Hardware Interfaces

Referring to the Comportable guideline for peripheral device functionality, the module otp_ctrl has the following hardware interfaces defined

Primary Clock: clk_i
Other Clocks: clk_edn_i
Bus Device Interfaces (TL-UL): core_tl, prim_tl
Bus Host Interfaces (TL-UL): none

Peripheral Pins for Chip IO

Pin name	Direction	Description
test[7:0]	output	Test-related GPIOs. Only active in DFT-enabled life cycle states.

Inter-Module Signals

Port Name	Package::Struct	Type	Act	Width	Description
otp_ext_voltage_h		io	none	1
otp_ast_pwr_seq	otp_ctrl_pkg::otp_ast_req	uni	req	1	Power sequencing signals to AST (VDD domain).
otp_ast_pwr_seq_h	otp_ctrl_pkg::otp_ast_rsp	uni	rcv	1	Power sequencing signals coming from AST (VCC domain).
edn	edn_pkg::edn	req_rsp	req	1	Entropy request to the entropy distribution network for LFSR reseeding and ephemeral key derivation.
pwr_otp	pwrmgr_pkg::pwr_otp	req_rsp	rsp	1	Initialization request/acknowledge from/to power manager.
lc_otp_vendor_test	otp_ctrl_pkg::lc_otp_vendor_test	req_rsp	rsp	1	Vendor test control signals from/to the life cycle TAP.
lc_otp_program	otp_ctrl_pkg::lc_otp_program	req_rsp	rsp	1	Life cycle state transition interface.
otp_lc_data	otp_ctrl_pkg::otp_lc_data	uni	req	1	Life cycle state output holding the current life cycle state, the value of the transition counter and the tokens needed for life cycle transitions.
lc_escalate_en	lc_ctrl_pkg::lc_tx	uni	rcv	1	Life cycle escalation enable coming from life cycle controller. This signal moves all FSMs within OTP into the error state.
lc_creator_seed_sw_rw_en	lc_ctrl_pkg::lc_tx	uni	rcv	1	Provision enable qualifier coming from life cycle controller. This signal enables SW read / write access to the RMA_TOKEN and CREATOR_ROOT_KEY_SHARE0 and CREATOR_ROOT_KEY_SHARE1.
lc_seed_hw_rd_en	lc_ctrl_pkg::lc_tx	uni	rcv	1	Seed read enable coming from life cycle controller. This signal enables HW read access to the CREATOR_ROOT_KEY_SHARE0 and CREATOR_ROOT_KEY_SHARE1.
lc_dft_en	lc_ctrl_pkg::lc_tx	uni	rcv	1	Test enable qualifier coming from life cycle controller. This signals enables the TL-UL access port to the proprietary OTP IP.
lc_check_byp_en	lc_ctrl_pkg::lc_tx	uni	rcv	1	Life cycle partition check bypass signal. This signal causes the life cycle partition to bypass consistency checks during life cycle state transitions in order to prevent spurious consistency check failures.
otp_keymgr_key	otp_ctrl_pkg::otp_keymgr_key	uni	req	1	Key output to the key manager holding CREATOR_ROOT_KEY_SHARE0 and CREATOR_ROOT_KEY_SHARE1.
flash_otp_key	otp_ctrl_pkg::flash_otp_key	req_rsp	rsp	1	Key derivation interface for FLASH scrambling.
sram_otp_key	otp_ctrl_pkg::sram_otp_key	req_rsp	rsp	3	Array with key derivation interfaces for SRAM scrambling devices.
otbn_otp_key	otp_ctrl_pkg::otbn_otp_key	req_rsp	rsp	1	Key derivation interface for OTBN scrambling devices.
otp_hw_cfg	otp_ctrl_part_pkg::otp_hw_cfg	uni	req	1	Output of the HW_CFG partition.
obs_ctrl	ast_pkg::ast_obs_ctrl	uni	rcv	1	AST observability control signals.
otp_obs	logic	uni	req	8	AST observability bus.
core_tl	tlul_pkg::tl	req_rsp	rsp	1
prim_tl	tlul_pkg::tl	req_rsp	rsp	1

Interrupts

Interrupt Name	Type	Description
otp_operation_done	Event	A direct access command or digest calculation operation has completed.
otp_error	Event	An error has occurred in the OTP controller. Check the `ERR_CODE` register to get more information.

Security Alerts

Alert Name	Description
fatal_macro_error	This alert triggers if hardware detects an uncorrectable error during an OTP transaction, for example an uncorrectable ECC error in the OTP array.
fatal_check_error	This alert triggers if any of the background checks fails. This includes the digest checks and concurrent ECC checks in the buffer registers.
fatal_bus_integ_error	This fatal alert is triggered when a fatal TL-UL bus integrity fault is detected.
fatal_prim_otp_alert	Fatal alert triggered inside the OTP primitive, including fatal TL-UL bus integrity faults of the test interface.
recov_prim_otp_alert	Recoverable alert triggered inside the OTP primitive.

