Rising Edge Delay 1 0 0 or 1 0 or 1
PWMxB Output = PWMxB Input with No Delay

Note:
For all the modes above, the position of the binary switches S4 to S8 is set to 0.
• Mode 1: Bypass delays on both falling (FED) as well as raising edge (RED)
In this mode the dead time submodule is disabled. Signals PWMxA and PWMxB pass through without any
modifications.
• Mode 25: Classical Dead Time Polarity Settings

These modes represent typical configurations of polarity and should cover the active-high/low modes in
available industry power switch gate drivers. The typical waveforms are shown in Figures 29-23 to 29-26.
• Modes 6 and 7: Bypass delay on falling edge (FED) or rising edge (RED)
RY
In these modes, either RED (Rising Edge Delay) or FED (Falling Edge Delay) is bypassed. As a result, the
corresponding delay is not applied.
A
IN
IM
Figure 2923. Active High Complementary (AHC) Dead Time Waveforms

EL
PR
Figure 2924. Active Low Complementary (ALC) Dead Time Waveforms

RY
Figure 2925. Active High (AH) Dead Time Waveforms
A
IN
IM
EL
Figure 2926. Active Low (AL) Dead Time Waveforms
Rising edge (RED) and falling edge (FED) delays may be set up independently. The delay value is programmed
using the 16-bit registers MCPWM_DTx_RED and MCPWM_DTx_FED. The register value represents the number
of clock (DT_clk) periods by which a signal edge is delayed. DT_CLK can be selected from PWM_clk or PT_clk
PR
through register MCPWM_DTx_CLK_SEL.
To calculate the delay on falling edge (FED) and rising edge (RED), use the following formulas:
F ED = M CP W M _DT x_F ED × TDT _clk
RED = M CP W M _DT x_RED × TDT _clk

29.3.3.3 PWM Carrier Submodule
The coupling of PWM output to a motor driver may need isolation with a transformer. Transformers deliver only
AC signals, while the duty cycle of a PWM signal may range anywhere from 0% to 100%. The PWM carrier
submodule passes such a PWM signal through a transformer by using a high frequency carrier to modulate the
signal.
Function Overview
The following key characteristics of this submodule are configurable:
• Carrier frequency
RY
• Pulse width of the first pulse
• Duty cycle of the second and the subsequent pulses
• Enabling/disabling the carrier function
Operational Highlights
A
The PWM carrier clock (PC_clk) is derived from PWM_clk. The frequency and duty cycle are configured by the
MCPWM_CARRIERx_PRESCALE and MCPWM_CARRIERx_DUTY bits in the MCPWM_CARRIERx_CFG_REG
IN
register. The purpose of one-shot pulses is to provide high-energy impulse to reliably turn on the power switch.
Subsequent pulses sustain the power-on status. The width of a one-shot pulse is configurable with the
MCPWM_CARRIERx_OSHTWTH bits. Enabling/disabling of the carrier submodule is done with the
MCPWM_CARRIERx_EN bit.
IM
Waveform Examples
Figure 29-27 shows an example of waveforms, where a carrier is superimposed on original PWM pulses. This
figure do not show the first one-shot pulse and the duty-cycle control. Related details are covered in the following
two sections.
EL
PR
Figure 2927. Example of Waveforms Showing PWM Carrier Action

OneShot Pulse
The width of the first pulse is configurable. It may assume one of 16 possible values and is described by the
formula below:
T1stpulse =
TP W M _clk × 8 × (M CP W M _CARRIERx_P RESCALE + 1) × (M CP W M _CARRIERx_OSHT W T H + 1)
Where:
• TP M W _clk is the period of the PWM clock (PWM_clk).
• (M CP W M _CARRIERx_OSHT W T H + 1) is the width of the first pulse (whose value ranges from 1 to
16).
RY
• (M CP W M _CARRIERx_P RESCALE + 1) is the PWM carrier clock’s (PC_clk) prescaler value.
The first one-shot pulse and subsequent sustaining pulses are shown in Figure 29-28.
A
IN
IM
EL
Figure 2928. Example of the First Pulse and the Subsequent Sustaining Pulses of the PWM Carrier Sub
module
PR
Duty Cycle Control
After issuing the first one-shot pulse, the remaining PWM signal is modulated according to the carrier frequency.
Users can configure the duty cycle of this signal. Tuning of duty may be required, so that the signal passes
through the isolating transformer and can still operate (turn on/off) the motor drive, changing rotation speed and
direction.
The duty cycle may be set to one of seven values, using MCPWM_CARRIERx_DUTY, or bits [7:5] of
register
MCPWM_CARRIERx_CFG_REG.
Below is the formula for calculating the duty cycle:
Duty = M CP W M _CARRIERx_DU T Y ÷ 8

All seven settings of the duty cycle are shown in Figure 29-29.
A RY
IN
Figure 2929. Possible Duty Cycle Settings for Sustaining Pulses in the PWM Carrier Submodule
29.3.3.4 Fault Handler Submodule

IM
Each MCPWM peripheral is connected to three fault signals (FAULT0, FAULT1 and FAULT2) which are sourced
from the GPIO matrix. These signals are intended to indicate external fault conditions, and may be preprocessed
by the fault detection submodule to generate fault events. Fault events can then execute the user code to control
MCPWM outputs in response to specific faults.
EL
Function of Fault Handler Submodule
The key actions performed by the fault handler submodule are:
• Forcing outputs PWMxA and PWMxB, upon detected fault, to one of the following states:
– High
PR
– Low
– Toggle
– No action taken
• Execution of one-shot trip (OST) upon detection of over-current conditions/short circuits.
• Cycle-by-cycle tripping (CBC) to provide current-limiting operation.
• Allocation of either one-shot or cycle-by-cycle operation for each fault signal.
• Generation of interrupts for each fault input.
• Support for software-force tripping.
• Enabling or disabling of submodule function as required.

Operation and Configuration Tips
This section provides the operational tips and set-up options for the fault handler submodule.
Fault signals coming from pins are sampled and synced in the GPIO matrix. In order to guarantee the successful
sampling of fault pulses, each pulse duration must be at least two APB clock cycles. The fault detection
submodule will then sample fault signals by using PWM_clk. So, the duration of fault pulses coming from GPIO
matrix must be at least one PWM_clk cycle. Differently put, regardless of the period relation between APB clock
and PWM_clk, the width of fault signal pulses on pins must be at least equal to the sum of two APB clock cycles
and one PWM_clk cycle.
Each level of fault signals, FAULT0 to FAULT2, can be used by the fault handler submodule to generate fault
events (fault_event0 to fault_event2). Every fault event can be configured individually to provide CBC action, OST
RY
action, or none.
• CyclebyCycle (CBC) action:

When CBC action is triggered, the state of PWMxA and PWMxB will be changed immediately according to
the configuration of fields MCPWM_FHx_A_CBC_U/D and MCPWM_FHx_B_CBC_U/D. Different actions
can be indicted when the PWM timer is incrementing or decrementing. Different CBC action interrupts can
A
be triggered for different fault events. Status field MCPWM_FHx_CBC_ON indicates whether a CBC action
is on or off. When the fault event is no longer present, CBC actions on PWMxA/B will be cleared at a
specified point, which is either a D/UTEP or D/UTEZ event. Field MCPWM_FHx_CBCPULSE determines at
IN
which event PWMxA and PWMxB will be able to resume normal actions. Therefore, in this mode, the CBC
action is cleared or refreshed upon every PWM cycle.
• OneShot (OST) action:

When OST action is triggered, the state of PWMxA and PWMxB will be changed immediately, depending
IM
on the setting of fields MCPWM_FHx_A_OST_U/D and MCPWM_FHx_B_OST_U/D. Different actions can
be configured when PWM timer is incrementing or decrementing. Different OST action interrupts can be
triggered form different fault events. Status field MCPWM_FHx_OST_ON indicates whether an OST action
is on or off. The OST actions on PWMxA/B are not automatically cleared when the fault event is no longer
EL
present. One-shot actions must be cleared manually by setting the rising edge of the
MCPWM_FHx_CLR_OST bit.
29.3.4 Capture Submodule
PR
The capture submodule contains three complete capture channels. Channel inputs CAP0, CAP1 and CAP2 are
sourced from the GPIO matrix. Thanks to the flexibility of the GPIO matrix, CAP0, CAP1 and CAP2 can be
configured from any pin input. Multiple capture channels can be sourced from the same pin input, while
prescaling for each channel can be set differently. Also, capture channels are sourced from different pins. This
provides several options for handling capture signals by hardware in the background, instead of having them
processed directly by the CPU. A capture submodule has the following independent key resources:
• One 32-bit timer (counter) which can be synchronized with the PWM timer, another submodule or software.
• Three capture channels, each equipped with a 32-bit time-stamp and a capture prescaler.
• Independent edge polarity (rising/falling edge) selection for any capture channel.
• Input capture signal prescaling (from 1 to 256).

• Interrupt capabilities on any of the three capture events.
29.3.4.2 Capture Timer
The capture timer is a 32-bit counter incrementing continuously. It is enabled by setting

MCPWM_CAP_TIMER_EN to 1. Its operating clock source is APB_CLK. When MCPWM_CAP_SYNCI_EN is
configured, the counter will be loaded with phase stored in register
MCPWM_CAP_TIMER_PHASE_REG at the time of a sync event. Sync events can select from PWM timers
sync-out, PWM module sync-in by configuring MCPWM_CAP_SYNCI_SEL. Sync event can also generate by
setting MCPWM_CAP_SYNC_SW. The capture timer provides timing references for all three capture
channels.
RY
29.3.4.3 Capture Channel
The capture signal coming to a capture channel will be inverted first, if needed, and then prescaled. Each capture
channel has a prescaler register of MCPWM_CAPx_PRESCALE. Finally, specified edges of preprocessed capture
signal will trigger capture events. Setting MCPWM_CAPx_EN to enable a capture channel. The capture event
A
occurs at the time selected by the MCPWM_CAPx_MODE. When a capture event occurs, the capture timer’s
value is stored in time-stamp register MCPWM_CAP_CHx_REG. Different interrupts can be generated for
different capture channels at capture events. The edge that triggers a capture event is recorded in register
IN
MCPWM_CAPx_EDGE. The capture event can be also forced by software setting MCPWM_CAPx_SW.
IM
EL
PR


The addresses in this section are relative to Motor Control PWM0 and Motor Control PWM1 base address

Prescaler configuration
MCPWM_CLK_CFG_REG PWM clock prescaler register 0x0000 R/W
PWM Timer 0 Configuration and status
MCPWM_TIMER0_CFG0_REG PWM timer0 period and update method config- 0x0004 R/W
uration register
MCPWM_TIMER0_CFG1_REG PWM timer0 working mode and start/stop con- 0x0008 R/W
RY
trol configuration register
MCPWM_TIMER0_SYNC_REG PWM timer0 sync function configuration register 0x000C R/W
MCPWM_TIMER0_STATUS_REG PWM timer0 status register 0x0010 RO
PWM Timer 1 Configuration and Status
A
uration register
MCPWM_TIMER1_CFG1_REG PWM timer1 working mode and start/stop con- 0x0018 varies
MCPWM_TIMER1_SYNC_REG
MCPWM_TIMER1_STATUS_REG
IN
PWM timer1 sync function configuration register
PWM timer1 status register
0x001C
0x0020
R/W
RO
PWM Timer 2 Configuration and status
IM
uration register
MCPWM_TIMER2_CFG1_REG PWM timer2 working mode and start/stop con- 0x0028 varies
MCPWM_TIMER2_SYNC_REG PWM timer2 sync function configuration register 0x002C R/W
MCPWM_TIMER2_STATUS_REG PWM timer2 status register 0x0030 RO
EL
Common configuration for PWM timers

MCPWM_TIMER_SYNCI_CFG_REG Synchronization input selection for three PWM 0x0034 R/W
timers
MCPWM_OPERATOR_TIMERSEL_REG Select specific timer for PWM operators 0x0038 R/W
PWM Operator 0 Configuration and Status
PR
MCPWM_GEN0_STMP_CFG_REG Transfer status and update method for time 0x003C varies
stamp registers A and B
MCPWM_GEN0_TSTMP_A_REG PWM generator 0 shadow register for timer 0x0040 R/W
stamp A
MCPWM_GEN0_TSTMP_B_REG PWM generator 0 shadow register for timer 0x0044 R/W
stamp B
MCPWM_GEN0_CFG0_REG PWM generator 0 event T0 and T1 handling 0x0048 R/W
MCPWM_GEN0_FORCE_REG Permissive to force PWM0A and PWM0B out- 0x004C R/W
puts by software
MCPWM_GEN0_A_REG Actions triggered by events on PWM0A 0x0050 R/W
MCPWM_GEN0_B_REG Actions triggered by events on PWM0B 0x0054 R/W


MCPWM_DT0_CFG_REG PWM generator 0 dead time type selection and 0x0058 R/W
configuration
MCPWM_DT0_FED_CFG_REG PWM generator 0 shadow register for falling 0x005C R/W
edge delay (FED)
MCPWM_DT0_RED_CFG_REG PWM generator 0 shadow register for rising 0x0060 R/W
edge delay (RED)
MCPWM_CARRIER0_CFG_REG PWM generator 0 carrier enable and configura- 0x0064 R/W
tion
MCPWM_FH0_CFG0_REG Actions on PWM0A and PWM0B on trip events 0x0068 R/W
MCPWM_FH0_CFG1_REG Software triggers for fault handler actions 0x006C R/W
RY
MCPWM_FH0_STATUS_REG Status of fault events 0x0070 RO
MCPWM_GEN1_STMP_CFG_REG Transfer status and update method for time 0x0074 varies
MCPWM_GEN1_TSTMP_A_REG PWM generator 1 shadow register for timer 0x0078 R/W
stamp A
A
MCPWM_GEN1_TSTMP_B_REG PWM generator 1 shadow register for timer 0x007C R/W
stamp B
MCPWM_GEN1_CFG0_REG
MCPWM_GEN1_FORCE_REG
IN
PWM generator 1 event T0 and T1 handling
Permissive to force PWM1A and PWM1B out-
0x0080
0x0084
R/W
R/W
puts by software
MCPWM_GEN1_A_REG Actions triggered by events on PWM1A 0x0088 R/W
IM
MCPWM_GEN1_B_REG Actions triggered by events on PWM1B 0x008C R/W
MCPWM_DT1_CFG_REG PWM generator 1 dead time type selection and 0x0090 R/W
configuration
MCPWM_DT1_FED_CFG_REG PWM generator 1 shadow register for falling 0x0094 R/W
edge delay (FED)
EL
MCPWM_DT1_RED_CFG_REG PWM generator 1 shadow register for rising 0x0098 R/W

edge delay (RED)
MCPWM_CARRIER1_CFG_REG PWM generator 1 carrier enable and configura- 0x009C R/W
tion
MCPWM_FH1_CFG0_REG Actions on PWM1A and PWM1B trip events 0x00A0 R/W
PR
MCPWM_FH1_CFG1_REG Software triggers for fault handler actions 0x00A4 R/W

MCPWM_FH1_STATUS_REG Status of fault events 0x00A8 RO
MCPWM_GEN2_STMP_CFG_REG Transfer status and update method for time 0x00AC varies
MCPWM_GEN2_TSTMP_A_REG PWM generator 2 shadow register for timer 0x00B0 R/W
stamp A
MCPWM_GEN2_TSTMP_B_REG PWM generator 2 shadow register for timer 0x00B4 R/W
stamp B
MCPWM_GEN2_CFG0_REG PWM generator 2 event T0 and T1 handling 0x00B8 R/W
MCPWM_GEN2_FORCE_REG Permissive to force PWM2A and PWM2B out- 0x00BC R/W
puts by software


MCPWM_GEN2_A_REG Actions triggered by events on PWM2A 0x00C0 R/W
MCPWM_GEN2_B_REG Actions triggered by events on PWM2B 0x00C4 R/W
MCPWM_DT2_CFG_REG PWM generator 2 dead time type selection and 0x00C8 R/W
configuration
MCPWM_DT2_FED_CFG_REG PWM generator 2 shadow register for falling 0x00CC R/W
edge delay (FED)
MCPWM_DT2_RED_CFG_REG PWM generator 2 shadow register for rising 0x00D0 R/W
edge delay (RED)
MCPWM_CARRIER2_CFG_REG PWM generator 2 carrier enable and configura- 0x00D4 R/W
tion
RY
MCPWM_FH2_CFG0_REG Actions on PWM2A and PWM2B trip events 0x00D8 R/W
MCPWM_FH2_CFG1_REG Software triggers for fault handler actions 0x00DC R/W
MCPWM_FH2_STATUS_REG Status of fault events 0x00E0 RO
Fault Detection Configuration and Status
MCPWM_FAULT_DETECT_REG Fault detection configuration and status 0x00E4 varies
A
Capture Configuration and Status
MCPWM_CAP_TIMER_CFG_REG Configure capture timer 0x00E8 varies
MCPWM_CAP_TIMER_PHASE_REG Phase for capture timer sync 0x00EC R/W
MCPWM_CAP_CH0_CFG_REG
MCPWM_CAP_CH1_CFG_REG
IN
Capture channel 0 configuration and enable
Capture channel 1 configuration and enable
0x00F0
0x00F4
varies
varies
MCPWM_CAP_CH2_CFG_REG Capture channel 2 configuration and enable 0x00F8 varies
MCPWM_CAP_CH0_REG Ch0 capture value status register 0x00FC RO
IM
MCPWM_CAP_CH1_REG Ch1 capture value status register 0x0100 RO
MCPWM_CAP_CH2_REG ch2 capture value status register 0x0104 RO
MCPWM_CAP_STATUS_REG Edge of last capture trigger 0x0108 RO
Enable update of active registers
MCPWM_UPDATE_CFG_REG Enable update 0x010C R/W
EL
Manage Interrupts
MCPWM_INT_ENA_REG Interrupt enable bits 0x0110 R/W
MCPWM_INT_RAW_REG Raw interrupt status 0x0114 R/WTC
/SS
MCPWM_INT_ST_REG Masked interrupt status 0x0118 RO
PR
MCPWM_INT_CLR_REG Interrupt clear bits 0x011C WT

MCPWM APB Configuration Register
MCPWM_CLK_REG MCPWM APB configuration register 0x0120 R/W
Version Register
MCPWM_VERSION_REG Version control register 0x0124 R/W

29.5 Registers
The addresses in this section are relative to Motor Control PWM0 and Motor Control PWM1 base address
Register 29.1. MCPWM_CLK_CFG_REG (0x0000)
E
AL
SC
RE
_P
LK
_C
)
ed
M
W
rv
CP
se
(re
RY M
31 8 7 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
MCPWM_CLK_PRESCALE Period of PWM_clk = 6.25ns * (PWM_CLK_PRESCALE + 1). (R/W)
A
Register 29.2. MCPWM_TIMER0_CFG0_REG (0x0004)
D
HO
IN
ET
M
UP
LE
D_
CA
D
O
ES
RI
RI
PR
PE
PE
0_
0_
0_
ER
ER
ER
IM
IM
I
_T
_T
_T
IM
d)
M
e
W
rv
CP
CP
CP
se
(re
M
31 26 25 24 23 8 7 0
0 0 0 0 0 0 0 0xff 0x0 Reset
MCPWM_TIMER0_PRESCALE Period of PT0_clk = Period of

EL
PWM_clk * (PWM_TIMER0_PRESCALE + 1). (R/W)
MCPWM_TIMER0_PERIOD Period shadow register of PWM timer0. (R/W)
MCPWM_TIMER0_PERIOD_UPMETHOD Update method for active register of PWM timer0 period.

0: immediate; 1: TEZ; 2: sync; 3: TEZ | sync. TEZ here and below means timer equal zero event.
PR
(R/W)

T
AR
D
O
ST
M
0_
0_
ER
ER
IM
IM
_T
_T
)
ed
M
W
W
rv
CP
CP
se
(re
M
31 5 4 3 2 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 0x0 Reset
MCPWM_TIMER0_START PWM timer0 start and stop control. (R/W/SC)
• 0: if PWM timer0 starts, then stops at TEZ;
RY
• 1: if timer0 starts, then stops at TEP;
• 2: PWM timer0 starts and runs on;
• 3: timer0 starts and stops at the next TEZ;
A
• 4: timer0 starts and stops at the next TEP.
TEP here and below means the event that happens when the timer equals to period.
IN
MCPWM_TIMER0_MOD PWM timer0 working mode. (R/W)
• 0: freeze;
• 1: increase mode
IM
• 2: decrease mode
• 3: up-down mode.
EL
PR

Register 29.4. MCPWM_TIMER0_SYNC_REG (0x000C)
N
I O
CT
RE
0_ NC EL
NC SW
EN
DI
_S
E_
CO
I_
E
SY _
AS
AS
YN
PH
PH
ER SY
W TIM _S
0_
0_
IM 0_
0
ER
ER
M WM ER
_T R
M E
IM
IM
M
CP _TI
_T
_T
CP _
d )
M
ve
W
er
CP
CP
CP
s
(re
M
31 21 20 19 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
MCPWM_TIMER0_SYNCI_EN When set, timer reloading with phase on sync input event is enabled.
(R/W)
MCPWM_TIMER0_SYNC_SW Toggling this bit will trigger a software sync. (R/W)
MCPWM_TIMER0_SYNCO_SEL PWM timer0 sync_out selection, 0: sync_in; 1: TEZ; 2: TEP. The

sync_out will always generate when toggling the MCPWM_TIMER0_SYNC_SW bit. (R/W)
A
MCPWM_TIMER0_PHASE Phase for timer reload on sync event. (R/W)
MCPWM_TIMER0_PHASE_DIRECTION Configure the PWM timer0’s direction when timer0 mode

is up-down mode. 0: increase; 1: decrease. (R/W)
IN
Register 29.5. MCPWM_TIMER0_STATUS_REG (0x0010)
IM
N
IO
CT
E
LU
RE
VA
DI
0_
0_
ER
ER
IM
IM
EL
_T
_T
d)
M
e
W
rv
CP
CP
se
(re
31 17 16 15 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_TIMER0_VALUE Current PWM timer0 counter value. (RO)

PR
MCPWM_TIMER0_DIRECTION Current PWM timer0 counter direction. 0: increment; 1: decrement.

