Hardware Interfaces and Registers

Interfaces

Referring to the Comportable guideline for peripheral device functionality, the module edn has the following hardware interfaces defined.

Primary Clock: clk_i

Other Clocks: none

Bus Device Interfaces (TL-UL): tl

Bus Host Interfaces (TL-UL): none

Peripheral Pins for Chip IO: none

Inter-Module Signals: Reference

Inter-Module Signals
Port Name Package::Struct Type Act Width Description
csrng_cmd csrng_pkg::csrng req_rsp req 1 EDN supports a signal CSRNG application interface.
edn edn_pkg::edn req_rsp rsp 8 The collection of peripheral ports supported by edn. The width (4) indicates the number of peripheral ports on a single instance. Due to limitations in the parametrization of top-level interconnects this value is not currently parameterizable. However, the number of peripheral ports may change in a future revision.
tl tlul_pkg::tl req_rsp rsp 1

Interrupts:

Interrupt NameTypeDescription
edn_cmd_req_doneEvent

Asserted when a software CSRNG request has completed.

edn_fatal_errEvent

Asserted when a FIFO error occurs.

Security Alerts:

Alert NameDescription
recov_alert

This alert is triggered when entropy bus data matches on consecutive clock cycles.

fatal_alert

This alert triggers (i) if an illegal state machine state is reached, or (ii) if a fatal integrity failure is detected on the TL-UL bus.

Security Countermeasures:

Countermeasure IDDescription
EDN.CONFIG.REGWEN

Registers are protected from writes.

EDN.CONFIG.MUBI

Registers have multi-bit encoded fields.

EDN.MAIN_SM.FSM.SPARSE

The EDN main state machine uses a sparse state encoding.

EDN.ACK_SM.FSM.SPARSE

The EDN ACK state machine uses a sparse state encoding.

EDN.CTR.REDUN

Counter hardening on the generate command maximum requests counter.

EDN.MAIN_SM.CTR.LOCAL_ESC

A mismatch detected inside any EDN counter moves the main state machine into a terminal error state.

EDN.CS_RDATA.BUS.CONSISTENCY

Comparison on successive bus values for genbits returned from csrng that will distribute over the endpoint buses.

EDN.TILE_LINK.BUS.INTEGRITY

Tilelink end-to-end bus integrity scheme.

Registers

Summary
Name Offset Length Description
edn.INTR_STATE 0x0 4

Interrupt State Register

edn.INTR_ENABLE 0x4 4

Interrupt Enable Register

edn.INTR_TEST 0x8 4

Interrupt Test Register

edn.ALERT_TEST 0xc 4

Alert Test Register

edn.REGWEN 0x10 4

Register write enable for all control registers

edn.CTRL 0x14 4

EDN control register

edn.BOOT_INS_CMD 0x18 4

EDN boot instantiate command register

edn.BOOT_GEN_CMD 0x1c 4

EDN boot generate command register

edn.SW_CMD_REQ 0x20 4

EDN csrng app command request register

edn.SW_CMD_STS 0x24 4

EDN command status register

edn.RESEED_CMD 0x28 4

EDN csrng reseed command register

edn.GENERATE_CMD 0x2c 4

EDN csrng generate command register

edn.MAX_NUM_REQS_BETWEEN_RESEEDS 0x30 4

EDN maximum number of requests between reseeds register

edn.RECOV_ALERT_STS 0x34 4

Recoverable alert status register

edn.ERR_CODE 0x38 4

Hardware detection of fatal error conditions status register

edn.ERR_CODE_TEST 0x3c 4

Test error conditions register

edn.MAIN_SM_STATE 0x40 4

Main state machine state debug register

edn.INTR_STATE @ 0x0

Interrupt State Register

Reset default = 0x0, mask 0x3
31302928272625242322212019181716
 
1514131211109876543210
  edn_fatal_err edn_cmd_req_done
BitsTypeResetNameDescription
0rw1c0x0edn_cmd_req_done

Asserted when a software CSRNG request has completed.