Security Countermeasures

Countermeasure ID	Description
OTP_CTRL.BUS.INTEGRITY	End-to-end bus integrity scheme.
OTP_CTRL.SECRET.MEM.SCRAMBLE	Secret partitions are scrambled with a full-round PRESENT cipher.
OTP_CTRL.PART.MEM.DIGEST	Integrity of buffered partitions is ensured via a 64bit digest.
OTP_CTRL.DAI.FSM.SPARSE	The direct access interface FSM is sparsely encoded.
OTP_CTRL.KDI.FSM.SPARSE	The key derivation interface FSM is sparsely encoded.
OTP_CTRL.LCI.FSM.SPARSE	The life cycle interface FSM is sparsely encoded.
OTP_CTRL.PART.FSM.SPARSE	The partition FSMs are sparsely encoded.
OTP_CTRL.SCRMBL.FSM.SPARSE	The scramble datapath FSM is sparsely encoded.
OTP_CTRL.TIMER.FSM.SPARSE	The background check timer FSM is sparsely encoded.
OTP_CTRL.DAI.CTR.REDUN	The direct access interface address counter employs a cross-counter implementation.
OTP_CTRL.KDI_SEED.CTR.REDUN	The key derivation interface counter employs a cross-counter implementation.
OTP_CTRL.KDI_ENTROPY.CTR.REDUN	The key derivation entropy counter employs a cross-counter implementation.
OTP_CTRL.LCI.CTR.REDUN	The life cycle interface address counter employs a cross-counter implementation.
OTP_CTRL.PART.CTR.REDUN	The address counter of buffered partitions employs a cross-counter implementation.
OTP_CTRL.SCRMBL.CTR.REDUN	The srambling datapath counter employs a cross-counter implementation.
OTP_CTRL.TIMER_INTEG.CTR.REDUN	The background integrity check timer employs a duplicated counter implementation.
OTP_CTRL.TIMER_CNSTY.CTR.REDUN	The background consistency check timer employs a duplicated counter implementation.
OTP_CTRL.TIMER.LFSR.REDUN	The background check LFSR is duplicated.
OTP_CTRL.DAI.FSM.LOCAL_ESC	The direct access interface FSM is moved into an invalid state upon local escalation.
OTP_CTRL.LCI.FSM.LOCAL_ESC	The life cycle interface FSM is moved into an invalid state upon local escalation.
OTP_CTRL.KDI.FSM.LOCAL_ESC	The key derivation interface FSM is moved into an invalid state upon local escalation.
OTP_CTRL.PART.FSM.LOCAL_ESC	The partition FSMs are moved into an invalid state upon local escalation.
OTP_CTRL.SCRMBL.FSM.LOCAL_ESC	The scramble datapath FSM is moved into an invalid state upon local escalation.
OTP_CTRL.TIMER.FSM.LOCAL_ESC	The background check timer FSM is moved into an invalid state upon local escalation.
OTP_CTRL.DAI.FSM.GLOBAL_ESC	The direct access interface FSM is moved into an invalid state upon global escalation via life cycle.
OTP_CTRL.LCI.FSM.GLOBAL_ESC	The life cycle interface FSM is moved into an invalid state upon global escalation via life cycle.
OTP_CTRL.KDI.FSM.GLOBAL_ESC	The key derivation interface FSM is moved into an invalid state upon global escalation via life cycle.
OTP_CTRL.PART.FSM.GLOBAL_ESC	The partition FSMs are moved into an invalid state upon global escalation via life cycle.
OTP_CTRL.SCRMBL.FSM.GLOBAL_ESC	The scramble datapath FSM is moved into an invalid state upon global escalation via life cycle.
OTP_CTRL.TIMER.FSM.GLOBAL_ESC	The background check timer FSM is moved into an invalid state upon global escalation via life cycle.
OTP_CTRL.PART.DATA_REG.INTEGRITY	All partition buffer registers are protected with ECC on 64bit blocks.
OTP_CTRL.PART.DATA_REG.BKGN_CHK	The digest of buffered partitions is recomputed and checked at pseudorandom intervals in the background.
OTP_CTRL.PART.MEM.REGREN	Unbuffered (‘software’) partitions can be read-locked via a CSR until the next system reset.
OTP_CTRL.PART.MEM.SW_UNREADABLE	Secret buffered partitions become unreadable to software once they are locked via the digest.
OTP_CTRL.PART.MEM.SW_UNWRITABLE	All partitions become unwritable by software once they are locked via the digest.
OTP_CTRL.LC_PART.MEM.SW_NOACCESS	The life cycle partition is not directly readable nor writable via software.
OTP_CTRL.ACCESS.CTRL.MUBI	The access control signals going from the partitions to the DAI are MUBI encoded.
OTP_CTRL.TOKEN_VALID.CTRL.MUBI	The token valid signals going to the life cycle controller are MUBI encoded.
OTP_CTRL.LC_CTRL.INTERSIG.MUBI	The life cycle control signals are multibit encoded.
OTP_CTRL.TEST.BUS.LC_GATED	Prevent access to test signals and the OTP backdoor interface in non-test lifecycle states.
OTP_CTRL.TEST_TL_LC_GATE.FSM.SPARSE	The control FSM inside the TL-UL gating primitive is sparsely encoded.
OTP_CTRL.DIRECT_ACCESS.CONFIG.REGWEN	The direct access CSRs are REGWEN protected.
OTP_CTRL.CHECK_TRIGGER.CONFIG.REGWEN	The check trigger CSR is REGWEN protected.
OTP_CTRL.CHECK.CONFIG.REGWEN	The check CSR is REGWEN protected.
OTP_CTRL.MACRO.MEM.INTEGRITY	The OTP macro employs a vendor-specific integrity scheme at the granularity of the native 16bit OTP words. The scheme is able to at least detect single bit errors.
OTP_CTRL.MACRO.MEM.CM	The OTP macro may contain additional vendor-specific countermeasures.