(RO)

D
HO
ET
M
UP
LE
D_
CA
D
O
ES
RI
RI
PR
PE
PE
1_
1_
1_
ER
ER
ER
IM
IM
IM
_T
_T
_T
d)
M
ve
W
er
CP
CP
CP
s
(re
M
31 26 25 24 23 8 7 0
0 0 0 0 0 0 0 0xff 0x0 Reset
RY
MCPWM_TIMER1_PRESCALE Period of PT0_clk = Period of PWM_clk * (PWM_timer1_PRESCALE
+ 1). (R/W)
MCPWM_TIMER1_PERIOD_UPMETHOD Update method for active register of PWM timer1 period,

0: immediate, 1: TEZ, 2: sync, 3: TEZ | sync. TEZ here and below means timer equal zero event.
A
(R/W)
IN
T
AR
D
O
ST
M
IM
1_
1_
ER
ER
IM
IM
_T
_T
d)
M
ve
W
r
CP
CP
se
(re
M
31 5 4 3 2 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 0x0 Reset

EL

PR
MCPWM_TIMER1_MOD PWM timer1 working mode. 0: freeze; 1: increase mode; 2: decrease

mode; 3: up-down mode. (R/W)

N
I O
CT
RE
1_ NC EL
NC SW
EN
DI
_S
E_
CO
I_
E
SY _
AS
AS
YN
PH
PH
ER SY
W TIM _S
1_
1_
IM 1_
1
ER
ER
M WM ER
_T R
M E
IM
IM
M
CP _TI
_T
_T
CP _
d )
M
ve
W
er
CP
CP
CP
s
(re
M
31 21 20 19 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
(R/W)
MCPWM_TIMER1_SYNCO_SEL PWM timer1 sync_out selection. 0: sync_in; 1: TEZ; 2: TEP. The

sync_out will always generate when toggling the reg_timer1_sync_sw bit. (R/W)
A
MCPWM_TIMER1_PHASE_DIRECTION Configure the PWM timer1’s direction when timer1 is in up-

down mode. 0: increase; 1: decrease. (R/W)
IN
IM
N
IO
CT
E
LU
RE
VA
DI
1_
1_
ER
ER
IM
IM
EL
_T
_T
d)
M
e
W
rv
CP
CP
se
(re
31 17 16 15 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_TIMER1_VALUE Current value of PWM timer1 counter. (RO)

PR
MCPWM_TIMER1_DIRECTION Current direction of PWM timer1 counter. 0: increment; 1: decre-

ment. (RO)

D
HO
ET
M
UP
EL
D_
CA
D
O
ES
RI
RI
PR
PE
PE
2_
2_
2_
ER
ER
ER
IM
IM
IM
_T
_T
_T
d)
M
ve
W
er
CP
CP
CP
s
(re
M
31 26 25 24 23 8 7 0
0 0 0 0 0 0 0 0xff 0x0 Reset
RY
MCPWM_TIMER2_PRESCALE Period of PT0_clk = Period of PWM_clk * (PWM_timer2_PRESCALE
+ 1). (R/W)
MCPWM_TIMER2_PERIOD_UPMETHOD Update method for active register of PWM timer2 period.

0: immediate; 1: TEZ; 2: sync; 3: TEZ | sync. TEZ here and below means timer equal zero event.
A
(R/W)
IN
IM
EL
PR

T
AR
D
O
ST
M
2_
2_
ER
ER
IM
IM
_T
_T
)
ed
M
W
W
rv
CP
CP
se
(re
M
31 5 4 3 2 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 0x0 Reset
RY
A
IN
MCPWM_TIMER2_MOD PWM timer2 working mode. (R/W)
• 0: freeze;
• 1: increase mode;
IM
• 2: decrease mode;
• 3: up-down mode.
EL
PR

N
I O
CT
RE
2_ NC EL
NC SW
EN
DI
_S
E_
CO
I_
E
SY _
AS
AS
YN
PH
PH
ER SY
W TIM _S
2_
2_
IM 2_
2
ER
ER
M WM ER
_T R
M E
IM
IM
M
CP _TI
_T
_T
CP _
d )
M
ve
W
er
CP
CP
CP
s
(re
M
31 21 20 19 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
(R/W)
MCPWM_TIMER2_SYNCO_SEL PWM timer2 sync_out selection. 0: sync_in; 1: TEZ; 2: TEP. The

sync_out will always generate when toggling the reg_timer2_sync_sw bit. (R/W)
A
MCPWM_TIMER2_PHASE_DIRECTION Configure the PWM timer2’s direction when timer2 mode

is up-down mode. 0: increase; 1: decrease. (R/W)
IN
IM
N
IO
CT
E
LU
RE
VA
DI
2_
2_
ER
ER
IM
IM
EL
_T
_T
d)
M
e
W
rv
CP
CP
se
(re
31 17 16 15 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_TIMER2_VALUE Current value of PWM timer2 counter. (RO)

PR
MCPWM_TIMER2_DIRECTION Current direction of PWM timer2 counter. 0: increment; 1: decre-

ment. (RO)

Register 29.14. MCPWM_TIMER_SYNCI_CFG_REG (0x0034)
NC _IN RT
NV T
T
_I R
ER
SY I1 VE
I0 VE
L_ NC _IN
NA SY CI2
EL
EL
EL
IS
IS
IS
ER L_ N
XT NA SY
NC
NC
NC
_E R L_
SY
SY
SY
M TE A
2_
1_
0_
W EX RN
ER
ER
ER
CP _ TE
IM
IM
IM
M WM EX
_T
_T
_T
CP _
)
ed
M WM
M
W
W
rv
CP
CP
CP
CP
se
(re
M
31 12 11 10 9 8 6 5 3 2 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
MCPWM_TIMER0_SYNCISEL Select sync input for PWM timer0. (R/W)
• 1: PWM timer0 sync_out;
A
• 4: SYNC0 from GPIO matrix;

IN
• Other values: no sync input selected.

IM

EL

PR

Register 29.14. MCPWM_TIMER_SYNCI_CFG_REG (0x0034)
RY
• 6: SYNC2 from GPIO matrix
MCPWM_EXTERNAL_SYNCI0_INVERT Invert SYNC0 from GPIO matrix. (R/W)
A

IN
Register 29.15. MCPWM_OPERATOR_TIMERSEL_REG (0x0038)
IM
L
SE
SE
SE
ER
ER
ER
IM
IM
I
_T
_T
_T
R2
R1
R0
TO
TO
TO
RA
RA
RA
PE
PE
PE
_O
_O
_O
)
EL
ed
M
W
W
rv
CP
CP
CP
se
(re
31 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_OPERATOR0_TIMERSEL Select which PWM timer’s is the timing reference for PWM op-
PR
erator0. 0: timer0; 1: timer1; 2: timer2. (R/W)

Register 29.16. MCPWM_GEN0_STMP_CFG_REG (0x003C)
_F LL
L
D
UL
HO
HO
D W FU
SH W_
ET
ET
M
M
A_ D
0_ SH
UP
UP
EN B_
B_
A_
_ G 0_
0_
0_
M N
EN
EN
W GE
_G
_G
CP _
d)
M WM
M
ve
W
er
CP
CP
CP
s
(re
M
31 10 9 8 7 4 3 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_GEN0_A_UPMETHOD Update method for PWM generator 0 time stamp A’s active regis-
RY
ter. When all bits are set to 0: immediately; when bit0 is set to 1: TEZ; when bit1 is set to 1: TEP;
when bit2 is set to 1: sync; when bit3 is set to 1: disable the update. (R/W)
MCPWM_GEN0_B_UPMETHOD Update method for PWM generator 0 time stamp B’s active regis-
A
MCPWM_GEN0_A_SHDW_FULL Set and reset by hardware. If set, PWM generator 0 time stamp
A’s shadow reg is filled and waiting to be transferred to A’s active reg; if cleared, A’s active reg has
been updated with shadow register latest value. (R/WTC/SC)
IN
MCPWM_GEN0_B_SHDW_FULL Set and reset by hardware. If set, PWM generator 0 time stamp
B’s shadow reg is filled and waiting to be transferred to B’s active reg; if cleared, B’s active reg has
IM
Register 29.17. MCPWM_GEN0_TSTMP_A_REG (0x0040)
A
0_
EN
EL
_G
)
ed
M
W
rv
CP
se
(re
31 16 15 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
PR
MCPWM_GEN0_A PWM generator 0 time stamp A’s shadow register. (R/W)
Register 29.18. MCPWM_GEN0_TSTMP_B_REG (0x0044)

B
0_
EN
_G
)
ed
M
W
rv
CP
se
(re
31 16 15 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_GEN0_B PWM generator 0 time stamp B’s shadow register. (R/W)

Register 29.19. MCPWM_GEN0_CFG0_REG (0x0048)
D
HO
ET
PM
L
EL
_U
E
_S
_S
G
CF
T1
T0
0_
0_
0_
EN
EN
EN
_G
_G
_G
d)
M
ve
W
er
CP
CP
CP
s
(re
M
31 10 9 7 6 4 3 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_GEN0_CFG_UPMETHOD Update method for PWM generator 0’s active register of con-
RY
figuration. When all bits are set to 0: immediately; when bit0 is set to 1: TEZ; when bit1 is set to
1:TEP; when bit2 is set to 1:sync; when bit3 is set to 1:disable the update. (R/W)
MCPWM_GEN0_T0_SEL Source selection for PWM generator 0 event_t0, take effect immediately,
0: fault_event0, 1: fault_event1, 2: fault_event2, 3: sync_taken, 4: none. (R/W)
A
IN
IM
EL
PR

Register 29.20. MCPWM_GEN0_FORCE_REG (0x004C)
D
HO
DE
DE
ET
E
O
RC OD
RC OD
M
M
UP
E_
E_
M
_M
E_
RC
RC
E_
E
CE
E
RC
RC
O
O
R
UF
UF
FO
FO
FO
F
IF
NT
T
CI
CI
CI
TU
NC
CN
CP _GE B_N
CP _GE B_N
C
CP _GE A_N
CN
B_
_G _A_
A_
_
0_
0_
0_
N0
N0
N0
N0
EN
EN
EN
CP _GE
_G
_G
)
ed
M
W
W
rv
CP
CP
CP
se
(re
M
31 16 15 14 13 12 11 10 9 8 7 6 5 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x20 Reset
RY
MCPWM_GEN0_CNTUFORCE_UPMETHOD Updating method for continuous software force of
PWM generator0. When all bits are set to 0: immediately; when bit0 is set to 1: TEZ; when
bit1 is set to 1: TEP; when bit2 is set to 1: TEA; when bit3 is set to 1: TEB; when bit4 is set to
1: sync; when bit5 is set to 1: disable update. (TEA/B here and below means an event generated
when the timer’s value equals to that of register A/B.) (R/W)
A
MCPWM_GEN0_A_CNTUFORCE_MODE Continuous software force mode for PWM0A. 0: dis-
abled, 1: low, 2: high, 3: disabled. (R/W) IN
MCPWM_GEN0_B_CNTUFORCE_MODE Continuous software force mode for PWM0B. 0: dis-
abled, 1: low, 2: high, 3: disabled. (R/W)
MCPWM_GEN0_A_NCIFORCE Trigger of non-continuous immediate software-force event for

PWM0A, a toggle will trigger a force event. (R/W)
IM
MCPWM_GEN0_A_NCIFORCE_MODE Non-continuous immediate software force mode for
PWM0A. 0: disabled, 1: low, 2: high, 3: disabled. (R/W)
MCPWM_GEN0_B_NCIFORCE Trigger of non-continuous immediate software-force event for

EL
PWM0B, a toggle will trigger a force event. (R/W)
MCPWM_GEN0_B_NCIFORCE_MODE Non-continuous immediate software force mode for

PWM0B. 0: disabled, 1: low, 2: high, 3: disabled. (R/W)
PR

Register 29.21. MCPWM_GEN0_A_REG (0x0050)
B
EA
EA
P
Z
EZ
TE
TE
TE
TE
TE
T1
T0
T1
0
DT
UT
UT
UT
_D
_D
_D
_D
_D
_U
_U
_U
_
A_
A_
A
_A
_A
_A
_A
_A
_A
A
0_
0_
0_
0_
0_
0_
0
N0
N0
N0
0
EN
EN
EN
EN
EN
EN
EN
EN
EN
E
E
_G
_G
_G
_G
_G
_G
_G
_G
_G
_G
_G
_G
d)
M
ve
W
er
CP
CP
CP
CP
CP
CP
CP
CP
CP
CP
CP
CP
s
(re
M
31 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_GEN0_A_UTEZ Action on PWM0A triggered by event TEZ when timer increasing. 0: no

change, 1: low, 2: high, 3: toggle. (R/W)
RY
MCPWM_GEN0_A_UTEP Action on PWM0A triggered by event TEP when timer increasing. 0: no
MCPWM_GEN0_A_UTEA Action on PWM0A triggered by event TEA when timer increasing. 0: no

MCPWM_GEN0_A_UTEB Action on PWM0A triggered by event TEB when timer increasing. 0: no
A
MCPWM_GEN0_A_UT0 Action on PWM0A triggered by event_t0 when timer increasing. 0: no

IN
IM
MCPWM_GEN0_A_DTEZ Action on PWM0A triggered by event TEZ when timer decreasing. 0: no
MCPWM_GEN0_A_DTEP Action on PWM0A triggered by event TEP when timer decreasing. 0: no

EL
MCPWM_GEN0_A_DTEA Action on PWM0A triggered by event TEA when timer decreasing. 0: no

MCPWM_GEN0_A_DTEB Action on PWM0A triggered by event TEB when timer decreasing. 0: no

PR
MCPWM_GEN0_A_DT0 Action on PWM0A triggered by event_t0 when timer decreasing. 0: no



Register 29.22. MCPWM_GEN0_B_REG (0x0054)
B
EA
EA
P
Z
EZ
TE
TE
TE
TE
TE
1
T0
T1
0
DT
DT
UT
UT
UT
_D
_D
_D
_D
_U
_U
_U
B_
B_
B_
_B
_B
_B
_B
_B
_B
B
0_
0_
0_
0_
0_
0_
N0
N0
N0
0
EN
EN
EN
EN
EN
EN
EN
EN
EN
E
E
_G
_G
_G
_G
_G
_G
_G
_G
_G
_G
_G
_G
d)
M
ve
W
er
CP
CP
CP
CP
CP
CP
CP
CP
CP
CP
CP
CP
s
(re
M
31 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_GEN0_B_UTEZ Action on PWM0B triggered by event TEZ when timer increasing. 0: no

RY
MCPWM_GEN0_B_UTEP Action on PWM0B triggered by event TEP when timer increasing. 0: no
MCPWM_GEN0_B_UTEA Action on PWM0B triggered by event TEA when timer increasing. 0: no

MCPWM_GEN0_B_UTEB Action on PWM0B triggered by event TEB when timer increasing. 0: no
A
MCPWM_GEN0_B_UT0 Action on PWM0B triggered by event_t0 when timer increasing. 0: no

IN
IM
MCPWM_GEN0_B_DTEZ Action on PWM0B triggered by event TEZ when timer decreasing. 0: no
MCPWM_GEN0_B_DTEP Action on PWM0B triggered by event TEP when timer decreasing. 0: no

EL
MCPWM_GEN0_B_DTEA Action on PWM0B triggered by event TEA when timer decreasing. 0: no

MCPWM_GEN0_B_DTEB Action on PWM0B triggered by event TEB when timer decreasing. 0: no

PR
MCPWM_GEN0_B_DT0 Action on PWM0B triggered by event_t0 when timer decreasing. 0: no



Register 29.23. MCPWM_DT0_CFG_REG (0x0058)
D
T
D
N T
CP _ 0_ _ EL R
HO
CP _ 0_ _ TI R
HO
CP _ 0_ _ YP S
CP _ 0_ _ TIN S
M WM DT RED INS VE
M WM DT FED OU VE
M WM DT FED TB AS
M WM DT RED OU AS
EB SW P
O P
ET
ET
_D U T A
DE
_M A
_D A T L
CP _ 0_ U YP
T0 _O SW
M 0_ OU E
PM
PM
M WM DT B_O SEL
W DT B_ INS
M WM DT A_O TB
_U
_U
CP _ 0_ U
CP _ 0_ _
ED
M WM DT CLK
ED
_R
_F
CP _ 0_
T0
T0
M WM DT
_D
_D
CP _
d)
M WM
M
ve
W
er
CP
CP
CP
s
(re
M
31 18 17 16 15 14 13 12 11 10 9 8 7 4 3 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 Reset
MCPWM_DT0_FED_UPMETHOD Update method for FED (rising edge delay) active register. 0: im-
RY
mediate; when bit0 is set to 1: tez; when bit1 is set to 1: tep; when bit2 is set to 1: sync; when
bit3 is set to 1: disable the update. (R/W)
MCPWM_DT0_RED_UPMETHOD Update method for RED (rising edge delay) active register. 0:
immediate; when bit0 is set to 1: tez; when bit1 is set to 1: tep; when bit2 is set to 1: sync; when
A
MCPWM_DT0_DEB_MODE S8 in table 29-5, dual-edge B mode, 0: fed/red take effect on different
path separately, 1: fed/red take effect on B path, A out is in bypass or dulpB mode (R/W)
IN
MCPWM_DT0_A_OUTSWAP S6 in table 29-5. (R/W)
MCPWM_DT0_B_OUTSWAP S7 in table 29-5. (R/W)
MCPWM_DT0_RED_INSEL S4 in table 29-5. (R/W)

IM
MCPWM_DT0_FED_INSEL S5 in table 29-5. (R/W)
MCPWM_DT0_RED_OUTINVERT S2 in table 29-5. (R/W)
MCPWM_DT0_FED_OUTINVERT S3 in table 29-5. (R/W)

EL
MCPWM_DT0_A_OUTBYPASS S1 in table 29-5. (R/W)
MCPWM_DT0_B_OUTBYPASS S0 in table 29-5. (R/W)
MCPWM_DT0_CLK_SEL Dead time generator 0 clock selection. 0: PWM_clk, 1: PT_clk. (R/W)

PR
Register 29.24. MCPWM_DT0_FED_CFG_REG (0x005C)

DE
_F
T0
_D
)
ed
M
W
rv
CP
se
(re
31 16 15 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_DT0_FED Shadow register for FED. (R/W)

Register 29.25. MCPWM_DT0_RED_CFG_REG (0x0060)
E D
_R
T0
_D
d)
M
ve
W
er
CP
s
(re
M
31 16 15 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_DT0_RED Shadow register for RED. (R/W)
RY
Register 29.26. MCPWM_CARRIER0_CFG_REG (0x0064)
T
ER
LE
TH
_I T
UT R
NV
CA
O VE
TW
TY
ES
0_ _IN
SH
DU
PR
EN
ER IN
O
RI 0_
0_
0_
0_
0_
AR IER
ER
ER
ER
ER
RI
RI
RI
RI
_C R
M R
AR
AR
AR
AR
A
W CA
_C
_C
_C
_C
CP _
)
ed
M WM
M
W
W
rv
CP
CP
CP
CP
CP
se
(re
M
31 14 13 12 11 8 7 5 4 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
IN
0 0 0 0 0 0 0 0 0 Reset
MCPWM_CARRIER0_EN When set, carrier0 function is enabled. When cleared, carrier0 is by-
passed. (R/W)
IM
MCPWM_CARRIER0_PRESCALE PWM carrier0 clock (PC_clk) prescale value. Period of PC_clk =
period of PWM_clk * (PWM_CARRIER0_PRESCALE + 1). (R/W)
MCPWM_CARRIER0_DUTY Carrier duty selection. Duty = PWM_CARRIER0_DUTY / 8. (R/W)
MCPWM_CARRIER0_OSHTWTH Width of the first pulse in number of periods of the carrier. (R/W)
EL
MCPWM_CARRIER0_OUT_INVERT When set, invert the output of PWM0A and PWM0B for this
submodule. (R/W)
MCPWM_CARRIER0_IN_INVERT When set, invert the input of PWM0A and PWM0B for this sub-
module. (R/W)
PR

