🠛
QuantaVirt ›
QUAC 100 Register Map
QUAC 100 Register Map
QV-REF-REGS
Rev 1.0 — January 2026
Reference
Complete hardware register reference for the QUAC 100 Quantum-Resistant Universal Accelerator Card as accessed by the QuantaVirt hypervisor PQC driver. Covers BAR0 MMIO registers, command/response ring layout, interrupt configuration, DMA engine, NTT accelerator, QRNG, performance counters, and firmware update interface.
Register Map Overview #
The QUAC 100 exposes a single 64 KB BAR0 MMIO region. All registers are 32-bit unless noted. Multi-word registers use little-endian byte ordering. The driver must not access reserved fields — writes are ignored, reads return zero.
Offset Range Size Region Description
0x0000–0x00FF256 B Device Control Global device status, version, capability, reset 0x0100–0x01FF256 B Command Ring Command submission ring base, head, tail, size 0x0200–0x02FF256 B Response Ring Completion ring base, head, tail, size 0x0300–0x03FF256 B Interrupts MSI-X control, interrupt mask, cause, coalescing 0x0400–0x04FF256 B DMA Engine DMA control, scatter-gather, address translation 0x0500–0x05FF256 B NTT Engine NTT accelerator control, twiddle factor base, status 0x0600–0x06FF256 B QRNG Quantum RNG control, entropy pool, health status 0x0700–0x07FF256 B Performance Counters Operation counts, latency histograms, throughput 0x0800–0x08FF256 B Firmware Update Firmware flash control, bank select, progress 0x0900–0xFFFF~62 KB Reserved Reserved for future use — do not access
PCIe Configuration Space #
Register Offset Value Description
Vendor ID 0x00 0x1DB7Dyber, Inc. Device ID 0x02 0x0100QUAC 100 Revision ID 0x08 0x01Revision A1 Class Code 0x09 0x10 80 00Encryption controller (class 0x10, sub 0x80) Subsystem Vendor ID 0x2C 0x1DB7Dyber, Inc. Subsystem Device ID 0x2E 0x0100QUAC 100 (standard SKU) BAR0 0x10 64-bit MMIO 64 KB memory-mapped I/O, prefetchable MSI-X Capability 0x40+ 16 vectors MSI-X table in BAR0 + 0xFE00 PCIe Link — Gen4 x8 Max 15.75 GT/s per lane, ~126 Gbps aggregate
BAR0 Memory Layout #
BAR0 Base Address (e.g. 0xfb000000)
┌─────────────────────────────────────────â”
│ 0x0000 Device Control (256 B) │
│ 0x0100 Command Ring (256 B) │
│ 0x0200 Response Ring (256 B) │
│ 0x0300 Interrupt Control (256 B) │
│ 0x0400 DMA Engine (256 B) │
│ 0x0500 NTT Engine (256 B) │
│ 0x0600 QRNG (256 B) │
│ 0x0700 Performance Counters (256 B) │
│ 0x0800 Firmware Update (256 B) │
│ 0x0900 Reserved (~62 KB) │
│ 0xFE00 MSI-X Table (256 B) │
│ 0xFF00 MSI-X PBA (256 B) │
└─────────────────────────────────────────┘
Total: 64 KB (0x10000)Device Control Registers (0x0000–0x00FF) #
Offset Name R/W Reset Bits Description
0x0000DEV_ID RO 0x1DB70100[31:16] Vendor, [15:0] Device Device identification 0x0004DEV_REV RO 0x00010000[31:16] HW rev, [15:0] FW major.minor Hardware and firmware revision 0x0008DEV_STATUS RO 0x00000001[0] ready, [1] error, [2] fw_update, [3] overtemp, [7:4] engine_count Global device status 0x000CDEV_CTRL RW 0x00000000[0] enable, [1] soft_reset, [2] halt, [3] flush Device control — set bit 0 to enable operations 0x0010DEV_CAP RO varies [0] ML-KEM, [1] ML-DSA, [2] SLH-DSA, [3] AES-GCM, [4] ChaCha20, [5] QRNG, [6] NTT, [7] DMA_SG, [8] FW_DUAL_BANK