Registers

Summary of the `core` interface’s registers

Name	Offset	Length	Description
otp_ctrl.`INTR_STATE`	0x0	4	Interrupt State Register
otp_ctrl.`INTR_ENABLE`	0x4	4	Interrupt Enable Register
otp_ctrl.`INTR_TEST`	0x8	4	Interrupt Test Register
otp_ctrl.`ALERT_TEST`	0xc	4	Alert Test Register
otp_ctrl.`STATUS`	0x10	4	OTP status register.
otp_ctrl.`ERR_CODE`	0x14	4	This register holds information about error conditions that occurred in the agents
otp_ctrl.`DIRECT_ACCESS_REGWEN`	0x18	4	Register write enable for all direct access interface registers.
otp_ctrl.`DIRECT_ACCESS_CMD`	0x1c	4	Command register for direct accesses.
otp_ctrl.`DIRECT_ACCESS_ADDRESS`	0x20	4	Address register for direct accesses.
otp_ctrl.`DIRECT_ACCESS_WDATA_0`	0x24	4	Write data for direct accesses.
otp_ctrl.`DIRECT_ACCESS_WDATA_1`	0x28	4	Write data for direct accesses.
otp_ctrl.`DIRECT_ACCESS_RDATA_0`	0x2c	4	Read data for direct accesses.
otp_ctrl.`DIRECT_ACCESS_RDATA_1`	0x30	4	Read data for direct accesses.
otp_ctrl.`CHECK_TRIGGER_REGWEN`	0x34	4	Register write enable for !!CHECK_TRIGGER.
otp_ctrl.`CHECK_TRIGGER`	0x38	4	Command register for direct accesses.
otp_ctrl.`CHECK_REGWEN`	0x3c	4	Register write enable for !!INTEGRITY_CHECK_PERIOD and !!CONSISTENCY_CHECK_PERIOD.
otp_ctrl.`CHECK_TIMEOUT`	0x40	4	Timeout value for the integrity and consistency checks.
otp_ctrl.`INTEGRITY_CHECK_PERIOD`	0x44	4	This value specifies the maximum period that can be generated pseudo-randomly.
otp_ctrl.`CONSISTENCY_CHECK_PERIOD`	0x48	4	This value specifies the maximum period that can be generated pseudo-randomly.
otp_ctrl.`VENDOR_TEST_READ_LOCK`	0x4c	4	Runtime read lock for the VENDOR_TEST partition.
otp_ctrl.`CREATOR_SW_CFG_READ_LOCK`	0x50	4	Runtime read lock for the CREATOR_SW_CFG partition.
otp_ctrl.`OWNER_SW_CFG_READ_LOCK`	0x54	4	Runtime read lock for the OWNER_SW_CFG partition.
otp_ctrl.`VENDOR_TEST_DIGEST_0`	0x58	4	Integrity digest for the VENDOR_TEST partition.
otp_ctrl.`VENDOR_TEST_DIGEST_1`	0x5c	4	Integrity digest for the VENDOR_TEST partition.
otp_ctrl.`CREATOR_SW_CFG_DIGEST_0`	0x60	4	Integrity digest for the CREATOR_SW_CFG partition.
otp_ctrl.`CREATOR_SW_CFG_DIGEST_1`	0x64	4	Integrity digest for the CREATOR_SW_CFG partition.
otp_ctrl.`OWNER_SW_CFG_DIGEST_0`	0x68	4	Integrity digest for the OWNER_SW_CFG partition.
otp_ctrl.`OWNER_SW_CFG_DIGEST_1`	0x6c	4	Integrity digest for the OWNER_SW_CFG partition.
otp_ctrl.`HW_CFG_DIGEST_0`	0x70	4	Integrity digest for the HW_CFG partition.
otp_ctrl.`HW_CFG_DIGEST_1`	0x74	4	Integrity digest for the HW_CFG partition.
otp_ctrl.`SECRET0_DIGEST_0`	0x78	4	Integrity digest for the SECRET0 partition.
otp_ctrl.`SECRET0_DIGEST_1`	0x7c	4	Integrity digest for the SECRET0 partition.
otp_ctrl.`SECRET1_DIGEST_0`	0x80	4	Integrity digest for the SECRET1 partition.
otp_ctrl.`SECRET1_DIGEST_1`	0x84	4	Integrity digest for the SECRET1 partition.
otp_ctrl.`SECRET2_DIGEST_0`	0x88	4	Integrity digest for the SECRET2 partition.
otp_ctrl.`SECRET2_DIGEST_1`	0x8c	4	Integrity digest for the SECRET2 partition.
otp_ctrl.`SW_CFG_WINDOW`	0x1000	2048	Any read to this window directly maps to the corresponding offset in the creator and owner software

INTR_STATE

Interrupt State Register

Offset: 0x0
Reset default: 0x0
Reset mask: 0x3

Fields

Bits	Type	Reset	Name	Description
31:2				Reserved
1	rw1c	0x0	otp_error	An error has occurred in the OTP controller. Check the `ERR_CODE` register to get more information.
0	rw1c	0x0	otp_operation_done	A direct access command or digest calculation operation has completed.

INTR_ENABLE

Interrupt Enable Register

Offset: 0x4
Reset default: 0x0
Reset mask: 0x3

Fields

Bits	Type	Reset	Name	Description
31:2				Reserved
1	rw	0x0	otp_error	Enable interrupt when `INTR_STATE.otp_error` is set.
0	rw	0x0	otp_operation_done	Enable interrupt when `INTR_STATE.otp_operation_done` is set.

