Memory Map and Register Reference

1. Memory Map

SEP uses 32-bit addressing. The following table outlines the SEP CPU’s logical view of the SEP-local address space. External masters use the chiplet-global base programmed in SEP_GLOBAL_BASE_ADDR; SEP CPU software uses either direct internal addresses (0x1000_0000, 0x1080_0000, and so on) or the local alias view described below.

Table 1. SEP CPU Logical Address Space
Base Address	End Address	Size	Unit	Description
0x00000000	0x0FFFFFFF	256 MiB	External	External to the chiplet but outside SMU.
0x10000000	0x1FFFFFFF	256 MiB	SEP Local	Direct SEP-local resources.
0x20000000	0x3FFFFFFF	512 MiB	SEP External	Reserved adopter extension aperture.
0x40000000	0x7FFFFFFF	1 GiB	SMC	SMC resources.
0x80000000	0xBFFFFFFF	1 GiB	SMU	SMU resources, including DTP.
0xC0000000	0xCFFFFFFF	256 MiB	SEP CPU Resources	EL2 ICCM, DCCM, and interrupt-controller resources.
0xD0000000	0xFFFFFFFF	768 MiB	SEP Local Alias	CPU-local alias of the direct 0x10000000–0x3FFFFFFF range.

The SEP Local Alias row is an alternate CPU-side name for the same hardware listed in the SEP Local and SEP External rows. For example, 0xD000_0000 aliases 0x1000_0000 and 0xD080_2000 aliases 0x1080_2000. This alias range is used by SEP-local masters, while external masters use chiplet-global addresses.

The EL2 CPU resources are mapped into a separate segment than the SEP Local resources due to constraints on the CPU memory map. The ICCM, DCCM, and PIC addresses in the 0xC000_0000 region are statically configured in the CPU core module and are reached through the CPU’s internal wiring. The high local-alias mapping covers the 0xD000_0000 and above alias view. CPU CSRs are accessed with dedicated RISC-V instructions and do not appear in the address map.

The high local alias span has a fixed SEP-local size of 768 MiB (0xD000_0000 through 0xFFFF_FFFF), corresponding to the direct internal range 0x1000_0000 through 0x3FFF_FFFF. The chiplet-global SEP aperture configured by SEP_GLOBAL_BASE_ADDR / SEP_REGION_SIZE controls the SMU xbar and inbound global-to-local remap.

Table 2. SEP EL2 CPU Resources
Base Address	End Address	Size	Unit	Description
0xC0000000	0xC003FFFF	256 KiB	ICCM	Tightly coupled instruction SRAM for the SEP CPU.
0xC0040000	0xC005FFFF	128 KiB	DCCM	Tightly coupled data SRAM for the SEP CPU.
0xC0060000	0xC007FFFF	128 KiB	Reserved	Reserved
0xC0080000	0xC0087FFF	32 KiB	PIC	VeeR EL2 Programmable Interrupt Controller (PIC) memory-mapped registers. Supports up to PIC_TOTAL_INT external interrupt sources with 15 priority levels.
0xC0088000	0xCFFFFFFF	261600 KiB	Reserved	Reserved

The remaining subsystems are mapped into regions 1 and 2 for the EL2 CPU.

Each row below is the aperture reserved for a unit, and the Decoded Extent column gives the part of it that registers or memory back. The last two columns state how SEP answers a 32-bit access that no register or memory backs, as seen at its inbound AXI port, and Decode Response Codes defines them and their codes.

The TRNG aperture is forwarded in full to an adopter-defined external IP. SEP does not decode offsets inside that window, so every access reaches the external TRNG slave. Intra-aperture decode is then an integrator constraint: when an adopter TRNG is connected, an address that owns no register must return an error and must not alias onto a live register. When no external TRNG is connected, the window is terminated with a DECERR slave, so single-beat reads and writes both return DECERR, refuse the access and never alias onto a live register. See the Integrator Guide.

2. Single-Beat Register Access

Register regions support single-beat transactions only. Bursts are supported into ICCM, DCCM, SRAM, the extension port and the outbound SMN windows. The fabric routes a burst on its first address only, so the later beats of a burst to a register region may be answered with errors or alias onto other registers. The crypto region, which spans OTBN through ABR in the generated memory map below, refuses bursts (Single-Beat Access Only).