Register 29.27. MCPWM_FH0_CFG0_REG (0x0068)
_D
_U
M WM FH F0_ D
_U
_D
_U
_D
BC
M WM FH F0_ ST
C_
C_
W FH F1 BC
H0 2_ C
W C
M WM FH F1_ ST
M WM FH F2_ ST
M WM FH SW ST
BC
BC
ST
ST
ST
ST
_F F B
_S CB
CP _ 0_ _O
_C
CB
CB
CP _ 0_ O
CP _ 0_ O
CP _ 0_ O
CP _ 0_ C
M 0_ _C
O
_O
_C
_O
_C
B_
CP M_ _A_
_B
_B
_B
_A
_A
_A
0_
CP _ 0_
H0
H0
H0
H0
H0
H0
0
H
CP _FH
M WM FH
_F
_F
_F
_F
_F
_F
_F
d)
M
ve
W
er
CP
CP
CP
CP
CP
CP
CP
CP
s
(re
M
M
31 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_FH0_SW_CBC Enable register for software force cycle-by-cycle mode action. 0: disable,
1: enable. (R/W)
RY
MCPWM_FH0_F2_CBC event_f2 will trigger cycle-by-cycle mode action. 0: disable, 1: enable.
(R/W)

(R/W)
A
(R/W)
MCPWM_FH0_SW_OST Enable register for software force one-shot mode action. 0: disable, 1:
enable. (R/W)
IN
MCPWM_FH0_F2_OST event_f2 will trigger one-shot mode action. 0: disable, 1: enable. (R/W)
IM
MCPWM_FH0_A_CBC_D Cycle-by-cycle mode action on PWM0A when fault event occurs and timer
is decreasing. 0: do nothing, 1: force low, 2: force high, 3: toggle. (R/W)
EL
MCPWM_FH0_A_CBC_U Cycle-by-cycle mode action on PWM0A when fault event occurs and timer
is increasing. 0: do nothing, 1: force low, 2: force high, 3: toggle. (R/W)
MCPWM_FH0_A_OST_D One-shot mode action on PWM0A when fault event occurs and timer is
decreasing. 0: do nothing, 1: force low, 2: force high, 3: toggle. (R/W)
PR
MCPWM_FH0_A_OST_U One-shot mode action on PWM0A when fault event occurs and timer is
increasing. 0: do nothing, 1: force low, 2: force high, 3: toggle. (R/W)
MCPWM_FH0_B_CBC_D Cycle-by-cycle mode action on PWM0B when fault event occurs and timer
MCPWM_FH0_B_CBC_U Cycle-by-cycle mode action on PWM0B when fault event occurs and timer
is increasing. 0: do nothing,1: force low, 2: force high, 3: toggle. (R/W)
MCPWM_FH0_B_OST_D One-shot mode action on PWM0B when fault event occurs and timer is
MCPWM_FH0_B_OST_U One-shot mode action on PWM0B when fault event occurs and timer is

Register 29.28. MCPWM_FH0_CFG1_REG (0x006C)
C
0_ CE_ ST
E
CB
LS
R _O
ST
U
FO E
_O
H0 CP
0_ RC
LR
CB
CP _FH _FO
_C
M 0
W FH
CP _FH
_F
CP _
d)
M WM
M
ve
W
er
CP
s
(re
M
31 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_FH0_CLR_OST A rising edge will clear on going one-shot mode action. (R/W)
RY
MCPWM_FH0_CBCPULSE Cycle-by-cycle mode action refresh moment selection. When bit0 is set
to 1: TEZ; when bit1 is set to 1: TEP. (R/W)
MCPWM_FH0_FORCE_CBC A toggle triggers a cycle-by-cycle mode action. (R/W)
MCPWM_FH0_FORCE_OST A toggle (software negate its value) triggers a one-shot mode action.
(R/W)
A
IN
Register 29.29. MCPWM_FH0_STATUS_REG (0x0070)
N
BC N
_O
_C _O
H0 ST
_F O
M 0_
W FH
CP _
d)
IM
M WM
e
rv
CP
se
(re
M
31 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_FH0_CBC_ON Set and reset by hardware. If set, a cycle-by-cycle mode action is on-going.
EL
(RO)
MCPWM_FH0_OST_ON Set and reset by hardware. If set, an one-shot mode action is on-going.
(RO)
PR

Register 29.30. MCPWM_GEN1_STMP_CFG_REG (0x0074)
_F LL
L
D
UL
HO
HO
D W FU
SH W_
ET
ET
M
M
A_ D
1_ SH
UP
UP
EN B_
B_
A_
_ G 1_
1_
1_
M N
EN
EN
W GE
_G
_G
CP _
d)
M WM
M
ve
W
er
CP
CP
CP
s
(re
M
31 10 9 8 7 4 3 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
A
A’s shadow reg is filled and waiting to be transferred to A’s active reg. If cleared, A’s active reg has
IN
B’s shadow reg is filled and waiting to be transferred to B’s active reg. If cleared, B’s active reg has
IM
Register 29.31. MCPWM_GEN1_TSTMP_A_REG (0x0078)
A
1_
EN
EL
_G
)
ed
M
W
rv
CP
se
(re
31 16 15 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
PR
Register 29.32. MCPWM_GEN1_TSTMP_B_REG (0x007C)

B
1_
EN
_G
)
ed
M
W
rv
CP
se
(re
31 16 15 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset

Register 29.33. MCPWM_GEN1_CFG0_REG (0x0080)
D
HO
ET
PM
L
EL
_U
E
_S
_S
G
CF
T1
T0
1_
1_
1_
EN
EN
EN
_G
_G
_G
d)
M
ve
W
er
CP
CP
CP
s
(re
M
31 10 9 7 6 4 3 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
figuration. When all bits are set to 0: immediately; when bit0 is set to 1: TEZ; when bit1 is set to
1:sync; when bit3 is set to 1:disable the update. (R/W)
A
IN
IM
EL
PR

Register 29.34. MCPWM_GEN1_FORCE_REG (0x0084)
D
HO
DE
DE
ET
E
O
RC OD
RC OD
M
M
UP
E_
E_
M
_M
E_
RC
RC
E_
E
CE
E
RC
RC
O
O
R
UF
UF
FO
FO
FO
F
IF
NT
T
CI
CI
CI
TU
NC
CN
CP _GE B_N
CP _GE B_N
C
CP _GE A_N
CN
B_
_G _A_
A_
_
1_
1_
1_
N1
N1
N1
N1
EN
EN
EN
CP _GE
_G
_G
)
ed
M
W
W
rv
CP
CP
CP
se
(re
M
31 16 15 14 13 12 11 10 9 8 7 6 5 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x20 Reset
RY
PWM generator 1. When all bits are set to 0: immediately; when bit0 is set to 1: TEZ; when
A

IM
PWM1A. 0: disabled, 1: low, 2: high, 3: disabled. (R/W)

EL

PR

Register 29.35. MCPWM_GEN1_A_REG (0x0088)
B
EA
EA
P
Z
EZ
TE
TE
TE
TE
TE
T1
T0
T1
0
DT
UT
UT
UT
_D
_D
_D
_D
_D
_U
_U
_U
_
A_
A_
A
_A
_A
_A
_A
_A
_A
A
1_
1_
1_
1_
1_
1_
1
N1
N1
N1
1
EN
EN
EN
EN
EN
EN
EN
EN
EN
E
E
_G
_G
_G
_G
_G
_G
_G
_G
_G
_G
_G
_G
d)
M
ve
W
er
CP
CP
CP
CP
CP
CP
CP
CP
CP
CP
CP
CP
s
(re
M
31 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset

RY

A

IN
IM

EL


PR



Register 29.36. MCPWM_GEN1_B_REG (0x008C)
B
EA
EA
P
Z
EZ
TE
TE
TE
TE
TE
1
T0
T1
0
DT
DT
UT
UT
UT
_D
_D
_D
_D
_U
_U
_U
B_
B_
B_
_B
_B
_B
_B
_B
_B
B
1_
1_
1_
1_
1_
1_
N1
N1
N1
1
EN
EN
EN
EN
EN
EN
EN
EN
EN
E
E
_G
_G
_G
_G
_G
_G
_G
_G
_G
_G
_G
_G
d)
M
ve
W
er
CP
CP
CP
CP
CP
CP
CP
CP
CP
CP
CP
CP
s
(re
M
31 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset

RY

A

IN
IM

EL


PR



Register 29.37. MCPWM_DT1_CFG_REG (0x0090)
D
T
D
N T
CP _ 1_ _ EL R
HO
CP _ 1_ _ TI R
HO
CP _ 1_ _ YP S
CP _ 1_ _ TIN S
M WM DT RED INS VE
M WM DT FED OU VE
M WM DT FED TB AS
M WM DT RED OU AS
EB SW P
O P
ET
ET
_D U T A
DE
_M A
_D A T L
CP _ 1_ U YP
T1 _O SW
M 1_ OU E
PM
PM
M WM DT B_O SEL
W DT B_ INS
M WM DT A_O TB
_U
_U
CP _ 1_ U
CP _ 1_ _
ED
M WM DT CLK
ED
_R
_F
CP _ 1_
T1
T1
M WM DT
_D
_D
CP _
d)
M WM
M
ve
W
er
CP
CP
CP
s
(re
M
31 18 17 16 15 14 13 12 11 10 9 8 7 4 3 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 Reset
MCPWM_DT1_FED_UPMETHOD Update method for FED (falling edge delay) active register. 0: im-
RY
A
MCPWM_DT1_DEB_MODE S8 in table 29-5, dual-edge B mode. 0: fed/red take effect on different
path separately; 1: fed/red take effect on B path, A out is in bypass or dulpB mode. (R/W)
IN

IM

EL

PR
Register 29.38. MCPWM_DT1_FED_CFG_REG (0x0094)

DE
_F
T1
_D
)
ed
M
W
rv
CP
se
(re
31 16 15 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset

Register 29.39. MCPWM_DT1_RED_CFG_REG (0x0098)
E D
_R
T1
_D
d)
M
ve
W
er
CP
s
(re
M
31 16 15 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
Register 29.40. MCPWM_CARRIER1_CFG_REG (0x009C)
T
ER
LE
TH
_I T
UT R
NV
CA
O VE
TW
TY
ES
1_ _IN
SH
DU
PR
EN
ER IN
O
RI 1_
1_
1_
1_
1_
AR IER
ER
ER
ER
ER
RI
RI
RI
RI
_C R
M R
AR
AR
AR
AR
A
W CA
_C
_C
_C
_C
CP _
)
ed
M WM
M
W
W
rv
CP
CP
CP
CP
CP
se
(re
M
31 14 13 12 11 8 7 5 4 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
IN
0 0 0 0 0 0 0 0 0 Reset
passed. (R/W)
IM
EL
submodule. (R/W)
module. (R/W)
PR

Register 29.41. MCPWM_FH1_CFG0_REG (0x00A0)
_D
_U
M WM FH F0_ D
_U
_D
_U
_D
BC
M WM FH F0_ ST
C_
C_
W FH F1 BC
H1 2_ C
W C
M WM FH F1_ ST
M WM FH F2_ ST
M WM FH SW ST
BC
BC
ST
ST
ST
ST
_F F B
_S CB
CP _ 1_ _O
_C
CB
CB
CP _ 1_ O
CP _ 1_ O
CP _ 1_ O
CP _ 1_ C
M 1_ _C
O
_O
_C
_O
_C
B_
CP M_ _A_
_B
_B
_B
_A
_A
_A
1_
CP _ 1_
H1
H1
H1
H1
H1
H1
1
H
CP _FH
M WM FH
_F
_F
_F
_F
_F
_F
_F
d)
M
ve
W
er
CP
CP
CP
CP
CP
CP
CP
CP
s
(re
M
M
31 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
1: enable. (R/W)
RY
(R/W)

(R/W)
A
(R/W)
enable. (R/W)
IN
IM
MCPWM_FH1_F0_OST event_f0 will trigger one-shot mode action. 0: disable, 1: enable (R/W)
EL
decreasing. 0: do nothing,1: force low, 2: force high, 3: toggle. (R/W)
PR

Register 29.42. MCPWM_FH1_CFG1_REG (0x00A4)
C
1_ CE_ ST
E
CB
LS
R _O
ST
U
FO E
_O
H1 CP
1_ RC
LR
CB
CP _FH _FO
_C
M 1
W FH
CP _FH
_F
CP _
d)
M WM
M
ve
W
er
CP
s
(re
M
31 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
MCPWM_FH1_CBCPULSE Cycle-by-cycle mode action refresh moment selection. When all bits
are 0: refresh disabled; when bit0 is set to 1: TEZ; when bit1 is set to 1: TEP; when all bits are 1:
TEZ/TEP. (R/W)
A
(R/W)
IN
Register 29.43. MCPWM_FH1_STATUS_REG (0x00A8)
N
BC N
_O
_C _O
H1 ST
_F O
M 1_
IM
W FH
CP _
)
ed
M WM
rv
CP
se
(re
M
31 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
EL
(RO)
(RO)
PR

Register 29.44. MCPWM_FH2_STATUS_REG (0x00E0)
N
BC N
_O
_C _O
H2 ST
_F O
M 2_
W FH
CP _
d)
M WM
ve
er
CP
s
(re
M
31 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
(RO)
RY
(RO)
Register 29.45. MCPWM_GEN2_STMP_CFG_REG (0x00AC)
A _F LL
L
D
UL
HO
HO
DW FU
SH W_
ET
ET
M
M
A_ D
2_ SH
UP
UP
IN
EN B_
B_
A_
_G 2_
2_
2_
M N
EN
EN
W GE
_G
_G
CP _
d)
M WM
M
ve
W
r
CP
CP
CP
se
(re
M
31 10 9 8 7 4 3 0
IM
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
EL
PR
A’s shadow reg is filled and waiting to be transferred to A’s active reg. If cleared, A’s active reg has
B’s shadow reg is filled and waiting to be transferred to B’s active reg. If cleared, B’s active reg has

Register 29.46. MCPWM_GEN2_STMP_A_REG (0x00B0)
A
2_
EN
_G
d)
M
ve
W
r
CP
se
(re
M
31 16 15 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
Register 29.47. MCPWM_GEN2_STMP_B_REG (0x00B4)
B
2_
EN
_G
d)
M
ve
W
r
CP
se
(re
M
31 16 15 0
A
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset

IN
Register 29.48. MCPWM_GEN2_CFG0_REG (0x00B8)
IM
D
HO
ET
PM
L
EL
_U
E
_S
_S
G
CF
T1
T0
2_
2_
2_
EN
EN
EN
_G
_G
_G
d)
M
EL ve
W
r
CP
CP
CP
se
(re
31 10 9 7 6 4 3 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
PR
figuration. 0: immediately; when bit0 is set to 1: TEZ; when bit1 is set to 1: sync; when bit3 is set
to 1: disable the update. (R/W)

Register 29.49. MCPWM_GEN2_FORCE_REG (0x00BC)
D
HO
DE
DE
ET
E
O
RC OD
RC OD
M
M
UP
E_
E_
M
_M
E_
RC
RC
E_
E
CE
E
RC
RC
O
O
R
UF
UF
FO
FO
FO
F
IF
NT
T
CI
CI
CI
TU
NC
CN
CP _GE B_N
CP _GE B_N
C
CP _GE A_N
CN
B_
_G _A_
A_
_
2_
2_
2_
N2
N2
N2
N2
EN
EN
EN
CP _GE
_G
_G
)
ed
M
W
W
rv
CP
CP
CP
se
(re
M
31 16 15 14 13 12 11 10 9 8 7 6 5 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x20 Reset
RY
PWM generator 2. When all bits are set to 0: immediately; when bit0 is set to 1: TEZ; when
A

IM
PWM2A, 0: disabled, 1: low, 2: high, 3: disabled. (R/W)

EL

PR

Register 29.50. MCPWM_GEN2_A_REG (0x00C0)
B
EA
EA
P
Z
EZ
TE
TE
TE
TE
TE
T1
T0
T1
0
DT
UT
UT
UT
_D
_D
_D
_D
_D
_U
_U
_U
_
A_
A_
A
_A
_A
_A
_A
_A
_A
A
2_
2_
2_
2_
2_
2_
2
N2
N2
N2
2
EN
EN
EN
EN
EN
EN
EN
EN
EN
E
E
_G
_G
_G
_G
_G
_G
_G
_G
_G
_G
_G
_G
d)
M
ve
W
er
CP
CP
CP
CP
CP
CP
CP
CP
CP
CP
CP
CP
s
(re
M
31 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset

RY

A

IN
IM

EL


PR



Register 29.51. MCPWM_GEN2_B_REG (0x00C4)
B
EA
EA
P
Z
EZ
TE
TE
TE
TE
TE
1
T0
T1
0
DT
DT
UT
UT
UT
_D
_D
_D
_D
_U
_U
_U
B_
B_
B_
_B
_B
_B
_B
_B
_B
B
2_
2_
2_
2_
2_
2_
N2
N2
N2
2
EN
EN
EN
EN
EN
EN
EN
EN
EN
E
E
_G
_G
_G
_G
_G
_G
_G
_G
_G
_G
_G
_G
d)
M
ve
W
er
CP
CP
CP
CP
CP
CP
CP
CP
CP
CP
CP
CP
s
(re
M
31 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset

RY

A

IN
IM

EL


PR



Register 29.52. MCPWM_DT2_CFG_REG (0x00C8)
D
T
D
N T
CP _ 2_ _ EL R
HO
CP _ 2_ _ TI R
HO
CP _ 2_ _ YP S
CP _ 2_ _ TIN S
M WM DT RED INS VE
M WM DT FED OU VE
M WM DT FED TB AS
M WM DT RED OU AS
EB SW P
O P
ET
ET
_D U T A
DE
_M A
_D A T L
CP _ 2_ U YP
T2 _O SW
M 2_ OU E
PM
PM
M WM DT B_O SEL
W DT B_ INS
M WM DT A_O TB
_U
_U
CP _ 2_ U
CP _ 2_ _
ED
M WM DT CLK
ED
_R
_F
CP _ 2_
T2
T2
M WM DT
_D
_D
CP _
d)
M WM
M
ve
W
er
CP
CP
CP
s
(re
M
31 18 17 16 15 14 13 12 11 10 9 8 7 4 3 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 Reset
MCPWM_DT2_FED_UPMETHOD Update method for FED (falling edge delay) active register. 0: im-
RY
A
MCPWM_DT2_DEB_MODE S8 in table 29-5, dual-edge B mode. 0: fed/red take effect on different
path separately; 1: fed/red take effect on B path, A out is in bypass or dulpB mode. (R/W)
IN

IM

EL

PR
Register 29.53. MCPWM_DT2_FED_CFG_REG (0x00CC)

DE
_F
T2
_D
)
ed
M
W
rv
CP
se
(re
31 16 15 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset

Register 29.54. MCPWM_DT2_RED_CFG_REG (0x00D0)
E D
_R
T2
_D
d)
M
ve
W
er
CP
s
(re
M
31 16 15 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
Register 29.55. MCPWM_CARRIER2_CFG_REG (0x00D4)
T
ER
LE
TH
_I T
UT R
NV
CA
O VE
TW
TY
ES
2_ _IN
SH
DU
PR
EN
ER IN
O
RI 2_
2_
2_
2_
2_
AR IER
ER
ER
ER
ER
RI
RI
RI
RI
_C R
M R
AR
AR
AR
AR
A
W CA
_C
_C
_C
_C
CP _
)
ed
M WM
M
W
W
rv
CP
CP
CP
CP
CP
se
(re
M
31 14 13 12 11 8 7 5 4 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
IN
0 0 0 0 0 0 0 0 0 Reset
passed. (R/W)
IM
EL
submodule. (R/W)
module. (R/W)
PR

Register 29.56. MCPWM_FH2_CFG0_REG (0x00D8)
_D
_U
M WM FH F0_ D
_U
_D
_U
_D
BC
M WM FH F0_ ST
C_
C_
W FH F1 BC
H2 2_ C
W C
M WM FH F1_ ST
M WM FH F2_ ST
M WM FH SW ST
BC
BC
ST
ST
ST
ST
_F F B
_S CB
CP _ 2_ _O
_C
CB
CB
CP _ 2_ O
CP _ 2_ O
CP _ 2_ O
CP _ 2_ C
M 2_ _C
O
_O
_C
_O
_C
B_
CP M_ _A_
_B
_B
_B
_A
_A
_A
2_
CP _ 2_
H2
H2
H2
H2
H2
H2
2
H
CP _FH
M WM FH
_F
_F
_F
_F
_F
_F
_F
d)
M
ve
W
er
CP
CP
CP
CP
CP
CP
CP
CP
s
(re
M
M
31 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
1: enable. (R/W)
RY
(R/W)

(R/W)
A
(R/W)
enable. (R/W)
IN
IM
EL
PR

Register 29.57. MCPWM_FH2_CFG1_REG (0x00DC)
C
2_ CE_ ST
E
CB
LS
R _O
ST
U
FO E
_O
H2 CP
2_ RC
LR
CB
CP _FH _FO
_C
M 2
W FH
CP _FH
_F
CP _
d)
M WM
M
ve
W
er
CP
s
(re
M
31 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
MCPWM_FH2_CBCPULSE Cycle-by-cycle mode action refresh moment selection. When bit0 is set
to 1: TEZ; when bit1 is set to 1: TEP. (R/W)
(R/W)
A
IN
Register 29.58. MCPWM_FAULT_DETECT_REG (0x00E4)
CP _ EN 2
CP _ EN 1
CP _ P 0
M WM F1_ OLE
M WM F0_ OLE
M WM F2_ OLE
M WM EV T_F
M WM EV T_F
M WM F2_ T_F
W F1 N
_F N
EN
CP _ EN
CP _ P
CP _ P
CP _ E
M _E
0_
M WM EV
CP _
d)
M WM
ver
IM
CP
se
(re
31 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_F0_EN When set, event_f0 generation is enabled. (R/W)