INTR_TEST

Interrupt Test Register

Offset: 0x8
Reset default: 0x0
Reset mask: 0x3

Fields

Bits	Type	Reset	Name	Description
31:2				Reserved
1	wo	0x0	otp_error	Write 1 to force `INTR_STATE.otp_error` to 1.
0	wo	0x0	otp_operation_done	Write 1 to force `INTR_STATE.otp_operation_done` to 1.

ALERT_TEST

Alert Test Register

Offset: 0xc
Reset default: 0x0
Reset mask: 0x1f

Fields

Bits	Type	Reset	Name	Description
31:5				Reserved
4	wo	0x0	recov_prim_otp_alert	Write 1 to trigger one alert event of this kind.
3	wo	0x0	fatal_prim_otp_alert	Write 1 to trigger one alert event of this kind.
2	wo	0x0	fatal_bus_integ_error	Write 1 to trigger one alert event of this kind.
1	wo	0x0	fatal_check_error	Write 1 to trigger one alert event of this kind.
0	wo	0x0	fatal_macro_error	Write 1 to trigger one alert event of this kind.

STATUS

OTP status register.

Offset: 0x10
Reset default: 0x0
Reset mask: 0x1ffff

Fields

Bits	Type	Reset	Name	Description
31:17				Reserved
16	ro	0x0	CHECK_PENDING	Set to 1 if an integrity or consistency check triggered by the LFSR timer or via `CHECK_TRIGGER` is pending.
15	ro	0x0	DAI_IDLE	Set to 1 if the DAI is idle and ready to accept commands.
14	ro	0x0	BUS_INTEG_ERROR	This bit is set to 1 if a fatal bus integrity fault is detected. This error triggers a fatal_bus_integ_error alert.
13	ro	0x0	KEY_DERIV_FSM_ERROR	Set to 1 if the key derivation FSM has reached an invalid state. This raises an fatal_check_error alert and is an unrecoverable error condition.
12	ro	0x0	SCRAMBLING_FSM_ERROR	Set to 1 if the scrambling datapath FSM has reached an invalid state. This raises an fatal_check_error alert and is an unrecoverable error condition.
11	ro	0x0	LFSR_FSM_ERROR	Set to 1 if the LFSR timer FSM has reached an invalid state. This raises an fatal_check_error alert and is an unrecoverable error condition.
10	ro	0x0	TIMEOUT_ERROR	Set to 1 if an integrity or consistency check times out. This raises an fatal_check_error alert and is an unrecoverable error condition.
9	ro	0x0	LCI_ERROR	Set to 1 if an error occurred in the LCI. If set to 1, SW should check the `ERR_CODE` register at the corresponding index.
8	ro	0x0	DAI_ERROR	Set to 1 if an error occurred in the DAI. If set to 1, SW should check the `ERR_CODE` register at the corresponding index.
7	ro	0x0	LIFE_CYCLE_ERROR	Set to 1 if an error occurred in this partition. If set to 1, SW should check the `ERR_CODE` register at the corresponding index.
6	ro	0x0	SECRET2_ERROR	Set to 1 if an error occurred in this partition. If set to 1, SW should check the `ERR_CODE` register at the corresponding index.
5	ro	0x0	SECRET1_ERROR	Set to 1 if an error occurred in this partition. If set to 1, SW should check the `ERR_CODE` register at the corresponding index.
4	ro	0x0	SECRET0_ERROR	Set to 1 if an error occurred in this partition. If set to 1, SW should check the `ERR_CODE` register at the corresponding index.
3	ro	0x0	HW_CFG_ERROR	Set to 1 if an error occurred in this partition. If set to 1, SW should check the `ERR_CODE` register at the corresponding index.
2	ro	0x0	OWNER_SW_CFG_ERROR	Set to 1 if an error occurred in this partition. If set to 1, SW should check the `ERR_CODE` register at the corresponding index.
1	ro	0x0	CREATOR_SW_CFG_ERROR	Set to 1 if an error occurred in this partition. If set to 1, SW should check the `ERR_CODE` register at the corresponding index.
0	ro	0x0	VENDOR_TEST_ERROR	Set to 1 if an error occurred in this partition. If set to 1, SW should check the `ERR_CODE` register at the corresponding index.

This register holds information about error conditions that occurred in the agents interacting with the OTP macro via the internal bus. The error codes should be checked if the partitions, DAI or LCI flag an error in the STATUS register, or when an INTR_STATE.otp_error has been triggered. Note that all errors trigger an otp_error interrupt, and in addition some errors may trigger either an fatal_macro_error or an fatal_check_error alert.

