5. Special function register SFR

The following abbreviations may be used in describing the registers in this manual:

Abbreviation	Description
RO	Indicates access type: read only
WO	Indicates the access type: write only, the value read is invalid
RW	Indicates access type: readable and writable
h	End with hexadecimal number
b	Expressed as a binary number

5.1 SFR profile and address distribution

The CH559 uses the special function registers SFR and xSFR to control, manage, and set the operating mode.

The SFR occupies the 80h-FFh address range of the internal data storage space and can only be accessed by direct address mode instructions.

Registers whose address is x0h or x8h are bit-addressable, which avoids changing the value of other bits when accessing a specific bit; registers other than a multiple of 8 can only be accessed byte by byte.

Some SFRs can only write data in safe mode, but are read-only in non-secure mode, such as: GLOBAL_CFG, PLL_CFG, CLOCK_CFG, SLEEP_CTRL, WAKE_CTRL.

Some SFRs have one or more aliases, such as: SPI0_CK_SE/SPI0_S_PRE, UDEV_CTRL/UHUB0_CTRL, UEP1_CTRL/UH_SETUP, UEP2_CTRL/UH_RX_CTRL, UEP2_T_LEN/UH_EP_PID, UEP3_CTRL/UH_TX_CTRL, UEP3_T_LEN/UH_TX_LEN, P5_PIN/P4_CFG.

Partial addresses correspond to multiple independent SFRs, for example: TL2/T2CAP1L, TH2/T2CAP1H, SAFE_MOD/CHIP_ID, T3_COUNT_L/T3_CK_SE_L, T3_COUNT_H/T3_CK_SE_H, SER1_FIFO/SER1_RBR/SER1_THR/SER1_DLL, SER1_IER/SER1_DLM, SER1_IIR/SER1_FCR, SER1_ADDR/SER1_DIV, ROM_CTRL/ROM_STATUS.

xSFR occupies the 2440h-298Fh address range of the xdata type of the external data storage space, or the 40H-8Fh address range of the pdata type. xSFR can only be accessed in bytes by indirect addressing via the MOVX instruction.

The default is based on the DPTR pointer; however, after bXIR_XSFR is set, the faster R0 or R1 can be used as a pdata type pointer to access xSFRs named pU* and pLED_*.

Some xSFRs have one or more aliases, for example: UEP2_3_MOD/UH_EP_MOD, UEP2_DMA_H/UH_RX_DMA_H, UEP2_DMA_L/UH_RX_DMA_L, UEP2_DMA/UH_RX_DMA, UEP3_DMA_H/UH_TX_DMA_H, UEP3_DMA_L/UH_TX_DMA_L, UEP3_DMA/UH_TX_DMA.

Partial addresses correspond to multiple independent xSFRs, for example: LED_DATA/LED_FIFO_CN.

The CH559 contains all the registers of the 8051 standard SFR, and other device control registers have been added. The specific SFR is shown in the table below.

Table 5.1 Special Function Register Table

SFR_Table

Remarks: (1), Text in red means it can be addressed by bit; (2), the following is the corresponding description of the color box.

Color	Description
	Register address
	SPI0 related register
	ADC related register
	USB related register
	Timer/Counter 2 Related Registers
	Port setting related register
	SPI1 related register
	PWM1 and PWM2 related registers
	UART1 related register
	Timer/Counter 0 and 1 related registers
	Flash-ROM related register