Capability flags — which crypto engines are present 0x0014DEV_CAP2 RO varies [3:0] max_cmd_ring_log2, [7:4] max_resp_ring_log2, [15:8] max_dma_size_log2, [23:16] ntt_max_degree_log2 Extended capability parameters 0x0018FW_VERSION RO varies [31:24] major, [23:16] minor, [15:0] patch Firmware version (e.g. 1.0.0 = 0x01000000) 0x001CFW_BUILD RO varies [31:0] build timestamp Firmware build date as Unix epoch (seconds) 0x0020SERIAL_LO RO unique [31:0] Device serial number (low 32 bits) 0x0024SERIAL_HI RO unique [31:0] Device serial number (high 32 bits) 0x0028TEMP RO varies [15:0] die temp × 100 °C, [31:16] throttle threshold Die temperature in centidegrees (e.g. 4500 = 45.00 °C) 0x002CPOWER RO varies [15:0] current mW, [31:16] peak mW Power consumption in milliwatts 0x0030UPTIME RO 0 [31:0] Seconds since last reset 0x0034ERR_COUNT RW1C 0 [31:0] Total error count — write 1 to clear 0x0038ERR_LAST RO 0 [15:0] error code, [31:16] engine_id Last error code and which engine raised it
Reset Sequence: Set DEV_CTRL[1] (soft_reset). Poll DEV_STATUS[0] (ready) — device returns to ready state within 50 ms. All rings and counters are cleared on reset.
Command Ring Registers (0x0100–0x01FF) #
The command ring is a circular buffer in host memory where the driver submits cryptographic operation descriptors. The QUAC 100 fetches commands via DMA.
Offset Name R/W Reset Description
0x0100CMD_RING_BASE_LO RW 0 Command ring physical base address [31:0] — must be 4 KB aligned 0x0104CMD_RING_BASE_HI RW 0 Command ring physical base address [63:32] 0x0108CMD_RING_SIZE RW 0 [15:0] number of entries (must be power of 2, max 4096) 0x010CCMD_RING_HEAD RO 0 [15:0] hardware consumer head index — device advances after fetching 0x0110CMD_RING_TAIL RW 0 [15:0] software producer tail index — driver writes to submit 0x0114CMD_RING_CTRL RW 0 [0] enable, [1] pause, [2] abort_all 0x0118CMD_RING_STATUS RO 0 [0] active, [1] empty, [2] full, [3] error, [15:8] pending_count 0x011CCMD_RING_DB WO — Doorbell — write any value to notify device of new commands
/* Command submission flow */
1. Write command descriptor to ring[tail]
2. Advance tail: CMD_RING_TAIL = (tail + 1) % ring_size
3. Ring doorbell: write to CMD_RING_DB
4. Device fetches descriptor via DMA, advances HEAD
5. On completion, device writes response to response ringResponse Ring Registers (0x0200–0x02FF) #
Offset Name R/W Reset Description
0x0200RESP_RING_BASE_LO RW 0 Response ring physical base address [31:0] — 4 KB aligned 0x0204RESP_RING_BASE_HI RW 0 Response ring physical base address [63:32] 0x0208RESP_RING_SIZE RW 0 [15:0] number of entries (power of 2, max 4096) 0x020CRESP_RING_HEAD RW 0 [15:0] software consumer head — driver advances after processing 0x0210RESP_RING_TAIL RO 0 [15:0] hardware producer tail — device advances after writing completion 0x0214RESP_RING_CTRL RW 0 [0] enable, [7:4] coalesce_count (batch N responses before interrupt) 0x0218RESP_RING_STATUS RO 0 [0] active, [1] empty, [2] full, [15:8] pending_count
Interrupt Registers (0x0300–0x03FF) #
Offset Name R/W Reset Description
