Hardware Interfaces and Registers

Interfaces

Referring to the Comportable guideline for peripheral device functionality, the module otp_ctrl has the following hardware interfaces defined.

Primary Clock: clk_i

Other Clocks: clk_edn_i

Bus Device Interfaces (TL-UL): core_tl, prim_tl

Bus Host Interfaces (TL-UL): none

Peripheral Pins for Chip IO:

Pin namedirectionDescription
test[7:0]output

Test-related GPIOs. Only active in DFT-enabled life cycle states.

Inter-Module Signals: Reference

Inter-Module Signals
Port Name Package::Struct Type Act Width Description
otp_ext_voltage_h io none 1
otp_ast_pwr_seq otp_ctrl_pkg::otp_ast_req uni req 1 Power sequencing signals to AST (VDD domain).
otp_ast_pwr_seq_h otp_ctrl_pkg::otp_ast_rsp uni rcv 1 Power sequencing signals coming from AST (VCC domain).
edn edn_pkg::edn req_rsp req 1 Entropy request to the entropy distribution network for LFSR reseeding and ephemeral key derivation.
pwr_otp pwrmgr_pkg::pwr_otp req_rsp rsp 1 Initialization request/acknowledge from/to power manager.
lc_otp_vendor_test otp_ctrl_pkg::lc_otp_vendor_test req_rsp rsp 1 Vendor test control signals from/to the life cycle TAP.
lc_otp_program otp_ctrl_pkg::lc_otp_program req_rsp rsp 1 Life cycle state transition interface.
otp_lc_data otp_ctrl_pkg::otp_lc_data uni req 1 Life cycle state output holding the current life cycle state, the value of the transition counter and the tokens needed for life cycle transitions.
lc_escalate_en lc_ctrl_pkg::lc_tx uni rcv 1 Life cycle escalation enable coming from life cycle controller. This signal moves all FSMs within OTP into the error state.
lc_creator_seed_sw_rw_en lc_ctrl_pkg::lc_tx uni rcv 1 Provision enable qualifier coming from life cycle controller. This signal enables SW read / write access to the RMA_TOKEN and CREATOR_ROOT_KEY_SHARE0 and CREATOR_ROOT_KEY_SHARE1.
lc_seed_hw_rd_en lc_ctrl_pkg::lc_tx uni rcv 1 Seed read enable coming from life cycle controller. This signal enables HW read access to the CREATOR_ROOT_KEY_SHARE0 and CREATOR_ROOT_KEY_SHARE1.
lc_dft_en lc_ctrl_pkg::lc_tx uni rcv 1 Test enable qualifier coming from from life cycle controller. This signals enables the TL-UL access port to the proprietary OTP IP.
lc_check_byp_en lc_ctrl_pkg::lc_tx uni rcv 1 Life cycle partition check bypass signal. This signal causes the life cycle partition to bypass consistency checks during life cycle state transitions in order to prevent spurious consistency check failures.
otp_keymgr_key otp_ctrl_pkg::otp_keymgr_key uni req 1 Key output to the key manager holding CREATOR_ROOT_KEY_SHARE0 and CREATOR_ROOT_KEY_SHARE1.
flash_otp_key otp_ctrl_pkg::flash_otp_key req_rsp rsp 1 Key derivation interface for FLASH scrambling.
sram_otp_key otp_ctrl_pkg::sram_otp_key req_rsp rsp 3 Array with key derivation interfaces for SRAM scrambling devices.
otbn_otp_key otp_ctrl_pkg::otbn_otp_key req_rsp rsp 1 Key derivation interface for OTBN scrambling devices.
otp_hw_cfg otp_ctrl_part_pkg::otp_hw_cfg uni req 1 Output of the HW_CFG partition.
obs_ctrl ast_pkg::ast_obs_ctrl uni rcv 1 AST observability control signals.
otp_obs logic uni req 8 AST observability bus.
core_tl tlul_pkg::tl req_rsp rsp 1
prim_tl tlul_pkg::tl req_rsp rsp 1

Interrupts:

Interrupt NameTypeDescription
otp_operation_doneEvent

A direct access command or digest calculation operation has completed.

otp_errorEvent

An error has occurred in the OTP controller. Check the ERR_CODE register to get more information.

Security Alerts:

Alert NameDescription
fatal_macro_error

This alert triggers if hardware detects an uncorrectable error during an OTP transaction, for example an uncorrectable ECC error in the OTP array.

fatal_check_error

This alert triggers if any of the background checks fails. This includes the digest checks and concurrent ECC checks in the buffer registers.

fatal_bus_integ_error

This fatal alert is triggered when a fatal TL-UL bus integrity fault is detected.

fatal_prim_otp_alert

Fatal alert triggered inside the OTP primitive, including fatal TL-UL bus integrity faults of the test interface.

recov_prim_otp_alert

Recoverable alert triggered inside the OTP primitive.

Security Countermeasures:

Countermeasure IDDescription
OTP_CTRL.BUS.INTEGRITY

End-to-end bus integrity scheme.

OTP_CTRL.SECRET.MEM.SCRAMBLE

Secret partitions are scrambled with a full-round PRESENT cipher.

OTP_CTRL.PART.MEM.DIGEST

Integrity of buffered partitions is ensured via a 64bit digest.

OTP_CTRL.DAI.FSM.SPARSE

The direct access interface FSM is sparsely encoded.

OTP_CTRL.KDI.FSM.SPARSE

The key derivation interface FSM is sparsely encoded.

OTP_CTRL.LCI.FSM.SPARSE

The life cycle interface FSM is sparsely encoded.

OTP_CTRL.PART.FSM.SPARSE

The partition FSMs are sparsely encoded.

OTP_CTRL.SCRMBL.FSM.SPARSE

The scramble datapath FSM is sparsely encoded.

OTP_CTRL.TIMER.FSM.SPARSE

The background check timer FSM is sparsely encoded.

OTP_CTRL.DAI.CTR.REDUN

The direct access interface address counter employs a cross-counter implementation.

OTP_CTRL.KDI_SEED.CTR.REDUN

The key derivation interface counter employs a cross-counter implementation.

OTP_CTRL.KDI_ENTROPY.CTR.REDUN

The key derivation entropy counter employs a cross-counter implementation.