5.2 SFR types and reset values

Function type	Name	Address	Description	Reset value
System settings register	B	F0h	B register	0000 0000b
	ACC	E0h	accumulator	0000 0000b
	PSW	D0h	Program status register	0000 0000b
	GLOBAL_CFG	B1h	Global configuration register (in the bootloader state)	1110 0000b
	GLOBAL_CFG	B1h	Global configuration register (in application state)	1100 0000b
	CHIP_ID	A1h	Chip ID (read only)	0101 1001b
	SAFE_MOD	A1h	Safe mode control register (write only)	0000 0000b
	DPH	83h	Data address pointer is 8 bits high	0000 0000b
	DPL	82h	Data address pointer is lower 8 bits	0000 0000b
	DPTR	82h	DPL and DPH form a 16-bit SFR	0000h
	SP	81h	Stack pointer	0000 0111b
Clock, sleep, and power control registers	WDOG_COUNT	FFh	Watchdog count register	0000 0000b
	RESET_KEEP	FEh	Reset holding register (in power-on reset state)	0000 0000b
	WAKE_CTRL	EBh	Sleep wake control register	0000 0000b
	SLEEP_CTRL	EAh	Sleep control register	0000 0000b
	CLOCK_CFG	B3h	System clock configuration register	1001 1000b
	PLL_CFG	B2h	PLL clock configuration register	1101 1000b
	PCON	87h	Power control register (in power-on reset state)	0001 0000b
Interrupt control register	IP_EX	E9h	Extended interrupt priority control register	0000 0000b
	IE_EX	E8h	Extended interrupt enable register	0000 0000b
	GPIO_IE	CFh	GPIO interrupt enable register	0000 0000b
	IP	B8h	Interrupt priority control register	0000 0000b
	IE	A8h	Interrupt enable register	0000 0000b
Flash-ROM register	ROM_DATA_H	8Fh	flash-ROM data register high byte	xxxx xxxxb
	ROM_DATA_L	8Eh	Flash-ROM data register low byte	xxxx xxxxb
	ROM_DATA	8Eh	ROM_DATA_L and ROM_DATA_H form a 16-bit SFR	xxxxh
	ROM_STATUS	86h	flash-ROM status register (read only)	1000 0000b
	ROM_CTRL	86h	flash-ROM control register (write only)	0000 0000b
	ROM_ADDR_H	85h	flash-ROM address register high byte	xxxx xxxxb
	ROM_ADDR_L	84h	Flash-ROM address register low byte	xxxx xxxxb
	ROM_ADDR	84h	ROM_ADDR_L and ROM_ADDR_H form a 16-bit SFR	xxxxh
Port setting register	XBUS_SPEED	FDh	External bus speed configuration register	1111 1111b
	XBUS_AUX	FDh	External bus auxiliary setting register	0000 0000b
	PIN_FUNC	CEh	Pin function select register	0000 0000b
	P4_CFG	C7h	P4 port configuration register	0000 0000b
	P5_IN	C7h	P5 port input register (read only)	0000 0000b
	PORT_CFG	C6h	Port configuration register	0000 1111b
	P0_PU	C5h	P0 port pull-up enable register (En_P0_Pullup=0)	0000 0000b
	P0_PU	C5h	P0 port pull-up enable register (En_P0_Pullup=1)	1111 1111b
	P0_DIR	C4h	P0 port direction control register	0000 0000b
	P4_PU	C3h	P4 port pull-up enable register	1111 1111b
	P4_DIR	C2h	P4 port direction control register	0000 0000b
	P4_IN	C1h	P4 port input register (read only)	1111 1111b
	P4_OUT	C0h	P4 port output register	0000 0000b
	P3_PU	BFh	P3 port direction control register	1111 1111b
	P3_DIR	BEh	P3 port pull-up enable register	0000 0000b
	P2_PU	BDh	P2 port pull-up enable register	1111 1111b
	P2_DIR	BCh	P2 port direction control register	0000 0000b
	P1_PU	BBh	P1 port pull-up enable register	1111 1111b
	P1_DIR	BAh	P1 port direction control register	0000 0000b