0x0300INT_STATUS RW1C 0 Interrupt cause — write 1 to acknowledge 0x0304INT_MASK RW 0xFFFFFFFFInterrupt mask — 1 = masked (disabled), 0 = enabled 0x0308INT_FORCE WO — Force interrupt for testing — write bit position 0x030CINT_COALESCE RW 0x00010001[15:0] max_usec delay, [31:16] max_count before interrupt
Interrupt Bit Definitions (INT_STATUS / INT_MASK)
Bit Name Description
[0] RESP_READY One or more responses available in response ring [1] CMD_ERROR Command processing error occurred [2] DMA_COMPLETE DMA transfer completed [3] DMA_ERROR DMA transfer error (bad address, IOMMU fault) [4] QRNG_READY QRNG entropy pool has data available [5] QRNG_HEALTH QRNG health test warning or failure [6] TEMP_WARN Die temperature exceeded warning threshold [7] TEMP_CRIT Die temperature exceeded critical threshold — throttling active [8] FW_UPDATE_DONE Firmware flash operation completed [9] FW_UPDATE_ERR Firmware flash operation failed [10] LINK_DOWN PCIe link state changed (for hot-plug support) [11] WATCHDOG Hardware watchdog expired (command took too long) [15:12] Reserved —
DMA Engine Registers (0x0400–0x04FF) #
Offset Name R/W Reset Description
0x0400DMA_CTRL RW 0 [0] enable, [1] sg_mode (scatter-gather), [3:2] burst_size (00=64B, 01=128B, 10=256B, 11=512B) 0x0404DMA_STATUS RO 0 [0] idle, [1] active, [2] error, [7:4] channel_count 0x0408DMA_SRC_LO RW 0 Source address [31:0] (for single-descriptor DMA) 0x040CDMA_SRC_HI RW 0 Source address [63:32] 0x0410DMA_DST_LO RW 0 Destination address [31:0] 0x0414DMA_DST_HI RW 0 Destination address [63:32] 0x0418DMA_LEN RW 0 [31:0] transfer length in bytes (max 16 MB) 0x041CDMA_SG_BASE_LO RW 0 Scatter-gather list base [31:0] — when sg_mode=1 0x0420DMA_SG_BASE_HI RW 0 Scatter-gather list base [63:32] 0x0424DMA_SG_COUNT RW 0 [15:0] number of SG entries (max 256) 0x0428DMA_XFER_COUNT RO 0 [31:0] total bytes transferred since last reset
NTT Engine Registers (0x0500–0x05FF) #
The Number Theoretic Transform engine implements the Radix-32 NTT used by ML-KEM and ML-DSA. It operates at 1 GHz on polynomial coefficients in the configured ring.
Offset Name R/W Reset Description
0x0500NTT_CTRL RW 0 [0] start, [1] inverse, [2] auto_reduce, [4:3] radix (00=2, 01=4, 10=8, 11=32) 0x0504NTT_STATUS RO 0 [0] idle, [1] busy, [2] done, [3] error 0x0508NTT_MODULUS RW 0x00000D01[31:0] polynomial modulus q (default 3329 for ML-KEM) 0x050CNTT_DEGREE RW 0x00000100[15:0] polynomial degree N (default 256) 0x0510NTT_TWIDDLE_BASE_LO RW 0 Twiddle factor table physical address [31:0] 0x0514NTT_TWIDDLE_BASE_HI RW 0 Twiddle factor table physical address [63:32] 0x0518NTT_INPUT_BASE_LO RW 0 Input polynomial coefficients physical address [31:0] 0x051CNTT_INPUT_BASE_HI RW 0 Input polynomial coefficients physical address [63:32] 0x0520NTT_OUTPUT_BASE_LO RW 0 Output polynomial coefficients physical address [31:0] 0x0524NTT_OUTPUT_BASE_HI RW 0 Output polynomial coefficients physical address [63:32] 0x0528NTT_CYCLE_COUNT RO 0 [31:0] clock cycles for last NTT operation
Radix-32 NTT: The default radix-32 mode processes 32 butterfly operations per clock cycle at 1 GHz, completing a 256-point NTT in approximately 64 cycles (~64 ns). For ML-DSA (q = 8380417), set NTT_MODULUS = 0x007FE001.
