km_csr
Wrap the PeakRDL-generated km_csr_reg block with the Key Manager control/status (KMCSR) hardware logic.
Custom logic around the register block:
- IRQ aggregation: combines the twelve sticky interrupt sources (ROM and SRAM parity errors, ROM write error, SRAM write-lock violation, AXI SLVERR and DECERR, DRBG error, wipe, OTP change, OTP signal-integrity error, execute and ROM access violations) with per-source enable masking into the single CPU interrupt km_irq_o; IRQ_SET sets any source for testing.
- Scrambler lock: write-once lock for the SCRAMBLER_KEY and SCRAMBLER_CTRL registers; once locked, SCRAMBLER_KEY reads return zero and ignores writes, SCRAMBLER_CTRL reads show lock and enable set, and scrambler_key_o keeps the key held at lock time.
- OTP data capture and read-through: OTP register values reflect the registered differential values, read as zero for any field locked in OTP_READ_LOCK or OTP_READ_LOCK_COLD; encoded changes and dual-rail signal-integrity errors raise sticky status and interrupts.
- Soft reset: generation guarded by the magic code 0x53525354 in SOFT_RST_CODE.
- Virtual UART and test protocol register plumbing.
Reset domains:
- cold_rst_ni (AASD) resets the SRAM scrambler lock/key/enable (SCRAMBLER_CTRL.lock, SCRAMBLER_KEY), the VUART edge detect, the OTP captures and decoders, and the entire regblock via arst_n. Cold reset always implies warm reset.
- warm_rst_ni (synchronous) resets soft_rst_q, the OTP identity and class-key captures, and the regblock CPUIF plus all warm-tagged fields via WARM_RST_N, including IRQ_STATUS/IRQ_ENABLE/IRQ_SET, SOFT_RST_CODE, RECOVERABLE_ERR, BOOT_STATUS, SRAM_LOCK (write-lock bits), SRAM_WRITE_LOCK_VIOLATION, SRAM_EXEC_MODE (execute-permission whitelist mode), IRQ_ENTRY_ADDR/IRQ_ENTRY_LOCK, OTP_READ_LOCK, OTP_CHANGE_STATUS, the VUART registers, and the firmware test-bench registers. The OTP life-cycle and demotion captures and OTP_READ_LOCK_COLD survive warm reset. Warm reset breaks the soft reset trigger loop and quiesces the AXI CPUIF state machine.
Ports
| Name | Direction | Type | Description |
|---|---|---|---|
clk_i | input | logic | System clock. |
cold_rst_ni | input | logic | Cold reset: async-assert/sync-deassert (AASD). |
warm_rst_ni | input | logic | Warm reset: fully synchronous (from km_reset_conditioner). |
axil_req_i | input | axil_req_t | AXI4-Lite slave request from the crossbar. |
axil_resp_o | output | axil_resp_t | AXI4-Lite slave response to the crossbar. |
rom_parity_err_i | input | logic | IRQ event: ROM parity error (pulse). |
sram_parity_err_i | input | logic | IRQ event: SRAM parity error (pulse). |
rom_write_err_i | input | logic | IRQ event: ROM write attempt detected (pulse). |
axi_slverr_i | input | logic | IRQ event: AXI SLVERR error (pulse). |
axi_decerr_i | input | logic | IRQ event: AXI DECERR error (pulse). |
drbg_err_i | input | logic | IRQ event: DRBG sampler error (pulse). |
wipe_state_i | input | logic | IRQ event: wipe state; sets the sticky IRQ while high. |
scrambler_key_o | output | logic [31:0] | Scrambler key; frozen at its lock-time value once locked. |
scrambler_enable_o | output | logic | SRAM scrambler enable to the CPU wrapper, from SCRAMBLER_CTRL.ENABLE; forced high once locked. |
scrambler_lock_o | output | logic | Scrambler lock status. |
sram_lock_bits_o | output | logic [31:0] | Write-1-only SRAM write-lock bits to the SRAM interface; bit[i]=1 locks region i. |
sram_write_lock_violation_region_i | input | logic [31:0] | SRAM write-lock violation from the SRAM interface: one-hot region that had an attempted write while locked. |
sram_exec_mode_o | output | logic | SRAM execute-permission mode to the CPU wrapper: 0=ROM-only whitelist, 1=write-locked-SRAM whitelist. |
exec_violation_i | input | logic | Execute-permission whitelist violation from the CPU wrapper: pulse when a fetch is outside the whitelist. |
rom_access_violation_i | input | logic | ROM lockout violation from the CPU wrapper: pulse on a ROM fetch or read after lockout engages. |
km_irq_o | output | logic | Aggregated IRQ output to the CPU: OR of IRQ_STATUS masked by IRQ_ENABLE. |
irq_entry_addr_o | output | logic [31:0] | Programmable IRQ entry address to the CPU wrapper (PicoRV32); write-locked by IRQ_ENTRY_LOCK. |
soft_rst_o | output | logic | Soft reset output to the conditioner, active-low; goes low once SOFT_RST_CODE holds the magic code and returns high on warm reset. |
recoverable_err_o | output | logic | Recoverable-error level from the firmware-written RECOVERABLE_ERR register. |
vuart_tx_data_o | output | logic [7:0] | Virtual UART TX byte data; firmware writes the byte and the testbench captures it. |
vuart_tx_valid_o | output | logic | Virtual UART TX data valid strobe, one cycle on each rising edge of VUART_TX.DATA_VALID. |
vuart_rx_data_i | input | logic [7:0] | Virtual UART RX byte; the testbench writes it and firmware reads it. |
vuart_rx_valid_i | input | logic | Virtual UART RX data valid, mirrored into VUART_RX and VUART_STATUS. |
tb_result_o | output | logic [31:0] | Test protocol, firmware to testbench: test result (0=fail, 1=pass). |
tb_signature_o | output | logic [31:0] | Test protocol: test completion signature. |
tb_errcode_o | output | logic [31:0] | Test protocol: error code. |
tb_subtest_o | output | logic [31:0] | Test protocol: current subtest number. |
tb_cmd_o | output | logic [31:0] | Test protocol: command from firmware. |
tb_cmd_arg_o | output | logic [31:0] | Test protocol: command argument from firmware. |
tb_cmd_next_i | input | logic [31:0] | Test protocol, testbench to firmware: loaded into TB_CMD on every cycle without a firmware write, so the testbench clears a command by driving zero. |
tb_cmd_status_i | input | logic [31:0] | Test protocol: command status from the testbench. |
tb_cmd_result_i | input | logic [31:0] | Test protocol: command result from the testbench. |
otp_data_i | input | km_otp_data_t | Differentially encoded SEP OTP data, registered before decode and readback. |