Offset: 0x14
Reset default: 0x0
Reset mask: 0x3fffffff

Fields

Bits	Type	Reset	Name
31:30			Reserved
29:27	ro	0x0	ERR_CODE_9
26:24	ro	0x0	ERR_CODE_8
23:21	ro	0x0	ERR_CODE_7
20:18	ro	0x0	ERR_CODE_6
17:15	ro	0x0	ERR_CODE_5
14:12	ro	0x0	ERR_CODE_4
11:9	ro	0x0	ERR_CODE_3
8:6	ro	0x0	ERR_CODE_2
5:3	ro	0x0	ERR_CODE_1
2:0	ro	0x0	ERR_CODE_0

ERR_CODE . ERR_CODE_9

Value	Name	Description
0x0	NO_ERROR	No error condition has occurred.
0x1	MACRO_ERROR	Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.
0x2	MACRO_ECC_CORR_ERROR	A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.
0x3	MACRO_ECC_UNCORR_ERROR	An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.
0x4	MACRO_WRITE_BLANK_ERROR	This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command. Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check). It is important that SW ensures that each word is only written once, since this can render the device useless.
0x5	ACCESS_ERROR	This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.
0x6	CHECK_FAIL_ERROR	An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.
0x7	FSM_STATE_ERROR	The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

ERR_CODE . ERR_CODE_8

Value	Name	Description
0x0	NO_ERROR	No error condition has occurred.
0x1	MACRO_ERROR	Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.
0x2	MACRO_ECC_CORR_ERROR	A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.
0x3	MACRO_ECC_UNCORR_ERROR	An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.
0x4	MACRO_WRITE_BLANK_ERROR	This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command. Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check). It is important that SW ensures that each word is only written once, since this can render the device useless.
0x5	ACCESS_ERROR	This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.
0x6	CHECK_FAIL_ERROR	An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.
0x7	FSM_STATE_ERROR	The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

ERR_CODE . ERR_CODE_7

Value	Name	Description
0x0	NO_ERROR	No error condition has occurred.
0x1	MACRO_ERROR	Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.
0x2	MACRO_ECC_CORR_ERROR	A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.
0x3	MACRO_ECC_UNCORR_ERROR	An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.
0x4	MACRO_WRITE_BLANK_ERROR	This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command. Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check). It is important that SW ensures that each word is only written once, since this can render the device useless.
0x5	ACCESS_ERROR	This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.
0x6	CHECK_FAIL_ERROR	An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.
0x7	FSM_STATE_ERROR	The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

ERR_CODE . ERR_CODE_6

Value	Name	Description
0x0	NO_ERROR	No error condition has occurred.
0x1	MACRO_ERROR	Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.
0x2	MACRO_ECC_CORR_ERROR	A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.
0x3	MACRO_ECC_UNCORR_ERROR	An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.
0x4	MACRO_WRITE_BLANK_ERROR	This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command. Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check). It is important that SW ensures that each word is only written once, since this can render the device useless.
0x5	ACCESS_ERROR	This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.
0x6	CHECK_FAIL_ERROR	An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.
0x7	FSM_STATE_ERROR	The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

ERR_CODE . ERR_CODE_5

Value	Name	Description
0x0	NO_ERROR	No error condition has occurred.
0x1	MACRO_ERROR	Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.
0x2	MACRO_ECC_CORR_ERROR	A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.
0x3	MACRO_ECC_UNCORR_ERROR	An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.
0x4	MACRO_WRITE_BLANK_ERROR	This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command. Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check). It is important that SW ensures that each word is only written once, since this can render the device useless.
0x5	ACCESS_ERROR	This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.
0x6	CHECK_FAIL_ERROR	An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.
0x7	FSM_STATE_ERROR	The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

ERR_CODE . ERR_CODE_4

Value	Name	Description
0x0	NO_ERROR	No error condition has occurred.
0x1	MACRO_ERROR	Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.
0x2	MACRO_ECC_CORR_ERROR	A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.
0x3	MACRO_ECC_UNCORR_ERROR	An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.
0x4	MACRO_WRITE_BLANK_ERROR	This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command. Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check). It is important that SW ensures that each word is only written once, since this can render the device useless.
0x5	ACCESS_ERROR	This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.
0x6	CHECK_FAIL_ERROR	An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.
0x7	FSM_STATE_ERROR	The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

ERR_CODE . ERR_CODE_3

Value	Name	Description
0x0	NO_ERROR	No error condition has occurred.
0x1	MACRO_ERROR	Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.
0x2	MACRO_ECC_CORR_ERROR	A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.
0x3	MACRO_ECC_UNCORR_ERROR	An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.
0x4	MACRO_WRITE_BLANK_ERROR	This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command. Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check). It is important that SW ensures that each word is only written once, since this can render the device useless.
0x5	ACCESS_ERROR	This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.
0x6	CHECK_FAIL_ERROR	An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.
0x7	FSM_STATE_ERROR	The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

ERR_CODE . ERR_CODE_2

Value	Name	Description
0x0	NO_ERROR	No error condition has occurred.
0x1	MACRO_ERROR	Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.
0x2	MACRO_ECC_CORR_ERROR	A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.
0x3	MACRO_ECC_UNCORR_ERROR	An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.
0x4	MACRO_WRITE_BLANK_ERROR	This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command. Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check). It is important that SW ensures that each word is only written once, since this can render the device useless.
0x5	ACCESS_ERROR	This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.
0x6	CHECK_FAIL_ERROR	An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.
0x7	FSM_STATE_ERROR	The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

ERR_CODE . ERR_CODE_1

Value	Name	Description
0x0	NO_ERROR	No error condition has occurred.
0x1	MACRO_ERROR	Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.
0x2	MACRO_ECC_CORR_ERROR	A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.
0x3	MACRO_ECC_UNCORR_ERROR	An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.
0x4	MACRO_WRITE_BLANK_ERROR	This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command. Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check). It is important that SW ensures that each word is only written once, since this can render the device useless.
0x5	ACCESS_ERROR	This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.
0x6	CHECK_FAIL_ERROR	An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.
0x7	FSM_STATE_ERROR	The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