QRNG Registers (0x0600–0x06FF) #
Offset Name R/W Reset Description
0x0600QRNG_CTRL RW 0 [0] enable, [1] conditioning (SHAKE-256), [2] continuous_test 0x0604QRNG_STATUS RO 0 [0] ready (entropy available), [1] healthy, [2] test_fail, [3] depleted 0x0608QRNG_DATA RO random [31:0] 32 bits of conditioned quantum random data — read drains pool 0x060CQRNG_POOL_LEVEL RO varies [15:0] entropy pool level in bytes (max 4096) 0x0610QRNG_THROUGHPUT RO varies [31:0] raw entropy generation rate in bits/sec 0x0614QRNG_HEALTH_STATUS RO 0 [0] repetition_pass, [1] adaptive_pass, [2] chi_squared_pass, [3] startup_pass 0x0618QRNG_HEALTH_FAIL_CT RW1C 0 [31:0] cumulative health test failure count 0x061CQRNG_MIN_ENTROPY RO varies [15:0] estimated min-entropy per bit × 1000 (e.g. 997 = 0.997)
Performance Counters (0x0700–0x07FF) #
Offset Name Width Description
0x0700CTR_MLKEM_KEYGEN 64-bit ML-KEM KeyGen operations completed 0x0708CTR_MLKEM_ENCAPS 64-bit ML-KEM Encapsulation operations completed 0x0710CTR_MLKEM_DECAPS 64-bit ML-KEM Decapsulation operations completed 0x0718CTR_MLDSA_KEYGEN 64-bit ML-DSA KeyGen operations completed 0x0720CTR_MLDSA_SIGN 64-bit ML-DSA Sign operations completed 0x0728CTR_MLDSA_VERIFY 64-bit ML-DSA Verify operations completed 0x0730CTR_AEAD_ENCRYPT 64-bit AEAD encrypt operations completed 0x0738CTR_AEAD_DECRYPT 64-bit AEAD decrypt operations completed 0x0740CTR_NTT_FWD 64-bit Forward NTT operations completed 0x0748CTR_NTT_INV 64-bit Inverse NTT operations completed 0x0750CTR_QRNG_BYTES 64-bit Total QRNG bytes generated 0x0758CTR_DMA_BYTES 64-bit Total DMA bytes transferred 0x0760CTR_CMD_TOTAL 64-bit Total commands submitted 0x0768CTR_CMD_ERRORS 64-bit Total command errors 0x0770CTR_AVG_LATENCY_NS 32-bit Rolling average command latency in nanoseconds 0x0774CTR_MAX_LATENCY_NS 32-bit Maximum observed command latency in nanoseconds 0x0778CTR_THROUGHPUT_OPS 32-bit Operations per second (1-second rolling window) 0x07FCCTR_RESET WO — Write 0xDEADBEEF to reset all counters
Firmware Update Registers (0x0800–0x08FF) #
Offset Name R/W Description
0x0800FW_UPDATE_CTRL RW [0] begin_update, [1] commit, [2] abort, [3] bank_select (0=A, 1=B) 0x0804FW_UPDATE_STATUS RO [0] idle, [1] erasing, [2] writing, [3] verifying, [4] complete, [5] error 0x0808FW_UPDATE_ADDR RW Flash write address offset (within firmware bank) 0x080CFW_UPDATE_DATA WO 32-bit write data — write sequentially to program flash 0x0810FW_UPDATE_SIZE RW Total firmware image size in bytes 0x0814FW_UPDATE_CRC RW Expected CRC-32 of firmware image 0x0818FW_UPDATE_PROGRESS RO [15:0] bytes written, [31:16] total bytes — for progress reporting 0x081CFW_ACTIVE_BANK RO [0] active bank (0=A, 1=B)
Dual-Bank Safety: The QUAC 100 has dual firmware banks. Updates write to the inactive bank. If verification fails or the new firmware doesn't boot, the device automatically reverts to the previous working bank on the next power cycle.