	P1_IE	B9h	P1 port input enable register	1111 1111b
	P3	B0h	P3 port input and output registers	1111 1111b
	P2	A0h	P2 port input and output registers	1111 1111b
	P1	90h	P1 port input and output registers	1111 1111b
	P0	80h	P0 port input and output registers	1111 1111b
Timer/Counter 0 and 1 registers	TH1	8Dh	Timer1 count high byte	xxxx xxxxb
	TH0	8Ch	Timer0 count high byte	xxxx xxxxb
	TL1	8Bh3	Timer1 count low byte	xxxx xxxxb
	TL0	8Ah	Timer0 count low byte	xxxx xxxxb
	TMOD	89h	Timer0/1 mode register	0000 0000b
	TCON	88h	Timer0/1 Control Register	0000 0000b
UART0 register	SBUF	99h	UART0 data register	xxxx xxxxb
UART0 register	SCON	98h	UART0 control register	0000 0000b
Timer/Counter 2 Registers	TH2	CDh	Timer2 counter high byte	0000 0000b
	TL2	CCh	Timer2 counter low byte	0000 0000b
	T2COUNT	CCh	TL2 and TH2 form a 16-bit SFR	0000h
	T2CAP1H	CDh	Timer2 capture 1 data high byte (read only)	xxxx xxxxb
	T2CAP1L	CCh	Timer2 capture 1 data low byte (read only)	xxxx xxxxb
	T2CAP1	CCh	T2CAP1L and T2CAP1H form a 16-bit SFR	xxxxh
	RCAP2H	CBh	Count reload/capture 2 data register high byte	0000 0000b
	RCAP2L	CAh	Count reload/capture 2 data register low byte	0000 0000b
	RCAP2	CAh	RCAP2L and RCAP2H form a 16-bit SFR	0000h
	T2MOD	C9h	Timer2 mode register	0000 0000b
	T2CON	C8h	Timer2 Control Register	0000 0000b
Timer/counter 3 registers	T3_FIFO_H	AFh	Timer3 FIFO high byte	xxxx xxxxb
	T3_FIFO_L	AEh	Timer3 FIFO low byte	xxxx xxxxb
	T3_FIFO	AEh	T3_FIFO_L and T3_FIFO_H form a 16-bit SFR	xxxxh
	T3_DMA_AH	ADh	DMA current buffer address high byte	0000 xxxxb
	T3_DMA_AL	ACh	DMA current buffer address low byte	xxxx xxx0b
	T3_DMA	ACh	T3_DMA_AL and T3_DMA_AH form a 16-bit SFR	0xxxh
	T3_DMA_CN	ABh	DMA residual count register	0000 0000b
	T3_CTRL	AAh	Timer3 Control Register	0000 0010b
	T3_STAT	A9h	Timer3 Status Register	0000 0000b
	T3_END_H	A7h	Timer3 counts the final high byte	xxxx xxxxb
	T3_END_L	A6h	Timer3 counts the final low byte	xxxx xxxxb
	T3_END	A6h	T3_END_L and T3_END_H form a 16-bit SFR	xxxxh
	T3_COUNT_H	A5h	Timer3 current count high byte (read only)	0000 0000b
	T3_COUNT_L	A4h	Timer3 current count low byte (read only)	0000 0000b
	T3_COUNT	A4h	T3_COUNT_L and T3_COUNT_H form a 16-bit SFR	0000h
	T3_CK_SE_H	A5h	Timer3 clock divider setting high byte	0000 0000b
	T3_CK_SE_L	A4h	Timer3 clock divider sets the low byte	0010 0000b
	T3_CK_SE	A4h	T3_CK_SE_L and T3_CK_SE_H form a 16-bit SFR	0020h
	T3_SETUP	A3h	Timer3 setup register	0000 0100b
PWM1 and PWM2 registers	PWM_CYCLE	9Fh	PWM cycle period register	xxxx xxxxb
	PWM_CK_SE	9Eh	PWM clock divider setting register	0000 0000b
	PWM_CTRL	9Dh	PWM control register	0000 0010b
	PWM_DATA	9Ch	PWM1 data register	xxxx xxxxb
	PWM_DATA2	9Bh	PWM2 data register	xxxx xxxxb
SPI0 register	SPI0_SETUP	FCh	SPI0 setting register	0000 0000b
	SPI0_S_PRE	FBh	SPI0 slave mode preset data register	0010 0000b
	SPI0_CK_SE	FBh	SPI0 clock divider setting register	0010 0000b
	SPI0_CTRL	FAh	SPI0 control register	0000 0010b
	SPI0_DATA	F9h	SPI0 data transceiver register	xxxx xxxxb
	SPI0_STAT	F8h	SPI0 status register	0000 1000b
