Silicon access.

Control across the silicon cluster

Investigation, 2 October 2026. The development objective is to establish Seigsit physically through SEIGRASM and develop Hyphos operations through its connected relations. This requires investigating the components and connections throughout the cluster. Existing instruction execution can provide an entry mechanism for progressively taking control. Each step must identify which component performs the operation, what maintains its state, and which dependencies remain. Neither a classified ADC observation nor an object in processor memory establishes the complete physical Seigsit.

The immediate question is whether an accessible component can perform and retain an observable operation after SEIGRASM stops issuing commands to it. This separates continuing hardware activity from a sequence continuously driven by the application processor. It does not by itself establish six-state transport, firmware exclusion or Seigsit creation. The existing electrical exceptions remain unexplained; their cause cannot be assigned to binary encoding from the recovered observations.

The resource descriptions follow the RP1 overview, peripheral specification and PIO access description. They establish candidate capabilities, not the outcome of a Hyphos experiment. Six electrical states remain a requirement to realize and test; changing their representation is not evidence of changing the physical transport.

The write-relative acquisition return recovered the declared counts in all 32 continuous conditions, including sixteen quiet windows. All sixteen observed first arrivals aligned with the second interval from the divider write. The following prepared acquisition reduced median command delay by 94.7% while retaining those counts and accepted recovery. The measured arrival-boundary experiment then recovered the predicted change of first cycle in all 24 observed continuous conditions with resolved command position. All 48 resolved counts agreed; sixteen close early conditions retained timing ambiguity. The unchanged repeat recovered the same counts and resolved first-cycle predictions after power loss. Both returns retain close-margin timing uncertainty. This supports measured local scheduling while physical state establishment and transfer remain open.

Measured access and candidate routes

Archived observation. Acquisition BEABB6712394 contains a completed, checksum-valid record pair. The raw recording was decoded again for this investigation. It identifies RP1 as 0x20001927, platform 0x2, with peripheral BAR1 at bus address 0x80000000. The retained outbound window maps that address to CPU address 0x1c00000000. The window extends to 0x1c3fffffff; the recorded link checks agree and no exception is recorded.

Derived candidate. BAR2 was recorded as 0x80400000. Applying the same recorded translation gives CPU address 0x1c00400000. Independent RP1 reverse engineering identifies BAR2 with SRAM. The archive contains no load from this candidate SRAM address, so its accessibility, contents and availability for replacement code remain untested. A current boot must revalidate the mapping before using it.

This archive was produced by the earlier compiled observation apparatus. Its raw register observations are retained as evidence; its executable is not selected as the SEIGRASM implementation. The private acquisition record retains provenance. Raw-record SHA-256: 7402a9d1d4e961e1c342936dc97f3f961207a04ebb383e1eb22070c942c45dcf.

Board-source evidence. The board description names RP1's boot connection as AON_GPIO_00 (SDA), AON_GPIO_01 (SCL) and AON_GPIO_02 (RUN). The PMIC connection uses the separate AON_SGPIO_04/05 bank. The same board description places SD on BCM2712 SDIO1, while Ethernet belongs to RP1. Pin names must be resolved through the actual controller and bank; the existing PMIC pin mask cannot be reused for RP1.

Recording implication. SD is the candidate recording path during an RP1 replacement investigation. Ethernet cannot be assumed to remain available while RP1 is reset. BCM2712's separate SD controller makes continued recording plausible, but survival of an RP1 reset must be physically verified, including shared power, clock and pin dependencies.

A route to local SEIGRASM execution

External experimental evidence. The RP1 reverse-engineering project reports uploading code through the internal I2C boot interface and executing it on a local Cortex-M3. Its loader supplies a concrete protocol reference. The author also reports difficulty restoring the original firmware and an unsuccessful attempt to start the second core. These observations identify a testable entry path, not a verified replacement procedure for this apparatus.

The proposed target implementation uses authored SEIGRASM opcode streams for the application-processor entry and the local processor's execution mode. Reference drivers and the external loader are information sources only. They are not copied into the target or used as a foreign-compiled implementation. The initial test would load volatile memory; persistent EEPROM modification is unnecessary for this question.

The first local payload should perform a bounded challenge response and record progression in an explicitly reserved region. The application processor records a baseline without issuing a start, starts the payload once, leaves a measured interval without accessing its region, and then retrieves the response. A second distinct challenge tests whether the returned state is live rather than a retained marker. An explicit stop must terminate progression. Completion criteria require the input identity, ordered progress, terminal response, stop result and surviving evidence path; an acknowledgement of an upload is insufficient.

Before that payload can be installed, implementation must establish the board's boot-bus mapping, bounded transfers with readback, local reset and execution entry, memory ownership, and a recoverable recording path. PIO then becomes a candidate local consumer: its control registers are not generally exposed to the application processor through PCIe, although its data FIFOs are reachable. Merely reproducing the vendor's mailbox call would retain its execution dependency.