Each command descriptor is 64 bytes (16 DWORDs) written to the command ring.
DWORD Byte Offset Field Description
0 0x00 opcode [15:0], flags [31:16]Operation code (see table below) and flags 1 0x04 cmd_id [31:0]Driver-assigned command ID — echoed in response 2 0x08 param_set [7:0], key_id [31:8]Algorithm parameter set (0=512, 1=768, 2=1024) and key handle 3 0x0C input_len [31:0]Input data length in bytes 4–5 0x10 input_addr [63:0]Physical address of input data buffer 6–7 0x18 output_addr [63:0]Physical address of output data buffer 8–9 0x20 key_addr [63:0]Physical address of key material (if not using key_id) 10 0x28 output_max_len [31:0]Maximum output buffer size 11–15 0x2C Reserved Must be zero
Command Opcodes
Opcode Name Input Output
0x0001MLKEM_KEYGEN 32B seed pk + sk 0x0002MLKEM_ENCAPS pk + 32B randomness ct + ss 0x0003MLKEM_DECAPS sk + ct ss 0x0011MLDSA_KEYGEN 32B seed pk + sk 0x0012MLDSA_SIGN sk + message sig 0x0013MLDSA_VERIFY pk + message + sig 1B result (0/1) 0x0021AES_GCM_ENCRYPT key + nonce + plaintext + AAD ciphertext + tag 0x0022AES_GCM_DECRYPT key + nonce + ciphertext + tag + AAD plaintext (or error) 0x0023CHACHA_ENCRYPT key + nonce + plaintext + AAD ciphertext + tag 0x0024CHACHA_DECRYPT key + nonce + ciphertext + tag + AAD plaintext (or error) 0x0031NTT_FORWARD polynomial coefficients NTT-domain coefficients 0x0032NTT_INVERSE NTT-domain coefficients polynomial coefficients 0x0041QRNG_READ — N random bytes 0x00F0SELF_TEST — test results 0x00FFNOP — —
Each response descriptor is 32 bytes (8 DWORDs) written by the device to the response ring.
DWORD Byte Offset Field Description
0 0x00 status [15:0], flags [31:16]Response status code and flags 1 0x04 cmd_id [31:0]Echoed command ID from original command 2 0x08 output_len [31:0]Actual output data length in bytes 3 0x0C latency_ns [31:0]Command processing time in nanoseconds 4–7 0x10 Reserved Must be zero
Hardware Response Codes #
Code Name Description
0x0000QUAC100_RESP_SUCCESS Operation completed successfully 0x0001QUAC100_RESP_INVALID_OPCODE Unknown or unsupported opcode 0x0002QUAC100_RESP_INVALID_PARAM Invalid parameter set or key handle 0x0003QUAC100_RESP_INVALID_LEN Input or output length out of range 0x0004QUAC100_RESP_DMA_ERROR DMA read/write failed — check IOMMU and address mapping 0x0005QUAC100_RESP_CRYPTO_FAIL Cryptographic operation failed (e.g. decryption tag mismatch) 0x0006QUAC100_RESP_KEY_NOT_FOUND Referenced key_id not in hardware keystore 0x0007QUAC100_RESP_BUSY Engine busy — retry later 0x0008QUAC100_RESP_TIMEOUT Operation timed out (hardware watchdog) 0x0009QUAC100_RESP_SELF_TEST_FAIL Hardware self-test detected internal error 0x000AQUAC100_RESP_QRNG_DEPLETED QRNG entropy pool empty — wait and retry 0x000BQUAC100_RESP_QRNG_HEALTH_FAIL QRNG health test failed — entropy source degraded 0x000CQUAC100_RESP_OVERTEMP Operation rejected due to thermal throttling 0x000DQUAC100_RESP_FW_ERROR Firmware internal error — collect diagnostics and report 0x00FFQUAC100_RESP_UNKNOWN Unknown error — should not occur; indicates hardware fault