3. Units Unreachable from the Inbound Port

Several SEP units are not connected to the external inbound port and answer DECERR to any external access attempt. These units include the Boot ROM, Reset Control, ICCM, DCCM, PIC, and AP/STEE remap regions. The inbound port serves the mailbox and system CSR windows, and forwards all other addresses below 0x4000_0000 (outside the mailbox and system CSR windows) to the SEP local crossbar. Addresses above 0x4000_0000 and the units listed above are not reachable through this external path and receive error responses from the smn_inbound port. Their rows in the table below state what the SEP CPU sees.

Table 3. SEP Component Address Map
Base Address	End Address	Size	Decoded Extent	Unit	Description	Hole in Extent (R / W)	Past Extent (R / W)
0x10000000	0x1003FFFF	256 KiB	256 KiB	sep_sram	SEP scratch SRAM.	-	-
0x10040000	0x1004FFFF	64 KiB	64 KiB	sep_boot_rom	BL0 immutable instruction memory.	-	-
0x10050000	0x107FFFFF	7872 KiB	7872 KiB	Reserved	Reserved	DECERR, 0xBADCAB1E / DECERR	-
0x10800000	0x10800FFF	4 KiB	336 B	DMA Controller	Secure DMA control and status registers.	SLVERR, 0xFFFFFFFF / SLVERR^[1]	DECERR, 0xBADCAB1E / DECERR
0x10801000	0x10801FFF	4 KiB	56 B	Always-On Timer	Wakeup and watchdog timers running on a low-power, always-on clock	-	DECERR, 0xBADCAB1E / DECERR
0x10802000	0x1080203F	64 B	64 B	SEP Scratch Address Map	Cold-reset scratch register bank.	-	-
0x10802040	0x1080207F	64 B	64 B	Reserved	Reserved	DECERR, 0xBADCAB1E / DECERR	-
0x10802080	0x108020BF	64 B	64 B	SEP Scratch Address Map	Warm-reset scratch register bank.	-	-
0x108020C0	0x10802FFF	3904 B	3904 B	Reserved	Reserved	DECERR, 0xBADCAB1E / DECERR	-
0x10803000	0x10803FFF	4 KiB	8 B	SEP Reset Control Address Map	Software resets for KM, OTBN, AES, HMAC, KMAC, the internal TRNG, and Adams Bridge.	-	DECERR, 0xBADCAB1E / DECERR
0x10804000	0x108FFFFF	1008 KiB	1008 KiB	Reserved	Reserved	DECERR, 0xBADCAB1E / DECERR	-
0x10900000	0x1090FFFF	64 KiB	48 KiB	OpenTitan Big Number Accelerator	Programmable coprocessor for asymmetric cryptography with SCA and FI countermeasures	SLVERR, 0xFFFFFFFF / SLVERR	DECERR, 0xBADCAB1E / DECERR
0x10910000	0x10910FFF	4 KiB	140 B	AES Accelerator	AES block-cipher accelerator.	-	DECERR, 0xBADCAB1E / DECERR
0x10911000	0x10912FFF	8 KiB	8 KiB	HMAC Accelerator	Accelerator for SHA-2 256/384/512-based keyed HMAC and the hash function	SLVERR, 0xFFFFFFFF / SLVERR	-
0x10913000	0x10913FFF	4 KiB	4 KiB	KMAC Accelerator	Accelerator for Keccak-based keyed hash message authentication code and SHA-3 hash functions; with SCA and FI countermeasures	SLVERR, 0xFFFFFFFF / SLVERR	-
0x10914000	0x10914FFF	4 KiB	4 KiB	Reserved	Reserved	DECERR, 0xBADCAB1E / DECERR	-
0x10915000	0x109157FF	2 KiB	96 B	Cryptographically Secure Random Number Generator	Takes entropy bits to produce cryptographically secure random numbers for consumption by hardware blocks and by software	-	DECERR, 0xBADCAB1E / DECERR
0x10915800	0x10915FFF	2 KiB	72 B	Entropy Distribution Network	Distributes random numbers produced by CSRNG to hardware blocks	-	DECERR, 0xBADCAB1E / DECERR
0x10916000	0x10916FFF	4 KiB	380 B	Entropy Source Address Map	Entropy-source configuration, status, and data registers.	OKAY, 0x0 / OKAY	DECERR, 0xBADCAB1E / DECERR
0x10917000	0x10917FFF	4 KiB	4 KiB	External TRNG	External TRNG register passthrough; the register layout is adopter-defined	Adopter-defined^[2]	-
0x10918000	0x1091FFFF	32 KiB	24 B	SEP Lifecycle Control Address Map	Lifecycle state and transition control.	-	DECERR, 0xBADCAB1E / DECERR
0x10920000	0x10920FFF	4 KiB	28 B	Key Manager Mailbox SEP Side	Register interface for SEP host to access mailbox (write to inbound FIFO, read from outbound FIFO)	-	DECERR, 0xBADCAB1E / DECERR