ERR_CODE . ERR_CODE_0

Value	Name	Description
0x0	NO_ERROR	No error condition has occurred.
0x1	MACRO_ERROR	Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.
0x2	MACRO_ECC_CORR_ERROR	A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.
0x3	MACRO_ECC_UNCORR_ERROR	An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.
0x4	MACRO_WRITE_BLANK_ERROR	This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command. Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check). It is important that SW ensures that each word is only written once, since this can render the device useless.
0x5	ACCESS_ERROR	This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.
0x6	CHECK_FAIL_ERROR	An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.
0x7	FSM_STATE_ERROR	The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

DIRECT_ACCESS_REGWEN

Offset: 0x18
Reset default: 0x1
Reset mask: 0x1

Fields

Bits	Type	Reset	Name	Description
31:1				Reserved
0	ro	0x1	DIRECT_ACCESS_REGWEN	This bit is hardware-managed and only readable by software. The DAI sets this bit temporarily to 0 during an OTP operation such that the corresponding address and data registers cannot be modified while the operation is pending.

DIRECT_ACCESS_CMD

Command register for direct accesses.

Offset: 0x1c
Reset default: 0x0
Reset mask: 0x7
Register enable: DIRECT_ACCESS_REGWEN

Fields

Bits	Type	Reset	Name	Description
31:3				Reserved
2	r0w1c	0x0	DIGEST	Initiates the digest calculation and locking sequence for the partition specified by `DIRECT_ACCESS_ADDRESS.`
1	r0w1c	0x0	WR	Initiates a programming sequence that writes the data in `DIRECT_ACCESS_WDATA_0` and `DIRECT_ACCESS_WDATA_1` (for 64bit partitions) to the location specified by `DIRECT_ACCESS_ADDRESS.`
0	r0w1c	0x0	RD	Initiates a readout sequence that reads the location specified by `DIRECT_ACCESS_ADDRESS.` The command places the data read into `DIRECT_ACCESS_RDATA_0` and `DIRECT_ACCESS_RDATA_1` (for 64bit partitions).

DIRECT_ACCESS_ADDRESS

Address register for direct accesses.

Offset: 0x20
Reset default: 0x0
Reset mask: 0x7ff
Register enable: DIRECT_ACCESS_REGWEN

Fields

Bits	Type	Reset	Name
31:11			Reserved
10:0	rw	0x0	DIRECT_ACCESS_ADDRESS

DIRECT_ACCESS_ADDRESS . DIRECT_ACCESS_ADDRESS

This is the address for the OTP word to be read or written through the direct access interface. Note that the address is aligned to the access size internally, hence bits 1:0 are ignored for 32bit accesses, and bits 2:0 are ignored for 64bit accesses.

For the digest calculation command, set this register to the partition base offset.

DIRECT_ACCESS_WDATA

Write data for direct accesses. Hardware automatically determines the access granule (32bit or 64bit) based on which partition is being written to.

Reset default: 0x0
Reset mask: 0xffffffff

Instances

Name	Offset
DIRECT_ACCESS_WDATA_0	0x24
DIRECT_ACCESS_WDATA_1	0x28

Fields

Bits	Type	Reset	Name	Description
31:0	rw	0x0	DIRECT_ACCESS_WDATA

DIRECT_ACCESS_RDATA

Read data for direct accesses. Hardware automatically determines the access granule (32bit or 64bit) based on which partition is read from.

Reset default: 0x0
Reset mask: 0xffffffff

Instances

Name	Offset
DIRECT_ACCESS_RDATA_0	0x2c
DIRECT_ACCESS_RDATA_1	0x30

Fields

Bits	Type	Reset	Name	Description
31:0	ro	0x0	DIRECT_ACCESS_RDATA

CHECK_TRIGGER_REGWEN

Offset: 0x34
Reset default: 0x1
Reset mask: 0x1

Fields

Bits	Type	Reset	Name	Description
31:1				Reserved
0	rw0c	0x1	CHECK_TRIGGER_REGWEN	When cleared to 0, the `CHECK_TRIGGER` register cannot be written anymore. Write 0 to clear this bit.

CHECK_TRIGGER

Command register for direct accesses.

Offset: 0x38
Reset default: 0x0
Reset mask: 0x3
Register enable: CHECK_TRIGGER_REGWEN

Fields

Bits	Type	Reset	Name
31:2			Reserved
1	r0w1c	0x0	CONSISTENCY
0	r0w1c	0x0	INTEGRITY

CHECK_TRIGGER . CONSISTENCY

Writing 1 to this bit triggers a consistency check. SW should monitor STATUS.CHECK_PENDING and wait until the check has been completed. If there are any errors, those will be flagged in the STATUS and ERR_CODE registers, and via interrupts and alerts.

CHECK_TRIGGER . INTEGRITY

Writing 1 to this bit triggers an integrity check. SW should monitor STATUS.CHECK_PENDING and wait until the check has been completed. If there are any errors, those will be flagged in the STATUS and ERR_CODE registers, and via the interrupts and alerts.

CHECK_REGWEN

Offset: 0x3c
Reset default: 0x1
Reset mask: 0x1

Fields

Bits	Type	Reset	Name	Description
31:1				Reserved
0	rw0c	0x1	CHECK_REGWEN	When cleared to 0, `INTEGRITY_CHECK_PERIOD` and `CONSISTENCY_CHECK_PERIOD` registers cannot be written anymore. Write 0 to clear this bit.

CHECK_TIMEOUT

Timeout value for the integrity and consistency checks.