EL
MCPWM_F0_POLE Set event_f0 trigger polarity on FAULT0 source from GPIO matrix. 0: level low,
1: level high. (R/W)
PR
MCPWM_EVENT_F0 Set and reset by hardware. If set, event_f0 is on going. (RO)

Register 29.59. MCPWM_CAP_TIMER_CFG_REG (0x00E8)
EL
W
ER N
N
_S
IM I_E
_E
S
C_
CI
_T C
YN
YN
AP N Y
_S
_S
_ C _S
AP
AP
M P
W CA
_C
_C
CP _
d)
M WM
ve
W
er
CP
CP
CP
s
(re
M
31 6 5 4 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_CAP_TIMER_EN When set, capture timer incrementing under APB_clk is enabled. (R/W)
MCPWM_CAP_SYNCI_EN When set, capture timer sync is enabled. (R/W)
RY
MCPWM_CAP_SYNCI_SEL Capture module sync input selection. 0: none, 1: timer0 sync_out, 2:
timer1 sync_out, 3: timer2 sync_out, 4: SYNC0 from GPIO matrix, 5: SYNC1 from GPIO matrix,
6: SYNC2 from GPIO matrix. (R/W)
MCPWM_CAP_SYNC_SW When reg_cap_synci_en is 1, write 1 will trigger a capture timer sync,
A
capture timer is loaded with value in phase register. (WT)
IN
Register 29.60. MCPWM_CAP_TIMER_PHASE_REG (0x00EC)
ER
_P
HAS
E
IM
M
TI
A P_
_C
M
W
CP
M
31 0
0 Reset
EL
MCPWM_CAP_TIMER_PHASE Phase value for capture timer sync operation. (R/W)

PR

Register 29.61. MCPWM_CAP_CH0_CFG_REG (0x00F0)
LE
T
ER
CA
NV
E
ES
AP OD
_I
AP SW
PR
EN
IN
_ C _M
_C 0_
0_
0_
0_
P0
M P
AP
W CA
CP _CA
_C
CP _
d)
M WM
M
ve
W
er
CP
CP
CP
s
(re
M
31 13 12 11 10 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_CAP0_EN When set, capture on channel 0 is enabled. (R/W)
RY
MCPWM_CAP0_MODE Edge of capture on channel 0 after prescaling. When bit0 is set to 1: enable
capture on the falling edge, When bit1 is set to 1: enable capture on the rising edge. (R/W)
MCPWM_CAP0_PRESCALE Value of prescaling on rising edge of CAP0. Prescale value =

PWM_CAP0_PRESCALE + 1. (R/W)
MCPWM_CAP0_IN_INVERT When set, CAP0 form GPIO matrix is inverted before prescale. (R/W)
A
MCPWM_CAP0_SW Write 1 will trigger a software forced capture on channel 0. (WT)
IN
LE
T
ER
CA
NV
E
ES
AP OD
IM
_I
AP SW
PR
EN
IN
_C _M
_C 1_
1_
1_
1_
P1
M P
AP
W CA
CP _CA
_C
CP _
d)
M WM
M
ve
W
r
CP
CP
CP
se
(re
M
31 13 12 11 10 3 2 1 0
EL
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
PR


LE
T
ER
CA
NV
E
ES
AP OD
_I
AP SW
PR
EN
IN
_ C _M
_C 2_
2_
2_
2_
P2
M P
AP
W CA
CP _CA
_C
CP _
d)
M WM
M
ve
W
er
CP
CP
CP
s
(re
M
31 13 12 11 10 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY

A
IN
Register 29.64. MCPWM_CAP_CH0_REG (0x00FC)
_V
AL
UE
IM M
CP
W
M
_C
A P0
31 0
0 Reset
EL
MCPWM_CAP0_VALUE Value of last capture on channel 0. (RO)
Register 29.65. MCPWM_CAP_CH1_REG (0x0100)

PR
UE
AL
_V
A P1
_C
M
W
CP
M
31 0
0 Reset

Register 29.66. MCPWM_CAP_CH2_REG (0x0104)
UE
AL
_V
A P2
_C
M
W
CP
M
31 0
0 Reset
RY
Register 29.67. MCPWM_CAP_STATUS_REG (0x0108)
_C 1_ GE
0_ GE
E
G
M P D
AP ED
ED
W CA _E
CP _ P2
M WM CA
CP _
)
ed
M WM
rv
A
CP
se
(re
M
31 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
IN
MCPWM_CAP0_EDGE Edge of last capture trigger on channel 0, 0: rising edge, 1: falling edge.
(RO)
IM
(RO)
(RO)
EL
PR

Register 29.68. MCPWM_UPDATE_CFG_REG (0x010C)
_E _UP
UP E
P
_G B EN P
N
L_ RC
CP _ 1_ _E U
CP _ 0_ _E U
M O _ U
M WM OP UP E_
M WM OP UP E_
W GL UP E_
BA FO
M WM OP FO N
M WM OP FO N
CP _ 2_ RC
CP _ 1_ RC
CP _ 0_ RC
LO AL_
M WM OP FO
CP _ 2_
M WM OP
CP _
d)
M WM
ve
er
CP
s
(re
M
31 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 0 1 0 1 Reset
MCPWM_GLOBAL_UP_EN The global enable of update of all active registers in MCPWM module.
RY
(R/W)
MCPWM_GLOBAL_FORCE_UP A toggle (software invert its value) will trigger a forced update of all
active registers in MCPWM module. (R/W)
MCPWM_OP0_UP_EN When set and PWM_GLOBAL_UP_EN is set, update of active registers in

PWM operator 0 are enabled. (R/W)
A
MCPWM_OP0_FORCE_UP A toggle (software invert its value) will trigger a forced update of active
registers in PWM operator 0. (R/W) IN
registers in PWM operator 1. (R/W)
IM
EL
registers in PWM operator 2. (R/W)

PR

Register 29.69. MCPWM_INT_ENA_REG (0x0110)
O NT NA
T_ A
A
IN N
EN
M WM FAU T2_ R_ T_E A
M WM FAU 1_ T_E T_E A
M WM TIM T0_ T_E A A
M WM TIM R2_ P_ T_E A

M WM TIM R1_ Z_ T_E A
M WM TIM 0_ Z_ T_E A
W TIM R2 EZ_ T_E A
_T R T T A
ER ST _I NA
ST _I _E
P_ _E
C P _ L C IN N
CP _ L IN IN N
CP _ L IN N N
CP _ E T IN N
CP _ E T IN N
CP _ E T IN N
CP _ E T IN N
M E _S IN N
M WM FAU T0_ R_ T_E
M WM OP CB INT NA
M WM OP TEB INT NA
M WM OP TEB INT NA
M WM TIM R0_ P_ T_E
IM 1_ OP _E
M WM OP TEB INT NA
M WM OP TEA INT NA
M WM OP TEA INT NA
M WM FH OS INT NA
M WM FH CB INT NA
M WM FH CB INT NA
M WM FAU TEA INT NA

M WM FAU T2_ INT NA
M WM FAU T1_ R_ NA
0_ OP NT
M WM TIM R2_ T_E A
M WM TIM R1_ P_ A
E
E
E
CP _ 0_ _ _E
CP _ 2_ _ _E
CP _ 1_ _ _E
CP _ 0_ T_ _E
CP _ 2_ T_ _E
CP _ 1_ C_ _E
CP _ 0_ _ _E
CP _ L _ _E
CP _ L C _E
CP _ L C IN
CP _ E IN N
CP _ E T N
CP _ E T IN
CP _ P0 T A
CP _ 2_ T A
CP _ 1_ T_ A
CP _ 0_ C_ _
CP _ 2_ C_ _
CP _ 1_ _ _
M WM CA _IN EN
M WM FH _IN EN
M WM FH OS EN
M WM FH OS INT
L
L
L
E
E
E
E
E
_
_
_
CP _ P1 T
M WM CA _IN
R
T
CP _ P2
M WM CA
CP M_
)
ed
W
rv
CP
se
(re
M
M
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_TIMER0_STOP_INT_ENA The enable bit for the interrupt triggered when the timer 0 stops.
RY
(R/W)
(R/W)
(R/W)
A
MCPWM_TIMER0_TEZ_INT_ENA The enable bit for the interrupt triggered by a PWM timer 0 TEZ
event. (R/W)
IN
event. (R/W)
IM
event. (R/W)
MCPWM_TIMER0_TEP_INT_ENA The enable bit for the interrupt triggered by a PWM timer 0 TEP
event. (R/W)
EL
event. (R/W)
event. (R/W)
MCPWM_FAULT0_INT_ENA The enable bit for the interrupt triggered when event_f0 starts. (R/W)
PR
MCPWM_FAULT0_CLR_INT_ENA The enable bit for the interrupt triggered when event_f0 ends.
(R/W)

Register 29.69. MCPWM_INT_ENA_REG (0x0110)
(R/W)
(R/W)
MCPWM_OP0_TEA_INT_ENA The enable bit for the interrupt triggered by a PWM operator 0 TEA
event (R/W)
RY
event (R/W)
event (R/W)
A
MCPWM_OP0_TEB_INT_ENA The enable bit for the interrupt triggered by a PWM operator 0 TEB
event (R/W)
event (R/W)
IN
event (R/W)
IM
MCPWM_FH0_CBC_INT_ENA The enable bit for the interrupt triggered by a cycle-by-cycle mode
action on PWM0. (R/W)
EL
MCPWM_FH0_OST_INT_ENA The enable bit for the interrupt triggered by a one-shot mode action
on PWM0. (R/W)
PR
on PWM1. (R/W)
on PWM2. (R/W)
MCPWM_CAP0_INT_ENA The enable bit for the interrupt triggered by capture on channel 0. (R/W)

Register 29.70. MCPWM_INT_RAW_REG (0x0114)
O NT AW
T_ W
W
M WM FAU T2_ R_ T_R W
M WM FAU 1_ T_R T_R W
M WM TIM T0_ T_R W W
M WM TIM R2_ P_ T_R W

M WM TIM R1_ Z_ T_R W
M WM TIM 0_ Z_ T_R W
W TIM R2 EZ_ T_R W
_T R T T W
ER ST _I AW
IN A
RA
ST _I _R
P_ _R
CP _ L C IN A
CP _ L IN IN A
CP _ L IN A A
CP _ E T IN A
CP _ E T IN A
CP _ E T IN A
CP _ E T IN A
M E _S IN A
M WM OP CB INT AW
M WM OP TEB INT AW
M WM OP TEB INT AW
M WM OP TEB INT AW
M WM OP TEA INT AW
M WM OP TEA INT AW
M WM FAU T0_ R_ T_R

M WM FH OS INT AW
M WM FH CB INT AW
M WM FH CB INT AW
M WM FAU TEA INT AW

M WM FAU T2_ INT AW
M WM FAU T1_ R_ AW
M WM TIM R0_ P_ T_R
IM 1_ OP _R
0_ OP NT
M WM TIM R2_ T_R W
M WM TIM R1_ P_ W
R
R
R
CP _ 0_ _ _R
CP _ 2_ _ _R
CP _ 1_ _ _R
CP _ 0_ T_ _R
CP _ 2_ T_ _R
CP _ 1_ C_ _R
CP _ 0_ _ _R
CP _ L _ _R
CP _ L C _R
CP _ P0 T W
CP _ 2_ T W
CP _ 1_ T_ W
CP _ L C IN
CP _ E IN A
CP _ E T A
CP _ E T IN
CP _ 0_ C_ _
CP _ 2_ C_ _
CP _ 1_ _ _
M WM CA _IN RA
M WM FH _IN RA
M WM FH OS RA
M WM FH OS INT
L
L
L
E
E
E
E
E
_
_
_
CP _ P1 T
M WM CA _IN
R
T
CP _ P2
M WM CA
CP _
CP )
ed
M WM
rv
se
(re
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_TIMER0_STOP_INT_RAW The raw status bit for the interrupt triggered when the timer 0
RY
stops. (R/WTC/SS)
stops. (R/WTC/SS)
A
stops. (R/WTC/SS)
MCPWM_TIMER0_TEZ_INT_RAW The raw status bit for the interrupt triggered by a PWM timer 0
TEZ event. (R/WTC/SS)
IN
IM
MCPWM_TIMER0_TEP_INT_RAW The raw status bit for the interrupt triggered by a PWM timer 0
TEP event. (R/WTC/SS)
EL
MCPWM_FAULT0_INT_RAW The raw status bit for the interrupt triggered when event_f0 starts.
PR
(R/WTC/SS)
(R/WTC/SS)
(R/WTC/SS)
MCPWM_FAULT0_CLR_INT_RAW The raw status bit for the interrupt triggered when event_f0 ends.
(R/WTC/SS)

Register 29.70. MCPWM_INT_RAW_REG (0x0114)
(R/WTC/SS)
(R/WTC/SS)
MCPWM_OP0_TEA_INT_RAW The raw status bit for the interrupt triggered by a PWM operator 0
TEA event (R/WTC/SS)
RY
A
MCPWM_OP0_TEB_INT_RAW The raw status bit for the interrupt triggered by a PWM operator 0
TEB event (R/WTC/SS)
IN
IM
MCPWM_FH0_CBC_INT_RAW The raw status bit for the interrupt triggered by a cycle-by-cycle
mode action on PWM0. (R/WTC/SS)
EL
MCPWM_FH0_OST_INT_RAW The raw status bit for the interrupt triggered by a one-shot mode
action on PWM0. (R/WTC/SS)
PR
MCPWM_CAP0_INT_RAW The raw status bit for the interrupt triggered by capture on channel 0.
(R/WTC/SS)
(R/WTC/SS)
(R/WTC/SS)

Register 29.71. MCPWM_INT_ST_REG (0x0118)
O NT T
IN T
ST
ST _I _S
P_ _S
CP _ L C IN T
CP _ L IN IN T
CP _ L IN T T
CP _ E T IN T
CP _ E T IN T
CP _ E T IN T
CP _ E T IN T
M E _S IN T
ER ST _I T
T_
M WM FAU T0_ R_ T_S
M WM FAU T2_ R_ T_S
M WM FAU 1_ T_S T_S
M WM TIM R0_ P_ T_S

M WM TIM R2_ P_ T_S
M WM TIM R1_ Z_ T_S
M WM TIM 0_ Z_ T_S
W TIM R2 EZ_ T_S
IM 1_ OP _S
0_ OP NT
M WM OP CB INT T
M WM OP TEB INT T
M WM OP TEB INT T
M WM OP TEB INT T
M WM OP TEA INT T
M WM OP TEA INT T
M WM FH OS INT T
M WM FH CB INT T
M WM FH CB INT T
M WM FAU TEA INT T

M WM FAU T2_ INT T
M WM FAU T1_ R_ T
_T R T T
S
S
S
CP _ 0_ _ _S
CP _ 2_ _ _S
CP _ 1_ _ _S
CP _ 0_ T_ _S
CP _ 2_ T_ _S
CP _ 1_ C_ _S
CP _ 0_ _ _S
CP _ L _ _S
CP _ L C _S
CP _ L C IN
CP _ E T IN
CP _ E IN T
CP _ E T T
CP _ 0_ C_ _
CP _ 2_ C_ _
CP _ 1_ _ _
M WM TIM T0_ T_S

M WM TIM R2_ T_S
M WM FH OS INT
M WM TIM R1_ P_
M WM CA _IN ST
M WM FH _IN ST
M WM FH OS ST
L
L
L
E
E
E
E
E
_
_
_
CP _ 1_ T_
CP _ P1 T
CP _ P0 T
CP _ 2_ T
M WM CA _IN
R
T
CP _ P2
M WM CA
CP M_
)
ed
W
rv
CP
se
(re
M
M
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_TIMER0_STOP_INT_ST The masked status bit for the interrupt triggered when the timer
RY
0 stops. (RO)
1 stops. (RO)
2 stops. (RO)
A
MCPWM_TIMER0_TEZ_INT_ST The masked status bit for the interrupt triggered by a PWM timer 0
TEZ event. (RO)
IN
TEZ event. (RO)
IM
TEZ event. (RO)
MCPWM_TIMER0_TEP_INT_ST The masked status bit for the interrupt triggered by a PWM timer 0
TEP event. (RO)
EL
TEP event. (RO)
TEP event. (RO)
MCPWM_FAULT0_INT_ST The masked status bit for the interrupt triggered when event_f0 starts.
PR
(RO)
(RO)
(RO)
MCPWM_FAULT0_CLR_INT_ST The masked status bit for the interrupt triggered when event_f0
ends. (RO)

Register 29.71. MCPWM_INT_ST_REG (0x0118)
ends. (RO)
ends. (RO)
MCPWM_OP0_TEA_INT_ST The masked status bit for the interrupt triggered by a PWM operator 0
TEA event (RO)
RY
TEA event (RO)
TEA event (RO)
A
MCPWM_OP0_TEB_INT_ST The masked status bit for the interrupt triggered by a PWM operator 0
TEB event (RO)
TEB event (RO)
IN
TEB event (RO)
IM
MCPWM_FH0_CBC_INT_ST The masked status bit for the interrupt triggered by a cycle-by-cycle
mode action on PWM0. (RO)
EL
MCPWM_FH0_OST_INT_ST The masked status bit for the interrupt triggered by a one-shot mode
action on PWM0. (RO)
PR
MCPWM_CAP0_INT_ST The masked status bit for the interrupt triggered by capture on channel 0.
(RO)
(RO)
(RO)

Register 29.72. MCPWM_INT_CLR_REG (0x011C)
O NT LR
T_ R
R
IN L
CL
M WM FAU T2_ R_ T_C R
M WM FAU 1_ T_C T_C R
M WM TIM T0_ T_C R R
R
R
R
W TIM R2 EZ_ T_C R

_T R T T R
ER ST _I LR
ST _I _C
P_ _C
CP _ L C IN L
CP _ L IN IN L
CP _ L IN L L
CP _ E T IN L
CP _ E T IN L
CP _ E T IN L
CP _ E T IN L
M E _S IN L
M WM FAU T0_ R_ T_C
M WM TIM R0_ P_ T_C

M WM TIM R2_ P_ T_C
M WM TIM R1_ Z_ T_C
M WM TIM 0_ Z_ _C
IM 1_ OP _C
M WM OP CB INT LR
M WM OP TEB INT LR
M WM OP TEB INT LR
M WM OP TEB INT LR
M WM OP TEA INT LR
M WM OP TEA INT LR
M WM FH OS INT LR
M WM FH CB INT LR
M WM FH CB INT LR
M WM FAU TEA INT LR

M WM FAU T2_ INT LR
M WM FAU T1_ R_ LR
0_ OP NT
M WM TIM R2_ T_C R
M WM TIM R1_ P_ R
T
C
C
C
CP _ 0_ _ _C
CP _ 2_ _ _C
CP _ 1_ _ _C
CP _ 0_ T_ _C
CP _ 2_ T_ _C
CP _ 1_ C_ _C
CP _ 0_ _ _C
CP _ L _ _C
CP _ L C _C
CP _ L C IN
CP _ E T IN
CP _ E IN L
CP _ E T L
CP _ P0 T R
CP _ 2_ T R
CP _ 1_ T_ R
CP _ 0_ C_ _
CP _ 2_ C_ _
CP _ 1_ _ _
M WM CA _IN CL
M WM FH _IN CL
M WM FH OS CL
M WM FH OS INT
L
L
L
E
E
E
E
E
_
_
_
CP _ P1 T
M WM CA _IN
R
T
CP _ P2
M WM CA
CP M_
CP )
d
ve
W
er
s
(re
M
M
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_TIMER0_STOP_INT_CLR Set this bit to clear the interrupt triggered when the timer 0
RY
stops. (WT)
stops. (WT)
stops. (WT)
A
MCPWM_TIMER0_TEZ_INT_CLR Set this bit to clear the interrupt triggered by a PWM timer 0 TEZ
event. (WT)
IN
event. (WT)
IM
event. (WT)
MCPWM_TIMER0_TEP_INT_CLR Set this bit to clear the interrupt triggered by a PWM timer 0 TEP
event. (WT)
EL
event. (WT)
event. (WT)
MCPWM_FAULT0_INT_CLR Set this bit to clear the interrupt triggered when event_f0 starts. (WT)
PR

Register 29.72. MCPWM_INT_CLR_REG (0x011C)
MCPWM_FAULT0_CLR_INT_CLR Set this bit to clear the interrupt triggered when event_f0 ends.
(WT)
(WT)
(WT)
RY
MCPWM_OP0_TEA_INT_CLR Set this bit to clear the interrupt triggered by a PWM operator 0 TEA
event (WT)
event (WT)
A
event (WT)
MCPWM_OP0_TEB_INT_CLR Set this bit to clear the interrupt triggered by a PWM operator 0 TEB
event (WT)
IN
event (WT)
IM
event (WT)
MCPWM_FH0_CBC_INT_CLR Set this bit to clear the interrupt triggered by a cycle-by-cycle mode
action on PWM0. (WT)
EL
PR
MCPWM_FH0_OST_INT_CLR Set this bit to clear the interrupt triggered by a one-shot mode action
on PWM0. (WT)
on PWM1. (WT)
on PWM2. (WT)
MCPWM_CAP0_INT_CLR Set this bit to clear the interrupt triggered by capture on channel 0. (WT)

Register 29.73. MCPWM_CLK_REG (0x0120)
N
_E
LK
_C
d)
M
ve
W
r
CP
se
(re
M
31 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
MCPWM_CLK_EN Force clock on for this register file. (R/W)
RY
Register 29.74. MCPWM_VERSION_REG (0x0124)
E
AT
_D
)
ed
M
W
rv
CP
se
(re
M
31 28 27 0
A
0 0 0 0 0x2107230 Reset
MCPWM_DATE Version of this register file. (R/W)

IN
IM
EL
PR

30 Remote Control Peripheral (RMT)
30.1 Overview
The RMT module is designed to send and receive infrared remote control signals. A variety of remote control
protocols can be encoded/decoded via software based on the RMT module. The RMT module converts pulse
codes stored in the module’s built-in RAM into output signals, or converts input signals into pulse codes and
stores them in RAM. In addition, the RMT module optionally modulates its output signals with a carrier wave, or
optionally demodulates and filters its input signals.
The RMT module has eight channels, numbered from zero to seven. Each channel is able to independently
RY
transmit or receive signals.
• Channel 0 ~ 3 (TX channel) are dedicated to sending signals.
• Channel 4 ~ 7 (RX channel) are dedicated to receiving signals.
Each TX/RX channel is controlled by a dedicated set of registers with the same functionality. Channel 3 and
channel 7 support DMA access, so the two channels also have a set of DMA-related control and status registers.
A
Registers for each TX channel are indicated by n which is used as a placeholder for the channel number, and m
for each RX channel. IN
30.2 Features
• Four TX channels
• Four RX channels
IM
• Support multiple channels (programmable) transmitting data simultaneously
• Eight channels share a 384 x 32-bit RAM
• Support modulation on TX pulses

EL
• Support filtering and demodulation on RX pulses
• Wrap TX mode
• Wrap RX mode
• Continuous TX mode
PR
• DMA access for TX mode on channel 3
• DMA access for RX mode on channel 7

30.3.1 Architecture
A RY
IN
IM
Figure 301. RMT Architecture
As shown in Figure 30-1, each TX channel (SEND_CHn) has:

EL
• 1 x clock divider counter (Div Counter)
• 1 x state machine (FSM)
• 1 x transmitter
Each RX channel (RECV_CHm) has:

PR
• 1 x clock divider counter (Div Counter)
• 1 x state machine (FSM)
• 1 x receiver
The eight channels share a 384 x 32-bit RAM.
30.3.2 RAM
30.3.2.1 RAM Architecture
Figure 30-2 shows the format of pulse code in RAM. Each pulse code contains a 16-bit entry with two fields:
“level” and “period”. “level” (0 or 1) indicates a low-/high-level value was received or is going to be sent, while
“period” points out the number of clock cycles (see Figure 30-1 clk_div) that the level lasts for.