SPI1 register	SPI1_CK_SE	B7h	SPI1 clock divider setting register	0010 0000b
	SPI1_CTRL	B6h	SPI1 control register	0000 0010b
	SPI1_DATA	B5h	SPI1 data transceiver register	xxxx xxxxb
	SPI1_STAT	B4h	SPI1 status register	0000 1000b
UART1 register	SER1_DLL	9Ah	UART1 Baud Rate Divisor Latch Low Byte	xxxx xxxxb
	SER1_FIFO	9Ah	UART1 data FIFO read and write registers	xxxx xxxxb
	SER1_DIV	97h	UART1 prescaler divisor register	0xxx xxxxb
	SER1_ADDR	97h	UART1 bus address preload register	1111 1111b
	SER1_MSR	96h	UART1 Modem MODEM Status Register (Read Only)	1111 0000b
	SER1_LSR	95h	UART1 line status register (read only)	0110 0000b
	SER1_MCR	94h	UART1 Modem MODEM Control Register	0000 0000b
	SER1_LCR	93h	UART1 line control register	0000 0000b
	SER1_IIR	92h	UART1 Interrupt Identification Register (Read Only)	0000 0001b
	SER1_FCR	92h	FIFO control register (write only)	0000 0000b
	SER1_DLM	91h	UART1 baud rate divisor latch high byte	1000 0000b
	SER1_IER	91h	UART1 interrupt enable register	0000 0000b
ADC register	ADC_EX_SW	F7h	ADC Extended Analog Switch Control Register	0000 0000b
	ADC_SETUP	F6h	ADC setup register	0000 1000b
	ADC_FIFO_H	F5h	FIFO high byte of ADC (read only)	0000 0xxxb
	ADC_FIFO_L	F4h	ADC FIFO low byte (read only)	xxxx xxxxb
	ADC_FIFO	F4h	ADC_FIFO_L and ADC_FIFO_H form a 16-bit SFR	0xxxh
	ADC_CHANN	F3h	ADC channel select register	0000 0000b
	ADC_CTRL	F2h	ADC control register	0000 0000b
	ADC_STAT	F1h	ADC status register	0000 0100b
	ADC_CK_SE	EFh	ADC clock divider setting register	0001 0000b
	ADC_DMA_CN	EEh	DMA residual count register	0000 0000b
	ADC_DMA_AH	EDh	DMA current buffer address high byte	0000 xxxxb
	ADC_DMA_AL	ECh	DMA current buffer address low byte	xxxx xxx0b
	ADC_DMA	ECh	ADC_DMA_AL and ADC_DMA_AH form a 16-bit SFR	0xxxh
USB register	USB_DMA_AH	E7h	DMA current buffer address high byte (read only)	000x xxxxb
	USB_DMA_AL	E6h	DMA current buffer address low byte (read only)	xxxx xxx0b
	USB_DMA	E6h	USB_DMA_AL and USB_DMA_AH form a 16-bit SFR	xxxxh
	UHUB1_CTRL	E5h	USB host HUB1 port control register	1100 x000b
	UHUB0_CTRL	E4h	USB host HUB0 port control register	0100 x000b
	UDEV_CTRL	E4h	USB Device Port Control Register	0100 x000b
	USB_DEV_AD	E3h	USB Device Address Register	0000 0000b
	USB_CTRL	E2h	USB Control Register	0000 0110b
	USB_INT_EN	E1h	USB Interrupt Enable Register	0000 0000b
	UEP4_T_LEN	DFh	Endpoint 4 Transmit Length Register	0xxx xxxxb
	UEP4_CTRL	DEh	Endpoint 4 Control Register	0000 0000b
	UEP0_T_LEN	DDh	Endpoint 0 Transmit Length Register	0xxx xxxxb
	UEP0_CTRL	DCh	Endpoint 0 Control Register	0000 0000b
	USB_HUB_ST	DBh	SB Host HUB Port Status Register (Read Only)	0000 0000b
	USB_MIS_ST	DAh	SB Miscellaneous Status Register (Read Only)	xx10 1000b
	USB_INT_ST	D9h	USB Interrupt Status Register (Read Only)	00xx xxxxb
	USB_INT_FG	D8h	USB Interrupt Flag Register	0010 0000b
	UEP3_T_LEN	D7h	Endpoint 3 Transmit Length Register	0xxx xxxxb
	UH_TX_LEN	D7h	USB host send length register	0xxx xxxxb
	UEP3_CTRL	D6h	Endpoint 3 Control Register	0000 0000b
	UH_TX_CTRL	D6h	USB host transmit endpoint control register	0000 0000b
