Registers

Summary of the regs interface’s registers

ALERT_TEST

Alert Test Register

• Offset: 0x0
• Reset default: 0x0
• Reset mask: 0x7

Fields

{"reg": [{"name": "fatal_prog_error", "bits": 1, "attr": ["wo"], "rotate": -90}, {"name": "fatal_state_error", "bits": 1, "attr": ["wo"], "rotate": -90}, {"name": "fatal_bus_integ_error", "bits": 1, "attr": ["wo"], "rotate": -90}, {"bits": 29}], "config": {"lanes": 1, "fontsize": 10, "vspace": 230}}

STATUS

life cycle status register. Note that all errors are terminal and require a reset cycle.

• Offset: 0x4
• Reset default: 0x0
• Reset mask: 0xfff

Fields

{"reg": [{"name": "INITIALIZED", "bits": 1, "attr": ["ro"], "rotate": -90}, {"name": "READY", "bits": 1, "attr": ["ro"], "rotate": -90}, {"name": "EXT_CLOCK_SWITCHED", "bits": 1, "attr": ["ro"], "rotate": -90}, {"name": "TRANSITION_SUCCESSFUL", "bits": 1, "attr": ["ro"], "rotate": -90}, {"name": "TRANSITION_COUNT_ERROR", "bits": 1, "attr": ["ro"], "rotate": -90}, {"name": "TRANSITION_ERROR", "bits": 1, "attr": ["ro"], "rotate": -90}, {"name": "TOKEN_ERROR", "bits": 1, "attr": ["ro"], "rotate": -90}, {"name": "FLASH_RMA_ERROR", "bits": 1, "attr": ["ro"], "rotate": -90}, {"name": "OTP_ERROR", "bits": 1, "attr": ["ro"], "rotate": -90}, {"name": "STATE_ERROR", "bits": 1, "attr": ["ro"], "rotate": -90}, {"name": "BUS_INTEG_ERROR", "bits": 1, "attr": ["ro"], "rotate": -90}, {"name": "OTP_PARTITION_ERROR", "bits": 1, "attr": ["ro"], "rotate": -90}, {"bits": 20}], "config": {"lanes": 1, "fontsize": 10, "vspace": 240}}

STATUS . OTP_PARTITION_ERROR

This bit is set to 1 if the life cycle partition in OTP is in error state. This bit is intended for production testing during the RAW life cycle state, where the OTP control and status registers are not accessible. This error does not trigger an alert in the life cycle controller.

STATUS . BUS_INTEG_ERROR

This bit is set to 1 if a fatal bus integrity fault is detected. This error triggers a fatal_bus_integ_error alert.

STATUS . STATE_ERROR

This bit is set to 1 if either the controller FSM state or the life cycle state is invalid or has been corrupted as part of a tampering attempt. This error will move the life cycle state automatically to INVALID and raise a fatal_state_error alert.

STATUS . OTP_ERROR

This bit is set to 1 if an error occurred during an OTP programming operation. This error will move the life cycle state automatically to POST_TRANSITION and raise a fatal_prog_error alert.

STATUS . FLASH_RMA_ERROR

This bit is set to 1 if flash failed to correctly respond to an RMA request. Note that each transition attempt increments the LC_TRANSITION_CNT and moves the life cycle state into POST_TRANSITION.

STATUS . TOKEN_ERROR

This bit is set to 1 if the token supplied for a conditional transition was invalid. Note that each transition attempt increments the LC_TRANSITION_CNT and moves the life cycle state into POST_TRANSITION.

STATUS . TRANSITION_ERROR

This bit is set to 1 if the last transition command requested an invalid state transition (e.g. DEV -> RAW). Note that each transition attempt increments the LC_TRANSITION_CNT and moves the life cycle state into POST_TRANSITION.

STATUS . TRANSITION_COUNT_ERROR

This bit is set to 1 if the LC_TRANSITION_CNT has reached its maximum. If this is the case, no more state transitions can be performed. Note that each transition attempt increments the LC_TRANSITION_CNT and moves the life cycle state into POST_TRANSITION.

STATUS . TRANSITION_SUCCESSFUL

This bit is set to 1 if the last life cycle transition request was successful. Note that each transition attempt increments the LC_TRANSITION_CNT and moves the life cycle state into POST_TRANSITION.