Figure 302. Format of Pulse Code in RAM
The minimum value for the period is zero (0) and is interpreted as a transmission end-marker. For a non-zero
RY
period (i.e., not an end-marker), its value is limited by APB clock and RMT clock according to the equation
below:
3 × Tapb_clk + 5 × Trmt_sclk < period × Tclk_div (1)
A
30.3.2.2 Use of RAM
The RAM is divided into eight 48 x 32-bit blocks. By default, each channel uses one block (block 0 for channel 0,
IN
block 1 for channel 1, and so on).
If the data size of one single transfer is larger than one block size of TX channel n or RX channel m, users can
configure the channel:
• to enable wrap mode by setting RMT_MEM_TX/RX_WRAP_EN_CHn/m.

IM
• or to use more blocks by configuring RMT_MEM_SIZE_CHn/m.
Setting RMT_MEM_SIZE_CHn/m > 1 allows channel n/m to use the memory of subsequent channels, block
(n/m) ~ block (n/m + RMT_MEM_SIZE_CHn/m -1). If so, the subsequent channels n/m + 1 ~ n/m +
RMT_MEM_SIZE_CHn/m - 1 can not be used once their RAM blocks are occupied. For example, if channel 0 is
EL
configured to use block 0 and block 1, then channel 1 can not be used due to its block being occupied. But
channel 2 and channel 3 are not affected, and can be used normally.
Note that the RAM used by each channel is mapped from low address to high address. Under such mapping,
channel 0 is able to use the RAM blocks for channels 1, 2 ... and 7 by setting RMT_MEM_SIZE_CH0, but channel
7 can not use the blocks for channels 0, 1, ... or 6. Therefore, the maximum value of RMT_MEM_SIZE_CHn
PR
should not exceed (8 - n) and the maximum of RMT_MEM_SIZE_CHm should not exceed (8 - m).
The RMT RAM can be accessed via the APB bus, read by a transmitting channel, and written to by a receiving
channel. To avoid any possible access conflict between the receiver writing RAM and the APB bus reading RAM,
RMT can be configured to designate the block’s owner, be it the receiver or APB bus, by configuring
RMT_MEM_OWNER_CHm. If this ownership is violated, a flag signal RMT_MEM_OWNER_ERR_CHm will be
generated.
When the RMT module is inactive, the RAM can be put into low-power mode by setting
RMT_MEM_FORCE_PD.

30.3.2.3 RAM Access
APB bus is able to access RAM in FIFO mode and in NONFIFO (Direct Address) mode, depending on the
configuration of RMT_APB_FIFO_MASK:
• 1: use NONFIFO mode;
• 0: use FIFO mode.
Channels 3 and 7 also support DMA access.
FIFO Mode
In FIFO mode, the APB reads data from or writes data to RAM via a fixed address stored in
RY
RMT_CHn/mDATA_REG.
NONFIFO Mode
In NONFIFO mode, the APB writes data to or reads data from a continuous address range.
• The write-starting address of TX channel n is: RMT base address + 0x800 + (n - 1) x 48. The access
address for the second data and the following data are RMT base address + 0x800 + (n - 1) x 48 + 0x4,
A
and so on, incremented by 0x4.
• The read-starting address of RX channel m is: RMT base address + 0x8c0 + (m - 1) x 48. The access
IN
address for the second data and the following data are RMT base address + 0x8c0 + (m - 1) x 48 + 0x4,
and so on, incremented by 0x4.
DMA Mode
Channel 3 also supports DMA access. If RMT_DMA_ACCESS_EN_CH3 is set, RAM of channel 3 only allows
IM
DMA access. FIFO access or NOFIFO access to channel 3 by the APB bus are forbidden, otherwise
unpredictable consequences may occur.
To ensure correct data transmission,
1. DMA should be started first.

EL
2. RMT can only start sending data after DMA channel gets data ready, otherwise, unexpected data may be
sent.
In normal TX mode, when the RAM of channel 3 is fully written by DMA, an RMT_APB_MEM_WR_ERR_CH3
interrupt is triggered. Setting RMT_MEM_TX_WRAP_EN_CH3 allows channel 3 to transmit more data than one
PR
block can fit, with no software operation needed.
Channel 7 also supports DMA access. If RMT_DMA_ACCESS_EN_CH7 is set, the RAM of channel 7 is allowed
to send data to DMA. Note in this mode, channel 7’s RAM can also be accessed by APB via NONFIFO
mode.
In normal RX mode, when the size of data read by DMA from channel 7 is equal to its RAM size, an
RMT_APB_ME
M_RD_ERR_CH7 is triggered and the subsequent data is discarded. If RMT_MEM_RX_WRAP_EN_CH7 is set,
data of more than one block size can be received with no software wrap operation needed. If channel 7’s RAM is
full but the DMA still does not start receiving data from the channel, the newly received data by this channel will
replace the previous data.

Note:
When channel 7 receives an end-maker, a DMA in_suc_eof interrupt is generated. Two bytes are written to DMA if the
period[14:0] is 0, and four bytes to DMA if the period[30:16] is 0.
30.3.3 Clock
The clock source of RMT can be APB_CLK, FOSC_CLK, or XTAL_CLK, depending on the configuration of
RMT_SC
LK_SEL. RMT clock can be enabled by setting RMT_SCLK_ACTIVE. RMT working clock is obtained by dividing
the selected clock source with a fractional divider, see Figure 30-1. The divider is:
RY
RM T _SCLK_DIV _N U M + 1 + RM T _SCLK_DIV _A/RM T _SCLK_DIV _B
For more information, see Chapter 6 Reset and Clock. RMT_DIV_CNT_CHn/m is used to configure the divider
coefficient of internal clock divider for RMT channels. The coefficient is normally equal to the value of
RMT_DIV_CNT_CHn/m, except value 0 that represents divider 256. The clock divider can be reset by setting
A
RMT_REF_CNT_RST_CHn/m. The clock generated from the divider can be used by the counter (see Figure
30-1). IN
30.3.4 Transmitter
Note:
Updating the configuration described in this and subsequent sections requires to set RMT_CONF_UPDATE_CHn first,
see Section 30.3.6.
IM
30.3.4.1 Normal TX Mode
When RMT_TX_START_CHn is set, the transmitter of channel n starts reading and sending pulse codes from the
EL
starting address of its RAM block. The codes are sent starting from low-address entry. When an end-marker (a
zero period) is encountered, the transmitter stops the transmission, returns to idle state and generates an
RMT_CHn_TX_END_INT interrupt. Setting RMT_TX_STOP_CHn to 1 also stops the transmission and
immediately sets the transmitter back to idle. The output level of a transmitter in idle state is determined by the
“level” field of the end-marker or by the content of RMT_IDLE_OUT_LV_CHn, depending on the configuration of
PR
RMT_IDLE_OUT_EN_CHn:
• 0: the level in idle state is determined by the “level” field of the end-marker.
• 1: the level is determined by RMT_IDLE_OUT_LV_CHn.
30.3.4.2 Wrap TX Mode
To transmit more pulse codes than can be fitted in the channel’s RAM, users can enable wrap mode by setting
RMT_MEM_TX_WRAP_EN_CHn. In wrap mode, the transmitter sends the data from RAM in loops till an
end-marker is encountered. For example, if RMT_MEM_SIZE_CHn = 1, the transmitter starts sending data from
the address 48 * n, and then the data from higher RAM address. Once the transmitter finishes sending the data
from (48 * (n + 1) - 1), it continues sending data from 48 * n again till encounters an end-marker. Wrap mode is
also applicable for RMT_MEM_SIZE_CHn > 1.

When the size of transmitted pulse codes is larger than or equal to the value set by RMT_TX_LIM_CHn, an
RMT_CHn_TX_THR_EVENT_INT interrupt is generated. In wrap mode, RMT_TX_LIM_CHn can be set to a half or
a fraction of the size of the channel’s RAM block. When an RMT_CHn_TX_THR_EVENT_INT interrupt is detected
by software, the already used RAM region can be updated by new pulse codes. In such way, the transmitter can
seamlessly send unlimited pulse codes in wrap mode.
Note:
If RAM is accessed by DMA mode, more pulse codes than one block size can be transmitted with no additional operation
needed. If accessed by APB bus, wrap mode has to be enabled via software to send more data than one block size.
30.3.4.3 TX Modulation
RY
Transmitter output can be modulated with a carrier wave by setting RMT_CARRIER_EN_CHn. The carrier
waveform is configurable. In a carrier cycle, the high level lasts for (RMT_CARRIER_HIGH_CHn + 1) rmt_sclk
cycles, while the low level lasts for (RMT_CARRIER_LOW_CHn + 1) rmt_sclk cycles. When
RMT_CARRIER_OUT_LV_CHn is set, carrier wave is added on the high-level of output signals; while
RMT_CARRIER_OUT_LV_CHn is cleared, carrier wave is added on the low-level of output signals. Carrier wave
A
can be added on all output signals during modulation, or just added on valid pulse codes (the data stored in
RAM), which can be set by configuring RMT_CARRIER_EFF_EN_CHn:
IN
• 0: add carrier wave on all output signals.
• 1: add carrier wave only on valid signals.
30.3.4.4 Continuous TX Mode

IM
The continuous TX mode can be enabled by setting RMT_TX_CONTI_MODE_CHn. In this mode, the transmitter
sends the pulse codes from RAM in loops:
• If an end-marker is encountered, the transmitter starts transmitting from the first data of the channel’s RAM
again.
EL
• If no end-marker is encountered, the transmitter starts transmitting from the first data again after the last
data is transmitted.
If RMT_TX_LOOP_CNT_EN_CHn is set, the loop counting is incremented by 1 each time an end-marker is

encountered. If the counting reaches the value set by RMT_TX_LOOP_NUM_CHn, an RMT_CHn_TX_LOOP_INT
PR
interrupt is generated. If RMT_LOOP_STOP_EN_CHn is set, the transmission stops immediately once an

RMT_CHn_TX_LOOP_INT interrupt is generated, otherwise, the transmission will continue. In an end-maker, if its
period[14:0] is 0, then the period of the previous data must satisfy:
6 × Tapb_clk + 12 × Trmt_sclk < period × Tclk_div (2)
The period of the other data only need to satisfy relation (1).
30.3.4.5 Simultaneous TX Mode
RMT module supports multiple channels transmitting data simultaneously. To use this function, follow the steps
below:
1. Configure RMT_TX_SIM_CHn to choose which multiple channels are used to transmit data simultaneously.

2. Set RMT_TX_SIM_EN to enable this transmission mode.
3. Set RMT_TX_START_CHn for each selected channel, to start data transmitting.
The transmission starts once the final channel is configured. RMT module also supports simultaneous
transmission of channels 0 ~ 2’s RAM accessed by APB bus and channel 3’s RAM accessed by DMA.
30.3.5 Receiver
30.3.5.1 Normal RX Mode
The receiver of channel m is controlled by RMT_RX_EN_CHm:
• 1: the receiver starts working.
RY
• 0: the receiver stops receiving data.
When the receiver becomes active, it starts counting from the first edge of the signal, detecting signal levels and
counting clock cycles the level lasts for. Each cycle count (period) is then written back to RAM together with the
level information (level). When the receiver detects no change in a signal level for a number of clock cycles more
than the value set by RMT_IDLE_THRES_CHm, the receiver will stop receiving data, return to idle state, and
A
generate an RMT_CHm_RX_END_INT interrupt. Please note that RMT_IDLE_THRES_CHm should be configured
to a maximum value according to your application, otherwise a valid received level may be mistaken as a level in
IN
idle state. If the RAM space of this RX channel is used up by the received data, the receiver stops receiving data,
and an RMT_CHn_ERR_INT interrupt is triggered by RAM FULL event.
30.3.5.2 Wrap RX Mode

IM
To receive more pulse codes than can be fitted in the channel’s RAM, users can enable wrap mode for channel m
by configuring RMT_MEM_RX_WRAP_EN_CHm. But if RAM is accessed by DMA mode, more pulse codes than
one block size can be received with no additional operation needed. If accessed by APB bus, wrap mode has to
be enabled to send more data than one block size. In wrap mode, the receiver stores the received data to RAM
space of this channel in loops. Receiving ends, when the receiver detects no change in a signal level for a
EL
number of clock cycles more than the value set by RMT_IDLE_THRES_CHm. The receiver returns to idle state
and generates an RMT_CHm_RX_END_INT interrupt. For example, if RMT_MEM_SIZE_CHm is set to 1, the
receiver starts receiving data and stores the data to address 48 * m, and then to higher RAM address. When the
receiver finishes storing the received data to (48 * (m + 1) - 1), the receiver continues receiving data and storing
data to the address 48 * m again, no change is detected on a signal level for more than RMT_IDLE_THRES_CHm
PR
clock cycles. Wrap mode is also applicable for RMT_MEM_SIZE_CHm > 1.
An RMT_CHm_RX_THR_EVENT_INT interrupt is generated when the size of received pulse codes is larger than
or equal to the value set by RMT_CHm_RX_LIM_REG. In wrap mode, RMT_CHm_RX_LIM_REG can be set to a
half or a fraction of the size of the channel’s RAM block. When an RMT_CHm_RX_THR_EVENT_INT interrupt is
detected, the already used RAM region can be updated by subsequent data.
30.3.5.3 RX Filtering
Users can enable the receiver to filter input signals by setting RMT_RX_FILTER_EN_CHm for channel m. The filter
samples input signals continuously, and detects the signals which remain unchanged for a continuous
RMT_RX_FIL

TER_THRES_CHm rmt_sclk cycles as valid, otherwise, the signals will be detected as invalid. Only the valid
signals can pass through this filter. The filter removes pulses with a length of less than
RMT_RX_FILTER_THRES_CHm rmt_sclk cycles.
30.3.5.4 RX Demodulation
Users can enable RX demodulation on input signals or on filtered signals by setting RMT_CARRIER_EN_CHm.
RX demodulation can be applied to high-level carrier wave or low-level carrier wave, depending on the
configuration of RMT_CARRIER_OUT_LV_CHm:
• 1: demodulate high-level carrier wave
• 0: demodulate low-level carrier wave
RY
Users can configure RMT_CARRIER_HIGH_THRES_CHm and RMT_CARRIER_LOW_THRES_CHm to set the
thresholds to demodulate high-level carrier or low-level carrier. If the high-level of a signal lasts for less than
RMT_CARRIER_HIGH_THRES_CHm clk_div cycles, or the low-level lasts for less than RMT_CARRIER_LOW
_THRES_CHm clk_div cycles, such level is detected as a carrier and then is filtered out.
A
30.3.6 Configuration Update
To update RMT registers configuration, please set RMT_CONF_UPDATE_CHn/m for each channel first. All the
IN
bits/fields listed in the second column of Table 30-1 should follow this rule.
Table 301. Configuration Update
Register Bit/Field Configuration Update

IM
TX Channel
RMT_CARRIER_OUT_LV_CHn
RMT_CARRIER_EN_CHn
RMT_CARRIER_EFF_EN_CHn
RMT_DIV_CNT_CHn
RMT_CHnCONF0_REG
EL
RMT_TX_STOP_CHn
RMT_IDLE_OUT_EN_CHn
RMT_IDLE_OUT_LV_CHn
RMT_TX_CONTI_MODE_CHn
RMT_CARRIER_HIGH_CHn
RMT_CHnCARRIER_DUTY_REG
PR
RMT_CARRIER_LOW_CHn
RMT_TX_LOOP_CNT_EN_CHn
RMT_CHn_TX_LIM_REG RMT_TX_LOOP_NUM_CHn
RMT_TX_LIM_CHn
RMT_TX_SIM_REG RMT_TX_SIM_EN
RX Channel
RMT_CARRIER_OUT_LV_CHm
RMT_CARRIER_EN_CHm
RMT_CHmCONF0_REG
RMT_IDLE_THRES_CHm
RMT_DIV_CNT_CHm
RMT_RX_FILTER_THRES_CHm
RMT_CHmCONF1_REG


Register Bit/Field Configuration Update
RMT_RX_EN_CHm
RMT_CARRIER_HIGH_THRES_CHm
RMT_CHm_RX_CARRIER_RM_REG
RMT_CARRIER_LOW_THRES_CHm
RMT_CHm_RX_LIM_REG RMT_RX_LIM_CHm
RMT_REF_CNT_RST_REG RMT_REF_CNT_RST_CHm
30.4 Interrupts
• RMT_CHn/m_ERR_INT: triggered when channel n/m does not read or write data correctly. For example,
RY
the receiver still tries to write data into RAM when the RAM is full. Or the transmitter still tries to read data
from RAM when the RAM is empty.
• RMT_CHn_TX_THR_EVENT_INT: triggered when the amount of data the transmitter has sent matches the
value of RMT_CHn_TX_LIM_REG.
• RMT_CHm_RX_THR_EVENT_INT: triggered each time when the amount of data received by the receiver
A
reaches the value set in RMT_CHm_RX_LIM_REG.
• RMT_CHn_TX_END_INT: triggered when the transmitter has finished transmitting signals.

IN
• RMT_CHm_RX_END_INT: triggered when the receiver has finished receiving signals.
• RMT_CHn_TX_LOOP_INT: triggered when the loop counting reaches the value set by
RMT_TX_LOOP_NUM
IM
_CHn in continuous TX mode.
• RMT_CH3_DMA_ACCESS_FAIL_INT: triggered when the result of (the entries written to channel 3’s RAM -
the entries transmitted by channel 3) is larger than channel 3’s RAM size, but DAM keeps writing data to
this channel.
EL
• RMT_CH7_DMA_ACCESS_FAIL_INT: triggered when the result of (the entries received by channel 7’s RAM
- the entries read by DMA) is larger than channel 7’s RAM size, but channel 7 keeps receiving data.

The addresses in this section are relative to RMT base address provided in Table 3-4 in Chapter 3 System and
PR
Memory .

