sep_crypto

Integrate SEP cryptographic accelerators, Key Manager, eFuse, lifecycle, and entropy paths.

Hosts OTBN, AES, HMAC, KMAC, Adams Bridge (only when SEP_ABR_EN is defined; otherwise its apertures answer DECERR), Key Manager, eFuse, lifecycle, and the internal TRNG behind the local-crossbar slave and isolation handshake with sep_reset_ctrl. Three 2:1 muxes, one per ext_trng_src_sel_i bit, choose between external TRNG stream i and internal DRBG stream i: leg 0 feeds the Key Manager, leg 1 the AES, KMAC and OTBN EDN clients, and leg 2 the entropy pool. The unselected DRBG stream is held (tready low) and the unselected external stream is drained (tready high). The native EDN client for sep_entropy_fifo is served by u_axis_edn_pool_s3c_scan from the muxed pool AXI-Stream leg so the pool draws from either the internal DRBG or the external TRNG. trng_entropy_clear_o clears the fabric entropy pool while the internal TRNG reset is active. Each *_bus_err_o is set by a TL-UL error response on that block's register bridge; in sep they are ORed onto one PIC source (see sep_pkg::periph_bus_err_e). SEP_SEC_DISABLE_TOKEN is replaced at synthesis with the netlist-embedded token digest. External TRNG AXI-Lite/Stream and eFuse shim interfaces leave for sep_ip_integration.

Parameters

Table 1. Parameters
Name	Type	Default	Description
`LATCHED_MEM_RDATA`	`bit`	`1'b1`	1 if the Key Manager ROM and SRAM macros latch read data for look-ahead.
`MASKING_EN`	`bit`	`1'b1`	Enables 2-share DOM masking in the Adams Bridge engine.
`SRAM_LATENCY`	`int unsigned`	`1`	Adams Bridge SRAM read latency in cycles.
`EXT_TRNG_NUM_AXIS`	`int unsigned`	`3`	Number of external TRNG AXI-Stream ports and entropy muxes; must equal SepCryptoEdnEndpointCount (3).
`SEP_SEC_DISABLE_TOKEN`	`bit [255:0]`	`256'b0`	Netlist-embedded secure-disable token digest; replace at synthesis.

Ports

Table 2. Ports
Name	Direction	Type	Description
`clk_i`	input	`logic`	System clock.
`rst_ni`	input	`logic`	Active-low power-on reset for the interconnect, eFuse, lifecycle, alert receivers and post-mux EDN adapters.
`entropy_rosc_sample_clk_i`	input	`logic`	Ring-oscillator sample clock for entropy_source; asynchronous to clk_i.
`axil_sep_otp_jtag_req_i`	input	`sep_efuse_pkg::efuse_axil_req_t`	OTP debug AXI-Lite manager interface.
`axil_sep_otp_jtag_resp_o`	output	`sep_efuse_pkg::efuse_axil_resp_t`	Response from the eFuse wrapper to the OTP debug manager.
`sep_crypto_axi_req_i`	input	`sep_pkg::sep_32_64_6_12_axi_req_t`	Full AXI4 slave from local crossbar.
`sep_crypto_axi_resp_o`	output	`sep_pkg::sep_32_64_6_12_axi_resp_t`	Response from the crypto interconnect to the local crossbar.
`efuse_shim_axi_req_i`	input	`sep_pkg::sep_32_64_6_12_axi_req_t`	eFuse shim CSR leg, split out of the sep_external crossbar window.
`efuse_shim_axi_resp_o`	output	`sep_pkg::sep_32_64_6_12_axi_resp_t`	Response to the eFuse shim CSR leg, from the eFuse wrapper through the shim merge mux.
`entropy_source_irq_o`	output	`logic`	Entropy source interrupt.
`ext_trng_axil_req_o`	output	`sep_pkg::sep_32_32_axil_req_t`	External TRNG AXI-Lite passthrough (to sep_ip_integration).
`ext_trng_axil_resp_i`	input	`sep_pkg::sep_32_32_axil_resp_t`	Response from the external TRNG register interface.