	UEP2_T_LEN	D5h	Endpoint 2 Transmit Length Register	0000 0000b
	UH_EP_PID	D5h	USB Host Token Setting Register	0000 0000b
	UEP2_CTRL	D4h	Endpoint 2 Control Register	0000 0000b
	UH_RX_CTRL	D4h	USB host receive endpoint control register	0000 0000b
	UEP1_T_LEN	D3h	Endpoint 1 Transmit Length Register	0xxx xxxxb
	UEP1_CTRL	D2h	Endpoint 1 Control Register	0000 0000b
	UH_SETUP	D2h	USB Host Auxiliary Settings Register	0000 0000b
	USB_RX_LEN	D1h	USB Receive Length Register (Read Only)	0xxx xxxxb
USB xSFR register	UEP4_1_MOD	2446h	Endpoint 1, 4 mode control register	0000 0000b
	UEP2_3_MOD	2447h	Endpoint 2, 3 Mode Control Register	0000 0000b
	UH_EP_MOD	2447h	USB Host Endpoint Mode Control Register	0000 0000b
	UEP0_DMA_H	2448h	Endpoints 0 and 4 Buffer Start Address High Bytes	000x xxxxb
	UEP0_DMA_L	2449h	Endpoints 0 and 4 Buffer Start Address Low Byte	xxxx xxx0b
	UEP0_DMA	2448h	UEP0_DMA_L and UEP0_DMA_H form a 16-bit SFR	xxxxh
	UEP1_DMA_H	244Ah	Endpoint 1 Buffer Start Address High Byte	000x xxxxb
	UEP1_DMA_L	244Bh	Endpoint 1 Buffer Start Address Low Byte	xxxx xxx0b
	UEP1_DMA	244Ah	UEP1_DMA_L and UEP1_DMA_H form 16-bit SFR	xxxxh
	UEP2_DMA_H	244Ch	Endpoint 2 Buffer start address high byte	000x xxxxb
	UEP2_DMA_L	244Dh	Endpoint 2 Buffer Start Address Low Byte	xxxx xxx0b
	UEP2_DMA	244Ch	UEP2_DMA_L and UEP2_DMA_H form 16-bit SFR	xxxxh
	UH_RX_DMA_H	244Ch	USB host receive buffer start address high byte	000x xxxxb
	UH_RX_DMA_L	244Dh	USB host receive buffer start address low byte	xxxx xxx0b
	UH_RX_DMA	244Ch	UH_RX_DMA_L and UH_RX_DMA_H form 16-bit SFR	xxxxh
	UEP3_DMA_H	244Eh	Endpoint 3 Buffer start address high byte	000x xxxxb
	UEP3_DMA_L	244Fh	Endpoint 3 Buffer Start Address Low Byte	xxxx xxx0b
	UEP3_DMA	244Eh	UEP3_DMA_L and UEP3_DMA_H form 16-bit SFR	xxxxh
	UH_TX_DMA_H	244Eh	USB host transmit buffer start address high byte	000x xxxxb
	UH_TX_DMA_L	244Fh	USB host send buffer start address low byte	xxxx xxx0b
	UH_TX_DMA	244Eh	UH_TX_DMA_L and UH_TX_DMA_H form a 16-bit SFR	xxxxh
	pU*	254*h	After bXIR_XSFR is set to 1, this name is used to address the above xSFR with pdata type, which is faster than xdata type addressing.
LED Control Card xSFR Register	LED_STAT	2880h	LED Status Register	010x 0000b
	LED_CTRL	2881h	LED Control Register	0000 0010b
	LED_FIFO_CN	2882h	FIFO Count Status Register (Read Only)	0000 0000b
	LED_DATA	2882h	LED data register (write only)	xxxx xxxxb
	LED_CK_SE	2883h	LED Clock Divider Setting Register	0001 0000b
	LED_DMA_AH	2884h	DMA current buffer address high byte	000x xxxxb
	LED_DMA_AL	2885h	DMA Current buffer address low byte	xxxx xxx0b
	LED_DMA	2884h	LED_DMA_AL and LED_DMA_AH Compose 16-bit SFR	xxxxh
	LED_DMA_CN	2886h	LED DMA Remaining Count Register	xxxx xxxxb
	LED_DMA_XH	2888h	DMA Current auxiliary buffer address high byte	000x xxxxb
	LED_DMA_XL	2889h	DMA Current auxiliary buffer address low byte	xxxx xxx0b
	LED_DMA_X	2888h	LED_DMA_XL and LED_DMA_XH form a 16-bit SFR	xxxxh
	pLED_*	298*h	After bXIR_XSFR is set to 1, this name is used to address the above xSFR with pdata type, which is faster than xdata type addressing.

