diff --git a/openpcd/firmware.txt b/openpcd/firmware.txt
index b34113c..6f8f85c 100644
--- a/openpcd/firmware.txt
+++ b/openpcd/firmware.txt
@@ -65,6 +65,22 @@ EP3	interrupt
 
 3.1 dumb interface
 
+struct usb_pcd_out_hdr {
+	u_int8_t cmd;		/* command */
+	u_int8_t flags;
+	u_int8_t reg;		/* register */
+	u_int8_t res;
+	u_int16_t len;
+	u_int8_t data[0];
+} __attribute__ ((packed));
+
+#define USB_PCD_CMD_WRITE_REG	0x01
+#define USB_PCD_CMD_WRITE_FIFO	0x02
+#define USB_PCD_CMD_WRITE_VFIFO	0x03
+#define USB_PCD_CMD_READ_REG	0x11
+#define USB_PCD_CMD_READ_FIFO	0x12
+#define USB_PCD_CMD_WRITE_VFIFO	0x13
+
 TBD
 
 3.2 Intelligent interface
@@ -102,7 +118,7 @@ is used to search for a free buffer using which the UDC RX DMA can be refilled.
 
 4.1.1 Performing SPI Register Read
 
-[ UDC has configured RX dma for reception of usb packets ]
+[ UDC has configured RX FIFO for reception of usb packets ]
 - UDC issues interrupt that USB endpoint receive has completed (FIFO)
 	- UDC driver defragments multiple packets into one transfer [optional]
 	- UDC driver submits another buffer for DMA reception
diff --git a/openpcd/firmware/TODO b/openpcd/firmware/TODO
new file mode 100644
index 0000000..eea1974
--- /dev/null
+++ b/openpcd/firmware/TODO
@@ -0,0 +1,27 @@
+SPI:
+- use PDC DMA for SPI transfers
+- use real SPI clock divisor (4.8MHz) rather than current 320kHz clock
+
+RC632:
+- Fix locking between 'atomic' ops like set/clear bit and RC632 IRQ
+- Implement VFIFO handling
+
+USB:
+- don't busy-wait for EP2/EP3 transfers but rather use TX completion IRQ
+- Implement VFIFO handling
+- Add DFU descriptor to host
+
+DFU:
+- implement DFU protocol for memory and flash
+- add capability to copy and execute DFU from RAM
+
+Generic:
+-
+
+Later, for PICCsim:
+- Implement SSC code for sampling subcarrier
+- Implement SSC code for generating subcarrier
+- Implement Manchester coding
+
+Way Later, for librfid:
+- Implement parts (or all of) 14443 in firmware as alternative configuration
diff --git a/openpcd/firmware/include/sys/types.h b/openpcd/firmware/include/sys/types.h
deleted file mode 100644
index f17ffe5..0000000
--- a/openpcd/firmware/include/sys/types.h
+++ /dev/null
@@ -1,14 +0,0 @@
-#ifndef _TYPES_H
-#define _TYPES_H
-
-typedef unsigned char	u_int8_t;
-typedef unsigned short	u_int16_t;
-typedef unsigned int	u_int32_t;
-typedef unsigned long long u_int64_t;
-
-typedef	signed char	int8_t;
-typedef signed short	int16_t;
-typedef signed int	int32_t;
-typedef signed long long int64_t;
-
-#endif
diff --git a/openpcd/firmware/src/flash.c b/openpcd/firmware/src/flash.c
new file mode 100644
index 0000000..cca7fb7
--- /dev/null
+++ b/openpcd/firmware/src/flash.c
@@ -0,0 +1,11 @@
+
+
+#define EFCS_CMD_WRITE_PAGE		0x01
+#define EFCS_CMD_SET_LOCK_BIT		0x02
+#define EFCS_CMD_WRITE_PAGE_LOCK	0x03
+#define EFCS_CMD_CLEAR_LOCK		0x04
+#define EFCS_CMD_ERASE_ALL		0x08
+#define EFCS_CMD_SET_NVM_BIT		0x0b
+#define EFCS_CMD_CLEAR_NVM_BIT		0x0d
+#define EFCS_CMD_SET_SECURITY_BIT	0x0f
+
diff --git a/openpcd/opcd_test/opcd_test.c b/openpcd/opcd_test/opcd_test.c
index c81afd8..57e5953 100644
--- a/openpcd/opcd_test/opcd_test.c
+++ b/openpcd/opcd_test/opcd_test.c
@@ -285,5 +285,7 @@ int main(int argc, char **argv)
 		}
 	}
 
+	sleep(1);
+
 	exit(0);
 }