OTP_CTRL.LCI.CTR.REDUN

The life cycle interface address counter employs a cross-counter implementation.

OTP_CTRL.PART.CTR.REDUN

The address counter of buffered partitions employs a cross-counter implementation.

OTP_CTRL.SCRMBL.CTR.REDUN

The srambling datapath counter employs a cross-counter implementation.

OTP_CTRL.TIMER_INTEG.CTR.REDUN

The background integrity check timer employs a duplicated counter implementation.

OTP_CTRL.TIMER_CNSTY.CTR.REDUN

The background consistency check timer employs a duplicated counter implementation.

OTP_CTRL.TIMER.LFSR.REDUN

The background check LFSR is duplicated.

OTP_CTRL.DAI.FSM.LOCAL_ESC

The direct access interface FSM is moved into an invalid state upon local escalation.

OTP_CTRL.LCI.FSM.LOCAL_ESC

The life cycle interface FSM is moved into an invalid state upon local escalation.

OTP_CTRL.KDI.FSM.LOCAL_ESC

The key derivation interface FSM is moved into an invalid state upon local escalation.

OTP_CTRL.PART.FSM.LOCAL_ESC

The partition FSMs are moved into an invalid state upon local escalation.

OTP_CTRL.SCRMBL.FSM.LOCAL_ESC

The scramble datapath FSM is moved into an invalid state upon local escalation.

OTP_CTRL.TIMER.FSM.LOCAL_ESC

The background check timer FSM is moved into an invalid state upon local escalation.

OTP_CTRL.DAI.FSM.GLOBAL_ESC

The direct access interface FSM is moved into an invalid state upon global escalation via life cycle.

OTP_CTRL.LCI.FSM.GLOBAL_ESC

The life cycle interface FSM is moved into an invalid state upon global escalation via life cycle.

OTP_CTRL.KDI.FSM.GLOBAL_ESC

The key derivation interface FSM is moved into an invalid state upon global escalation via life cycle.

OTP_CTRL.PART.FSM.GLOBAL_ESC

The partition FSMs are moved into an invalid state upon global escalation via life cycle.

OTP_CTRL.SCRMBL.FSM.GLOBAL_ESC

The scramble datapath FSM is moved into an invalid state upon global escalation via life cycle.

OTP_CTRL.TIMER.FSM.GLOBAL_ESC

The background check timer FSM is moved into an invalid state upon global escalation via life cycle.

OTP_CTRL.PART.DATA_REG.INTEGRITY

All partition buffer registers are protected with ECC on 64bit blocks.

OTP_CTRL.PART.DATA_REG.BKGN_CHK

The digest of buffered partitions is recomputed and checked at pseudorandom intervals in the background.

OTP_CTRL.PART.MEM.REGREN

Unbuffered ('software') partitions can be read-locked via a CSR until the next system reset.

OTP_CTRL.PART.MEM.SW_UNREADABLE

Secret buffered partitions become unreadable to software once they are locked via the digest.

OTP_CTRL.PART.MEM.SW_UNWRITABLE

All partitions become unwritable by software once they are locked via the digest.

OTP_CTRL.LC_PART.MEM.SW_NOACCESS

The life cycle partition is not directly readable nor writable via software.

OTP_CTRL.ACCESS.CTRL.MUBI

The access control signals going from the partitions to the DAI are MUBI encoded.

OTP_CTRL.TOKEN_VALID.CTRL.MUBI

The token valid signals going to the life cycle controller are MUBI encoded.

OTP_CTRL.LC_CTRL.INTERSIG.MUBI

The life cycle control signals are multibit encoded.

OTP_CTRL.TEST.BUS.LC_GATED

Prevent access to test signals and the OTP backdoor interface in non-test lifecycle states.

OTP_CTRL.TEST_TL_LC_GATE.FSM.SPARSE

The control FSM inside the TL-UL gating primitive is sparsely encoded.

OTP_CTRL.DIRECT_ACCESS.CONFIG.REGWEN

The direct access CSRs are REGWEN protected.

OTP_CTRL.CHECK_TRIGGER.CONFIG.REGWEN

The check trigger CSR is REGWEN protected.

OTP_CTRL.CHECK.CONFIG.REGWEN

The check CSR is REGWEN protected.

OTP_CTRL.MACRO.MEM.INTEGRITY

The OTP macro employs a vendor-specific integrity scheme at the granularity of the native 16bit OTP words. The scheme is able to at least detect single bit errors.

OTP_CTRL.MACRO.MEM.CM

The OTP macro may contain additional vendor-specific countermeasures.

Registers

Registers visible under device interface core

Summary
Name Offset Length Description
otp_ctrl.INTR_STATE 0x0 4

Interrupt State Register

otp_ctrl.INTR_ENABLE 0x4 4

Interrupt Enable Register

otp_ctrl.INTR_TEST 0x8 4

Interrupt Test Register

otp_ctrl.ALERT_TEST 0xc 4

Alert Test Register

otp_ctrl.STATUS 0x10 4

OTP status register.

otp_ctrl.ERR_CODE 0x14 4

This register holds information about error conditions that occurred in the agents interacting with the OTP macro via the internal bus. The error codes should be checked if the partitions, DAI or LCI flag an error in the STATUS register, or when an INTR_STATE.otp_error has been triggered. Note that all errors trigger an otp_error interrupt, and in addition some errors may trigger either an fatal_macro_error or an fatal_check_error alert.

otp_ctrl.DIRECT_ACCESS_REGWEN 0x18 4

Register write enable for all direct access interface registers.

otp_ctrl.DIRECT_ACCESS_CMD 0x1c 4

Command register for direct accesses.

otp_ctrl.DIRECT_ACCESS_ADDRESS 0x20 4

Address register for direct accesses.

otp_ctrl.DIRECT_ACCESS_WDATA_0 0x24 4

Write data for direct accesses. Hardware automatically determines the access granule (32bit or 64bit) based on which partition is being written to.

otp_ctrl.DIRECT_ACCESS_WDATA_1 0x28 4

Write data for direct accesses. Hardware automatically determines the access granule (32bit or 64bit) based on which partition is being written to.

otp_ctrl.DIRECT_ACCESS_RDATA_0 0x2c 4

Read data for direct accesses. Hardware automatically determines the access granule (32bit or 64bit) based on which partition is read from.