`ext_trng_axis_req_i`	input	`sep_crypto_pkg::ext_trng_axis_req_t`	External TRNG AXI-Stream inputs (from sep_ip_integration).
`ext_trng_axis_rsp_o`	output	`sep_crypto_pkg::ext_trng_axis_rsp_t`	tready to each external TRNG stream: the consumer's tready when selected, held high to drain the stream when not.
`entropy_pool_edn_req_i`	input	`edn_pkg::edn_req_t`	Native EDN client of the SEP entropy-pool FIFO (sep_entropy_fifo) that refills the pool. Served by u_axis_edn_pool_s3c_scan from the muxed pool AXI-Stream leg, so the pool draws from either the internal DRBG or the external TRNG.
`entropy_pool_edn_rsp_o`	output	`edn_pkg::edn_rsp_t`	Entropy response to the pool's native EDN client, carrying the FIPS bit from the selected leg-2 stream.
`trng_entropy_clear_o`	output	`logic`	Clears the fabric entropy pool while the internal TRNG reset is active; synchronized to clk_i and high during power-on reset.
`efuse_bank_ctrl_req_o`	output	`sep_efuse_pkg::efuse_axil_req_t`	eFuse wrapper AXI-Lite requests to the eFuse shim CSRs.
`efuse_bank_ctrl_resp_i`	input	`sep_efuse_pkg::efuse_axil_resp_t`	Response from the eFuse shim CSRs.
`efuse_shim_command_req_o`	output	`sep_efuse_pkg::fuse_command_req_t`	eFuse read and program commands on the custom shim command interface.
`efuse_shim_command_resp_i`	input	`sep_efuse_pkg::fuse_command_resp_t`	Shim response to the eFuse commands.
`test_en_i`	input	`logic`	DFT test-enable (scan-enable).
`scan_rst_ni`	input	`logic`	DFT scan reset, active-low; bypasses the reset synchronizer.
`sep_reset_ni`	input	`logic`	Active-low SEP reset after the JTAG override, from sep_reset_ctrl; cold reset for the Key Manager.
`sep_intermediate_reset_no`	output	`logic`	Active-low SEP reset, synchronized to clk_i and released once fuse sense and the external boot sequence are done; to sep_reset_ctrl before the JTAG override.
`secure_tm_req_i`	input	`logic`	Secure test mode request strap, latched into secure_tm_o.
`ext_boot_seq_done_i`	input	`logic`	Integration boot-sequence completion (memory repair and SMC straps); gates release of sep_intermediate_reset_no.
`security_disable_o`	output	`logic`	Security-disable status from eFuse token processing, active-high; exported to the SMC.
`lc_state_o`	output	`logic [2*sep_pkg::LcStateBitWidth-1:0]`	Differentially encoded lifecycle state from the eFuse shadow registers; exported to the SMC.
`feat_ctrl_o`	output	`sep_efuse_pkg::sep_efuse_map_lc_disable_reg_t`	Per-feature enable vector (1 = enabled) derived from the LC state, the SiP and system disable fuses, and the DEMOTE registers; all ones while security is disabled, otherwise all zeros on an LC-state integrity error.
`dbg_disable_o`	output	`sep_lifecycle_ctrl_pkg::dbg_disable_t`	Per-interface debug disables for the DTP, active-high (1 = disabled).
`sep_fuse_dft_disable_o`	output	`logic`	Disables the SEP fuse DFT access path, active-high; no functional consumer, provided for DFT insertion.
`smc_fuse_dft_disable_o`	output	`logic`	Disables the SMC fuse DFT access path, active-high; no functional consumer, provided for DFT insertion.
`lc_sigint_err_o`	output	`logic`	Integrity error on the differentially encoded LC state; forces every feature enable off unless security is disabled.
`shadow_regs_o`	output	`sep_efuse_pkg::efuse_map_t`	eFuse shadow register contents; secret fields read as zero in secure test mode.
`fuse_sense_done_o`	output	`logic`	High once the shadow registers have been loaded from the fuses.
`secure_tm_o`	output	`logic`	Latched secure test mode, active-high; captured on the second clock edge after rst_ni release when security is disabled, otherwise on the rising edge of fuse sense done.