5.3 General purpose 8051 register

Table 5.3.1 General 8051 Register List

Name	Address	Description	Reset value
B	F0h	B register	00h
A, ACC	E0h	accumulator	00h
PSW	D0h	program status register	00h
GLOBAL_CFG	B1h	Global configuration register (in the bootloader state)	E0h
GLOBAL_CFG	B1h	Global configuration register (in application state)	C0h
CHIP_ID	A1h	Chip ID Identifier (Read Only)	59h
SAFE_MOD	A1h	Safety Mode Control Register (Write Only)	00h
PCON	87h	power control register (in power-on reset state)	10h
DPH	83h	data address pointer high 8 bit	00h
DPL	82h	data address pointer low 8 bits	00h
DPTR	82h	DPL and DPH form 16-bit SFR	0000h
SP	81h	stack pointer	07h

B register (B):

Bit	Name	Access	Description	Reset value
[7:0]	B	RW	Arithmetic operation registers, mainly used for multiplication and division, bit-addressable	00h

A accumulator (A, ACC):

Bit	Name	Access	Description	Reset value
[7:0]	A/ACC	RW	Arithmetic accumulator, bit addressable	00h

Program Status Register (PSW):

Bit	Name	Access	Description
7	CY	RW	Carry flag: Used to record the carry or borrow of the most significant bit when performing arithmetic and logic operations. When the 8-bit addition is performed, the most significant bit is set, otherwise it is cleared. when 8-bit subtraction is performed If the borrow is borrowed, the bit is set, otherwise it is cleared. The logic instruction can make the bit bit or clear.
6	AC	RW	Auxiliary carry flag: When recording and subtracting, the lower 4 bits have a carry or borrow from the upper 4 bits, AC is set, otherwise cleared.
5	F0	RW	Universal flag bit addressable by bit 0: User can define it himself, can be cleared or set by software
4	RS1	RW	Register bank select bit high
3	RS0	RW	Register bank select bit low
2	OV	RW	Overflow flag: When adding or subtracting, the operation result exceeds 8 binary digits, then OV is set to 1, the flag overflows, otherwise cleared 0
1	F1	RW	Universal flag bit addressable by bit 1: User can define it, can be cleared or set by software
0	P	R0	Parity flag: Record the parity of 1 in accumulator A after the execution of the instruction. P1 for odd number 1 and P for even number 1

The state of the processor is stored in the status register PSW and the PSW supports bitwise addressing. The status word includes the carry flag, the auxiliary carry flag for BCD code processing, the parity flag, the overflow flag, and RS0 and RS1 for the working register bank selection. The area in which the working register set is located can be accessed either directly or indirectly.