otp_ctrl.DIRECT_ACCESS_RDATA_1 0x30 4

Read data for direct accesses. Hardware automatically determines the access granule (32bit or 64bit) based on which partition is read from.

otp_ctrl.CHECK_TRIGGER_REGWEN 0x34 4

Register write enable for CHECK_TRIGGER.

otp_ctrl.CHECK_TRIGGER 0x38 4

Command register for direct accesses.

otp_ctrl.CHECK_REGWEN 0x3c 4

Register write enable for INTEGRITY_CHECK_PERIOD and CONSISTENCY_CHECK_PERIOD.

otp_ctrl.CHECK_TIMEOUT 0x40 4

Timeout value for the integrity and consistency checks.

otp_ctrl.INTEGRITY_CHECK_PERIOD 0x44 4

This value specifies the maximum period that can be generated pseudo-randomly. Only applies to the HW_CFG and SECRET* partitions once they are locked.

otp_ctrl.CONSISTENCY_CHECK_PERIOD 0x48 4

This value specifies the maximum period that can be generated pseudo-randomly. This applies to the LIFE_CYCLE partition and the HW_CFG and SECRET* partitions once they are locked.

otp_ctrl.VENDOR_TEST_READ_LOCK 0x4c 4

Runtime read lock for the VENDOR_TEST partition.

otp_ctrl.CREATOR_SW_CFG_READ_LOCK 0x50 4

Runtime read lock for the CREATOR_SW_CFG partition.

otp_ctrl.OWNER_SW_CFG_READ_LOCK 0x54 4

Runtime read lock for the OWNER_SW_CFG partition.

otp_ctrl.VENDOR_TEST_DIGEST_0 0x58 4

Integrity digest for the VENDOR_TEST partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the VENDOR_TEST partition is locked and the digest becomes visible in this CSR.

otp_ctrl.VENDOR_TEST_DIGEST_1 0x5c 4

Integrity digest for the VENDOR_TEST partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the VENDOR_TEST partition is locked and the digest becomes visible in this CSR.

otp_ctrl.CREATOR_SW_CFG_DIGEST_0 0x60 4

Integrity digest for the CREATOR_SW_CFG partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the CREATOR_SW_CFG partition is locked and the digest becomes visible in this CSR.

otp_ctrl.CREATOR_SW_CFG_DIGEST_1 0x64 4

Integrity digest for the CREATOR_SW_CFG partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the CREATOR_SW_CFG partition is locked and the digest becomes visible in this CSR.

otp_ctrl.OWNER_SW_CFG_DIGEST_0 0x68 4

Integrity digest for the OWNER_SW_CFG partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the OWNER_SW_CFG partition is locked and the digest becomes visible in this CSR.

otp_ctrl.OWNER_SW_CFG_DIGEST_1 0x6c 4

Integrity digest for the OWNER_SW_CFG partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the OWNER_SW_CFG partition is locked and the digest becomes visible in this CSR.

otp_ctrl.HW_CFG_DIGEST_0 0x70 4

Integrity digest for the HW_CFG partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

otp_ctrl.HW_CFG_DIGEST_1 0x74 4

Integrity digest for the HW_CFG partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

otp_ctrl.SECRET0_DIGEST_0 0x78 4

Integrity digest for the SECRET0 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

otp_ctrl.SECRET0_DIGEST_1 0x7c 4

Integrity digest for the SECRET0 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

otp_ctrl.SECRET1_DIGEST_0 0x80 4

Integrity digest for the SECRET1 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

otp_ctrl.SECRET1_DIGEST_1 0x84 4

Integrity digest for the SECRET1 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

otp_ctrl.SECRET2_DIGEST_0 0x88 4

Integrity digest for the SECRET2 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

otp_ctrl.SECRET2_DIGEST_1 0x8c 4

Integrity digest for the SECRET2 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

otp_ctrl.SW_CFG_WINDOW 0x1000 2048

Any read to this window directly maps to the corresponding offset in the creator and owner software config partitions, and triggers an OTP readout of the bytes requested. Note that the transaction will block until OTP readout has completed.

otp_ctrl.INTR_STATE @ 0x0

Interrupt State Register

Reset default = 0x0, mask 0x3
31302928272625242322212019181716
 
1514131211109876543210
  otp_error otp_operation_done
BitsTypeResetNameDescription
0rw1c0x0otp_operation_done

A direct access command or digest calculation operation has completed.

1rw1c0x0otp_error

An error has occurred in the OTP controller. Check the ERR_CODE register to get more information.


otp_ctrl.INTR_ENABLE @ 0x4

Interrupt Enable Register

Reset default = 0x0, mask 0x3
31302928272625242322212019181716
 
1514131211109876543210
  otp_error otp_operation_done
BitsTypeResetNameDescription
0rw0x0otp_operation_done

Enable interrupt when INTR_STATE.otp_operation_done is set.

1rw0x0otp_error

Enable interrupt when INTR_STATE.otp_error is set.


otp_ctrl.INTR_TEST @ 0x8

Interrupt Test Register

Reset default = 0x0, mask 0x3
31302928272625242322212019181716
 
1514131211109876543210
  otp_error otp_operation_done
BitsTypeResetNameDescription
0wo0x0otp_operation_done

Write 1 to force INTR_STATE.otp_operation_done to 1.

1wo0x0otp_error

Write 1 to force INTR_STATE.otp_error to 1.


otp_ctrl.ALERT_TEST @ 0xc

Alert Test Register

Reset default = 0x0, mask 0x1f
31302928272625242322212019181716
 
1514131211109876543210
  recov_prim_otp_alert fatal_prim_otp_alert fatal_bus_integ_error fatal_check_error fatal_macro_error
BitsTypeResetNameDescription
0wo0x0fatal_macro_error

Write 1 to trigger one alert event of this kind.

1wo0x0fatal_check_error

Write 1 to trigger one alert event of this kind.

2wo0x0fatal_bus_integ_error

Write 1 to trigger one alert event of this kind.

3wo0x0fatal_prim_otp_alert

Write 1 to trigger one alert event of this kind.

4wo0x0recov_prim_otp_alert

Write 1 to trigger one alert event of this kind.


otp_ctrl.STATUS @ 0x10

OTP status register.