0x10921000	0x1092FFFF	60 KiB	60 KiB	Reserved	Reserved	DECERR, 0xBADCAB1E / DECERR	-
0x10930000	0x109303FF	1 KiB	1 KiB	SEP eFuse Map Address Map	Cached eFuse shadow registers.	-	-
0x10930400	0x109304FF	256 B	28 B	eFuse Interface Control Address Map	eFuse command and status registers.	-	SLVERR, 0xBADCAB1E / SLVERR
0x10930500	0x109305FF	256 B	116 B	eFuse Token Registers Address Map	eFuse security-token registers.	-	DECERR, 0xBADCAB1E / DECERR
0x10930600	0x1093FFFF	64000 B	64000 B	Reserved	Reserved	DECERR, 0xBADCAB1E / DECERR	-
0x10940000	0x1094FFFF	64 KiB	49176 B	abr	Adams Bridge post-quantum accelerator for ML-DSA and ML-KEM.	OKAY, 0x0 / OKAY	DECERR, 0xBADCAB1E / DECERR
0x10950000	0x1095FFFF	64 KiB	24 B	SEP Entropy Pool	Read-only entropy pool FIFO; DATA reads drain conditioned entropy supplied by the native EDN, and writes return SLVERR.	-	SLVERR, 0x0 / SLVERR^[3]
0x10960000	0x109FFFFF	640 KiB	640 KiB	Reserved	Reserved	DECERR, 0xBADCAB1E / DECERR	-
0x10A00000	0x10A0FFFF	64 KiB	30800 B	SEP AXI-Lite Mailbox Wrapper Address Map	Eight bidirectional mailbox pairs.	SLVERR, 0x0 / SLVERR	SLVERR, 0x0 / SLVERR
0x10A10000	0x10A101FF	512 B	512 B	AXI Alias Remap Address Map	TLB Registers for address remapping and attribute tagging	OKAY, 0x0 / OKAY	-
0x10A10200	0x10A1027F	128 B	128 B	Output Remap Address Map	Address-translation registers that remap outbound transactions and tag their attributes.	-	-
0x10A10280	0x10A102FF	128 B	128 B	Reserved	Reserved	DECERR, 0xBADCAB1E / DECERR	-
0x10A10300	0x10A1037F	128 B	128 B	Output Remap Address Map	Address-translation registers that remap outbound transactions and tag their attributes.	-	-
0x10A10380	0x10A1FFFF	64640 B	64640 B	Reserved	Reserved	DECERR, 0xBADCAB1E / DECERR	-
0x10A20000	0x10A203FF	1 KiB	1 KiB	AXI Filter Control Address Map	Per-filter access-control registers defining permitted address ranges and transaction attributes.	OKAY, 0x0 / OKAY	-
0x10A20400	0x10A20FFF	3 KiB	3 KiB	Reserved	Reserved	DECERR, 0xBADCAB1E / DECERR	-
0x10A21000	0x10A211FF	512 B	512 B	AXI Filter Control Address Map	Per-filter access-control registers defining permitted address ranges and transaction attributes.	OKAY, 0x0 / OKAY	-
0x10A21200	0x10A2FFFF	60928 B	60928 B	Reserved	Reserved	DECERR, 0xBADCAB1E / DECERR	-
0x10A30000	0x10A31FFF	8 KiB	4104 B	SEP CPU Control Address Map	SEP CPU control and interrupt registers.	OKAY, 0x0 / OKAY	DECERR, 0xBADCAB1E / DECERR
0x10A32000	0x10AFFFFF	824 KiB	824 KiB	Reserved	Reserved	DECERR, 0xBADCAB1E / DECERR	-
0x10B00000	0x10BFFFFF	1 MiB	56 B	SPI Host	External I/O SPI controller bridge.	-	DECERR, 0xBADCAB1E / DECERR
0x10C00000	0x10FFFFFF	4 MiB	4 MiB	Reserved	Reserved	DECERR, 0xBADCAB1E / DECERR	-
0x11000000	0x117FFFFF	8 MiB	8 MiB	ap_region	Address region whose accesses an output remap redirects.	Forwarded	-
0x11800000	0x11FFFFFF	8 MiB	8 MiB	stee_region	Address region whose accesses an output remap redirects.	Forwarded	-
0x12000000	0x1FFFFFFF	224 MiB	224 MiB	Reserved	Reserved	DECERR, 0xBADCAB1E / DECERR	-
0x20000000	0x3FFFFFFF	512 MiB	512 MiB	SEP External	SEP external address map (eFuse SHIM control and execute-in-place window).	Adopter-defined	-
0xC0000000	0xC003FFFF	256 KiB	256 KiB	sep_iccm	Tightly coupled instruction SRAM for the SEP CPU.	-	-
0xC0040000	0xC005FFFF	128 KiB	128 KiB	sep_dccm	Tightly coupled data SRAM for the SEP CPU.	-	-
0xC0080000	0xC0087FFF	32 KiB	21 KiB	EL2_PIC	VeeR EL2 Programmable Interrupt Controller (PIC) memory-mapped registers. Supports up to PIC_TOTAL_INT external interrupt sources with 15 priority levels.	OKAY, 0x0 / OKAY	OKAY, 0x0 / OKAY