First bounded experiment: autonomous acquisition

Returned: route admission refused; ADC comparison untested. Read the individual experiment and result. Preparation 0E308A2434D1. Test whether RP1's ADC can acquire its internal temperature signal and retain results after SEIGRASM withdraws access to that block. This provides an on-board analogue input and a local acquisition mechanism without inventing a DAC-to-ADC connection. It does not measure the same node as the DA9091 experiments or resolve their exceptions.

The vendor ADC driver identifies input 4 as the temperature input and defines single-conversion, continuous-conversion, FIFO, error and interrupt fields. The clock driver identifies the ADC clock controls. Register definitions provide implementation evidence; FIFO depth, conversion timing, reset state and clock availability must be verified for this RP1. No temperature conversion or accuracy claim is needed: preserve raw observations.

1. Entry and ownership. Record the current link, windows and component identity. Snapshot ADC controls, clock selection, divider, interrupt enables and FIFO status. An active converter, unread FIFO, asserted error or unexplained changing configuration prevents modification and is recorded as an unresolved ownership condition.
2. Stopped reference. Establish a documented inactive converter with an empty FIFO. Record a counter-bracketed interval without ADC access, then verify that no result appeared.
3. Single acquisition. Issue one conversion request. After an interval without ADC access, inspect completion and FIFO occupancy, retrieve the raw result, and verify that another no-request interval produces no additional result.
4. Autonomous acquisition. Enable continuous conversion once. Leave a counter-bracketed interval with no ADC polling, FIFO reads, SD writes or new conversion commands. Then stop conversion, poll READY for at most 10 ms, record FIFO status and drain retained entries with a 16-entry storage bound. The initial settings use the maximum integer ADC divider and a 2 ms interval. Actual conversion cadence and capacity remain experimental questions; saturation, overflow or an unexpected count ends the sequence with a recorded failure.
5. Intervention and restoration. Repeat the stopped control, then repeat the active condition with the order recorded. Restore writable configuration and compare it with the saved state. Record any irreversible observation effects, such as consuming FIFO entries or clearing status; configuration restoration is not restoration of the exact prior internal state.

Discriminating result. No entries in stopped controls, one entry after a single request, and multiple entries after one continuous-start request would support acquisition continuing without repeated application-processor intervention. Equal sample values remain valid; numerical variation is not used as proof of freshness. Occupancy, completion, errors, overflow and timing are evaluated together. Unexpected records or changes remain in the evidence and are not excluded or retried into a passing result.

Claim boundary. The initial entry, register access and recording mechanisms still use the board's existing digital interfaces. This experiment examines a component-control step toward the intended physical foundation; it is not a demonstration of a transport without binary dependencies. A processor waiting between accesses does not prove that its power is removed, that RP1 firmware is inactive, or that another bus master cannot intervene. Firmware replacement and physical Seigsit transfer require their own observations.

Execution and recording. Literal SEIGRASM instructions establish the entry, SD transport, route checks, ADC operations and senary journal. The PC packager copies those instruction words and supplies fixed addresses, descriptors and recording reservations. It does not compile a target implementation. The existing EEPROM/ROM loader, CPU instruction encoding, PCIe register transactions and SD transport remain apparatus dependencies. No firmware service is called by the acquisition code.

The initial trial design below belongs to the first RP1 investigation, which stopped before acquisition. The executed successor uses the six-condition protocol.

Initial trial sequence. Verify the previously recorded outbound windows, RP1 identity, ADC clock registers and ADC registers in four separately recorded operations. Run stopped, single, stopped, continuous, stopped, continuous, stopped; repeat this order once, for 14 trials. Each trial takes two initial configuration snapshots separated by 1 ms. Admission requires a disabled converter, empty disabled FIFO, no interrupt enable or force, no recorded error, a stable configuration and the existing oscillator selection. The code temporarily enables the ADC clock with divisor 1, waits 1 ms, selects temperature input 4, sets ADC DIV to 0x00ffff00, enables FIFO error reporting and waits another 1 ms after READY. Register readback must match before starting. The board description specifies a nominal 50 MHz oscillator; this is a declared input, not a measured frequency in this experiment.

Each acquisition interval is 2 ms with CPU counter observations only. A second 2 ms stopped interval follows FIFO draining and must retain an empty FIFO. The record preserves raw samples, occupancy, errors, requested mode, observed settings and counter brackets. Equal samples are accepted as measurements; count and completion determine the acquisition comparison. Every trial restores writable ADC and clock configuration before its results are sent to SD. A failed check ends the sequence after recording the failure and any restoration mismatch. The restored clock-selection indication is retained but excluded from writable-configuration equality.