Reset default = 0x0, mask 0x1ffff
31302928272625242322212019181716
  CHECK_PENDING
1514131211109876543210
DAI_IDLE BUS_INTEG_ERROR KEY_DERIV_FSM_ERROR SCRAMBLING_FSM_ERROR LFSR_FSM_ERROR TIMEOUT_ERROR LCI_ERROR DAI_ERROR LIFE_CYCLE_ERROR SECRET2_ERROR SECRET1_ERROR SECRET0_ERROR HW_CFG_ERROR OWNER_SW_CFG_ERROR CREATOR_SW_CFG_ERROR VENDOR_TEST_ERROR
BitsTypeResetNameDescription
0ro0x0VENDOR_TEST_ERROR

Set to 1 if an error occurred in this partition. If set to 1, SW should check the ERR_CODE register at the corresponding index.

1ro0x0CREATOR_SW_CFG_ERROR

Set to 1 if an error occurred in this partition. If set to 1, SW should check the ERR_CODE register at the corresponding index.

2ro0x0OWNER_SW_CFG_ERROR

Set to 1 if an error occurred in this partition. If set to 1, SW should check the ERR_CODE register at the corresponding index.

3ro0x0HW_CFG_ERROR

Set to 1 if an error occurred in this partition. If set to 1, SW should check the ERR_CODE register at the corresponding index.

4ro0x0SECRET0_ERROR

Set to 1 if an error occurred in this partition. If set to 1, SW should check the ERR_CODE register at the corresponding index.

5ro0x0SECRET1_ERROR

Set to 1 if an error occurred in this partition. If set to 1, SW should check the ERR_CODE register at the corresponding index.

6ro0x0SECRET2_ERROR

Set to 1 if an error occurred in this partition. If set to 1, SW should check the ERR_CODE register at the corresponding index.

7ro0x0LIFE_CYCLE_ERROR

Set to 1 if an error occurred in this partition. If set to 1, SW should check the ERR_CODE register at the corresponding index.

8ro0x0DAI_ERROR

Set to 1 if an error occurred in the DAI. If set to 1, SW should check the ERR_CODE register at the corresponding index.

9ro0x0LCI_ERROR

Set to 1 if an error occurred in the LCI. If set to 1, SW should check the ERR_CODE register at the corresponding index.

10ro0x0TIMEOUT_ERROR

Set to 1 if an integrity or consistency check times out. This raises an fatal_check_error alert and is an unrecoverable error condition.

11ro0x0LFSR_FSM_ERROR

Set to 1 if the LFSR timer FSM has reached an invalid state. This raises an fatal_check_error alert and is an unrecoverable error condition.

12ro0x0SCRAMBLING_FSM_ERROR

Set to 1 if the scrambling datapath FSM has reached an invalid state. This raises an fatal_check_error alert and is an unrecoverable error condition.

13ro0x0KEY_DERIV_FSM_ERROR

Set to 1 if the key derivation FSM has reached an invalid state. This raises an fatal_check_error alert and is an unrecoverable error condition.

14ro0x0BUS_INTEG_ERROR

This bit is set to 1 if a fatal bus integrity fault is detected. This error triggers a fatal_bus_integ_error alert.

15ro0x0DAI_IDLE

Set to 1 if the DAI is idle and ready to accept commands.

16ro0x0CHECK_PENDING

Set to 1 if an integrity or consistency check triggered by the LFSR timer or via CHECK_TRIGGER is pending.


otp_ctrl.ERR_CODE @ 0x14

This register holds information about error conditions that occurred in the agents interacting with the OTP macro via the internal bus. The error codes should be checked if the partitions, DAI or LCI flag an error in the STATUS register, or when an INTR_STATE.otp_error has been triggered. Note that all errors trigger an otp_error interrupt, and in addition some errors may trigger either an fatal_macro_error or an fatal_check_error alert.

Reset default = 0x0, mask 0x3fffffff
31302928272625242322212019181716
  ERR_CODE_9 ERR_CODE_8 ERR_CODE_7 ERR_CODE_6 ERR_CODE_5...
1514131211109876543210
...ERR_CODE_5 ERR_CODE_4 ERR_CODE_3 ERR_CODE_2 ERR_CODE_1 ERR_CODE_0
BitsTypeResetNameDescription
2:0ro0x0ERR_CODE_0
0x0NO_ERROR

No error condition has occurred.

0x1MACRO_ERROR

Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.

0x2MACRO_ECC_CORR_ERROR

A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.

0x3MACRO_ECC_UNCORR_ERROR

An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.

0x4MACRO_WRITE_BLANK_ERROR

This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command.

Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check).

It is important that SW ensures that each word is only written once, since this can render the device useless.

0x5ACCESS_ERROR

This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.

0x6CHECK_FAIL_ERROR

An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.

0x7FSM_STATE_ERROR

The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

5:3ro0x0ERR_CODE_1
0x0NO_ERROR

No error condition has occurred.

0x1MACRO_ERROR

Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.

0x2MACRO_ECC_CORR_ERROR

A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.

0x3MACRO_ECC_UNCORR_ERROR

An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.

0x4MACRO_WRITE_BLANK_ERROR

This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command.

Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check).

It is important that SW ensures that each word is only written once, since this can render the device useless.

0x5ACCESS_ERROR

This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.

0x6CHECK_FAIL_ERROR

An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.

0x7FSM_STATE_ERROR

The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

8:6ro0x0ERR_CODE_2
0x0NO_ERROR

No error condition has occurred.

0x1MACRO_ERROR

Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.

0x2MACRO_ECC_CORR_ERROR

A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.

0x3MACRO_ECC_UNCORR_ERROR

An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.

0x4MACRO_WRITE_BLANK_ERROR

This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command.

Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check).

It is important that SW ensures that each word is only written once, since this can render the device useless.

0x5ACCESS_ERROR

This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.

0x6CHECK_FAIL_ERROR

An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.

0x7FSM_STATE_ERROR

The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

11:9ro0x0ERR_CODE_3
0x0NO_ERROR

No error condition has occurred.

0x1MACRO_ERROR

Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.

0x2MACRO_ECC_CORR_ERROR

A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.

0x3MACRO_ECC_UNCORR_ERROR

An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.

0x4MACRO_WRITE_BLANK_ERROR

This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command.

Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check).

