lc_ctrl.rdl

// SPDX-License-Identifier: Apache-2.0
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

// Life-Cycle Controller Registers

addrmap lc_ctrl {
    reg {
        field {
            sw = w;
            desc = "Write 1 to trigger one alert event of this kind.";
        } FATAL_PROG_ERROR[0:0];
        field {
            sw = w;
            desc = "Write 1 to trigger one alert event of this kind.";
        } FATAL_STATE_ERROR[1:1];
        field {
            sw = w;
            desc = "Write 1 to trigger one alert event of this kind.";
        } FATAL_BUS_INTEG_ERROR[2:2];
    } ALERT_TEST @ 0x0;
    reg {
        field {
            sw = r;
            desc = "This bit is set to 1 if the life cycle controller has successfully initialized and the state exposed in LC_STATE and LC_TRANSITION_CNT is valid.";
        } INITIALIZED[0:0];
        field {
            sw = r;
            desc = "This bit is set to 1 if the life cycle controller has successfully initialized and is ready to accept a life cycle transition command.";
        } READY[1:1];
        field {
            sw = r;
            desc = "This bit is set to 1 if the clock manager has successfully switched to the external clock due to EXT_CLOCK_EN being set to 1.";
        } EXT_CLOCK_SWITCHED[2:2];
        field {
            sw = r;
            desc = "This bit is set to 1 if the last life cycle transition request was successful. Note that each transition attempt increments the LC_TRANSITION_CNT and moves the life cycle state into POST_TRANSITION.";
        } TRANSITION_SUCCESSFUL[3:3];
        field {
            sw = r;
            desc = "This bit is set to 1 if the LC_TRANSITION_CNT has reached its maximum. If this is the case, no more state transitions can be performed. Note that each transition attempt increments the LC_TRANSITION_CNT and moves the life cycle state into POST_TRANSITION.";
        } TRANSITION_COUNT_ERROR[4:4];
        field {
            sw = r;
            desc = "This bit is set to 1 if the last transition command requested an invalid state transition (e.g. DEV -> RAW). Note that each transition attempt increments the LC_TRANSITION_CNT and moves the life cycle state into POST_TRANSITION.";
        } TRANSITION_ERROR[5:5];
        field {
            sw = r;
            desc = "This bit is set to 1 if the token supplied for a conditional transition was invalid. Note that each transition attempt increments the LC_TRANSITION_CNT and moves the life cycle state into POST_TRANSITION.";
        } TOKEN_ERROR[6:6];
        field {
            sw = r;
            desc = "This bit is set to 1 if flash failed to correctly respond to an RMA request. Note that each transition attempt increments the LC_TRANSITION_CNT and moves the life cycle state into POST_TRANSITION.";
        } FLASH_RMA_ERROR[7:7];
        field {
            sw = r;
            desc = "This bit is set to 1 if an error occurred during an OTP programming operation. This error will move the life cycle state automatically to POST_TRANSITION and raise a fatal_prog_error alert.";
        } OTP_ERROR[8:8];
        field {
            sw = r;
            desc = "This bit is set to 1 if either the controller FSM state or the life cycle state is invalid or has been corrupted as part of a tampering attempt. This error will move the life cycle state automatically to INVALID and raise a fatal_state_error alert.";
        } STATE_ERROR[9:9];
       field {
            sw = r;
            desc = "This bit is set to 1 if a fatal bus integrity fault is detected. This error triggers a fatal_bus_integ_error alert.";
        } BUS_INTEG_ERROR[10:10];
       field {
            sw = r;
            desc = "This bit is set to 1 if the life cycle partition in OTP is in error state. This bit is intended for production testing during the RAW life cycle state, where the OTP control and status registers are not accessible. This error does not trigger an alert in the life cycle controller.";
        } OTP_PARTITION_ERROR[11:11];
    } STATUS @ 0x4;

    reg {
        desc = "Register write enable for the hardware mutex register.";
        default sw = rw;
        default onwrite = wzc;
        field {
            desc = "This bit is managed by software and is set to 1 by default. When cleared to 0, the CLAIM_TRANSITION_IF mutex register cannot be written to anymore. Write 0 to clear this bit.";
            reset = 0x1;
        } REGWEN [0:0];
    } CLAIM_TRANSITION_IF_REGWEN @ 0x8;

    reg {
        desc = "Hardware mutex to claim exclusive access to the transition interface.";
        default sw = rw;
        field {
            desc = "Mutex";
            reset = 0x69;
        } MUTEX [7:0];
    } CLAIM_TRANSITION_IF @ 0xC;