Recovery. The maximum completed sequence contains 141 journal sectors. Intent and completion records identify each operation; complete trial reports occupy seven sectors. Each sector is constructed by SEIGRASM, written to a reserved location and read back. The PC reader checks identity, checksum, ordinals, section order, parameters and the terminal record. A missing terminal record means incomplete recovery. A hardware abort or bus hang can leave an intent without a completion; RAM exception vectors do not guarantee a recoverable fault record. The terminal sector cannot prove its own target readback.

Run procedure. Use one two-minute powered run for this first acquisition. The numerical observation sequence itself contains approximately 0.1 seconds of requested delays; boot and SD recording add elapsed time. Two minutes is an initial operational allowance, not an observed completion time. Returned counter records will establish actual duration. Results and the public logbook edition are updated after recovery.

Validation scope. Supplied-response execution covers stopped, single and continuous conversion, retained equal values, busy and changing initial state, incorrect clock or divider readback, missing READY, missing samples, FIFO overflow, sample error, restoration mismatch, recording failure and boot entry. The native record constructor, persistence checks and journal reader are exercised together. These checks establish behaviour under the supplied responses; they do not establish the physical RP1 response or rule out another component intervening.

RP1 route established

The clock-control return completed three enable/disable cycles. The subsequent clocked ADC access returned zero from CS, retained all six surrounding controls and restored clock CTRL to zero. The single-conversion return then recovered READY clear immediately after the command, READY asserted later and RESULT 861 after two zero untriggered reads. Both ADC and clock restoration completed. The compact return recovered the readiness change after all six commands, with polls beginning 4.074–4.444 microseconds after command completion. Four commands changed RESULT and two retained equal values; all seven untriggered controls retained their values. Both restorations completed. The bounded autonomous return then retained zero entries in untriggered controls, one in each single-command condition, and one then two after continuous-start commands. Stopping, recovery and restoration completed. The subsequent acquisition-window comparison retained three entries in all four four-millisecond continuous conditions, with variable shorter-window counts and no count change observed across stopping. Controls and restoration passed. The queue-timing return then separated variable first-entry delay from later spacing near 1.31 ms; an early first arrival preceded four retained entries. Quiet references each retained three. The anchored restart return subsequently found all twelve observed continuous restarts compatible with continuation of their preceding arrival cadence, despite deliberately changed command timing. This supports retained timing across stop/restart. The pacing-divider comparison then changed arrival spacing from about 1.31 ms to 1.15 ms and back across A–B–B–A. Repeated three/four-entry patterns were consistent with the restart offset within that cadence. This characterizes reversible local timing control. The converter-enable comparison subsequently recorded the disable/re-enable transitions while all twelve observed continuous cycles retained compatibility with the preceding cadence, as did twelve retained-enable controls. All 40 conditions and restoration completed. The internal timing mechanism, polling effects, independent analog freshness and physical Seigsit transport remain unresolved.

The divider-write return then separated register writes from changed settings. All twelve observed continuous same-value write trials departed from prior arrival alignment and were compatible with intervals from the write; all twelve read controls retained prior alignment. The 40 conditions and restoration completed. This supports a local timing-origin control under the tested conditions, with matched write-relative acquisition as the next proposed test.

The route-activation experiment configured the controller and reached RP1 identity. Clock registers were readable before ADC access; subsequent ADC and clock reads returned 0xdeaddead. The clock-before-access experiment then stopped at clock readback validation, before any ADC access. The requested enable field was present, alongside an additional 0x10000000 field; root link and RP1 identity remained readable. Clock control and status must be distinguished before proceeding to the acquisition comparison.

Electrical entry and subsequent transfer

Entry investigation. Define the proposed spark by its connection, transition, receiving circuit and retained consequence. The earliest event observed after SEIGRASM starts must not be described as the first power-up impulse. Investigating the latter requires an already armed capture or a reset/boot mechanism that preserves that event. SD entry and RP1's internal boot connection provide different places to investigate this relation.

Communication investigation. Project-owned Ethernet messages can provide commands and continuous observations once a native MAC/PHY path is established. A protocol carried inside Ethernet frames does not change the PHY's electrical modulation. Investigating configurable signalling, diagnostic modes and physical loopback is a separate task. Preserve the distinction between a development bridge and the Seigsit transport being developed.

Seigsit continuation. After component control is measured, trace a complete physical relation from a controllable source through an actual connection to a receiving operation. Test state establishment, retention, transfer and a consequence determined by the received state. The Seigsit's connected identity and layers, followed by later content attachment and use, remain explicit requirements. Neither autonomous sampling nor local firmware replacement supplies those relations automatically.

Firmware replacement and agnosticism

Design objective. SEIGRASM is the project's custom assembly language: explicit instructions for controlling available silicon and establishing the foundation from which Hyphos self-bootstraps and SeigrOS develops. Firmware replacement belongs to this objective. Existing vendor software is an apparatus dependency to investigate and replace wherever an executable replacement can be installed.