It is important that SW ensures that each word is only written once, since this can render the device useless.

0x5ACCESS_ERROR

This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.

0x6CHECK_FAIL_ERROR

An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.

0x7FSM_STATE_ERROR

The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

14:12ro0x0ERR_CODE_4
0x0NO_ERROR

No error condition has occurred.

0x1MACRO_ERROR

Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.

0x2MACRO_ECC_CORR_ERROR

A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.

0x3MACRO_ECC_UNCORR_ERROR

An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.

0x4MACRO_WRITE_BLANK_ERROR

This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command.

Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check).

It is important that SW ensures that each word is only written once, since this can render the device useless.

0x5ACCESS_ERROR

This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.

0x6CHECK_FAIL_ERROR

An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.

0x7FSM_STATE_ERROR

The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

17:15ro0x0ERR_CODE_5
0x0NO_ERROR

No error condition has occurred.

0x1MACRO_ERROR

Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.

0x2MACRO_ECC_CORR_ERROR

A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.

0x3MACRO_ECC_UNCORR_ERROR

An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.

0x4MACRO_WRITE_BLANK_ERROR

This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command.

Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check).

It is important that SW ensures that each word is only written once, since this can render the device useless.

0x5ACCESS_ERROR

This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.

0x6CHECK_FAIL_ERROR

An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.

0x7FSM_STATE_ERROR

The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

20:18ro0x0ERR_CODE_6
0x0NO_ERROR

No error condition has occurred.

0x1MACRO_ERROR

Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.

0x2MACRO_ECC_CORR_ERROR

A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.

0x3MACRO_ECC_UNCORR_ERROR

An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.

0x4MACRO_WRITE_BLANK_ERROR

This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command.

Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check).

It is important that SW ensures that each word is only written once, since this can render the device useless.

0x5ACCESS_ERROR

This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.

0x6CHECK_FAIL_ERROR

An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.

0x7FSM_STATE_ERROR

The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

23:21ro0x0ERR_CODE_7
0x0NO_ERROR

No error condition has occurred.

0x1MACRO_ERROR

Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.

0x2MACRO_ECC_CORR_ERROR

A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.

0x3MACRO_ECC_UNCORR_ERROR

An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.

0x4MACRO_WRITE_BLANK_ERROR

This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command.

Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check).

It is important that SW ensures that each word is only written once, since this can render the device useless.

0x5ACCESS_ERROR

This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.

0x6CHECK_FAIL_ERROR

An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.

0x7FSM_STATE_ERROR

The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

26:24ro0x0ERR_CODE_8
0x0NO_ERROR

No error condition has occurred.

0x1MACRO_ERROR

Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.

0x2MACRO_ECC_CORR_ERROR

A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.

0x3MACRO_ECC_UNCORR_ERROR

An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.

0x4MACRO_WRITE_BLANK_ERROR

This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command.

Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check).

It is important that SW ensures that each word is only written once, since this can render the device useless.

0x5ACCESS_ERROR

This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.

0x6CHECK_FAIL_ERROR

An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.

0x7FSM_STATE_ERROR

The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.

29:27ro0x0ERR_CODE_9
0x0NO_ERROR

No error condition has occurred.

0x1MACRO_ERROR

Returned if the OTP macro command was invalid or did not complete successfully due to a macro malfunction. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_macro_error alert.

0x2MACRO_ECC_CORR_ERROR

A correctable ECC error has occured during an OTP read operation. The corresponding controller automatically recovers from this error when issuing a new command.

0x3MACRO_ECC_UNCORR_ERROR

An uncorrectable ECC error has occurred during an OTP read operation. This error should never occur during normal operation and is not recoverable. If this error is present this may be a sign that the device is malfunctioning. This error triggers an fatal_macro_error alert.

0x4MACRO_WRITE_BLANK_ERROR

This error is returned if a programming operation attempted to clear a bit that has previously been programmed to 1. The corresponding controller automatically recovers from this error when issuing a new command.

Note however that the affected OTP word may be left in an inconsistent state if this error occurs. This can cause several issues when the word is accessed again (either as part of a regular read operation, as part of the readout at boot, or as part of a background check).

It is important that SW ensures that each word is only written once, since this can render the device useless.

0x5ACCESS_ERROR

This error indicates that a locked memory region has been accessed. The corresponding controller automatically recovers from this error when issuing a new command.

0x6CHECK_FAIL_ERROR

An ECC, integrity or consistency mismatch has been detected in the buffer registers. This error should never occur during normal operation and is not recoverable. This error triggers an fatal_check_error alert.

0x7FSM_STATE_ERROR

The FSM of the corresponding controller has reached an invalid state, or the FSM has been moved into a terminal error state due to an escalation action via lc_escalate_en_i. This error should never occur during normal operation and is not recoverable. If this error is present, this is a sign that the device has fallen victim to an invasive attack. This error triggers an fatal_check_error alert.


otp_ctrl.DIRECT_ACCESS_REGWEN @ 0x18

Register write enable for all direct access interface registers.

Reset default = 0x1, mask 0x1
31302928272625242322212019181716
 
1514131211109876543210
  DIRECT_ACCESS_REGWEN
BitsTypeResetNameDescription
0ro0x1DIRECT_ACCESS_REGWEN

This bit is hardware-managed and only readable by software. The DAI sets this bit temporarily to 0 during an OTP operation such that the corresponding address and data registers cannot be modified while the operation is pending.


otp_ctrl.DIRECT_ACCESS_CMD @ 0x1c

Command register for direct accesses.

Reset default = 0x0, mask 0x7
Register enable = DIRECT_ACCESS_REGWEN
31302928272625242322212019181716
 
1514131211109876543210
  DIGEST WR RD
BitsTypeResetNameDescription
0r0w1c0x0RD

Initiates a readout sequence that reads the location specified by DIRECT_ACCESS_ADDRESS. The command places the data read into DIRECT_ACCESS_RDATA_0 and DIRECT_ACCESS_RDATA_1 (for 64bit partitions).

1r0w1c0x0WR

Initiates a programming sequence that writes the data in DIRECT_ACCESS_WDATA_0 and DIRECT_ACCESS_WDATA_1 (for 64bit partitions) to the location specified by DIRECT_ACCESS_ADDRESS.