STATUS . EXT_CLOCK_SWITCHED

This bit is set to 1 if the clock manager has successfully switched to the external clock due to EXT_CLOCK_EN being set to 1.

STATUS . READY

This bit is set to 1 if the life cycle controller has successfully initialized and is ready to accept a life cycle transition command.

STATUS . INITIALIZED

This bit is set to 1 if the life cycle controller has successfully initialized and the state exposed in LC_STATE and LC_TRANSITION_CNT is valid.

CLAIM_TRANSITION_IF_REGWEN

Register write enable for the hardware mutex register.

• Offset: 0x8
• Reset default: 0x1
• Reset mask: 0x1

Fields

{"reg": [{"name": "CLAIM_TRANSITION_IF_REGWEN", "bits": 1, "attr": ["rw0c"], "rotate": -90}, {"bits": 31}], "config": {"lanes": 1, "fontsize": 10, "vspace": 280}}

CLAIM_TRANSITION_IF

Hardware mutex to claim exclusive access to the transition interface.

• Offset: 0xc
• Reset default: 0x69
• Reset mask: 0xff
• Register enable: CLAIM_TRANSITION_IF_REGWEN

Fields

{"reg": [{"name": "MUTEX", "bits": 8, "attr": ["rw"], "rotate": 0}, {"bits": 24}], "config": {"lanes": 1, "fontsize": 10, "vspace": 80}}

CLAIM_TRANSITION_IF . MUTEX

In order to have exclusive access to the transition interface, SW must first claim the associated hardware mutex by writing kMultiBitBool8True to this register. If the register reads back kMultiBitBool8True, the mutex claim has been successful, and TRANSITION_REGWEN will be set automatically to 1 by HW. Write 0 to this register in order to release the HW mutex.

TRANSITION_REGWEN

Register write enable for all transition interface registers.

• Offset: 0x10
• Reset default: 0x0
• Reset mask: 0x1

Fields

{"reg": [{"name": "TRANSITION_REGWEN", "bits": 1, "attr": ["ro"], "rotate": -90}, {"bits": 31}], "config": {"lanes": 1, "fontsize": 10, "vspace": 190}}

TRANSITION_REGWEN . TRANSITION_REGWEN

This bit is hardware-managed and only readable by software. By default, this bit is set to 0 by hardware. Once SW has claimed the CLAIM_TRANSITION_IF mutex, this bit will be set to 1. Note that the life cycle controller sets this bit temporarily to 0 while executing a life cycle state transition.

TRANSITION_CMD

Command register for state transition requests.

• Offset: 0x14
• Reset default: 0x0
• Reset mask: 0x1
• Register enable: TRANSITION_REGWEN

Fields

{"reg": [{"name": "START", "bits": 1, "attr": ["r0w1c"], "rotate": -90}, {"bits": 31}], "config": {"lanes": 1, "fontsize": 10, "vspace": 80}}

TRANSITION_CMD . START

Writing a 1 to this register initiates the life cycle state transition to the state specified in TRANSITION_TARGET. Note that not all transitions are possible, and certain conditional transitions require an additional TRANSITION_TOKEN_0. In order to have exclusive access to this register, SW must first claim the associated hardware mutex via CLAIM_TRANSITION_IF.

TRANSITION_CTRL

Control register for state transition requests.

• Offset: 0x18
• Reset default: 0x0
• Reset mask: 0x3
• Register enable: TRANSITION_REGWEN

Fields

{"reg": [{"name": "EXT_CLOCK_EN", "bits": 1, "attr": ["rw1s"], "rotate": -90}, {"name": "VOLATILE_RAW_UNLOCK", "bits": 1, "attr": ["rw"], "rotate": -90}, {"bits": 30}], "config": {"lanes": 1, "fontsize": 10, "vspace": 210}}

TRANSITION_CTRL . VOLATILE_RAW_UNLOCK

When set to 1, LC_CTRL performs a volatile lifecycle transition from RAW -> TEST_UNLOCKED0. No state update will be written to OTP, and no reset will be needed after the transition has succeeded. Note that the token to be provided has to be the hashed unlock token, since in this case the token is NOT passed through KMAC before performing the comparison.