`km_rom_mem_req_o`	output	`km_intf_pkg::km_rom_mem_req_t`	Key Manager request to its 16 KiB ROM hard macro, instantiated at integration level.
`km_rom_mem_rsp_i`	input	`km_intf_pkg::km_rom_mem_rsp_t`	Read data from the Key Manager ROM hard macro to the Key Manager.
`km_sram_mem_req_o`	output	`km_intf_pkg::km_sram_mem_req_t`	Key Manager request to its 32 KiB SRAM hard macro, instantiated at integration level.
`km_sram_mem_rsp_i`	input	`km_intf_pkg::km_sram_mem_rsp_t`	Read data from the Key Manager SRAM hard macro to the Key Manager.
`km_mbox_irq_to_sep_o`	output	`logic`	Key Manager mailbox interrupt to the SEP host.
`km_unrecoverable_err_o`	output	`logic`	Key Manager unrecoverable fault, active-high: its CPU is in the trap state and no longer executing.
`km_recoverable_err_o`	output	`logic`	Key Manager recoverable-fault indication, from its KMCSR register bit.
`isolate_req_i`	input	`sep_pkg::sep_crypto_isolate_t`	Per-path isolation requests from sep_reset_ctrl, active-high.
`isolated_o`	output	`sep_pkg::sep_crypto_isolate_t`	Per-path isolation acknowledge to sep_reset_ctrl, same layout as isolate_req_i; a bit is high once that path is isolated and its outstanding transactions have drained.
`gated_rst_ni`	input	`sep_pkg::sep_sw_rst_t`	Isolation-sequenced software resets from sep_reset_ctrl (active-low).
`lcc_demote_state_1_o`	output	`logic [1:0]`	Differentially encoded DEMOTE_1.demote register bit, which re-opens debug feature bits [23:0] in TEST_DEV and PROD. Exported to the SMC.
`lcc_demote_state_2_o`	output	`logic [1:0]`	Differentially encoded DEMOTE_2.demote register bit, which re-opens debug feature bits [47:24] in TEST_DEV and PROD. Exported to the SMC.
`ext_trng_src_sel_i`	input	`logic [EXT_TRNG_NUM_AXIS-1:0]`	Per-leg entropy source select: 1 selects external TRNG stream i, 0 the internal DRBG stream i (from sep_cpu_ctrl via sep_system_csr).
`km_wipe_state_i`	input	`logic`	Key Manager emergency wipe control; a rising edge zeroes the Key Manager key state (from sep_cpu_ctrl via sep_system_csr).
`intr_hmac_done_o`	output	`logic`	HMAC done interrupt, to the SEP PIC.
`intr_hmac_fifo_empty_o`	output	`logic`	HMAC message FIFO empty interrupt.
`intr_hmac_err_o`	output	`logic`	HMAC error interrupt.
`intr_kmac_done_o`	output	`logic`	KMAC done interrupt, to the SEP PIC.
`intr_kmac_fifo_empty_o`	output	`logic`	KMAC message FIFO empty interrupt.
`intr_kmac_err_o`	output	`logic`	KMAC error interrupt.
`intr_cs_cmd_req_done_o`	output	`logic`	CSRNG command-request-done interrupt.
`intr_cs_entropy_req_o`	output	`logic`	CSRNG entropy-request interrupt.
`intr_cs_hw_inst_exc_o`	output	`logic`	CSRNG hardware-instance exception interrupt.
`intr_cs_fatal_err_o`	output	`logic`	CSRNG fatal-error interrupt.
`intr_edn_cmd_req_done_o`	output	`logic`	EDN command-request-done interrupt.
`intr_edn_fatal_err_o`	output	`logic`	EDN fatal-error interrupt.
`intr_otbn_done_o`	output	`logic`	OTBN done interrupt.
`intr_abr_error_o`	output	`logic`	Adams Bridge (PQC) error interrupt; held low when the engine is compiled out.
`intr_abr_notif_o`	output	`logic`	Adams Bridge notification interrupt, set on command completion; held low when the engine is compiled out.