FIFO R/W Register
RMT_CH0DATA_REG The read and write data register for channel 0 by 0x0000 RO
APB FIFO access
APB FIFO access
APB FIFO access
RMT_CH3DATA_REG The read and write data register for channel 3 by 0x000C RO
APB FIFO access


APB FIFO access
APB FIFO access
APB FIFO access
RMT_CH7DATA_REG The read and write data register for channel 7 by 0x001C RO
APB FIFO access
RMT_CH0CONF0_REG Configuration register 0 for channel 0 0x0020 varies
RY
RMT_CH3CONF0_REG Configuration register 0 for channel 3 0x002C varies
RMT_CH4CONF0_REG Configuration register 0 for channel 4 0x0030 R/W
A
RMT_CH6CONF1_REG
RMT_CH7CONF0_REG
IN
0x0044
0x0048
varies
R/W
RMT_CH4_RX_CARRIER_RM_REG Demodulation register for channel 4 0x0090 R/W
IM
RMT_CH7_RX_CARRIER_RM_REG Demodulation register for channel 7 0x009C R/W
RMT_SYS_CONF_REG Configuration register for RMT APB 0x00C0 R/W
RMT_REF_CNT_RST_REG Reset register for RMT clock divider 0x00C8 WT
EL
Status Registers
RMT_CH0STATUS_REG Channel 0 status register 0x0050 RO
RMT_CH3STATUS_REG Channel 3 status register 0x005C RO
PR

RMT_CH7STATUS_REG Channel 7 status register 0x006C RO
Interrupt Registers
RMT_INT_RAW_REG Raw interrupt status register 0x0070 R/WTC/SS
RMT_INT_ST_REG Masked interrupt status register 0x0074 RO
RMT_INT_ENA_REG Interrupt enable register 0x0078 R/W
RMT_INT_CLR_REG Interrupt clear register 0x007C WT
Carrier Wave Duty Cycle Registers
RMT_CH0CARRIER_DUTY_REG Duty duty configuration register for channel 0 0x0080 R/W


RMT_CH3CARRIER_DUTY_REG Duty duty configuration register for channel 3 0x008C R/W
TX Event Configuration Registers
RMT_CH0_TX_LIM_REG Configuration register for channel 0 TX event 0x00A0 varies
RMT_CH3_TX_LIM_REG Configuration register for channel 3 TX event 0x00AC varies
RMT_TX_SIM_REG RMT simultaneous TX register 0x00C4 R/W
RX Event Configuration Registers
RY
RMT_CH4_RX_LIM_REG Configuration register for channel 4 RX event 0x00B0 R/W
RMT_CH7_RX_LIM_REG Configuration register for channel 7 RX event 0x00BC R/W
Version Register
A
RMT_DATE_REG Version control register 0x00CC R/W
IN
IM
EL
PR

30.6 Registers
The addresses in this section are relative to RMT base address provided in Table 3-4 in Chapter 3 System and
Memory .
Register 30.1. RMT_CHnDATA_REG (n: 03) (0x0000+0x4*n)
A
AT
nD
CH
T_
RM
31 0
0x000000 Reset
RY
RMT_CHnDATA Read and write data for channel n via APB FIFO. (RO)
Register 30.2. RMT_CHmDATA_REG (m = 4, 5, 6, 7) (0x0010, 0x0014, 0x0018, 0x001C )
A
TA
DA
m
CH
T_
RM
31
IN
0x000000
0
Reset
RMT_CHmDATA Read and write data for channel m via APB FIFO. (RO)
IM
EL
PR

Register 30.3. RMT_CHnCONF0_REG (n: 03) (0x0020+0x4*n)
)
-2
:0
rn
fo
d
ve
er
n (res
_S D_ ST CH n
TX _R _R E_ CH
CH H3
EF H Hn
Hn
TA RS _C n
E_ _C
T_ EM EM OD N_
_C CH n
R_ _C C
_C
RT T_ H
Hn n
T _ X_ _ n
IE EN LV_
T A n
AT EN
RM _M _M I_M P_E
RM _TX _T _L CH
EN
RM _A CO WR CH
n
RR R_ T_
T d) UPD S_
F_
T EM UT N_
CH
T LE UT n
n
RM ID O CH
CA IE OU
V
RM rve F_ ES
CH
RM _M _O _E
E_
se ON CC
T_ LE_ P_
T_ RR R_
_
IZ
NT
PB N
RM _ID STO
RM C IE
_S
(re C _A
_C
T_ ARR
EM
T_ MA
d)
T _
V
A
RM _TX
DI
ve
M
RM _D
RM _C
T_
T_
er
T
s
RM
RM
RM
RM
(re
31 26 25 24 23 22 21 20 19 16 15 8 7 6 5 4 3 2 1 0
RY
0 0 0 0 0 0 0 0 0 0 1 1 1 0x1 0x2 0 0 0 0 0 0 0 0 Reset
RMT_TX_START_CHn Set this bit to start sending data in channel n. (WT)
RMT_MEM_RD_RST_CHn Set this bit to reset RAM read address accessed by the transmitter of
channel n. (WT)
A
RMT_APB_MEM_RST_CHn Set this bit to reset RAM W/R address for channel n when accessed by
APB FIFO. (WT)
RMT_TX_CONTI_MODE_CHn Set this bit to enable continuous TX mode for channel n. (R/W)
IN
In this mode, the transmitter starts its transmission from the first data, and in the following trans-
mission:
• if an end-marker is encountered, the transmitter starts transmitting data from the first data
IM
again;
• if no end-marker is encountered, the transmitter starts transmitting the first data again when
the last data is transmitted.
RMT_MEM_TX_WRAP_EN_CHn Set this bit to enable wrap TX mode for channel n. In this mode, if
EL
the TX data size is larger than the channel’s RAM block size, the transmitter continues transmitting
the first data again to the last data in loops. (R/W)
RMT_IDLE_OUT_LV_CHn This bit configures the level of output signal for channel n when the trans-
mitter is in idle state. (R/W)
PR
RMT_IDLE_OUT_EN_CHn This is the output enable-bit for channel n in idle state. 0: the output level
in idle state is determined by the level field of an end-marker. 1: the output level in idle state is
determined by RMT_IDLE_OUT_LV_CHn. (R/W)
RMT_TX_STOP_CHn Set this bit to stop the transmitter of channel n sending data out. (R/W/SC)
RMT_DIV_CNT_CHn This field is used to configure the divider for clock of channel n. (R/W)
RMT_MEM_SIZE_CHn This field is used to configure the maximum number of memory blocks allo-
cated to channel n. (R/W)
RMT_CARRIER_EFF_EN_CHn 1: Add carrier modulation on the output signal only at data-sending

state for channel n. 0: Add carrier modulation on the output signal at data-sending state and idle
state for channel n. Only valid when RMT_CARRIER_EN_CHn is 1. (R/W)

Register 30.3. RMT_CHnCONF0_REG (n: 03) (0x0020+0x4*n)
RMT_CARRIER_EN_CHn This is the carrier modulation enable-bit for channel n. 1: Add carrier mod-
ulation on the output signal. 0: No carrier modulation is added on output signal. (R/W)
RMT_CARRIER_OUT_LV_CHn This bit is used to configure the position of carrier wave for channel
n. (R/W)
1’h0: add carrier wave on low level.
1’h1: add carrier wave on high level.
RY
RMT_CONF_UPDATE_CHn Synchronization bit for channel n (WT)
RMT_DMA_ACCESS_EN_CH3 (Reserved for channel 0 2) DMA access enable bit for channel 3.
(R/W)
A
IN
IM
EL
PR

Register 30.4. RMT_CHmCONF0_REG (m = 4, 5, 6, 7) (0x0030, 0x0038, 0x0040, 0x0048)
)
-6
:4
rm
fo
ed
rv
se
re
7(
Hm Hm
CH
_C _C
N_
m
EN _LV
_E
CH
Hm
m
R_ T
SS
S_
IE OU
_C
CH
CE
RE
ZE
RR R_
_
AC
NT
TH
I
CA IE
_S
A_
_C
T_ ARR
_
EM
LE
RM d)
DM
V
ID
DI
e
M
RM C
rv
T_
T_
T_
T_
T_
se
RM
RM
RM
RM
(re
31 30 29 28 27 24 23 22 8 7 0
RY
0 0 1 1 0x1 0 0x7fff 0x2 Reset
RMT_DIV_CNT_CHm This field is used to configure the clock divider of channel m. (R/W)
RMT_IDLE_THRES_CHm This field is used to configure RX threshold. When no edge is detected on

the input signal for continuous clock cycles longer than this field value, the receiver stops receiving
data. (R/W)
A
RMT_DMA_ACCESS_EN_CH7 (Reserved for channel 4 6) DMA access enable bit for channel 7.
(R/W)
IN
RMT_MEM_SIZE_CHm This field is used to configure the maximum number of memory blocks allo-
cated to channel m. (R/W)
RMT_CARRIER_EN_CHm This is the carrier demodulation enable-bit for channel m. 1: enable carrier
IM
demodulation for input signal. 0: disable carrier modulation for input signal. (R/W)
RMT_CARRIER_OUT_LV_CHm This bit is used to configure the position of carrier demodulation for
channel m. (R/W)
1’h0: demodulate low-level carrier wave.

EL
1’h1: demodulate high-level carrier wave.

PR

Register 30.5. RMT_CHmCONF1_REG (m = 4, 5, 6, 7) (0x0034, 0x003C, 0x0044, 0x004C)
Hm
Hm
_C
CH ST Hm
_C
m
m
T_ EM EM R_C m
EN
_E R_ ST m
CH
m _CH
RM _M _M NE _CH
ES
RX _W _R H
N_ R _C
P_
E_
HR
RA
T B W N
AT
RM _A _O R_E
_T
W
T_ d) UPD
ER
X_
T EM E
ILT
RM _M FILT
_R
RM rve F_
_F
EM
se ON
T _
)
ed
P
RX
X
M
(re _C
RM _R
rv
T_
se
T
RM
RM
RM
31 (re 16 15 14 13 12 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0xf 0 1 0 0 0 Reset
RMT_RX_EN_CHm Set this bit to enable the receiver to start receiving data on channel m. (R/W)
RY
RMT_MEM_WR_RST_CHm Set this bit to reset RAM write address accessed by the receiver for
channel m. (WT)
RMT_APB_MEM_RST_CHm Set this bit to reset RAM W/R address accessed by APB FIFO for chan-
nel m. (WT)
A
RMT_MEM_OWNER_CHm This bit marks the ownership of channel m’s RAM block. (R/W/SC)
1’h1: Receiver is using the RAM. IN

1’h0: APB bus is using the RAM.
RMT_RX_FILTER_EN_CHm Set this bit to enable the receiver’s filter for channel m. (R/W)
RMT_RX_FILTER_THRES_CHm When receiving data, the receiver ignores the input pulse when its
IM
width is shorter than this register value in units of rmt_sclk cycles. (R/W)
RMT_MEM_RX_WRAP_EN_CHm Set this bit to enable wrap RX mode for channel m. In this mode,
if the RX data size is larger than channel m ’s RAM block size, the receiver stores the RX data from
the first address to the last address in loops. (R/W)
EL
RMT_CONF_UPDATE_CHm Synchronization bit for channel m. (WT)

PR

Register 30.6. RMT_CHm_RX_CARRIER_RM_REG (m = 4, 5, 6, 7) (0x0090, 0x0094, 0x0098, 0x009C)
Hm
H
_C
_C
S
ES
RE
HR
TH
_T
H_
W
G
O
HI
_L
R_
ER
IE
RI
RR
R
CA
CA
T_
T_
RM
RM
31 16 15 0
0x00 0x00 Reset
RMT_CARRIER_LOW_THRES_CHm The low level period in a carrier modulation mode is
RY
(RMT_CARRIER_LOW_THRES_CHm + 1) for channel m. (R/W)
RMT_CARRIER_HIGH_THRES_CHm The high level period in a carrier modulation mode is

(RMT_CARRIER_HIGH_THRES_CHm + 1) for channel m. (R/W)
A
Register 30.7. RMT_SYS_CONF_REG (0x00C0)
K N
IN
AS E_O
AP _C CE U
FI _F D
_M RC
UM
T_ EM OR _P
B_ LK _P
FO O
_S E
RM _M _F RCE
LK TIV
_N
B
_A
V_
EL
IV
IV
SC AC
T EM O
DI
_D
_D
EN
RM _M _F
K_
_
LK
LK
LK
K_
T EM
RM CL
d)
SC
SC
SC
CL
RM M
S
rv
T_
T_
T_
T_
T_
T_
T_
se
RM
RM
RM
RM
RM
RM
(re
IM
31 30 27 26 25 24 23 18 17 12 11 4 3 2 1 0
0 0 0 0 0 1 0x1 0x0 0x0 0x1 0 0 0 0 Reset
RMT_APB_FIFO_MASK 1’h1: Access memory directly (NONFIFO mode). 1’h0: Access memory by
FIFO (FIFO mode). (R/W)
EL
RMT_MEM_CLK_FORCE_ON Set this bit to enable the clock for RMT memory. (R/W)
RMT_MEM_FORCE_PD Set this bit to power down RMT memory. (R/W)
RMT_MEM_FORCE_PU 1: Disable the power-down function of RMT memory in Light-sleep. 0:

Power down RMT memory when RMT is in Light-sleep mode. (R/W)
PR
RMT_SCLK_DIV_NUM The integral part of the fractional divider. (R/W)
RMT_SCLK_DIV_A The numerator of the fractional part of the fractional divider. (R/W)
RMT_SCLK_DIV_B The denominator of the fractional part of the fractional divider. (R/W)
RMT_SCLK_SEL Choose the clock source of rmt_sclk. 1: APB_CLK; 2: FOSC_CLK; 3: XTAL_CLK.

(R/W)
RMT_SCLK_ACTIVE rmt_sclk switch. (R/W)
RMT_CLK_EN The enable signal of RMT register clock gate. 1: Power up the drive clock of registers.
0: Power down the drive clock of registers. (R/W)

Register 30.8. RMT_REF_CNT_RST_REG (0x00C8)
T EF T T 7
T EF T T 6
T EF T T 5
T_ EF_ T_ T_ 4
F_ T_ T_ 3
T_ T_ 2
T_ 1
0
RM _R _CN _RS _CH
RM _R _CN _RS _CH
RM _R _CN _RS _CH
RM _R _CN _RS _CH
RE CN RS CH
CN RS CH
RS CH
CH
T EF T T
RM _R _CN _RS
T EF T
RM _R _CN
T EF
)
ed
RM _R
rv
se
T
RM
(re
31 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RMT_REF_CNT_RST_CHn(n = 0, 1, 2, 3) This bit is used to reset the clock divider of channel n. (WT)
RY
RMT_REF_CNT_RST_CHm (m = 4, 5, 6, 7) This bit is used to reset the clock divider of channel m.
(WT)
Register 30.9. RMT_CHnSTATUS_REG (n: 03) (0x0050+0x4*n)
A
n
Hn
n CH
n
_C
CH R_
H
_C
DR
Y_ R
PT _E
EX
AD
IN
M R
R_
_E _W
_W
DD
n
CH
EM EM
EM
A
_R
E_
M M
M
T_ B_
B_
EM
AT
)
)
ed
ed
ed
P
AP
ST
M
RM _A
rv
rv
rv
T_
T_
T_
se
se
se
T
RM
RM
RM
RM
(re
(re
(re
31 27 26 25 24 22 21 20 11 10 9 0
IM
0 0 0 0 0 0 0 0 0 0 0 0 Reset
RMT_MEM_RADDR_EX_CHn This field records the memory address offset when transmitter of
channel n is using the RAM. (RO)
EL
RMT_APB_MEM_WADDR_CHn This field records the memory address offset when writes RAM over
APB bus. (RO)
RMT_STATE_CHn This field records the FSM status of channel n. (RO)
RMT_MEM_EMPTY_CHn This status bit will be set when the TX data size is larger than the memory
PR
size and the wrap TX mode is disabled. (RO)
RMT_APB_MEM_WR_ERR_CHn This status bit will be set if the offset address is out of memory size
(overflows) when writes via APB bus. (RO)

Register 30.10. RMT_CHmSTATUS_REG (m = 4, 5, 6, 7) (0x0060, 0x0064, 0x0068, 0x006C)
Hm
Hm
CH
m
NE m C
CH
_C
W CH R_
R_
DR
X_
_O LL_ _ER
ER
_E
AD
R_
EM U D
DR
M _F _R
_R
m
AD
CH
T_ EM EM
EM
_W
E_
RM M M
M
T_ B_
B_
EM
AT
d)
)
ed
ed
P
AP
ST
ve
M
RM _A
rv
rv
T_
T_
T_
er
se
se
T
s
RM
RM
RM
RM
(re
(re
(re
31 28 27 26 25 24 22 21 20 11 10 9 0
0 0 0 0 0 0 0 0 0 0xc0 0 0xc0 Reset
RMT_MEM_WADDR_EX_CHm This field records the memory address offset when receiver of chan-
RY
nel m is using the RAM. (RO)
RMT_APB_MEM_RADDR_CHm This field records the memory address offset when reads RAM over
APB bus. (RO)
RMT_STATE_CHm This field records the FSM status of channel m. (RO)
A
RMT_MEM_OWNER_ERR_CHm This status bit will be set when the ownership of memory block is
wrong. (RO)
RMT_MEM_FULL_CHm This status bit will be set if the receiver receives more data than the memory
can fit. (RO)
IN
RMT_APB_MEM_RD_ERR_CHm This status bit will be set if the offset address is out of memory size
(overflows) when reads RAM via APB bus. (RO)
IM
EL
PR

Register 30.11. RMT_INT_RAW_REG (0x0070)
RM _C _R TH EVE T_I _IN RAW

RM _C _E TH EVE T_I _R RAW
T H6 R _ N NT AW
T H5 R T_ N NT AW
T 4 R T_ W NT_ AW
W
T 2 R _ N T W
T H1 R T_ N T W
RR T W T W
AW
T H4 X_ _ N IL _
T 7 _ _ N T _
RA
T
T
RM _C _E THR EVE T_IN _RA

RM _C _E _IN EVE T_IN _RA
RM _C _E _IN RA T_IN _RA
RM _C _E _IN EVE T_I _R
RM _C _E _IN RA T_I _R
RM _C _R TH EVE _FA _IN
_R
T H3 _ _ N T
T_ H3_ _L P_ T_R W
T H2 _ P T_ W
X_ _ T W
T_ H0_ _T _E NT W
T H5 X_ _ S IL
RM C T HR VE _IN
RM _C _R EN INT AW
RM _C _T EN INT AW
RM _C _T LOO INT AW
RM _C _T LOO _IN AW
TX ND T W
ND NT AW
NT AW
AW
RM _C _R TH ES _FA
RM _C _T LOO _IN RA
RM C T OO IN A
RM _C _T THR _IN RA
RM _C _T THR EVE RA
0_ _E _IN _RA
T 4 _ _ _R
T H3 X_ _ _R
T H2 _ _ _R
R
_
_E _I _R
_I _R
_R
T H7 R T_ W
T_ H6_ X_E T_R W
T H5 X_ _ W
RR T W
T H2 _ T_ W
T_ 1_ _E _IN W
T H6 X_ CC S
X_ P T
X_ P _
RM _C _R _A ES
RM _C _E _IN RA
RM _C _R _IN RA
RM C R N A
RM _C _R EN INT
RM _C _E _IN RA
RM C T IN A
RM _C _T END RA
CH TX ND T
T_ 3_ _ _R
T H7 MA CC
_
D
D
D
X D
R
R
R
R R
RM _C _D _A
T H3 MA
R
R
R
R
R
X
X
X
X
X
X
X
RM _C _D
T H7
T 1
T 0
T 1
T 0
RM d)
H
H
H
H
H
e
RM C
rv
T_
se
(re
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
RMT_CHn_TX_END_INT_RAW (n = 03) The interrupt raw bit of RMT_CHn_TX_END_INT.
(R/WTC/SS)
RMT_CHn_ERR_INT_RAW (n = 03) The interrupt raw bit of RMT_CHn_ERR_INT. (R/WTC/SS)
RMT_CHn_TX_THR_EVENT_INT_RAW (n = 03) The interrupt raw bit of
A
RMT_CHn_TX_THR_EVENT_INT (R/WTC/SS)
RMT_CHn_TX_LOOP_INT_RAW (n = 03) The interrupt raw bit of RMT_CHn_TX_LOOP_INT.