After a successful VOLATILE_RAW_UNLOCK transition from RAW -> TEST_UNLOCKED0, the LC_CTRL FSM will go back to the IdleSt and set the STATUS.TRANSITION_SUCCESSFUL bit. The LC_CTRL accepts further transition commands in this state.

IMPORTANT NOTE: this feature is intended for test chips only in order to mitigate the risks of a malfunctioning OTP macro. Production devices will permanently disable this feature at compile time via the SecVolatileRawUnlockEn parameter.

Software can check whether VOLATILE_RAW_UNLOCK is available by writing 1 and reading back the register value. If the register reads back as 1 the mechanism is available, and if it reads back 0 it is not.

TRANSITION_CTRL . EXT_CLOCK_EN

When set to 1, the OTP clock will be switched to an externally supplied clock right away when the device is in a non-PROD life cycle state. The clock mux will remain switched until the next system reset.

TRANSITION_TOKEN

128bit token for conditional transitions. Make sure to set this to 0 for unconditional transitions. Note that this register is shared with the life cycle TAP/DMI interface. In order to have exclusive access to this register, SW must first claim the associated hardware mutex via CLAIM_TRANSITION_IF.

• Reset default: 0x0
• Reset mask: 0xffffffff

Instances

Fields

{"reg": [{"name": "TRANSITION_TOKEN", "bits": 32, "attr": ["rw"], "rotate": 0}], "config": {"lanes": 1, "fontsize": 10, "vspace": 80}}

TRANSITION_TARGET

This register exposes the decoded life cycle state.

• Offset: 0x2c
• Reset default: 0x0
• Reset mask: 0x3fffffff
• Register enable: TRANSITION_REGWEN

Fields

{"reg": [{"name": "STATE", "bits": 30, "attr": ["rw"], "rotate": 0}, {"bits": 2}], "config": {"lanes": 1, "fontsize": 10, "vspace": 80}}

TRANSITION_TARGET . STATE

This field encodes the target life cycle state in a redundant enum format. The 5bit state enum is repeated 6x so that it fills the entire 32bit register. The encoding is straightforward replication: [val, val, val, val, val, val].

Note that this register is shared with the life cycle TAP/DMI interface. In order to have exclusive access to this register, SW must first claim the associated hardware mutex via CLAIM_TRANSITION_IF.

Other values are reserved.

OTP_VENDOR_TEST_CTRL

Test/vendor-specific settings for the OTP macro wrapper. These values are only active during RAW, TEST_* and RMA life cycle states. In all other states, these values will be gated to zero before sending them to the OTP macro wrapper - even if this register is programmed to a non-zero value.

• Offset: 0x30
• Reset default: 0x0
• Reset mask: 0xffffffff
• Register enable: TRANSITION_REGWEN

Fields

{"reg": [{"name": "OTP_VENDOR_TEST_CTRL", "bits": 32, "attr": ["rw"], "rotate": 0}], "config": {"lanes": 1, "fontsize": 10, "vspace": 80}}

OTP_VENDOR_TEST_STATUS

Test/vendor-specific settings for the OTP macro wrapper. These values are only active during RAW, TEST_* and RMA life cycle states. In all other states, these values will read as zero.

• Offset: 0x34
• Reset default: 0x0
• Reset mask: 0xffffffff

Fields

{"reg": [{"name": "OTP_VENDOR_TEST_STATUS", "bits": 32, "attr": ["ro"], "rotate": 0}], "config": {"lanes": 1, "fontsize": 10, "vspace": 80}}

LC_STATE

This register exposes the decoded life cycle state.

• Offset: 0x38
• Reset default: 0x0
• Reset mask: 0x3fffffff

Fields

{"reg": [{"name": "STATE", "bits": 30, "attr": ["ro"], "rotate": 0}, {"bits": 2}], "config": {"lanes": 1, "fontsize": 10, "vspace": 80}}

LC_STATE . STATE

This field exposes the decoded life cycle state in a redundant enum format. The 5bit state enum is repeated 6x so that it fills the entire 32bit register. The encoding is straightforward replication: [val, val, val, val, val, val].

Other values are reserved.

LC_TRANSITION_CNT

This register exposes the state of the decoded life cycle transition counter.