1rw1c0x0edn_fatal_err

Asserted when a FIFO error occurs.


edn.INTR_ENABLE @ 0x4

Interrupt Enable Register

Reset default = 0x0, mask 0x3
31302928272625242322212019181716
 
1514131211109876543210
  edn_fatal_err edn_cmd_req_done
BitsTypeResetNameDescription
0rw0x0edn_cmd_req_done

Enable interrupt when INTR_STATE.edn_cmd_req_done is set.

1rw0x0edn_fatal_err

Enable interrupt when INTR_STATE.edn_fatal_err is set.


edn.INTR_TEST @ 0x8

Interrupt Test Register

Reset default = 0x0, mask 0x3
31302928272625242322212019181716
 
1514131211109876543210
  edn_fatal_err edn_cmd_req_done
BitsTypeResetNameDescription
0wo0x0edn_cmd_req_done

Write 1 to force INTR_STATE.edn_cmd_req_done to 1.

1wo0x0edn_fatal_err

Write 1 to force INTR_STATE.edn_fatal_err to 1.


edn.ALERT_TEST @ 0xc

Alert Test Register

Reset default = 0x0, mask 0x3
31302928272625242322212019181716
 
1514131211109876543210
  fatal_alert recov_alert
BitsTypeResetNameDescription
0wo0x0recov_alert

Write 1 to trigger one alert event of this kind.

1wo0x0fatal_alert

Write 1 to trigger one alert event of this kind.


edn.REGWEN @ 0x10

Register write enable for all control registers

Reset default = 0x1, mask 0x1
31302928272625242322212019181716
 
1514131211109876543210
  REGWEN
BitsTypeResetNameDescription
0rw0c0x1REGWEN

When true, the CTRL can be written by software. When false, this field read-only. Defaults true, write zero to clear. Note that this needs to be cleared after initial configuration at boot in order to lock in the listed register settings.


edn.CTRL @ 0x14

EDN control register

Reset default = 0x9999, mask 0xffff
Register enable = REGWEN
31302928272625242322212019181716
 
1514131211109876543210
CMD_FIFO_RST AUTO_REQ_MODE BOOT_REQ_MODE EDN_ENABLE
BitsTypeResetNameDescription
3:0rw0x9EDN_ENABLE

Setting this field to kMultiBitBool4True enables the EDN module. The modules of the entropy complex may only be enabled and disabled in a specific order, see Programmers Guide for details.

7:4rw0x9BOOT_REQ_MODE

Setting this field to kMultiBitBool4True will enable the feature where the EDN block will automatically send a boot-time request to the CSRNG application interface. The purpose of this feature is to request entropy as fast as possible after reset, and during chip boot-time.

11:8rw0x9AUTO_REQ_MODE

Setting this field to kMultiBitBool4True will enable the EDN block to automatically send another request to CSRNG application interface. It is assumed that a CSRNG instantiate command will be issued using the SW_CMD_REQ register interface. When this command has an command ack returned from CSRNG, a new generate command will be send out again without software intervention. It is expected that the generate command will be sent repeatedly so that a continuous supply of entropy can be delivered to the endpoints. Reseed commands will be sent on a programmable basic between generate commands. The GENERATE_CMD, RESEED_CMD, and MAX_NUM_REQS_BETWEEN_RESEEDS registers must set up before the SW_CMD_REQ register command is issued.

15:12rw0x9CMD_FIFO_RST

Setting this field to kMultiBitBool4True clears the two command FIFOs: the RESEED_CMD FIFO and the GENERATE_CMD FIFO. This field must be set to the reset state by software before any further commands can be issued to these FIFOs.


edn.BOOT_INS_CMD @ 0x18

EDN boot instantiate command register

Reset default = 0x901, mask 0xffffffff
31302928272625242322212019181716
BOOT_INS_CMD...
1514131211109876543210
...BOOT_INS_CMD
BitsTypeResetNameDescription
31:0rw0x901BOOT_INS_CMD

This field is used as the value for Instantiate command at boot time.


edn.BOOT_GEN_CMD @ 0x1c

EDN boot generate command register

Reset default = 0xfff003, mask 0xffffffff
31302928272625242322212019181716
BOOT_GEN_CMD...
1514131211109876543210
...BOOT_GEN_CMD
BitsTypeResetNameDescription
31:0rw0xfff003BOOT_GEN_CMD

This field is used as the value for generate command at boot time.


edn.SW_CMD_REQ @ 0x20

EDN csrng app command request register

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
SW_CMD_REQ...
1514131211109876543210
...SW_CMD_REQ
BitsTypeResetNameDescription
31:0woxSW_CMD_REQ

Any CSRNG action can be initiated by writing a CSRNG command to this register. The application interface must wait for the "ack" to return before issuing new commands. This interface is intended to be controlled solely by software.