Agnosticism. Hyphos operations describe the required capability independently of a particular board. Discovery and verified instruction implementations establish how available components can realize that capability within their electrical and architectural limits. The common operation can have different CPU opcodes, register mappings and entry procedures. A discovered register address or successful instruction does not imply unrestricted access to every component.

Current dependency inventory. The BCM2712 ROM and onboard EEPROM boot path still load the SD payload and establish its initial execution conditions. The documented SD recovery entry is relevant to a later replacement investigation; its existence does not demonstrate an unrestricted loader. Public EEPROM images provide material for static reverse engineering, but they are not copies verified against this board's complete installed image. No EEPROM or OTP write occurs in the present experiment. The returned experiment records direct DA9091 register transactions and raw ADC observations on this apparatus; a replaceable executable firmware interface inside that PMIC has not been established.

Decision. Test native electrical access through the existing bus pins before attempting persistent boot-firmware replacement. This isolates a concrete access hypothesis, preserves an SD-recorded result when a prerequisite fails, and identifies the remaining dependencies. It does not make the existing firmware a required foundation of SEIGRASM or SeigrOS.

Hyphos hardware observation

The unfinished HAL implementation supplies the relation native_adc_read → native.mmio_read → memory_read. The native access extension defines readable regions and an intrinsic memory read. These provide the reference requirement for the AArch64 observation operation: validate a selected access, acquire its raw value and express the result in senary. Other discovery and resource-combination logic remains available as reference; its full dependency graph is not required by this elementary operation.

The 408-octet instruction stream has two callable entries. Entry 0x0 accepts a request and writes twenty-five numeric senary digits, most significant first. Entry 0x4 performs the bounded read and returns its unsigned value. The existing AArch64 seed can prepare, publish and call the complete observation stream from senary input. All target behavior is in the authored opcode words; Python and Unicorn supply packaging and software validation only.

The request uses seven aligned little-endian cells. Complete access containment, natural alignment, extent overflow, permission, result capacity and result intersection with the request or observed region are checked before the target load. Success writes exactly twenty-five digits in the range zero through five. Status zero denotes success; statuses 1 through 5 identify invalid extent/request, denied read, invalid width/alignment, range/intersection and insufficient capacity, respectively. Rejection leaves result storage unchanged, so the caller must inspect status before consuming it. The source header defines both entry contracts and memory preconditions.

This implementation separates status from value: a successful zero observation is distinct from a rejected read. The reference mmio_read returns "0" on denied access, and native_adc_read applies a truth-value fallback; neither behavior is used to establish observation validity here. The request's octet extent is an explicit CPU access quantity. It does not redefine the reference IORegion.size, declared in Seigsits, or specify Seigsit layout. The Hyphos representation-to-access relation remains to be implemented.

Recorded validation identifies source and opcode hashes and reports twelve passing execution tests. Checks exercise all supported widths, small-region boundary combinations, unsigned range limits, senary carry boundaries, rejected requests, unchanged output on failure, one target load per successful call, register preservation, relocation and execution through the native seed. Mapped RAM supplies the test values; no peripheral model or physical measurement is used.

DSB SY precedes and follows the architectural load. Physical peripheral access also requires appropriate memory attributes and known read side effects; barriers do not establish the mapping. See Arm's memory model guide. Bus faults and nonresponding devices are outside this operation's status contract.

This is an AArch64 elementary implementation, not execution of the Hyphos source above. The request receives its region from the caller; it does not discover an ADC or verify an I/O map. No voltage conversion, firmware request, persistent recording or SD boot setup is included. Physical sensor access requires a verified bus/register relation, an ADC transfer function and recoverable acquisition evidence.

Local execution and connected resources

The configured-route RP1 return establishes uploaded SEIGRASM execution on local core 0 and control of PIO. The program served its own return channel and recovered six transformations with stopped-engine controls; both full reports matched. This acquires an execution location and connected resource beyond application-processor PCIe access.

The preceding failed admission identified routing that needed explicit control. The successful return resolves that prerequisite for the tested configuration. Boot ROM and inherited clocks/pads remain dependencies; one local processor and one resource do not establish control of the whole cluster. Further work must acquire the remaining resources and demonstrate the physical connections needed by the Seigsit.

From access to evidence

The returned AArch64 experiment connects native GPIO selection, I2C transactions, ADC acquisition and persistent SD records. Its status fields and raw observations are evaluated together. The current component-control investigation extends the scope to RP1, autonomous acquisition and local execution. The earlier ADC exceptions remain unresolved.

Replacement of the initial ROM/EEPROM loading path remains a distinct investigation. No persistent firmware was rewritten in this run. The result and remaining questions identify what the returned evidence supports.