Table 5.3.2 RS1 and RS0 Working Register Group Selection Table

RS1	RS0	Working register set
0	0	Group 0 (00h-07h)
0	1	Group 1 (08h-0Fh)
1	0	Group 2 (10h-17h)
1	1	Group 3 (18h-1Fh)

Table 5.3.3 Operations that affect the flag bit (X indicates that the flag bit is related to the operation result)

Operation	CY	OV	AC
ADD	X	X	X
ADDC	X	X	X
SUBB	X	X	X
MUL	0	X
DIV	0	X
DA A	X
RRC A	X
RLC A	X
CJNE	X
SETB C	1
CLR C	0
CPL C	X
MOV C, bit	X
ANL C, bit	X
ANL C,/bit	X
ORL C, bit	X
ORL C,/bit	X

Data Address Pointer (DPTR):

Bit	Name	Access	Description	Reset value
[7:0]	DPL	RW	Data pointer low byte	00h
[7:0]	DPH	RW	Data pointer high byte	00h

DPL and DPH form a 16-bit data pointer DPTR for accessing xSFR, xBUS, xRAM data memory or program memory. The actual DPTR corresponds to the physical 16-bit data pointers of DPTR0 and DPTR1, which are dynamically selected by DPS in XBUS_AUX.

Stack pointer (SP):

Bit	Name	Access	Description	Reset value
[7:0]	SP	RW	Stack pointer, mainly used for program calls and interrupt calls, and data in and out of the stack	07h

Stack specific functions: protect endpoints and protect the site, and manage them on a first-come, first-out basis. When the stack is pushed, the SP pointer is automatically incremented by 1, and the data or breakpoint information is saved. When the stack is taken, the SP pointer points to the data unit, and the SP pointer is automatically decremented by 1. The initial value of the SP after reset is 07h, and the corresponding default stack storage starts at 08h.

5.4 Special registers

Global configuration register (GLOBAL_CFG), writable only in safe mode:

Bit	Name	Access	Description	Reset value
[7:6]	Reserved	RO	Fixed value 11	11b
5	bBOOT_LOAD	RO	The Boot loader status bit is used to distinguish between the ISP bootloader status or the application state: set when the power is turned on, and cleared to 0 when the software is reset. For chips with an ISP bootloader, this bit is 1 indicates that the software has never been reset, usually the ISP bootloader state that was run after power-up. this bit is 0 indicating that the software has been reset, usually the application state	1
4	bSW_RESET	RW	Software reset control bit: Set to 1 to cause software reset, hardware auto-zero	0
3	bCODE_WE	RW	Flash-ROM write enable bit: This bit is 0 for write protection; 1 for Flash-ROM writable erasable	0
2	bDATA_WE	RW	DataFlash area write enable bit of Flash-ROM: This bit is 0 for write protection; 1 is for DataFlash area to be erasable and erasable	0
1	bXIR_XSFR	RW	MOVX_@R0/R1 instruction access range control bits: This bit is 0 to allow access to all xdata regions xRAM/xBUS/xSFR. This bit is 1 for access to xSFR and cannot access xRAM/xBUS	0
0	bWDOG_EN	RW	Watchdog reset enable bit: This bit is 0. The watchdog is only used as a timer. this bit is 1 to allow a watchdog reset when the timer overflows.	0

Chip ID (CHIP_ID):

Bit	Name	Access	Description	Reset value
[7:0]	CHIP_ID	RO	Fixed value 59h for identification chip	59h

Safe Mode Control Register (SAFE_MOD):

Bit	Name	Access	Description	Reset value
[7:0]	SAFE_MOD	WO	Used to enter or terminate safe mode	00h

Some SFRs can only write data in safe mode, and are always read-only in non-secure mode. Steps to enter safe mode:

write 55h to the register.
then write AAh to the register.
After that, about 13 to 23 system main frequency cycles are in safe mode, and one or more security class SFRs or ordinary SFRs can be rewritten during the validity period.
automatically terminate the safe mode after the above validity period.
Or write any value to this register to terminate the safe mode early.