(R/WTC/SS)
IN
RMT_CHm_RX_END_INT_RAW(m = 47) The interrupt raw bit of RMT_CHm_RX_END_INT.
(R/WTC/SS)
RMT_CHm_ERR_INT_RAW (m = 47) The interrupt raw bit of RMT_CHm_ERR_INT. (R/WTC/SS)

IM
RMT_CHm_RX_THR_EVENT_INT_RAW(m = 47) The interrupt raw bit of
RMT_CHm_RX_THR_EVENT_INT. (R/WTC/SS)
RMT_CH3_DMA_ACCESS_FAIL_INT_RAW The interrupt raw bit of

RMT_CH3_DMA_ACCESS_FAIL_INT. (R/WTC/SS)
EL
RMT_CH7_DMA_ACCESS_FAIL_INT_RAW The interrupt raw bit of

RMT_CH7_DMA_ACCESS_FAIL_INT. (R/WTC/SS)
PR

Register 30.12. RMT_INT_ST_REG (0x0074)
RM _C _R TH EVE T_I _IN ST

RM _C _E TH EVE T_I _S ST
T H4 X_ _ N IL _
T 7 _ _ N T _
T
T
T
RR T N N T
NT T
T
RM _C _E THR EVE T_IN _ST

RM _C _E _IN EVE T_IN _ST
RM _C _E _IN ST T_IN _ST
ST
RM _C _E _IN EVE T_I _S

RM _C _E _IN ST T_I _S
_S
T_
T H6 R _ N NT
T
T H3 _ _ N T
T 2 R _ N T
T H1 R T_ N T
T H5 X_ _ S IL
RM C T HR VE _IN
RM _C _R TH ES _FA
RM _C _T LOO _IN ST
RM C T OO IN T
RM _C _T THR _IN ST
RM _C _T THR EVE ST
RM _C _R EN INT T
RM _C _T EN INT T
RM _C _T LOO INT T
RM _C _T LOO _IN T
T_ H3_ _L P_ T_S
0_ _E _IN _ST
ND NT T
_I _ST
T
T_ H0_ _T _E NT
T 4 _ _ _S
T H3 X_ _ _S
T H2 _ _ _S
S
_
T H2 _ P T_
_
_ E _ I _S
_S
T H6 X_ CC S
X_ P T
X_ _ T
X_ P _
RM _C _R _A ES
RM _C _R EN INT
RM C E IN T
RM C R IN T
RM _C _R EN ST
RM _C _E _IN ST
RM _C _T _IN ST
RM _C _T END ST
CH TX ND T
TX ND T
NT
T_ H4_ R_ T_S
T_ H7_ R_ T_S
T_ 1_ E IN
T H7 MA CC
T 6 _ T_
_
_
T H2 _ T_
T H5 X_ _
X_ _
RR T
RR T
D
D
D
X D
R
R
R
R R
RM _C _D _A
T H3 MA
R
R
R
R
X
X
X
X
X
X
RM _C _D
T H7
T 5
T 1
T 0
T 1
T 0
T 3
RM d)
H
H
H
H
H
e
RM C
rv
T_
se
(re
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
RMT_CHn_TX_END_INT_ST (n = 03) The masked interrupt status bit of RMT_CHn_TX_END_INT.
(RO)
RMT_CHn_ERR_INT_ST (n = 03) The masked interrupt status bit of RMT_CHn_ERR_INT. (RO)
RMT_CHn_TX_THR_EVENT_INT_ST (n = 03) The masked interrupt status bit of

RMT_CHn_TX_THR_EVENT_INT. (RO)
A
RMT_CHn_TX_LOOP_INT_ST (n = 03) The masked interrupt status bit of
RMT_CHn_TX_LOOP_INT. (RO)
RMT_CHm_RX_END_INT_ST (m = 47) The

RMT_CHm_RX_END_INT. (RO)
IN masked interrupt status bit of
RMT_CHm_ERR_INT_ST (m = 47) The masked interrupt status bit of RMT_CHm_ERR_INT. (RO)

IM
RMT_CHm_RX_THR_EVENT_INT_ST (m = 47) The masked interrupt status bit of
RMT_CHm_RX_THR_EVENT_INT. (RO)
RMT_CH3_DMA_ACCESS_FAIL_INT_ST The masked interrupt status bit of

RMT_CH3_DMA_ACCESS_FAIL_INT. (RO)
EL
RMT_CH7_DMA_ACCESS_FAIL_INT_ST The masked interrupt status bit of

RMT_CH7_DMA_ACCESS_FAIL_INT. (RO)
PR

Register 30.13. RMT_INT_ENA_REG (0x0078)
A
A
RM _C _R TH EVE T_I _IN EN
RM _C _E TH EVE T_I _E EN
T H6 R _ N NT A
RR T N N NA
T_ H4_ R_ T_E A NT_ A

NA
T 2 R _ N T A
T H1 R T_ N T A
T_ A
A
T H4 X_ _ N IL _
T 7 _ _ N T _
N
N
T
T
RM _C _E THR EVE T_IN _EN

RM _C _E _IN EVE T_IN _EN
RM _C _E _IN EN T_IN _EN
EN
RM _C _E _IN EVE T_I _E

RM _C _E _IN EN T_I _E
E
T
T H3 _ _ N T
T H5 X_ _ S IL
T_ H3_ _L P_ T_E A
T H2 _ P T_ A
X_ _ T A
T_ H0_ _T _E NT A
N
RM C T HR VE _IN
RM _C _R TH ES _FA
RM _C _R EN INT NA
RM _C _T EN INT NA
RM _C _T LOO INT NA
RM _C _T LOO _IN NA
RM _C _T LOO _IN EN
RM C T OO IN N
RM _C _T THR _IN EN
RM _C _T THR EVE EN
TX ND T A
ND NT A
NT A
NA
0_ _E _IN _EN
_E _I _EN
_I _EN
T 4 _ _ _E
T H3 X_ _ _E
T H2 _ _ _E
E
_
_E
T H6 X_ CC S
T H7 R T_ A
T 6 _ T_ A
T H5 X_ _ A
RR T A
RR T A
X_ T A
T_ H1_ _E _IN A
X_ P T
X_ P _
RM _C _R _A ES
RM C E IN N
RM _C _R _IN EN
RM _C _R EN EN
RM _C _R EN INT
RM _C _E _IN EN
RM _C _T _IN EN
RM _C _T END EN
CH TX ND T
T H7 MA CC
_
_
_
D
D
D
X D
R
R
R
R
RM _C _D _A
T H3 MA
R
R
R
R
X
X
X
X
X
X
RM _C _D
T H7
T 5
T 1
T 0
T 1
T 0
T 3
T 2
RM d)
H
H
H
H
H
ve
RM _C
er
T
s
(re
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
RMT_CHn_TX_END_INT_ENA (n = 03) The interrupt enable bit of RMT_CHn_TX_END_INT. (R/W)
RMT_CHn_ERR_INT_ENA (n = 03) The interrupt enable bit of RMT_CHn_ERR_INT. (R/W)
RMT_CHn_TX_THR_EVENT_INT_ENA (n = 03) The interrupt enable bit of

RMT_CHn_TX_THR_EVENT_INT. (R/W)
A
RMT_CHn_TX_LOOP_INT_ENA (n = 03) The interrupt enable bit of RMT_CHn_TX_LOOP_INT.
(R/W) IN
RMT_CHm_RX_END_INT_ENA (m = 47) The interrupt enable bit of RMT_CHm_RX_END_INT.
(R/W)
RMT_CHm_ERR_INT_ENA (m = 47) The interrupt enable bit of RMT_CHm_ERR_INT. (R/W)

IM
RMT_CHm_RX_THR_EVENT_INT_ENA (m = 47) The interrupt enable bit of
RMT_CHm_RX_THR_EVENT_INT. (R/W)
RMT_CH3_DMA_ACCESS_FAIL_INT_ENA The interrupt enable bit of

RMT_CH3_DMA_ACCESS_FAIL_INT. (R/W)
EL
RMT_CH7_DMA_ACCESS_FAIL_INT_ENA The interrupt enable bit of

RMT_CH7_DMA_ACCESS_FAIL_INT. (R/W)
PR

Register 30.14. RMT_INT_CLR_REG (0x007C)
RM _C _R TH EVE T_I _IN CLR

RM _C _E TH EVE T_I _C CLR
T H6 R _ N NT LR
T H5 R T_ N NT LR
RR T R N LR
T 2 R _ N T R
T H1 R T_ N T R
T_ R
R
T H4 X_ _ N IL _
T 7 _ _ N T _
CL
T
T
L
L
L
CL
RM _C _E _IN EVE T_I _C
RM _C _E _IN CL T_I _C
RM _C _E THR EVE T_IN _C

RM _C _E _IN EVE T_IN _C
RM _C _E _IN CL T_IN _C
T_
T H3 _ _ N T
T H5 X_ _ S IL
T_ H3_ _L P_ T_C R
T H2 _ P T_ R
X_ _ T R
T_ H0_ _T _E NT R
N
RM C T HR VE _IN
RM _C _R TH ES _FA
RM _C _R EN INT LR
RM _C _T EN INT LR
RM _C _T LOO INT LR
RM _C _T LOO _IN LR
RM _C _T LOO _IN CL
RM C T OO IN L
RM _C _T THR _IN CL
RM _C _T THR EVE CL
TX ND T R
ND NT LR
NT LR
LR
0_ _E _IN _CL
T 4 _ _ _C
T H3 X_ _ _C
T H2 _ _ _C
C
_ E _ I _C
_ I _C
_C
_
_
T H6 X_ CC S
RR T R
T_ H6_ X_E T_C R

T H5 X_ _ R
RR T R
RR T R
X_ T R
T_ H1_ _E _IN R
X_ P T
X_ P _
RM _C _R _A ES
RM _C _R EN INT
RM _C _E _IN CL
RM _C _R _IN CL
RM C R N L
RM _C _E _IN CL
RM _C _T _IN CL
RM _C _T END CL
CH TX ND T
T H7 MA CC
_
_
_
_
_
D
D
D
X D
R
R
R
R R
RM _C _D _A
T H3 MA
R
R
X
X
X
X
X
X
RM _C _D
T H7
T 4
T 7
T 1
T 0
T 1
T 0
T 3
T 2
)
ed
H
H
H
H
H
H
H
RM C
rv
T_
se
RM
(re
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
RMT_CHn_TX_END_INT_CLR (n = 03) Set this bit to clear RMT_CHn_TX_END_INT interrupt. (WT)
RMT_CHn_ERR_INT_CLR (n = 03) Set this bit to clear RMT_CHn_ERR_INT interrupt. (WT)
RMT_CHn_TX_THR_EVENT_INT_CLR (n = 03) Set this bit to clear
A
RMT_CHn_TX_THR_EVENT_INT interrupt. (WT)
RMT_CHn_TX_LOOP_INT_CLR (n = 03) Set this bit to clear RMT_CHn_TX_LOOP_INT interrupt.

(WT)
IN
RMT_CHm_RX_END_INT_CLR (m = 47) Set this bit to clear RMT_CHm_RX_END_INT interrupt.
(WT)
RMT_CHm_ERR_INT_CLR (m = 47) Set this bit to clear RMT_CHm_ERR_INT interrupt. (WT)

IM
RMT_CHm_RX_THR_EVENT_INT_CLR (m = 47) Set this bit to clear
RMT_CHm_RX_THR_EVENT_INT interrupt. (WT)
RMT_CH3_DMA_ACCESS_FAIL_INT_CLR Set this bit to clear RMT_CH3_DMA_ACCESS_FAIL_INT

interrupt. (WT)
EL
RMT_CH7_DMA_ACCESS_FAIL_INT_CLR Set this bit to clear RMT_CH7_DMA_ACCESS_FAIL_INT

interrupt. (WT)
PR

Register 30.15. RMT_CHnCARRIER_DUTY_REG (n: 03) (0x0080+0x4*n)
Hn
CH
_C
H_
W
IG
O
H
L
R_
R_
IE
IE
RR
RR
CA
CA
T_
T_
RM
RM
31 16 15 0
0x40 0x40 Reset
RMT_CARRIER_LOW_CHn This field is used to configure carrier wave’s low level clock period for
channel n. (R/W)
RY
RMT_CARRIER_HIGH_CHn This field is used to configure carrier wave’s high level clock period for
channel n. (R/W)
Register 30.16. RMT_CHn_TX_LIM_REG (n: 03) (0x00A0+0x4*n)
A
Hn n
_C CH
EN T_
CN RE n
T_ SE
Hn
P_ T_ CH
IN _C
O UN N_
M
_L CO _E
NU
TX _ P
Hn
T_ OP STO
P_
_C
O
IM
RM _LO P_
O
_L
_L
T O
)
ed
RM _LO
TX
TX
rv
T_
T_
se
T
RM
RM
RM
(re
IM
31 22 21 20 19 18 9 8 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x80 Reset
RMT_TX_LIM_CHn This field is used to configure the maximum entries that channel n can send out.
(R/W)
EL
RMT_TX_LOOP_NUM_CHn This field is used to configure the maximum loop count when continuous
TX mode is enabled. (R/W)
RMT_TX_LOOP_CNT_EN_CHn This bit is the enable bit for loop counting. (R/W)
RMT_LOOP_COUNT_RESET_CHn This bit is used to reset the loop count when continuous TX
PR
mode is enabled. (WT)
RMT_LOOP_STOP_EN_CHn Set this bit, if the loop counting reaches the value set in
RMT_TX_LOOP_CNT_EN_CHn, continuous TX mode will be stopped. (R/W)

Register 30.17. RMT_TX_SIM_REG (0x00C4)
RM _TX SIM H3
TX IM H2
IM H1
H0
RM _TX SIM N
T _ _C
T_ _S _C
_S _C
_C
T _ _E
RM TX IM
T_ _S
d)
RM _TX
ve
r
se
T
RM
(re
31 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RMT_TX_SIM_CHn (n = 03) Set this bit to enable channel n to start sending data simultaneously
with other enabled channels. (R/W)
RMT_TX_SIM_EN This bit is used to enable multiple channels to start sending data simultaneously.
RY
(R/W)
Register 30.18. RMT_CHm_RX_LIM_REG (m = 4, 5, 6, 7) (0x00B0, 0x00B4, 0x00B8, 0x00BC)
A
EG
_R
M
LI
X_
_R
m
)
ed
CH
IN
v
T_
ser
RM
(re
31 9 8 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x80 Reset
IM
RMT_CHm_RX_LIM_REG This field is used to configure the maximum entries that channel m can
receive. (R/W)
Register 30.19. RMT_DATE_REG (0x00CC)

EL
TE
)
ed
DA
rv
T_
se
RM
(re
31 28 27 0
0 0 0 0 0x2101181 Reset
PR
RMT_DATE Version control register. (R/W)


The pulse count controller (PCNT) is designed to count input pulses. It can increment or decrement a pulse
counter value by keeping track of rising (positive) or falling (negative) edges of the input pulse signal. The PCNT
has four independent pulse counters called units, which have their groups of registers. There is only one clock in
PCNT, which is APB_CLK. In this chapter, n denotes the number of a unit from 0 ~ 3.
Each unit includes two channels (ch0 and ch1) which can independently increment or decrement its pulse
counter value. The remainder of the chapter will mostly focus on channel 0 (ch0) as the functionality of the two
channels is identical.
As shown in Figure 31-1, each channel has two input signals:
RY
1. One input pulse signal (e.g. sig_ch0_un, the input pulse signal for ch0 of unit n ch0)
2. One control signal (e.g. ctrl_ch0_un, the control signal for ch0 of unit n ch0)
A
IN
IM
EL
Figure 311. PCNT Block Diagram
31.1 Features
PR
A PCNT has the following features:
• Four independent pulse counters (units) that count from 1 to 65535
• Each unit consists of two independent channels sharing one pulse counter
• All channels have input pulse signals (e.g. sig_ch0_un) with their corresponding control signals (e.g.
ctrl_ch0_un)
• Independently filter glitches of input pulse signals (sig_ch0_un and sig_ch1_un) and control signals
(ctrl_ch0_un and ctrl_ch1_un) on each unit
• Each channel has the following parameters:
1. Selection between counting on positive or negative edges of the input pulse signal

2. Configuration to Increment, Decrement, or Disable counter mode for control signal’s high and low
states
A RY
IN
IM
Figure 312. PCNT Unit Architecture

EL
Figure 31-2 shows PCNT’s architecture. As stated above, ctrl_ch0_un is the control signal for ch0 of unit n. Its
high and low states can be assigned different counter modes and used for pulse counting of the channel’s input
pulse signal sig_ch0_un on negative or positive edges. The available counter modes are as follows:
PR
• Increment mode: When a channel detects an active edge of sig_ch0_un (can be configured by software),
the counter value pulse_cnt increases by 1. Upon reaching PCNT_CNT_H_LIM_Un, pulse_cnt is cleared. If
the channel’s counter mode is changed or if PCNT_CNT_PAUSE_Un is set before pulse_cnt reaches
PCNT_CNT_H_LIM_Un, then pulse_cnt freezes and its counter mode changes.
• Decrement mode: When a channel detects an active edge of sig_ch0_un (can be configured by software),
the counter value pulse_cnt decreases by 1. Upon reaching PCNT_CNT_L_LIM_Un, pulse_cnt is cleared. If
the channel’s counter mode is changed or if PCNT_CNT_PAUSE_Un is set before pulse_cnt reaches
PCNT_CNT_H_LIM_Un, then pulse_cnt freezes and its counter mode changes.
• Disable mode: Counting is disabled, and the counter value pulse_cnt freezes.
Table 31-1 to Table 31-4 provide information on how to configure the counter mode for channel 0.

Table 311. Counter Mode. Positive Edge of Input Pulse Signal. Control Signal in Low State
PCNT_CH0_POS_MODE_Un PCNT_CH0_LCTRL_MODE_Un Counter Mode

0 Increment
1 1 Decrement
Others Disable
0 Decrement
2 1 Increment
Others Disable
Others N/A Disable
RY
Table 312. Counter Mode. Positive Edge of Input Pulse Signal. Control Signal in High State
PCNT_CH0_POS_MODE_Un PCNT_CH0_HCTRL_MODE_Un Counter Mode

0 Increment
1 1 Decrement
A
Others Disable
0 Decrement
2 1 Increment
Others N/A
IN
Others Disable
Disable
IM
Table 313. Counter Mode. Negative Edge of Input Pulse Signal. Control Signal in Low State
PCNT_CH0_NEG_MODE_Un PCNT_CH0_LCTRL_MODE_Un Counter Mode

0 Increment
1 1 Decrement
EL
Others Disable
0 Decrement
2 1 Increment
Others Disable
Others N/A Disable
PR
Table 314. Counter Mode. Negative Edge of Input Pulse Signal. Control Signal in High State
PCNT_CH0_NEG_MODE_Un PCNT_CH0_HCTRL_MODE_Un Counter Mode

0 Increment
1 1 Decrement
Others Disable
0 Decrement
2 1 Increment
Others Disable
Others N/A Disable

Each unit has one filter for all its control and input pulse signals. A filter can be enabled with the bit
PCNT_FILTER_EN_Un. The filter monitors the signals and ignores all the noise, i.e. the glitches with pulse widths
shorter than PCNT_FILTER_THRES_Un APB clock cycles in length.
As previously mentioned, each unit has two channels which process different input pulse signals and increase or
decrease values via their respective inc_dec modules, then the two channels send these values to the adder
module which has a 16-bit wide signed register. This adder can be suspended by setting
PCNT_CNT_PAUSE_Un, and cleared by setting PCNT_PULSE_CNT_RST_Un.
The PCNT has five watchpoints that share one interrupt. The interrupt can be enabled or disabled by interrupt
enable signals of each individual watchpoint.
• Maximum count value: When pulse_cnt reaches PCNT_CNT_H_LIM_Un, a high limit interrupt is triggered
RY
and PCNT_CNT_THR_H_LIM_LAT_Un is high.
• Minimum count value: When pulse_cnt reaches PCNT_CNT_L_LIM_Un, a low limit interrupt is triggered and
PCNT_CNT_THR_L_LIM_LAT_Un is high.
• Two threshold values: When pulse_cnt equals either PCNT_CNT_THRES0_Un or

PCNT_CNT_THRES1_Un, an interrupt is triggered and either PCNT_CNT_THR_THRES0_LAT_Un or
A
PCNT_CNT_THR_THRES1_LAT_Un is high respectively.
• Zero: When pulse_cnt is 0, an interrupt is triggered and PCNT_CNT_THR_ZERO_LAT_Un is valid.
31.3 Applications
IN
In each unit, channel 0 and channel 1 can be configured to work independently or together. The three
subsections below provide details of channel 0 incrementing independently, channel 0 decrementing
IM
independently, and channel 0 and channel 1 incrementing together. For other working modes not elaborated in
this section (e.g. channel 1 incrementing/decremeting independently, or one channel incrementing while the
other decrementing), reference can be made to these three subsections.
31.3.1 Channel 0 Incrementing Independently

EL
PR
Figure 313. Channel 0 Up Counting Diagram
Figure 31-3 illustrates how channel 0 is configured to increment independently on the positive edge of
sig_ch0_un while channel 1 is disabled (see subsection 31.2 for how to disable channel 1). The configuration of
channel 0 is shown below.
• PCNT_CH0_LCTRL_MODE_Un=0: When ctrl_ch0_un is low, the counter mode specified for the low state
turns on, in this case it is Increment mode.