2r0w1c0x0DIGEST

Initiates the digest calculation and locking sequence for the partition specified by DIRECT_ACCESS_ADDRESS.


otp_ctrl.DIRECT_ACCESS_ADDRESS @ 0x20

Address register for direct accesses.

Reset default = 0x0, mask 0x7ff
Register enable = DIRECT_ACCESS_REGWEN
31302928272625242322212019181716
 
1514131211109876543210
  DIRECT_ACCESS_ADDRESS
BitsTypeResetNameDescription
10:0rw0x0DIRECT_ACCESS_ADDRESS

This is the address for the OTP word to be read or written through the direct access interface. Note that the address is aligned to the access size internally, hence bits 1:0 are ignored for 32bit accesses, and bits 2:0 are ignored for 64bit accesses.

For the digest calculation command, set this register to the partition base offset.


otp_ctrl.DIRECT_ACCESS_WDATA_0 @ 0x24

Write data for direct accesses. Hardware automatically determines the access granule (32bit or 64bit) based on which partition is being written to.

Reset default = 0x0, mask 0xffffffff
Register enable = DIRECT_ACCESS_REGWEN
31302928272625242322212019181716
DIRECT_ACCESS_WDATA_0...
1514131211109876543210
...DIRECT_ACCESS_WDATA_0
BitsTypeResetNameDescription
31:0rw0x0DIRECT_ACCESS_WDATA_0

otp_ctrl.DIRECT_ACCESS_WDATA_1 @ 0x28

Write data for direct accesses. Hardware automatically determines the access granule (32bit or 64bit) based on which partition is being written to.

Reset default = 0x0, mask 0xffffffff
Register enable = DIRECT_ACCESS_REGWEN
31302928272625242322212019181716
DIRECT_ACCESS_WDATA_1...
1514131211109876543210
...DIRECT_ACCESS_WDATA_1
BitsTypeResetNameDescription
31:0rw0x0DIRECT_ACCESS_WDATA_1

For WORD1


otp_ctrl.DIRECT_ACCESS_RDATA_0 @ 0x2c

Read data for direct accesses. Hardware automatically determines the access granule (32bit or 64bit) based on which partition is read from.

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
DIRECT_ACCESS_RDATA_0...
1514131211109876543210
...DIRECT_ACCESS_RDATA_0
BitsTypeResetNameDescription
31:0ro0x0DIRECT_ACCESS_RDATA_0

otp_ctrl.DIRECT_ACCESS_RDATA_1 @ 0x30

Read data for direct accesses. Hardware automatically determines the access granule (32bit or 64bit) based on which partition is read from.

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
DIRECT_ACCESS_RDATA_1...
1514131211109876543210
...DIRECT_ACCESS_RDATA_1
BitsTypeResetNameDescription
31:0ro0x0DIRECT_ACCESS_RDATA_1

For WORD1


otp_ctrl.CHECK_TRIGGER_REGWEN @ 0x34

Register write enable for CHECK_TRIGGER.

Reset default = 0x1, mask 0x1
31302928272625242322212019181716
 
1514131211109876543210
  CHECK_TRIGGER_REGWEN
BitsTypeResetNameDescription
0rw0c0x1CHECK_TRIGGER_REGWEN

When cleared to 0, the CHECK_TRIGGER register cannot be written anymore. Write 0 to clear this bit.


otp_ctrl.CHECK_TRIGGER @ 0x38

Command register for direct accesses.

Reset default = 0x0, mask 0x3
Register enable = CHECK_TRIGGER_REGWEN
31302928272625242322212019181716
 
1514131211109876543210
  CONSISTENCY INTEGRITY
BitsTypeResetNameDescription
0r0w1c0x0INTEGRITY

Writing 1 to this bit triggers an integrity check. SW should monitor STATUS.CHECK_PENDING and wait until the check has been completed. If there are any errors, those will be flagged in the STATUS and ERR_CODE registers, and via the interrupts and alerts.

1r0w1c0x0CONSISTENCY

Writing 1 to this bit triggers a consistency check. SW should monitor STATUS.CHECK_PENDING and wait until the check has been completed. If there are any errors, those will be flagged in the STATUS and ERR_CODE registers, and via interrupts and alerts.


otp_ctrl.CHECK_REGWEN @ 0x3c

Register write enable for INTEGRITY_CHECK_PERIOD and CONSISTENCY_CHECK_PERIOD.

Reset default = 0x1, mask 0x1
31302928272625242322212019181716
 
1514131211109876543210
  CHECK_REGWEN
BitsTypeResetNameDescription
0rw0c0x1CHECK_REGWEN

When cleared to 0, INTEGRITY_CHECK_PERIOD and CONSISTENCY_CHECK_PERIOD registers cannot be written anymore. Write 0 to clear this bit.


otp_ctrl.CHECK_TIMEOUT @ 0x40

Timeout value for the integrity and consistency checks.

Reset default = 0x0, mask 0xffffffff
Register enable = CHECK_REGWEN
31302928272625242322212019181716
CHECK_TIMEOUT...
1514131211109876543210
...CHECK_TIMEOUT
BitsTypeResetNameDescription
31:0rw0x0CHECK_TIMEOUT

Timeout value in cycles for the for the integrity and consistency checks. If an integrity or consistency check does not complete within the timeout window, an error will be flagged in the STATUS register, an otp_error interrupt will be raised, and an fatal_check_error alert will be sent out. The timeout should be set to a large value to stay on the safe side. The maximum check time can be upper bounded by the number of cycles it takes to readout, scramble and digest the entire OTP array. Since this amounts to roughly 25k cycles, it is recommended to set this value to at least 100'000 cycles in order to stay on the safe side. A value of zero disables the timeout mechanism (default).


otp_ctrl.INTEGRITY_CHECK_PERIOD @ 0x44

This value specifies the maximum period that can be generated pseudo-randomly. Only applies to the HW_CFG and SECRET* partitions once they are locked.

