nRF5340 (Nordic dual-core wireless SoC) — application core
The nRF5340 pairs a 128 MHz Cortex-M33 application core (1 MB flash, 512 KB RAM) with a 64 MHz Cortex-M33 network core for the BLE / 802.15.4 radio. This LabWired profile models the application core — the half that runs user firmware — to the point that unmodified upstream Zephyr boots and prints over the console.
The defining trait of this part for the simulator is its address map: the
nrf5340dk/nrf5340/cpuapp devicetree accesses every peripheral through the
non-secure alias base 0x5000_0000 (DT peripheral@50000000,
ranges = <0x0 0x5000_0000 0x1000_0000>), so e.g. UARTE0 is 0x5000_8000 and
CLOCK is 0x5000_5000 — not the 0x4000_0000 base used by the nRF52 family.
Status at a glance
Live status: the table below is a hand-maintained snapshot. For the authoritative, auto-generated view see the validation status and the chip conformance scoreboard.
| Aspect | Status |
|---|---|
| Chip yaml | configs/chips/nrf5340.yaml |
| System yaml | configs/systems/nrf5340dk.yaml |
| Reference firmware | crates/firmware-nrf5340-zephyr/ (unmodified Zephyr v3.7 hello_world) |
| Validation | firmware_survival::test_nrf5340_zephyr_survival + tests/nrf5340_clock_boot.rs |
| Tier | sim-validated — real Zephyr boot + behavioural models, no silicon diff |
What is proven
Unmodified upstream Zephyr v3.7 samples/hello_world, built for
nrf5340dk/nrf5340/cpuapp, boots end to end and prints
Hello World! nrf5340dk/nrf5340/cpuapp over the UARTE0 console. The boot walks
the genuine Zephyr clock_control (HFCLK/LFCLK start + status poll),
nrf_rtc_timer init (RTC1 on LFCLK), the ARMv8-M MPU setup, and the UARTE0
EasyDMA TX path. The entire run is bus-violation-free
(LABWIRED_TRACE_VIOLATIONS=1): every address the firmware touches is mapped.
Peripherals (from chip yaml)
| Peripheral | Base (non-secure) | Status | Notes |
|---|---|---|---|
| Cortex-M33 | — | ✅ modeled | Application core only; network core not modeled |
| CLOCK / POWER | 0x5000_5000 | ✅ behavioural | Shared nRF Nordic CLOCK model — HFCLK/LFCLK start→started |
| UARTE0 (console) | 0x5000_8000 | ✅ behavioural | EasyDMA TX → console sink (shared nRF UARTE model) |
| RTC0 / RTC1 | 0x5001_4000 / 0x5001_5000 | ✅ behavioural | RTC1 drives the kernel tick (shared nRF RTC model) |
| TIMER0–2 | 0x5000_f000 … | ✅ behavioural | Shared nRF TIMER model |
| GPIO P0 / P1 | 0x5084_2500 / 0x5084_2800 | ✅ modeled | nRF GPIO layout (note the unusual 0x_842_500 offset) |
| DCNF, SPU, OSC/REG, CTRL-AP, GPIOTE, DPPIC, FICR, UICR, analog trim | various | ⚪ benign stub | Poked at boot but not polled; zero-returning windows so the bus never faults |
Not yet modeled
- Network core (second Cortex-M33) and the BLE / 802.15.4 radio.
- TrustZone / SPU access enforcement (the SPU window is a benign stub; the secure/non-secure split is not policed).
- Analog trims — FICR/UICR/OSCILLATORS/REGULATORS are stubs returning 0, so oscillator/radio calibration is absent. This is irrelevant to the digital console path but means RF/analog fidelity is not represented.
- No live silicon diff — there is no nRF5340 bench board, so the models are validated against real firmware behaviour, not a register capture.
Rebuilding the fixture
See crates/firmware-nrf5340-zephyr/README.md.
build.sh rebuilds the committed ELF from a Zephyr v3.7 west workspace using the
gnuarmemb toolchain (no Zephyr SDK required).