    CLAIM_TRANSITION_IF.MUTEX -> swwe = CLAIM_TRANSITION_IF_REGWEN.REGWEN;

    reg {
        desc = "Register write enable for the hardware mutex register.";
        default sw = r;
        field {
            desc = "This bit is managed by software and is set to 1 by default. When cleared to 0, the CLAIM_TRANSITION_IF mutex register cannot be written to anymore. Write 0 to clear this bit.";
        } REGWEN [0:0];
    } TRANSITION_REGWEN @ 0x10;

    reg {
        desc = "Command register for state transition requests.";
        default sw = rw;
        default onwrite = woset;
        default onread = rclr;
        field {
            desc = "Start";
        } START [0:0];
    } TRANSITION_CMD @ 0x14;

    TRANSITION_CMD.START -> swwe = TRANSITION_REGWEN.REGWEN;

    reg {
        desc = "Control register for state transition requests.";
        field {
            desc = "When set to 1, the OTP clock will be switched to an externally supplied clock right away when the device is in a non-PROD life cycle state. The clock mux will remain switched until the next system reset.";
            onwrite = woclr;
            sw = rw;
        } EXT_CLOCK_EN [0:0];
        field {
            desc = "Volatile raw unlock";
            sw = rw;
        } VOLATILE_RAW_UNLOCK [1:1];
    } TRANSITION_CTRL @ 0x18;

    TRANSITION_CTRL.EXT_CLOCK_EN -> swwe = TRANSITION_REGWEN.REGWEN;
    TRANSITION_CTRL.VOLATILE_RAW_UNLOCK -> swwe = TRANSITION_REGWEN.REGWEN;

    reg transition_token_t {
        desc = "128bit token for conditional transitions. Make sure to set this to 0 for unconditional transitions. Note that this register is shared with the life cycle TAP/DMI interface. In order to have exclusive access to this register, SW must first claim the associated hardware mutex via CLAIM_TRANSITION_IF.";
        default sw = rw; // field prperty
        field { desc = "Transition token.";} TRANSITION_TOKEN [31:0];
    };

    transition_token_t TRANSITION_TOKEN_0 @ 0x1C;
    transition_token_t TRANSITION_TOKEN_1 @ 0x20;
    transition_token_t TRANSITION_TOKEN_2 @ 0x24;
    transition_token_t TRANSITION_TOKEN_3 @ 0x28;

    TRANSITION_TOKEN_0.TRANSITION_TOKEN -> swwe = TRANSITION_REGWEN.REGWEN;
    TRANSITION_TOKEN_1.TRANSITION_TOKEN -> swwe = TRANSITION_REGWEN.REGWEN;
    TRANSITION_TOKEN_2.TRANSITION_TOKEN -> swwe = TRANSITION_REGWEN.REGWEN;
    TRANSITION_TOKEN_3.TRANSITION_TOKEN -> swwe = TRANSITION_REGWEN.REGWEN;

    reg {
        desc = "This register exposes the decoded life cycle state.";
        field {
            desc = "This field encodes the target life cycle state in a redundant enum format. The 5bit state enum is repeated 6x so that it fills the entire 32bit register. The encoding is straightforward replication: [val, val, val, val, val, val].";
            sw = rw;
        } STATE [29:0];
    } TRANSITION_TARGET @ 0x2C;

    TRANSITION_TARGET.STATE-> swwe = TRANSITION_REGWEN.REGWEN;

    reg {
        desc = "Test/vendor-specific settings for the OTP macro wrapper. These values are only active during RAW, TEST_* and RMA life cycle states. In all other states, these values will be gated to zero before sending them to the OTP macro wrapper - even if this register is programmed to a non-zero value.";
        field {
            desc = "OTP vendor test control";
            sw = rw;
        } OTP_VENDOR_TEST_CTRL [31:0];
    } OTP_VENDOR_TEST_CTRL @ 0x30;