Offset: 0x40
Reset default: 0x0
Reset mask: 0xffffffff
Register enable: CHECK_REGWEN

Fields

Bits	Type	Reset	Name
31:0	rw	0x0	CHECK_TIMEOUT

CHECK_TIMEOUT . CHECK_TIMEOUT

Timeout value in cycles for the for the integrity and consistency checks. If an integrity or consistency check does not complete within the timeout window, an error will be flagged in the STATUS register, an otp_error interrupt will be raised, and an fatal_check_error alert will be sent out. The timeout should be set to a large value to stay on the safe side. The maximum check time can be upper bounded by the number of cycles it takes to readout, scramble and digest the entire OTP array. Since this amounts to roughly 25k cycles, it is recommended to set this value to at least 100’000 cycles in order to stay on the safe side. A value of zero disables the timeout mechanism (default).

INTEGRITY_CHECK_PERIOD

This value specifies the maximum period that can be generated pseudo-randomly. Only applies to the HW_CFG and SECRET* partitions once they are locked.

Offset: 0x44
Reset default: 0x0
Reset mask: 0xffffffff
Register enable: CHECK_REGWEN

Fields

Bits	Type	Reset	Name
31:0	rw	0x0	INTEGRITY_CHECK_PERIOD

INTEGRITY_CHECK_PERIOD . INTEGRITY_CHECK_PERIOD

The pseudo-random period is generated using a 40bit LFSR internally, and this register defines the bit mask to be applied to the LFSR output in order to limit its range. The value of this register is left shifted by 8bits and the lower bits are set to 8’hFF in order to form the 40bit mask. A recommended value is 0x3_FFFF, corresponding to a maximum period of ~2.8s at 24MHz. A value of zero disables the timer (default). Note that a one-off check can always be triggered via CHECK_TRIGGER.INTEGRITY.

CONSISTENCY_CHECK_PERIOD

This value specifies the maximum period that can be generated pseudo-randomly. This applies to the LIFE_CYCLE partition and the HW_CFG and SECRET* partitions once they are locked.

Offset: 0x48
Reset default: 0x0
Reset mask: 0xffffffff
Register enable: CHECK_REGWEN

Fields

Bits	Type	Reset	Name
31:0	rw	0x0	CONSISTENCY_CHECK_PERIOD

CONSISTENCY_CHECK_PERIOD . CONSISTENCY_CHECK_PERIOD

The pseudo-random period is generated using a 40bit LFSR internally, and this register defines the bit mask to be applied to the LFSR output in order to limit its range. The value of this register is left shifted by 8bits and the lower bits are set to 8’hFF in order to form the 40bit mask. A recommended value is 0x3FF_FFFF, corresponding to a maximum period of ~716s at 24MHz. A value of zero disables the timer (default). Note that a one-off check can always be triggered via CHECK_TRIGGER.CONSISTENCY.

VENDOR_TEST_READ_LOCK

Runtime read lock for the VENDOR_TEST partition.

Offset: 0x4c
Reset default: 0x1
Reset mask: 0x1
Register enable: DIRECT_ACCESS_REGWEN

Fields

Bits	Type	Reset	Name	Description
31:1				Reserved
0	rw0c	0x1	VENDOR_TEST_READ_LOCK	When cleared to 0, read access to the VENDOR_TEST partition is locked. Write 0 to clear this bit.

CREATOR_SW_CFG_READ_LOCK

Runtime read lock for the CREATOR_SW_CFG partition.

Offset: 0x50
Reset default: 0x1
Reset mask: 0x1
Register enable: DIRECT_ACCESS_REGWEN

Fields

Bits	Type	Reset	Name	Description
31:1				Reserved
0	rw0c	0x1	CREATOR_SW_CFG_READ_LOCK	When cleared to 0, read access to the CREATOR_SW_CFG partition is locked. Write 0 to clear this bit.

OWNER_SW_CFG_READ_LOCK

Runtime read lock for the OWNER_SW_CFG partition.

Offset: 0x54
Reset default: 0x1
Reset mask: 0x1
Register enable: DIRECT_ACCESS_REGWEN

Fields

Bits	Type	Reset	Name	Description
31:1				Reserved
0	rw0c	0x1	OWNER_SW_CFG_READ_LOCK	When cleared to 0, read access to the OWNER_SW_CFG partition is locked. Write 0 to clear this bit.

VENDOR_TEST_DIGEST

Integrity digest for the VENDOR_TEST partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the VENDOR_TEST partition is locked and the digest becomes visible in this CSR.

Reset default: 0x0
Reset mask: 0xffffffff

Instances

Name	Offset
VENDOR_TEST_DIGEST_0	0x58
VENDOR_TEST_DIGEST_1	0x5c

Fields

Bits	Type	Reset	Name	Description
31:0	ro	0x0	VENDOR_TEST_DIGEST

CREATOR_SW_CFG_DIGEST

Integrity digest for the CREATOR_SW_CFG partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the CREATOR_SW_CFG partition is locked and the digest becomes visible in this CSR.

Reset default: 0x0
Reset mask: 0xffffffff

Instances

Name	Offset
CREATOR_SW_CFG_DIGEST_0	0x60
CREATOR_SW_CFG_DIGEST_1	0x64

Fields

Bits	Type	Reset	Name	Description
31:0	ro	0x0	CREATOR_SW_CFG_DIGEST

OWNER_SW_CFG_DIGEST

Integrity digest for the OWNER_SW_CFG partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the OWNER_SW_CFG partition is locked and the digest becomes visible in this CSR.