• Offset: 0x3c
• Reset default: 0x0
• Reset mask: 0x1f

Fields

{"reg": [{"name": "CNT", "bits": 5, "attr": ["ro"], "rotate": 0}, {"bits": 27}], "config": {"lanes": 1, "fontsize": 10, "vspace": 80}}

LC_TRANSITION_CNT . CNT

Number of total life cycle state transition attempts. The life cycle controller allows up to 24 transition attempts. If this counter is equal to 24, the LC_STATE is considered to be invalid and will read as SCRAP.

If the counter state is invalid, or the life cycle controller is in the post-transition state, the counter will have the value 31 (i.e., all counter bits will be set).

LC_ID_STATE

This register exposes the id state of the device.

• Offset: 0x40
• Reset default: 0x0
• Reset mask: 0xffffffff

Fields

{"reg": [{"name": "STATE", "bits": 32, "attr": ["ro"], "rotate": 0}], "config": {"lanes": 1, "fontsize": 10, "vspace": 80}}

LC_ID_STATE . STATE

This field exposes the id state in redundant enum format. The 2bit id state enum is repeated 16x so that it fills the entire 32bit register. The encoding is straightforward replication: [val, val, … val].“

Other values are reserved.

HW_REVISION0

This register holds the SILICON_CREATOR_ID and the PRODUCT_ID.

• Offset: 0x44
• Reset default: 0x0
• Reset mask: 0xffffffff

Fields

{"reg": [{"name": "PRODUCT_ID", "bits": 16, "attr": ["ro"], "rotate": 0}, {"name": "SILICON_CREATOR_ID", "bits": 16, "attr": ["ro"], "rotate": 0}], "config": {"lanes": 1, "fontsize": 10, "vspace": 80}}

HW_REVISION0 . SILICON_CREATOR_ID

ID of the silicon creator. Assigned by the OpenTitan project. Zero is an invalid value. The encoding must follow the following range constraints:

0x0000: invalid value 0x0001 - 0x3FFF: reserved for use in the open-source OpenTitan project 0x4000 - 0x7FFF: reserved for real integrations of OpenTitan 0x8000 - 0xFFFF: reserved for future use

HW_REVISION0 . PRODUCT_ID

Used to identify a class of devices. Assigned by the Silicon Creator. Zero is an invalid value. The encoding must follow the following range constraints:

0x0000: invalid value 0x0001 - 0x3FFF: reserved for discrete chip products 0x4000 - 0x7FFF: reserved for integrated IP products 0x8000 - 0xFFFF: reserved for future use

HW_REVISION1

This register holds the REVISION_ID.

• Offset: 0x48
• Reset default: 0x0
• Reset mask: 0xffffffff

Fields

{"reg": [{"name": "REVISION_ID", "bits": 8, "attr": ["ro"], "rotate": 0}, {"name": "RESERVED", "bits": 24, "attr": ["ro"], "rotate": 0}], "config": {"lanes": 1, "fontsize": 10, "vspace": 80}}

HW_REVISION1 . RESERVED

Reserved bits. Set to zero.

HW_REVISION1 . REVISION_ID

Product revision ID. Assigned by the Silicon Creator. The encoding is not specified other than that different tapeouts must be assigned different revision numbers. I.e., each base or metal layer respin must be reflected so that software can rely on it to modify firmware and driver behavior. Zero is an invalid value.

DEVICE_ID

This is the 256bit DEVICE_ID value that is stored in the HW_CFG0 partition in OTP. If this register reads all-one, the HW_CFG0 partition has not been initialized yet or is in error state. If this register reads all-zero, this is indicative that the value has not been programmed to OTP yet.

• Reset default: 0x0
• Reset mask: 0xffffffff

Instances

Fields

{"reg": [{"name": "DEVICE_ID", "bits": 32, "attr": ["ro"], "rotate": 0}], "config": {"lanes": 1, "fontsize": 10, "vspace": 80}}

MANUF_STATE

This is a 256bit field used for keeping track of the manufacturing state.

• Reset default: 0x0
• Reset mask: 0xffffffff

Instances

Fields

{"reg": [{"name": "MANUF_STATE", "bits": 32, "attr": ["ro"], "rotate": 0}], "config": {"lanes": 1, "fontsize": 10, "vspace": 80}}

Summary of the dmi interface’s registers

dmi

Access window to lc_ctrl CSRs and .

• Word Aligned Offset Range: 0x0to0xffc
• Size (words): 1024
• Access: rw
• Byte writes are not supported.