Configuring Open Drain IO output type.

It almost works...
This code:

console.log("Peek 0x40010800:", peek32(0x40010800));
digitalWrite(A0,0); // just set into output mode
console.log("Peek 0x40010800:", peek32(0x40010800));
poke32(0x40010800, (peek32(0x40010800) & (~0b1100)) | 0b1100); // mask out existing bits and set open drain
console.log("Peek 0x40010800:", peek32(0x40010800));
analogWrite(A0, 0.5, { freq : 100 } ); // Set PWM 50%, 100Hz
console.log("Peek 0x40010800:", peek32(0x40010800));
poke32(0x40010800, (peek32(0x40010800) & (~0b1100)) | 0b1100); // mask out existing bits and set open drain again
console.log("Peek 0x40010800:", peek32(0x40010800));

Gives this output:

Peek 0x40010800: 7
Peek 0x40010800: 3
Peek 0x40010800: 15
Peek 0x40010800: 11
Peek 0x40010800: 15

1. Setting the config bits CNF1:0 to 0b01 sets the output to open-drain
   ok.
   
2. The analogWrite to set the PWM value then sets them back to 0b10 (alternate function output push-pull).
   
3. Writing CNF1:0 to 0b11 then sets output alternate function open-drain output, and I see open-drain PWM output.
   
   

I think the analogWrite clearing the output type might be down to jshPinSetFunction() where it does:

bool remap = (func&JSH_MASK_AF)!=JSH_AF0;
  if ((func&JSH_MASK_TYPE)==JSH_TIMER1)       GPIO_PinRemapConfig( GPIO_FullRemap_TIM1, remap );
  else if ((func&JSH_MASK_TYPE)==JSH_TIMER2)  GPIO_PinRemapConfig( GPIO_FullRemap_TIM2, remap );
  else if ((func&JSH_MASK_TYPE)==JSH_TIMER3)  GPIO_PinRemapConfig( GPIO_FullRemap_TIM3, remap );
...