`sep_crypto_pka_imem_sram_req_o`	output	`sep_crypto_pkg::sep_crypto_pka_imem_sram_req_t`	OTBN instruction-memory request to the external IMEM SRAM.
`sep_crypto_pka_imem_sram_rsp_i`	input	`sep_crypto_pkg::sep_crypto_pka_imem_sram_rsp_t`	Read data from the external OTBN IMEM SRAM.
`sep_crypto_pka_dmem_sram_req_o`	output	`sep_crypto_pkg::sep_crypto_pka_dmem_sram_req_t`	OTBN data-memory request to the external DMEM SRAM.
`sep_crypto_pka_dmem_sram_rsp_i`	input	`sep_crypto_pkg::sep_crypto_pka_dmem_sram_rsp_t`	Read data from the external OTBN DMEM SRAM.
`abr_mem_req_o`	output	`sep_crypto_pkg::abr_mem_req_t`	Adams Bridge (PQC) requests to its external SRAMs, whose macros live in sep_ip_integration; tied to zero when the engine is compiled out.
`abr_mem_rsp_i`	input	`sep_crypto_pkg::abr_mem_rsp_t`	Read data from the Adams Bridge external SRAMs.
`crypto_alert_o`	output	`logic`	Aggregated crypto alert: OR of the alert pulses and integrity failures of the 11 OpenTitan alert receivers (HMAC, OTBN, AES, KMAC, CSRNG, EDN).
`sep_efuse_debug_o`	output	`logic [9:0]`	eFuse controller debug flags: [0] shadow write locked, [1] shadow read locked, [2] program locked, [3] read locked, [4] write set-only, [5] LC-state access, [6] read timeout, [7] program timeout, [8] request error, [9] secure TM blocked.
`sep_efuse_token_match_sip_debug_o`	output	`logic [5:0]`	RMA SiP token match status code; 6'b010101 indicates a match.
`sep_efuse_token_match_chiplet_debug_o`	output	`logic [5:0]`	RMA chiplet token match status code; 6'b010101 indicates a match.
`locked_field_access_interrupt_o`	output	`logic`	Interrupt raised when an access targets a locked eFuse field.
`token_match_fault_o`	output	`logic`	Token Comparator Redundancy Fault Interrupt.
`aes_bus_err_o`	output	`logic`	Sticky AES register-bridge fault; held until aes_bus_err_clr_i.
`hmac_bus_err_o`	output	`logic`	Sticky HMAC register-bridge fault; held until hmac_bus_err_clr_i.
`kmac_bus_err_o`	output	`logic`	Sticky KMAC register-bridge fault; held until kmac_bus_err_clr_i.
`otbn_bus_err_o`	output	`logic`	Sticky OTBN register-bridge fault; held until otbn_bus_err_clr_i.
`csrng_bus_err_o`	output	`logic`	Sticky CSRNG register-bridge fault; held until csrng_bus_err_clr_i.
`edn_bus_err_o`	output	`logic`	Sticky EDN register-bridge fault; held until edn_bus_err_clr_i.
`aes_bus_err_clr_i`	input	`logic`	Single-cycle clear for aes_bus_err_o, pulsed by PERIPH_BUS_ERR_CLEAR.aes.
`hmac_bus_err_clr_i`	input	`logic`	Single-cycle clear for hmac_bus_err_o, pulsed by PERIPH_BUS_ERR_CLEAR.hmac.
`kmac_bus_err_clr_i`	input	`logic`	Single-cycle clear for kmac_bus_err_o, pulsed by PERIPH_BUS_ERR_CLEAR.kmac.
`otbn_bus_err_clr_i`	input	`logic`	Single-cycle clear for otbn_bus_err_o, pulsed by PERIPH_BUS_ERR_CLEAR.otbn.
`csrng_bus_err_clr_i`	input	`logic`	Single-cycle clear for csrng_bus_err_o, pulsed by PERIPH_BUS_ERR_CLEAR.csrng.
`edn_bus_err_clr_i`	input	`logic`	Single-cycle clear for edn_bus_err_o, pulsed by PERIPH_BUS_ERR_CLEAR.edn.