Visible to Intel only — GUID: suc1410359169055
Ixiasoft
Visible to Intel only — GUID: suc1410359169055
Ixiasoft
7.1.3.1.1. Secure Fuses
The following table details the HPS security fuse bits sent by the CSS to the Security Manager and contained within the HPS_fusesec register. A "blown" fuse state is represented by a 1 in the HPS_fusesec register and a "not blown" fuse state is represented by a 0.
Bits |
Name | Description |
---|---|---|
31:27 | Reserved | Bit values in this field are undefined. |
26:23 | csel_f | This field indicates the value of the clock select fuses that are available for configuring the clock for the boot interface and for the PLLs. Refer to the Clock Configuration section for more information on CSEL encodings. |
22 | dbg_access_f | This fuse determines the initial state of the debug access domains. |
21 | dbg_lock_JTAG | This field indicates if the HPS JTAG access level can be changed through software when the HPS is released from reset.
|
20 | dbg_lock_DAP | This field indicates if the DAP access level can be changed through software when the HPS is released from reset.
|
19 | dbg_lock_CPU0 | This field indicates if the CPU0 debug access level can be changed through software when the HPS is released from reset.
|
18 | dbg_lock_CPU1 | This field indicates if the CPU1 debug access level can be changed through software when the HPS is released from reset.
|
17 | dbg_lock_CS | This field indicates if the CoreSight debug access level can be changed through software when the HPS is released from reset.
|
16 | dbg_lock_FPGA | This field indicates if the FPGA debug access level can be changed through software when the HPS is released from reset.
|
15:12 | Reserved | Bit values in this field are undefined. |
11 | clr_ram_order_f | This fuse value determines how RAMs are cleared during a tamper event.
|
10 | clr_ram_cold_f | This fuse value indicates what happens to the RAM on a cold reset.
|
9 | clr_ram_warm_f | This fuse value indicates what happens to the RAMs on a warm reset.
|
8 | oc_boot_f | This fuse value determines if the second-stage boot code is allowed to boot from on-chip RAM.
|
7 | hps_clk_f | This fuse value selects the clock used for the boot process and in the case of a tamper event, memory scrambling.
|
6 | fpga_boot_f | If blown, this fuse value allows the FPGA to configure independently and allows the HPS to boot from an encrypted next-stage boot source that was decrypted into the FPGA.
|
5 | aes_en_f | This fuse value indicates if a decryption of the flash image is always performed.
|
4:2 | kak_src_f | This bit field indicates the source of the Key Authorization Key (KAK) which can be in:
|
1 | kak_len_f | This fuse value indicates the Key Authorization Key (KAK) length:
|
0 | authen_en_f | This fuse value determines whether authentication of flash images is required prior to execution.
|
At initialization, the FPGA also receives fuse information that is pertinent to its configuration. The HPS can read this information through a secure serial interface, which shifts the FPGA fuse values into the fpga_fusesec register in the Security Manager. The CSS shifts in a 32-bit value although some of the bits are considered reserved.