• PCNT_CH0_HCTRL_MODE_Un=2: When ctrl_ch0_un is high, the counter mode specified for the low state
turns on, in this case it is Disable mode.
• PCNT_CH0_POS_MODE_Un=1: The counter increments on the positive edge of sig_ch0_un.
• PCNT_CH0_NEG_MODE_Un=0: The counter idles on the negative edge of sig_ch0_un.
• PCNT_CNT_H_LIM_Un=5: When pulse_cnt counts up to PCNT_CNT_H_LIM_Un, it is cleared.
31.3.2 Channel 0 Decrementing Independently
A RY
Figure 314. Channel 0 Down Counting Diagram
IN
Figure 31-4 illustrates how channel 0 is configured to decrement independently on the positive edge of
sig_ch0_un while channel 1 is disabled. The configuration of channel 0 in this case differs from that in Figure 31-3
in the following aspects:
IM
• PCNT_CH0_POS_MODE_Un=2: the counter decrements on the positive edge of sig_ch0_un.
• PCNT_CNT_L_LIM_Un=-5: when pulse_cnt counts down to PCNT_CNT_L_LIM_Un, it is cleared.
31.3.3 Channel 0 and Channel 1 Incrementing Together

EL
PR
Figure 315. Two Channels Up Counting Diagram
Figure 31-5 illustrates how channel 0 and channel 1 are configured to increment on the positive edge of
sig_ch0_un and sig_ch1_un respectively at the same time. It can be seen in Figure 31-5 that control signal
ctrl_ch0_un and ctrl_ch1_un have the same waveform, so as input pulse signal sig_ch0_un and sig_ch1_un. The
configuration procedure is shown below.
• For channel 0:

– PCNT_CH0_LCTRL_MODE_Un=0: When ctrl_ch0_un is low, the counter mode specified for the low
state turns on, in this case it is Increment mode.
– PCNT_CH0_HCTRL_MODE_Un=2: When ctrl_ch0_un is high, the counter mode specified for the low
state turns on, in this case it is Disable mode.
– PCNT_CH0_POS_MODE_Un=1: The counter increments on the positive edge of sig_ch0_un.
– PCNT_CH0_NEG_MODE_Un=0: The counter idles on the negative edge of sig_ch0_un.
• For channel 1:
– PCNT_CH1_LCTRL_MODE_Un=0: When ctrl_ch1_un is low, the counter mode specified for the low
state turns on, in this case it is Increment mode.
RY
– PCNT_CH1_HCTRL_MODE_Un=2: When ctrl_ch1_un is high, the counter mode specified for the low
state turns on, in this case it is Disable mode.
– PCNT_CH1_POS_MODE_Un=1: The counter increments on the positive edge of sig_ch1_un.
– PCNT_CH1_NEG_MODE_Un=0: The counter idles on the negative edge of sig_ch1_un.
A
• PCNT_CNT_H_LIM_Un=10: When pulse_cnt counts up to PCNT_CNT_H_LIM_Un, it is cleared.
IN
IM
EL
PR


The addresses in this section are relative to Pulse Count Controller base address provided in Table 3-4 in Chapter

PCNT_U0_CONF0_REG Configuration register 0 for unit 0 0x0000 R/W
PCNT_U1_CONF0_REG Configuration register 0 for unit 1 0x000C R/W
RY
A
PCNT_CTRL_REG Control register for all counters 0x0060 R/W
Status Register
PCNT_U0_CNT_REG
IN
Counter value for unit 0 0x0030 RO
PCNT_U1_CNT_REG Counter value for unit 1 0x0034 RO
PCNT_U2_CNT_REG Counter value for unit 2 0x0038 RO
IM
PCNT_U3_CNT_REG Counter value for unit 3 0x003C RO
PCNT_U0_STATUS_REG PNCT UNIT0 status register 0x0050 RO
PCNT_U3_STATUS_REG PNCT UNIT3 status register 0x005C RO
EL
Interrupt Register
PCNT_INT_RAW_REG Interrupt raw status register 0x0040 RO
PCNT_INT_ST_REG Interrupt status register 0x0044 RO
PCNT_INT_ENA_REG Interrupt enable register 0x0048 R/W
PCNT_INT_CLR_REG Interrupt clear register 0x004C WO
PR
Version Register
PCNT_DATE_REG PCNT version control register 0x00FC R/W

31.5 Registers
The addresses in this section are relative to Pulse Count Controller base address provided in Table 3-4 in Chapter
Register 31.1. PCNT_Un_CONF0_REG (n: 03) (0x0000+0xC*n)
U0
0
0
_U
_U
_U
PC T_T R_H IM _EN U0

_F _Z IM _U 0
0
U0
U0
0
E_
NT HR _L _EN _U
_U
_U
DE
DE
DE
_E _EN U0
ILT ER _E 0
U0 U0
N H _L S0 _
U0
D
E_
E_
PC _T _L E EN
DE
DE
O
O
O
ER O N_
N_ _
D
D
S_
_M
_M
_M
NT HR HR S1_
O
O
O
E
_
_M
NT HR G_M
M
M
RL
RL
RL
RL
HR
S_
S_
PC T_T R_T RE
EG
CT
CT
CT
CT
_T
O
N H H
H
_N
_H
NT 0_N
_P
_P
ER
_L
_L
PC _T _T
1_
H1
H1
H1
H0
H0
H0
LT
CH
PC CH
FI
_C
_C
_C
_C
_C
_C
PC _T
_
_
NT
NT
NT
NT
NT
NT
NT
NT
NT
RY
PC
PC
PC
PC
PC
PC
PC
PC
PC
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 0
0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0 0 1 1 1 1 0x10 Reset
PCNT_FILTER_THRES_Un This sets the maximum threshold, in APB_CLK cycles, for the filter.
Any pulses with width less than this will be ignored when the filter is enabled. (R/W)
A
PCNT_FILTER_EN_Un This is the enable bit for unit n’s input filter. (R/W)
PCNT_THR_ZERO_EN_Un This is the enable bit for unit n’s zero comparator. (R/W)
PCNT_THR_H_LIM_EN_Un This is the enable bit for unit n’s thr_h_lim comparator. (R/W)
IN
PCNT_THR_L_LIM_EN_Un This is the enable bit for unit n’s thr_l_lim comparator. (R/W)
PCNT_THR_THRES0_EN_Un This is the enable bit for unit n’s thres0 comparator. (R/W)
IM
PCNT_THR_THRES1_EN_Un This is the enable bit for unit n’s thres1 comparator. (R/W)
PCNT_CH0_NEG_MODE_Un This register sets the behavior when the signal input of channel 0 de-
tects a negative edge.
EL
1: Increase the counter; 2: Decrease the counter; 0, 3: No effect on counter (R/W)
PCNT_CH0_POS_MODE_Un This register sets the behavior when the signal input of channel 0 de-
tects a positive edge.
1: Increase the counter; 2: Decrease the counter; 0, 3: No effect on counter (R/W)

PR
PCNT_CH0_HCTRL_MODE_Un This register configures how the

CHn_POS_MODE/CHn_NEG_MODE settings will be modified when the control signal is
high.
0: No modification; 1: Invert behavior (increase -> decrease, decrease -> increase); 2, 3: Inhibit
counter modification (R/W)

PCNT_CH0_LCTRL_MODE_Un This register configures how the

low.
PCNT_CH1_NEG_MODE_Un This register sets the behavior when the signal input of channel 1 de-
RY
tects a negative edge.
1: Increment the counter; 2: Decrement the counter; 0, 3: No effect on counter (R/W)
PCNT_CH1_POS_MODE_Un This register sets the behavior when the signal input of channel 1 de-
tects a positive edge.
A
1: Increment the counter; 2: Decrement the counter; 0, 3: No effect on counter (R/W)
PCNT_CH1_HCTRL_MODE_Un This register configures how the

high.
IN
IM
PCNT_CH1_LCTRL_MODE_Un This register configures how the
low.
EL

PR
0
U0
_U
0_
S1
ES
RE
HR
TH
_T
T_
NT
CN
_C
T_
NT
N
PC
PC
31 16 15 0
0x00 0x00 Reset
PCNT_CNT_THRES0_Un This register is used to configure the thres0 value for unit n. (R/W)
PCNT_CNT_THRES1_Un This register is used to configure the thres1 value for unit n. (R/W)

0
0
_U
_U
IM
M
LI
L
H_
L_
T_
T_
CN
CN
_
_
NT
NT
PC
PC
31 16 15 0
0x00 0x00 Reset
PCNT_CNT_H_LIM_Un This register is used to configure the thr_h_lim value for unit n. (R/W)
PCNT_CNT_L_LIM_Un This register is used to configure the thr_l_lim value for unit n. (R/W)
RY
Register 31.4. PCNT_CTRL_REG (0x0060)
PC T_P T_P CN U2 U3
_P T_P NT 1 2
NT 0 1
0
NT N E_C E_U T_U
_C _U _U
_U
N N E_ E_ T_
SE SE ST
ST
PC T_C LS US RS
PC T_C LS US RS
PC T_P T_P CN U3
UL AU _R
_R
N N E_ E_
N U A T_
N U A T_
A PC _C S S
NT UL AU
N
PC T_P T_P
_E
LK
N N
)
)
ed
ed
_C
PC T_C
rv
rv
NT
se
se
N
PC
PC
IN
(re
(re
31 17 16 15 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 0 1 0 1 Reset
PCNT_PULSE_CNT_RST_Un Set this bit to clear unit n’s counter. (R/W)

IM
PCNT_CNT_PAUSE_Un Set this bit to freeze unit n’s counter. (R/W)
PCNT_CLK_EN The registers clock gate enable signal of PCNT module. 1: the registers can be read
and written by application. 0: the registers can not be read or written by application (R/W)
EL
Register 31.5. PCNT_Un_CNT_REG (n: 03) (0x0030+0x4*n)

0
_U
NT
_C
PR
SE
UL
)
ed
_P
rv
NT
se
PC
(re
31 16 15 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x00 Reset
PCNT_PULSE_CNT_Un This register stores the current pulse count value for unit n. (RO)

Register 31.6. PCNT_Un_STATUS_REG (n: 03) (0x0050+0x4*n)
0
LA U0
0
_U
_M _U
NT R_T RES AT_ 0
HR RE _LA 0
PC CN TH L_L _L _U0
_Z S1_ T_
H H _L U
H 0 U
DE
T
NT T_T R_T IM AT_
_ T_ _ IM T
O
NT N HR _L _LA
PC T_C T_T R_H RO
O
ER
N N H E
PC T_C T_T R_Z
N N H
PC T_C T_T
_T
N N
d)
PC T_C
_C
ver
se
N
PC
(re
31 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0 Reset
PCNT_CNT_THR_ZERO_MODE_Un The pulse counter status of PCNT_Un corresponding to 0. 0:
RY
pulse counter decreases from positive to 0. 1: pulse counter increases from negative to 0. 2:
pulse counter is negative. 3: pulse counter is positive. (RO)
PCNT_CNT_THR_THRES1_LAT_Un The latched value of thres1 event of PCNT_Un when threshold

event interrupt is valid. 1: the current pulse counter equals to thres1 and thres1 event is valid. 0:
others (RO)
A
PCNT_CNT_THR_THRES0_LAT_Un The latched value of thres0 event of PCNT_Un when threshold
event interrupt is valid. 1: the current pulse counter equals to thres0 and thres0 event is valid. 0:
others (RO)
IN
PCNT_CNT_THR_L_LIM_LAT_Un The latched value of low limit event of PCNT_Un when threshold
event interrupt is valid. 1: the current pulse counter equals to thr_l_lim and low limit event is valid.
0: others (RO)
IM
PCNT_CNT_THR_H_LIM_LAT_Un The latched value of high limit event of PCNT_Un when threshold
event interrupt is valid. 1: the current pulse counter equals to thr_h_lim and high limit event is valid.
0: others (RO)
PCNT_CNT_THR_ZERO_LAT_Un The latched value of zero threshold event of PCNT_Un when

EL
threshold event interrupt is valid. 1: the current pulse counter equals to 0 and zero threshold
event is valid. 0: others (RO)
PR

Register 31.7. PCNT_INT_RAW_REG (0x0040)
VE _U IN AW
_U IN AW
T_ W
W
IN A
RA
_E NT 2_ T_R
NT 1_ T_R
0_ T_R
HR VE _U IN
_T _E NT 3_
NT HR VE _U
_C T_T _E NT
NT N HR VE
PC T_C T_T R_E
N N H
PC T_C T_T
N N
)
ed
PC T_C
v
er
N
s
PC
(re
31 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
PCNT_CNT_THR_EVENT_Un_INT_RAW The raw interrupt status bit for the
PCNT_CNT_THR_EVENT_Un_INT interrupt. (RO)
Register 31.8. PCNT_INT_ST_REG (0x0044)
A
VE _U IN T
_U IN T
IN T
ST
_E NT 2_ T_S
NT 1_ T_S
0_ T_S
T_
HR VE _U IN
_T _E NT 3_
NT HR VE _U
_C T_T _E NT
IN
NT N HR VE
PC T_C T_T R_E
N N H
PC T_C T_T
N N
)
ed
PC _C
rv
NT
se
PC
(re
IM
31 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
PCNT_CNT_THR_EVENT_Un_INT_ST The masked interrupt status bit for the

PCNT_CNT_THR_EVENT_Un_INT interrupt. (RO)
EL
Register 31.9. PCNT_INT_ENA_REG (0x0048)

VE _U IN NA
_U IN NA
T_ A
A
IN N
EN
_E NT 2_ T_E
NT 1_ T_E
0_ T_E
PR
HR VE _U IN
_T _E NT 3_
NT HR VE _U
_C T_T _E NT
NT N HR VE
PC T_C T_T R_E
N N H
PC T_C T_T
N N
)
ed
PC _C
rv
NT
se
PC
(re
31 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
PCNT_CNT_THR_EVENT_Un_INT_ENA The interrupt enable bit for the

PCNT_CNT_THR_EVENT_Un_INT interrupt. (R/W)

Register 31.10. PCNT_INT_CLR_REG (0x004C)
VE _U IN LR
_U IN LR
T_ R
R
IN L
CL
_E NT 2_ T_C
NT 1_ T_C
0_ T_C
HR VE _U IN
_T _E NT 3_
NT HR VE _U
_C T_T _E NT
NT N HR VE
PC T_C T_T R_E
N N H
PC _C T_T
NT N
)
ed
PC T_C
rv
se
N
PC
(re
31 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reset
RY
PCNT_CNT_THR_EVENT_Un_INT_CLR Set this bit to clear the PCNT_CNT_THR_EVENT_Un_INT
interrupt. (WO)
Register 31.11. PCNT_DATE_REG (0x00FC)
A
E
AT
_D
NT
PC
31
IN
0x19072601
0
Reset
PCNT_DATE This is the PCNT version control register. (R/W)

IM
EL
PR

Glossary
Glossary
Abbreviations for Peripherals
AES AES (Advanced Encryption Standard) Accelerator

BOOTCTRL Chip Boot Control
DS Digital Signature
DMA DMA (Direct Memory Access) Controller
eFuse eFuse Controller
HMAC HMAC (Hash-based Message Authentication Code) Accelerator
RY
I2C I2C (Inter-Integrated Circuit) Controller
I2S I2S (Inter-IC Sound) Controller
LEDC LED Control PWM (Pulse Width Modulation)
MCPWM Motor Control PWM (Pulse Width Modulation)
PCNT Pulse Count Controller
RMT Remote Control Peripheral
A
RNG Random Number Generator
RSA RSA (Rivest Shamir Adleman) Accelerator
SDHOST SD/MMC Host Controller
SHA
SPI
IN
SHA (Secure Hash Algorithm) Accelerator
SPI (Serial Peripheral Interface) Controller
SYSTIMER System Timer
TIMG Timer Group
IM
TWAI Two-wire Automotive Interface
UART UART (Universal Asynchronous Receiver-Transmitter) Controller
ULP Coprocessor Ultra-low-power Coprocessor
USB OTG USB On-The-Go
WDT Watchdog Timers
EL
Abbreviations for Registers
ISO Isolation. When a module is power down, its output pins will be stuck in unknown
PR
state (some middle voltage). ”ISO” registers will control to isolate its output pins
to be a determined value, so it will not affect the status of other working modules
which are not power down.
NMI Non-maskable interrupt.
REG Register.
R/W Read/write. Software can read and write to these bits.
RO Read-only. Software can only read these bits.
SYSREG System Registers
WO Write-only. Software can only write to these bits.

Revision History
Revision History
Date Version Release notes

Added the following chapters:
• Chapter 2 GDMA Controller (GDMA)
• Chapter 20 Clock Glitch Detection
• Chapter 23 I2C Controller (I2C)
• Chapter 29 Motor Control PWM (MCPWM)
• Chapter 30 Remote Control Peripheral (RMT)
2021-12-16 v0.3
Updated the following chapters:
RY
• Chapter 4 eFuse Controller
• Chapter 16 RSA Accelerator (RSA)
• Chapter 17 HMAC Accelerator (HMAC)
• Chapter 18 Digital Signature (DS)
Added the following chapters:
A
• Chapter 13 System Registers
• Chapter 17 HMAC Accelerator (HMAC)
• Chapter 19 External Memory Encryption and Decryption (XTS_AES)
2021-09-30 v0.2
IN
• Chapter 22 UART Controller (UART)
• Chapter 26 USB Serial/JTAG Controller (USB_SERIAL_JTAG)
Updated the following Chapters:
• Chapter 4 eFuse Controller
IM
• Chapter 24 Two-wire Automotive Interface (TWAI®)
2021-07-09 v0.1 Preliminary release

EL
PR

A RY
IN
IM
EL
PR
Disclaimer and Copyright Notice

Information in this document, including URL references, is subject to change without notice.
ALL THIRD PARTY’S INFORMATION IN THIS DOCUMENT IS PROVIDED AS IS WITH NO
WARRANTIES TO ITS AUTHENTICITY AND ACCURACY.
NO WARRANTY IS PROVIDED TO THIS DOCUMENT FOR ITS MERCHANTABILITY, NON-
INFRINGEMENT, FITNESS FOR ANY PARTICULAR PURPOSE, NOR DOES ANY WARRANTY
OTHERWISE ARISING OUT OF ANY PROPOSAL, SPECIFICATION OR SAMPLE.
All liability, including liability for infringement of any proprietary rights, relating to use of information
in this document is disclaimed. No licenses express or implied, by estoppel or otherwise, to any
intellectual property rights are granted herein.
The Wi-Fi Alliance Member logo is a trademark of the Wi-Fi Alliance. The Bluetooth logo is a
registered trademark of Bluetooth SIG.
All trade names, trademarks and registered trademarks mentioned in this document are property
www.espressif.com of their respective owners, and are hereby acknowledged.
Copyright © 2021 Espressif Systems (Shanghai) Co., Ltd. All rights reserved.

Esp32-S3 Technical Reference Manual en

Uploaded by

Copyright:

Available Formats

Esp32-S3 Technical Reference Manual en

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Esp32-S3 Technical Reference Manual en

Uploaded by

Copyright:

Available Formats

ESP32­S3

Technical Reference Manual

Documentation Change Notification

1 ULP Coprocessor (ULP­FSM, ULP­RISC­V) 25

1.7.1 Connecting RTC I2C Signals 45

Espressif Systems 3 ESP32-S3 TRM (Pre-release v0.3)

1.9.3 RTC I2C (RTC_PERI) Register Summary 50

2 GDMA Controller (GDMA) 74

2.6.1 Programming Procedures for GDMA’s Transmit Channel 83

3 System and Memory 114

Espressif Systems 4 ESP32-S3 TRM (Pre-release v0.3)

3.3.5 Modules/Peripherals 122

4 eFuse Controller 125

5 IO MUX and GPIO Matrix (GPIO, IO MUX) 185

5.5.1 Overview 189

5.5.4.2 SDM Configuration 192

Espressif Systems 5 ESP32-S3 TRM (Pre-release v0.3)

5.10.2 Power Supply Management 194

6 Reset and Clock 238

6.2.4.4 RTC Clock 243

7 Chip Boot Control 244

7.3 ROM Code Printing Control 245

8 Interrupt Matrix (INTERRUPT) 248

Espressif Systems 6 ESP32-S3 TRM (Pre-release v0.3)

8.3.3.2 Allocate multiple peripheral interrupt sources (Source_Yn) to CPUx 255

9 System Timer (SYSTIMER)

10 Timer Group (TIMG) 294

10.1 Overview 294

10.2.4 Timer Reload 296

11 Watchdog Timers 312

Espressif Systems 7 ESP32-S3 TRM (Pre-release v0.3)

11.1 Overview 312

12 XTAL32K Watchdog Timers (XTWDT) 319

13 System Registers 322

13.3 Function Description 322

13.3.2 Clock Registers 324

14 SHA Accelerator (SHA) 342

Espressif Systems 8 ESP32-S3 TRM (Pre-release v0.3)

14.4 Function Description 343

15 AES Accelerator (AES) 356

15.7 Register Summary 364

16 RSA Accelerator (RSA) 369

16.2 Features 369

17 HMAC Accelerator (HMAC) 378

Espressif Systems 9 ESP32-S3 TRM (Pre-release v0.3)

17.2 Functional Description 378

18 Digital Signature (DS) 393

19 External Memory Encryption and Decryption (XTS_AES)402

19.3 Module Structure 402

19.4.4 Data Padding 404

20 Clock Glitch Detection 412

Espressif Systems 10 ESP32-S3 TRM (Pre-release v0.3)

20.2.2 Reset 412

21 Random Number Generator (RNG) 413

22 UART Controller (UART) 415

22.4.9.1 Hardware Flow Control 425

22.5 Programming Procedures 428

Espressif Systems 11 ESP32-S3 TRM (Pre-release v0.3)

22.7 Registers 437

ESP32S3

1 ULP Coprocessor (ULPFSM, ULPRISCV) 25

24 Twowire Automotive Interface (TWAI®) 527

25 USB OnTheGo (USB) 566

1 ULP Coprocessor (ULPFSM, ULPRISCV)

Figure 11. ULP Coprocessor Overview

Table 11. Comparison of the Two Coprocessors

Figure 12. ULP Coprocessor Diagram