Reset default: 0x0
Reset mask: 0xffffffff

Instances

Name	Offset
OWNER_SW_CFG_DIGEST_0	0x68
OWNER_SW_CFG_DIGEST_1	0x6c

Fields

Bits	Type	Reset	Name	Description
31:0	ro	0x0	OWNER_SW_CFG_DIGEST

HW_CFG_DIGEST

Integrity digest for the HW_CFG partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

Reset default: 0x0
Reset mask: 0xffffffff

Instances

Name	Offset
HW_CFG_DIGEST_0	0x70
HW_CFG_DIGEST_1	0x74

Fields

Bits	Type	Reset	Name	Description
31:0	ro	0x0	HW_CFG_DIGEST

SECRET0_DIGEST

Integrity digest for the SECRET0 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

Reset default: 0x0
Reset mask: 0xffffffff

Instances

Name	Offset
SECRET0_DIGEST_0	0x78
SECRET0_DIGEST_1	0x7c

Fields

Bits	Type	Reset	Name	Description
31:0	ro	0x0	SECRET0_DIGEST

SECRET1_DIGEST

Integrity digest for the SECRET1 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

Reset default: 0x0
Reset mask: 0xffffffff

Instances

Name	Offset
SECRET1_DIGEST_0	0x80
SECRET1_DIGEST_1	0x84

Fields

Bits	Type	Reset	Name	Description
31:0	ro	0x0	SECRET1_DIGEST

SECRET2_DIGEST

Integrity digest for the SECRET2 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

Reset default: 0x0
Reset mask: 0xffffffff

Instances

Name	Offset
SECRET2_DIGEST_0	0x88
SECRET2_DIGEST_1	0x8c

Fields

Bits	Type	Reset	Name	Description
31:0	ro	0x0	SECRET2_DIGEST

SW_CFG_WINDOW

Any read to this window directly maps to the corresponding offset in the creator and owner software config partitions, and triggers an OTP readout of the bytes requested. Note that the transaction will block until OTP readout has completed.

Word Aligned Offset Range: 0x1000to0x17fc
Size (words): 512
Access: ro
Byte writes are not supported.

Summary of the `prim` interface’s registers

Name	Offset	Length
otp_ctrl.`CSR0`	0x0	4
otp_ctrl.`CSR1`	0x4	4
otp_ctrl.`CSR2`	0x8	4
otp_ctrl.`CSR3`	0xc	4
otp_ctrl.`CSR4`	0x10	4
otp_ctrl.`CSR5`	0x14	4
otp_ctrl.`CSR6`	0x18	4
otp_ctrl.`CSR7`	0x1c	4

CSR0

Offset: 0x0
Reset default: 0x0
Reset mask: 0x7ff3ff7

Fields

Bits	Type	Reset	Name	Description
31:27				Reserved
26:16	rw	0x0	field4
15:14				Reserved
13:4	rw	0x0	field3
3				Reserved
2	rw	0x0	field2
1	rw	0x0	field1
0	rw	0x0	field0

CSR1

Offset: 0x4
Reset default: 0x0
Reset mask: 0xffffffff

Fields

Bits	Type	Reset	Name
31:16	rw	0x0	field4
15	rw	0x0	field3
14:8	rw	0x0	field2
7	rw	0x0	field1
6:0	rw	0x0	field0

CSR2

Offset: 0x8
Reset default: 0x0
Reset mask: 0x1

Fields

Bits	Type	Reset	Name	Description
31:1				Reserved
0	rw	0x0	field0

CSR3

Offset: 0xc
Reset default: 0x0
Reset mask: 0x7f3ff7

Fields

Bits	Type	Reset	Name	Description
31:23				Reserved
22	ro	0x0	field8
21	ro	0x0	field7
20	ro	0x0	field6
19	ro	0x0	field5
18	ro	0x0	field4
17	ro	0x0	field3
16	rw1c	0x0	field2
15:14				Reserved
13:4	rw1c	0x0	field1
3				Reserved
2:0	rw1c	0x0	field0

CSR4

Offset: 0x10
Reset default: 0x0
Reset mask: 0x73ff

Fields

Bits	Type	Reset	Name	Description
31:15				Reserved
14	rw	0x0	field3
13	rw	0x0	field2
12	rw	0x0	field1
11:10				Reserved
9:0	rw	0x0	field0

CSR5

Offset: 0x14
Reset default: 0x0
Reset mask: 0xffff3fff

Fields

Bits	Type	Reset	Name	Description
31:16	rw	0x0	field6
15:14				Reserved
13	ro	0x0	field5
12	ro	0x0	field4
11:9	ro	0x0	field3
8	ro	0x0	field2
7:6	rw	0x0	field1
5:0	rw	0x0	field0

CSR6

Offset: 0x18
Reset default: 0x0
Reset mask: 0xffff1bff

Fields

Bits	Type	Reset	Name	Description
31:16	rw	0x0	field3
15:13				Reserved
12	rw	0x0	field2
11	rw	0x0	field1
10				Reserved
9:0	rw	0x0	field0

CSR7

Offset: 0x1c
Reset default: 0x0
Reset mask: 0xc73f

Fields

Bits	Type	Reset	Name	Description
31:16				Reserved
15	ro	0x0	field3
14	ro	0x0	field2
13:11				Reserved
10:8	ro	0x0	field1
7:6				Reserved
5:0	ro	0x0	field0