If CTRL.AUTO_REQ_MODE is set, only the first instantiate command has any effect. After that command has been processed, writes to this register register will have no effect on operation. Note that CSRNG command format details can be found in the CSRNG documentation.


edn.SW_CMD_STS @ 0x24

EDN command status register

Reset default = 0x0, mask 0x3
31302928272625242322212019181716
 
1514131211109876543210
  CMD_STS CMD_RDY
BitsTypeResetNameDescription
0ro0x0CMD_RDY

This bit indicates when the command interface is ready to accept commands.

1ro0x0CMD_STS

This one bit field is the status code returned with the application command ack. It is updated each time a command ack is asserted on the CSRNG interface. 0b0: Request completed successfully 0b1: Request completed with an error


edn.RESEED_CMD @ 0x28

EDN csrng reseed command register

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
RESEED_CMD...
1514131211109876543210
...RESEED_CMD
BitsTypeResetNameDescription
31:0woxRESEED_CMD

Writing this register will fill a FIFO with up to 13 command words (32b words). This FIFO will be used to automatically send out a reseed command to the CSRNG application interface when in CTRL.AUTO_REQ_MODE. This command will be sent only after the MAX_NUM_REQS_BETWEEN_RESEEDS counter value has reached zero.

If more than 13 entires are written to the FIFO, the design will automatically generate a fatal alert.

Note that CSRNG command format details can be found in the CSRNG documentation.


edn.GENERATE_CMD @ 0x2c

EDN csrng generate command register

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
GENERATE_CMD...
1514131211109876543210
...GENERATE_CMD
BitsTypeResetNameDescription
31:0woxGENERATE_CMD

Writing this register will fill a FIFO with up to 13 command words (32b words). This FIFO will be used to automatically send out a generate command to the CSRNG appl interface when in CTRL.AUTO_REQ_MODE. This command will be sent only after receiving a command ack from the previous command.

If more than 13 entires are written to the FIFO, the design will automatically generate a fatal alert.

Note that CSRNG command format details can be found in the CSRNG documentation.


EDN maximum number of requests between reseeds register

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
MAX_NUM_REQS_BETWEEN_RESEEDS...
1514131211109876543210
...MAX_NUM_REQS_BETWEEN_RESEEDS
BitsTypeResetNameDescription
31:0rw0x0MAX_NUM_REQS_BETWEEN_RESEEDS

Setting this field will set the number of generate requests that can be made to CSRNG before a reseed request is made. This value only has meaning when in CTRL.AUTO_REQ_MODE. This register supports a maximum of 2^32 requests between reseeds. This register will be used by a counter that counts down, triggering an automatic reseed when it reaches zero.


edn.RECOV_ALERT_STS @ 0x34

Recoverable alert status register

Reset default = 0x0, mask 0x100f
31302928272625242322212019181716
 
1514131211109876543210
  EDN_BUS_CMP_ALERT   CMD_FIFO_RST_FIELD_ALERT AUTO_REQ_MODE_FIELD_ALERT BOOT_REQ_MODE_FIELD_ALERT EDN_ENABLE_FIELD_ALERT
BitsTypeResetNameDescription
0rw0c0x0EDN_ENABLE_FIELD_ALERT

This bit is set when the EDN_ENABLE field is set to an illegal value, something other than kMultiBitBool4True or kMultiBitBool4False. Writing a zero resets this status bit.

1rw0c0x0BOOT_REQ_MODE_FIELD_ALERT

This bit is set when the BOOT_REQ_MODE field is set to an illegal value, something other than kMultiBitBool4True or kMultiBitBool4False. Writing a zero resets this status bit.