    OTP_VENDOR_TEST_CTRL.OTP_VENDOR_TEST_CTRL-> swwe = TRANSITION_REGWEN.REGWEN;

    reg {
        desc = "Test/vendor-specific settings for the OTP macro wrapper. These values are only active during RAW, TEST_* and RMA life cycle states. In all other states, these values will read as zero.";
        field {
            desc = "OT vendor test control";
            sw = r;
        } OTP_VENDOR_TEST_STATUS [31:0];
    } OTP_VENDOR_TEST_STATUS @ 0x34;

    reg {
        desc = "This register exposes the decoded life cycle state.";
        field {
            desc = "OT vendor test control";
            sw = r;
        } STATE [29:0];
    } LC_STATE @ 0x38;

    reg {
        desc = "This register exposes the state of the decoded life cycle transition counter.";
        field {
            desc = "OT vendor test control";
            sw = r;
        } CNT [4:0];
    } LC_TRANSITION_CNT @ 0x3C;

    reg {
        desc = "This register exposes the id state of the device.";
        field {
            desc = "OT vendor test control";
            sw = r;
        } CNT [31:0];
    } LC_ID_STATE @ 0x40;

    reg {
        desc = "This register holds the SILICON_CREATOR_ID and the PRODUCT_ID.";
        field {
            desc = "Used to identify a class of devices. Assigned by the Silicon Creator. Zero is an invalid value.";
            sw = r;
        } PRODUCT_ID [15:0];
        field {
            desc = "ID of the silicon creator. Assigned by the OpenTitan project. Zero is an invalid value.";
            sw = r;
        } SILICON_CREATOR_ID [31:16];
    } HW_REVISION0 @ 0x44;

    reg {
        desc = "This register holds the REVISION_ID.";
        field {
            desc = "Product revision ID. Assigned by the Silicon Creator. The encoding is not specified other than that different tapeouts must be assigned different revision numbers. I.e., each base or metal layer respin must be reflected so that software can rely on it to modify firmware and driver behavior. Zero is an invalid value.";
            sw = r;
        } REVISION_ID [7:0];
        field {
            desc = "Reserved bits. Set to zero.";
            reset = 0x0;
            sw = r;
        } RESERVED [31:8];
    } HW_REVISION1 @ 0x48;

    reg device_id_t {
        desc = "This is the 256bit DEVICE_ID value that is stored in the HW_CFG0 partition in OTP. If this register reads all-one, the HW_CFG0 partition has not been initialized yet or is in error state. If this register reads all-zero, this is indicative that the value has not been programmed to OTP yet.";
        default sw = r; // field prperty
        field { desc = "Device ID.";} DEVICE_ID [31:0];
    };

    device_id_t DEVICE_ID_0 @ 0x4C;
    device_id_t DEVICE_ID_1 @ 0x50;
    device_id_t DEVICE_ID_2 @ 0x54;
    device_id_t DEVICE_ID_3 @ 0x58;
    device_id_t DEVICE_ID_4 @ 0x5C;
    device_id_t DEVICE_ID_5 @ 0x60;
    device_id_t DEVICE_ID_6 @ 0x64;
    device_id_t DEVICE_ID_7 @ 0x68;

    reg manuf_state_t {
        desc = "This is a 256bit field used for keeping track of the manufacturing state.";
        default sw = r; // field prperty
        field { desc = "Manufacturing state.";} MANUF_STATE [31:0];
    };

    manuf_state_t MANUF_STATE_0 @ 0x6C;
    manuf_state_t MANUF_STATE_1 @ 0x70;
    manuf_state_t MANUF_STATE_2 @ 0x74;
    manuf_state_t MANUF_STATE_3 @ 0x78;
    manuf_state_t MANUF_STATE_4 @ 0x7C;
    manuf_state_t MANUF_STATE_5 @ 0x80;
    manuf_state_t MANUF_STATE_6 @ 0x84;
    manuf_state_t MANUF_STATE_7 @ 0x88;
};