Reset default = 0x0, mask 0xffffffff
Register enable = CHECK_REGWEN
31302928272625242322212019181716
INTEGRITY_CHECK_PERIOD...
1514131211109876543210
...INTEGRITY_CHECK_PERIOD
BitsTypeResetNameDescription
31:0rw0x0INTEGRITY_CHECK_PERIOD

The pseudo-random period is generated using a 40bit LFSR internally, and this register defines the bit mask to be applied to the LFSR output in order to limit its range. The value of this register is left shifted by 8bits and the lower bits are set to 8'hFF in order to form the 40bit mask. A recommended value is 0x3_FFFF, corresponding to a maximum period of ~2.8s at 24MHz. A value of zero disables the timer (default). Note that a one-off check can always be triggered via CHECK_TRIGGER.INTEGRITY.


otp_ctrl.CONSISTENCY_CHECK_PERIOD @ 0x48

This value specifies the maximum period that can be generated pseudo-randomly. This applies to the LIFE_CYCLE partition and the HW_CFG and SECRET* partitions once they are locked.

Reset default = 0x0, mask 0xffffffff
Register enable = CHECK_REGWEN
31302928272625242322212019181716
CONSISTENCY_CHECK_PERIOD...
1514131211109876543210
...CONSISTENCY_CHECK_PERIOD
BitsTypeResetNameDescription
31:0rw0x0CONSISTENCY_CHECK_PERIOD

The pseudo-random period is generated using a 40bit LFSR internally, and this register defines the bit mask to be applied to the LFSR output in order to limit its range. The value of this register is left shifted by 8bits and the lower bits are set to 8'hFF in order to form the 40bit mask. A recommended value is 0x3FF_FFFF, corresponding to a maximum period of ~716s at 24MHz. A value of zero disables the timer (default). Note that a one-off check can always be triggered via CHECK_TRIGGER.CONSISTENCY.


otp_ctrl.VENDOR_TEST_READ_LOCK @ 0x4c

Runtime read lock for the VENDOR_TEST partition.

Reset default = 0x1, mask 0x1
Register enable = DIRECT_ACCESS_REGWEN
31302928272625242322212019181716
 
1514131211109876543210
  VENDOR_TEST_READ_LOCK
BitsTypeResetNameDescription
0rw0c0x1VENDOR_TEST_READ_LOCK

When cleared to 0, read access to the VENDOR_TEST partition is locked. Write 0 to clear this bit.


otp_ctrl.CREATOR_SW_CFG_READ_LOCK @ 0x50

Runtime read lock for the CREATOR_SW_CFG partition.

Reset default = 0x1, mask 0x1
Register enable = DIRECT_ACCESS_REGWEN
31302928272625242322212019181716
 
1514131211109876543210
  CREATOR_SW_CFG_READ_LOCK
BitsTypeResetNameDescription
0rw0c0x1CREATOR_SW_CFG_READ_LOCK

When cleared to 0, read access to the CREATOR_SW_CFG partition is locked. Write 0 to clear this bit.


otp_ctrl.OWNER_SW_CFG_READ_LOCK @ 0x54

Runtime read lock for the OWNER_SW_CFG partition.

Reset default = 0x1, mask 0x1
Register enable = DIRECT_ACCESS_REGWEN
31302928272625242322212019181716
 
1514131211109876543210
  OWNER_SW_CFG_READ_LOCK
BitsTypeResetNameDescription
0rw0c0x1OWNER_SW_CFG_READ_LOCK

When cleared to 0, read access to the OWNER_SW_CFG partition is locked. Write 0 to clear this bit.


otp_ctrl.VENDOR_TEST_DIGEST_0 @ 0x58

Integrity digest for the VENDOR_TEST partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the VENDOR_TEST partition is locked and the digest becomes visible in this CSR.

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
VENDOR_TEST_DIGEST_0...
1514131211109876543210
...VENDOR_TEST_DIGEST_0
BitsTypeResetNameDescription
31:0ro0x0VENDOR_TEST_DIGEST_0

otp_ctrl.VENDOR_TEST_DIGEST_1 @ 0x5c

Integrity digest for the VENDOR_TEST partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the VENDOR_TEST partition is locked and the digest becomes visible in this CSR.

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
VENDOR_TEST_DIGEST_1...
1514131211109876543210
...VENDOR_TEST_DIGEST_1
BitsTypeResetNameDescription
31:0ro0x0VENDOR_TEST_DIGEST_1

For WORD1


otp_ctrl.CREATOR_SW_CFG_DIGEST_0 @ 0x60

Integrity digest for the CREATOR_SW_CFG partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the CREATOR_SW_CFG partition is locked and the digest becomes visible in this CSR.

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
CREATOR_SW_CFG_DIGEST_0...
1514131211109876543210
...CREATOR_SW_CFG_DIGEST_0
BitsTypeResetNameDescription
31:0ro0x0CREATOR_SW_CFG_DIGEST_0

otp_ctrl.CREATOR_SW_CFG_DIGEST_1 @ 0x64

Integrity digest for the CREATOR_SW_CFG partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the CREATOR_SW_CFG partition is locked and the digest becomes visible in this CSR.

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
CREATOR_SW_CFG_DIGEST_1...
1514131211109876543210
...CREATOR_SW_CFG_DIGEST_1
BitsTypeResetNameDescription
31:0ro0x0CREATOR_SW_CFG_DIGEST_1

For WORD1


otp_ctrl.OWNER_SW_CFG_DIGEST_0 @ 0x68

Integrity digest for the OWNER_SW_CFG partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the OWNER_SW_CFG partition is locked and the digest becomes visible in this CSR.

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
OWNER_SW_CFG_DIGEST_0...
1514131211109876543210
...OWNER_SW_CFG_DIGEST_0
BitsTypeResetNameDescription
31:0ro0x0OWNER_SW_CFG_DIGEST_0

otp_ctrl.OWNER_SW_CFG_DIGEST_1 @ 0x6c

Integrity digest for the OWNER_SW_CFG partition. The integrity digest is 0 by default. Software must write this digest value via the direct access interface in order to lock the partition. After a reset, write access to the OWNER_SW_CFG partition is locked and the digest becomes visible in this CSR.