2rw0c0x0AUTO_REQ_MODE_FIELD_ALERT

This bit is set when the CTRL.AUTO_REQ_MODE field is set to an illegal value, something other than kMultiBitBool4True or kMultiBitBool4False. Writing a zero resets this status bit.

3rw0c0x0CMD_FIFO_RST_FIELD_ALERT

This bit is set when the CMD_FIFO_RST field is set to an illegal value, something other than kMultiBitBool4True or kMultiBitBool4False. Writing a zero resets this status bit.

11:4Reserved
12rw0c0x0EDN_BUS_CMP_ALERT

This bit is set when the interal entropy bus value is equal to the prior valid value on the bus, indicating a possible attack. Writing a zero resets this status bit.


edn.ERR_CODE @ 0x38

Hardware detection of fatal error conditions status register

Reset default = 0x0, mask 0x70700007
31302928272625242322212019181716
  FIFO_STATE_ERR FIFO_READ_ERR FIFO_WRITE_ERR   EDN_CNTR_ERR EDN_MAIN_SM_ERR EDN_ACK_SM_ERR  
1514131211109876543210
  SFIFO_OUTPUT_ERR SFIFO_GENCMD_ERR SFIFO_RESCMD_ERR
BitsTypeResetNameDescription
0ro0x0SFIFO_RESCMD_ERR

This bit will be set to one when an error has been detected for the reseed command FIFO. The type of error is reflected in the type status bits (bits 28 through 30 of this register). When this bit is set, a fatal error condition will result.

1ro0x0SFIFO_GENCMD_ERR

This bit will be set to one when an error has been detected for the generate command FIFO. The type of error is reflected in the type status bits (bits 28 through 30 of this register). When this bit is set, a fatal error condition will result. This bit will stay set until the next reset.

2ro0x0SFIFO_OUTPUT_ERR

This bit will be set to one when an error has been detected for the output FIFO. The type of error is reflected in the type status bits (bits 28 through 30 of this register). When this bit is set, a fatal error condition will result.

19:3Reserved
20ro0x0EDN_ACK_SM_ERR

This bit will be set to one when an illegal state has been detected for the EDN ack stage state machine. This error will signal a fatal alert. This bit will stay set until the next reset.

21ro0x0EDN_MAIN_SM_ERR

This bit will be set to one when an illegal state has been detected for the EDN main stage state machine. This error will signal a fatal alert. This bit will stay set until the next reset.

22ro0x0EDN_CNTR_ERR

This bit will be set to one when a hardened counter has detected an error condition. This error will signal a fatal alert. This bit will stay set until the next reset.

27:23Reserved
28ro0x0FIFO_WRITE_ERR

This bit will be set to one when any of the source bits (bits 0 through 1 of this this register) are asserted as a result of an error pulse generated from any full FIFO that has been recieved a write pulse. This bit will stay set until the next reset.

29ro0x0FIFO_READ_ERR

This bit will be set to one when any of the source bits (bits 0 through 1 of this this register) are asserted as a result of an error pulse generated from any empty FIFO that has recieved a read pulse. This bit will stay set until the next reset.

30ro0x0FIFO_STATE_ERR

This bit will be set to one when any of the source bits (bits 0 through 1 of this this register) are asserted as a result of an error pulse generated from any FIFO where both the empty and full status bits are set. This bit will stay set until the next reset.


edn.ERR_CODE_TEST @ 0x3c

Test error conditions register

Reset default = 0x0, mask 0x1f
31302928272625242322212019181716
 
1514131211109876543210
  ERR_CODE_TEST
BitsTypeResetNameDescription
4:0rw0x0ERR_CODE_TEST

Setting this field will set the bit number for which an error will be forced in the hardware. This bit number is that same one found in the ERR_CODE register. The action of writing this register will force an error pulse. The sole purpose of this register is to test that any error properly propagates to either an interrupt or an alert.


edn.MAIN_SM_STATE @ 0x40

Main state machine state debug register

Reset default = 0x185, mask 0x1ff
31302928272625242322212019181716
 
1514131211109876543210
  MAIN_SM_STATE
BitsTypeResetNameDescription
8:0ro0x185MAIN_SM_STATE

This is the state of the EDN main state machine. See the RTL file edn_main_sm for the meaning of the values.