Test Mode Entry

SECURE_TM selects the protected configuration required for secure scan tests. It does not authenticate a JTAG owner or enable debug access. Lifecycle state, SIP_DIS, SYS_DIS and the SEC_DIS override determine the debug and function bits of feat_ctrl_o; SECURE_TM does not qualify those bits.

1. Entry and Exit

Connect the chiplet’s TEST_EN strap to the SEP wrapper’s secure_tm_req_i. Hold it stable through reset release, fuse sensing and the test session. The entry contract requires the sampled SECURE_TM value to remain asserted until chiplet cold reset ends the session; software has no clear operation.

Table 1. Secure test-mode sampling in the SEP wrapper
Condition	Action
Cold reset asserted	Clear `SECURE_TM` to 0.
`SEC_DIS` asserted at the early capture point	Sample the strap on the second rising clock edge after wrapper cold-reset release.
Fuse-sense completion rises	Sample the strap, including when `SEC_DIS` is asserted.
Neither sampling event	Retain the sampled value.

The early capture counter saturates after that opportunity: asserting SEC_DIS later does not itself sample the strap. A subsequent fuse-sense completion can sample it again. The current wrapper loads the strap value at each sampling event; it is not a set-only latch. If the strap changes from 1 to 0 between captures, the later capture can clear SECURE_TM without reset. The stable-strap requirement is therefore necessary to meet the reset-only exit contract; that contract is not an unconditional hardware guarantee for a changing strap.

2. Protection While Active

The secure-test configuration must enforce all four protections below. The adopter’s DFT integration remains responsible for secure-chain separation and command admission.

Table 2. Required secure-test protections
Protected resource	Requirement while `SECURE_TM=1`
Dedicated secure scan chain	Admit test commands only through an open, feature-gated scan path. Never admit dump commands. At `SECURE_TM=0`, admit no command on this chain.
Protection shadows	Block all updates to `LOCKS`, `LOCKS_SPARE`, `LC_STATE`, `SIP_DIS` and `SYS_DIS`.
OTP programming path	Hold the fuse macro’s write-enable inputs inactive.
Secret outputs	Disconnect `CHIPLET_UID`, `SIP_UID`, `SYS_UID` and `CLASS_KEY` from downstream consumers.

The eFuse controller implements request blocking and masks the designated secret shadow outputs to zero. Masking does not erase the stored fuse or shadow values, and register reads retain their normal access controls. It must not be treated as proof that every downstream consumer has been cleared. These protections allow testing without exposing persistent secrets that cannot be erased before RMA.

General scan chains follow their ordinary debug gates; the dedicated secure chain has the additional command restrictions above. For the normative scan classes and access rules, see secure_tm and the Secure Scan Chain.