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
OWNER_SW_CFG_DIGEST_1...
1514131211109876543210
...OWNER_SW_CFG_DIGEST_1
BitsTypeResetNameDescription
31:0ro0x0OWNER_SW_CFG_DIGEST_1

For WORD1


otp_ctrl.HW_CFG_DIGEST_0 @ 0x70

Integrity digest for the HW_CFG partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
HW_CFG_DIGEST_0...
1514131211109876543210
...HW_CFG_DIGEST_0
BitsTypeResetNameDescription
31:0ro0x0HW_CFG_DIGEST_0

otp_ctrl.HW_CFG_DIGEST_1 @ 0x74

Integrity digest for the HW_CFG partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
HW_CFG_DIGEST_1...
1514131211109876543210
...HW_CFG_DIGEST_1
BitsTypeResetNameDescription
31:0ro0x0HW_CFG_DIGEST_1

For WORD1


otp_ctrl.SECRET0_DIGEST_0 @ 0x78

Integrity digest for the SECRET0 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
SECRET0_DIGEST_0...
1514131211109876543210
...SECRET0_DIGEST_0
BitsTypeResetNameDescription
31:0ro0x0SECRET0_DIGEST_0

otp_ctrl.SECRET0_DIGEST_1 @ 0x7c

Integrity digest for the SECRET0 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
SECRET0_DIGEST_1...
1514131211109876543210
...SECRET0_DIGEST_1
BitsTypeResetNameDescription
31:0ro0x0SECRET0_DIGEST_1

For WORD1


otp_ctrl.SECRET1_DIGEST_0 @ 0x80

Integrity digest for the SECRET1 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
SECRET1_DIGEST_0...
1514131211109876543210
...SECRET1_DIGEST_0
BitsTypeResetNameDescription
31:0ro0x0SECRET1_DIGEST_0

otp_ctrl.SECRET1_DIGEST_1 @ 0x84

Integrity digest for the SECRET1 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
SECRET1_DIGEST_1...
1514131211109876543210
...SECRET1_DIGEST_1
BitsTypeResetNameDescription
31:0ro0x0SECRET1_DIGEST_1

For WORD1


otp_ctrl.SECRET2_DIGEST_0 @ 0x88

Integrity digest for the SECRET2 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
SECRET2_DIGEST_0...
1514131211109876543210
...SECRET2_DIGEST_0
BitsTypeResetNameDescription
31:0ro0x0SECRET2_DIGEST_0

otp_ctrl.SECRET2_DIGEST_1 @ 0x8c

Integrity digest for the SECRET2 partition. The integrity digest is 0 by default. The digest calculation can be triggered via the DIRECT_ACCESS_CMD. After a reset, the digest then becomes visible in this CSR, and the corresponding partition becomes write-locked.

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
SECRET2_DIGEST_1...
1514131211109876543210
...SECRET2_DIGEST_1
BitsTypeResetNameDescription
31:0ro0x0SECRET2_DIGEST_1

For WORD1


otp_ctrl.SW_CFG_WINDOW @ + 0x1000
512 item ro window
Byte writes are not supported
310
+0x1000 
+0x1004 
 ...
+0x17f8 
+0x17fc 

Any read to this window directly maps to the corresponding offset in the creator and owner software config partitions, and triggers an OTP readout of the bytes requested. Note that the transaction will block until OTP readout has completed.


Registers visible under device interface prim

Summary
Name Offset Length Description
otp_ctrl.CSR0 0x0 4

otp_ctrl.CSR1 0x4 4

otp_ctrl.CSR2 0x8 4

otp_ctrl.CSR3 0xc 4

otp_ctrl.CSR4 0x10 4

otp_ctrl.CSR5 0x14 4

otp_ctrl.CSR6 0x18 4

otp_ctrl.CSR7 0x1c 4

otp_ctrl.CSR0 @ 0x0

Reset default = 0x0, mask 0x7ff3ff7
31302928272625242322212019181716
  field4
1514131211109876543210
  field3   field2 field1 field0
BitsTypeResetNameDescription
0rw0x0field0

1rw0x0field1

2rw0x0field2

3Reserved
13:4rw0x0field3

15:14Reserved
26:16rw0x0field4


otp_ctrl.CSR1 @ 0x4

Reset default = 0x0, mask 0xffffffff
31302928272625242322212019181716
field4
1514131211109876543210
field3 field2 field1 field0
BitsTypeResetNameDescription
6:0rw0x0field0

7rw0x0field1

14:8rw0x0field2

15rw0x0field3

31:16rw0x0field4


otp_ctrl.CSR2 @ 0x8

Reset default = 0x0, mask 0x1
31302928272625242322212019181716
 
1514131211109876543210
  field0
BitsTypeResetNameDescription
0rw0x0field0


otp_ctrl.CSR3 @ 0xc

Reset default = 0x0, mask 0x7f3ff7
31302928272625242322212019181716
  field8 field7 field6 field5 field4 field3 field2
1514131211109876543210
  field1   field0
BitsTypeResetNameDescription
2:0rw1c0x0field0

3Reserved
13:4rw1c0x0field1

15:14Reserved
16rw1c0x0field2

17ro0x0field3

18ro0x0field4

19ro0x0field5

20ro0x0field6

21ro0x0field7

22ro0x0field8


otp_ctrl.CSR4 @ 0x10

Reset default = 0x0, mask 0x73ff
31302928272625242322212019181716
 
1514131211109876543210
  field3 field2 field1   field0
BitsTypeResetNameDescription
9:0rw0x0field0

11:10Reserved
12rw0x0field1

13rw0x0field2

14rw0x0field3


otp_ctrl.CSR5 @ 0x14

Reset default = 0x0, mask 0xffff3fff
31302928272625242322212019181716
field6
1514131211109876543210
  field5 field4 field3 field2 field1 field0
BitsTypeResetNameDescription
5:0rw0x0field0

7:6rw0x0field1

8ro0x0field2

11:9ro0x0field3

12ro0x0field4

13ro0x0field5

15:14Reserved
31:16rw0x0field6


otp_ctrl.CSR6 @ 0x18

Reset default = 0x0, mask 0xffff1bff
31302928272625242322212019181716
field3
1514131211109876543210
  field2 field1   field0
BitsTypeResetNameDescription
9:0rw0x0field0

10Reserved
11rw0x0field1

12rw0x0field2

15:13Reserved
31:16rw0x0field3


otp_ctrl.CSR7 @ 0x1c

Reset default = 0x0, mask 0xc73f
31302928272625242322212019181716
 
1514131211109876543210
field3 field2   field1   field0
BitsTypeResetNameDescription
5:0ro0x0field0

7:6Reserved
10:8ro0x0field1

13:11Reserved
14ro0x0field2

15ro0x0field3