efuse_shadow_reg_access_control

Enforce per-field read and write locks on APB accesses to the shadow map.

Filter APB requests using efuse_field_map_i and locks_i before they reach the shadow regs.

LockVectorBits is 2*(EFUSE_FIELDS-1), with write-lock at 2n and read-lock at 2n+1 per real field. The LOCKS meta-field uses sentinel idx all-ones and is excluded from hw-lock checks.

Report write_locked_o, read_locked_o, write_setup_only_o, and lc_state_access_o. locked_field_access_interrupt_o signals locked-field hits.

Parameters

Table 1. Parameters
Name	Type	Default	Description
`EFUSE_ADDR_WIDTH`	`int unsigned`	`12`	Width of the MAP window byte offset on apb_req_paddr_i.
`EFUSE_FIELDS`	`int unsigned`	`1`	eFuse field-map entry count.
`HAS_LC_STATE`	`bit`	`1'b0`	Set for SEP: field index 0 is the lifecycle-state field, exempt from hardware locks and reported on lc_state_access_o.
`LockVectorBits`	`int unsigned`	`2 * (EFUSE_FIELDS - 1)`	Hardware lock bits: a write and a read lock per field, excluding the LOCKS meta-field.

Ports

Table 2. Ports
Name	Direction	Type	Description
`clk_i`	input	`logic`	System clock; not used, the module is combinational.
`rst_ni`	input	`logic`	Active-low reset; not used, the module is combinational.
`secure_tm_i`	input	`logic`	Secure test mode, active-high; adds each field's secure-test-mode lock to the write check.
`efuse_field_map_i`	input	`efuse_pkg::rule_t [EFUSE_FIELDS-1:0]`	Per-field byte ranges, lock indices, and software lock bits.
`apb_req_paddr_i`	input	`logic [EFUSE_ADDR_WIDTH-1:0]`	Byte offset within the MAP window, matched against the field byte ranges.
`apb_req_pprot_i`	input	`logic [2:0]`	APB protection attributes, forwarded unchanged.
`apb_req_psel_i`	input	`logic`	APB select for the MAP window.
`apb_req_penable_i`	input	`logic`	APB access phase; lock checks apply only while it and the select are high.
`apb_req_pwrite_i`	input	`logic`	APB transfer direction, high for a write.
`apb_req_pwdata_i`	input	`logic [31:0]`	Write data forwarded to the shadow registers when the access is allowed.
`apb_req_pstrb_i`	input	`logic [3:0]`	Byte lane enables for the write.
`apb_resp_o`	output	`efuse_apb_resp_t`	APB response; a locked access completes with read data 0xBADCAB1E and no slave error.
`apb_req_from_ac_o`	output	`efuse_apb_req_t`	APB request forwarded to the shadow registers; zero unless the access passes the lock checks.
`apb_resp_from_ac_i`	input	`efuse_apb_resp_t`	APB response from the shadow registers for accesses that pass the lock checks.
`write_locked_o`	output	`logic`	High during an APB write access to a field that is write locked by its hardware lock bit, its software lock bits, or its secure-test-mode lock.
`write_setup_only_o`	output	`logic`	High when the addressed field is set-only: writes may set bits but not clear them; low when its hardware write lock is set.
`lc_state_access_o`	output	`logic`	High when the address falls in the lifecycle-state field.
`read_locked_o`	output	`logic`	High when the addressed field is read locked by its hardware or software lock bit.
`locks_i`	input	`logic [LockVectorBits-1:0]`	Hardware lock bits from the shadow LOCKS words: write lock at 2n, read lock at 2n+1 for field n.
`locked_field_access_interrupt_o`	output	`logic`	High during an APB access that a lock blocks.