Notes

^[1] An access to an unmapped offset also latches PIC source 41.
^[2] With no TRNG fitted, the reference integration answers DECERR, 0xBADCAB1E / DECERR.
^[3] A 32-bit read of the upper word of a register also answers SLVERR, 0x0.

4. Detailed Register Map

The address tables above identify each aperture. Detailed registers are published with the owning block:

CPU — sep_cpu_ctrl.
Interrupts — el2_pic.
SEP Reset Controller — sep_reset_ctrl.
Life Cycle Controller (LCC) — sep_lifecycle_ctrl.
OTP Fuse Controller — sep_efuse_map.
Watchdog Timer (WDT) — aon_timer.
AES Cipher — aes.
HMAC-SHA2 — hmac.
KMAC-SHA3 — kmac.
OTBN PKA Public Key Accelerator — otbn.
TRNG and DRBG — csrng, edn.
Direct Memory Access (DMA) — secure_dma.
Serial Peripheral Interface (SPI) — spi_controller.
CPU scratch banks — sep_scratch.
Entropy Pool — sep_entropy_pool.
Entropy Source.
Key Manager — controller, KPV, sampler, mailboxes and key wrappers.
Shared eFuse IP — eFuse MMR and interface registers.

4.1. External Window Reference Model

The SEP external-window model supplies the eFuse SHIM control register below. The efuse_shim_ctrl instance at offset 0x0 fixes where that block sits. EFUSE_SHIM_SIZE bytes from that base (CFG.SEP_EFUSE_SHIM_SIZE at the SMU, default 0x4) are routed to the eFuse controller, which forwards them unchanged on efuse_bank_ctrl to the adopter’s SHIM rather than out the external port. An adopter external map must keep an efuse_shim_ctrl instance at that offset. Its execute-in-place region is a memory window rather than a register bank. Adopter-specific external devices require their own register documentation.

SEP External

SEP external address map (eFuse SHIM control and execute-in-place window).

Register List:

Address	Name	Access	Description
0x0	EFUSE_BANK_INIT_TIME	RW	eFuse bank initialization time. Number of cycles to wait for the OTP macro to initialize before sensing can begin.

Register Details:

EFUSE_BANK_INIT_TIME

Bits	Field	Access	Reset	Description
31:0	init_time	RW	0x20	Most OTP have a initialization time before sensing can be done