[otp_ctrl] Spurious FSM state transition during consistency/integrity check
@vogelpi is already working on this.
Since Apr 21, 2025.
- Dominant language
- SystemVerilog
- Stars
- 3.6k
- Forks
- 1.1k
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 141
Description
The otp_ctrl immediately starts a state consistency/integrity check upon setting a non-zero value
in the period registers (`CONSISTENCY_CHECK_PERIOD`, `INTEGRITY_CHECK_PERIOD`) during which
the `CHECK_PENDING` bit is asserted in the status register `STATUS`. This bit is driven by the current
state of the OTP LFSR timer module which asserts it whenever its state is either `CnstyWaitSt` or
`ÌntegWaitSt`. However, when transitioning between these two states the timer reverts back to `IdleSt`
for a single cycle which results in the `CHECK_PENDING` bit to be deasserted for one cycle as well.
Now, if firmware happens to read the status registers during this one cycle it will erroneously assume
that the OTP controller is idle even though the consistency/integrity check is still ongoing
(see screenshot below).
This issue doesn't arise when a check is triggered through the `CHECK_TRIGGER` register due to the
default value of the pending bit being the driven by this register.
https://github.com/lowRISC/opentitan/blob/47374bd4983e853fc677bb44bf00d049e1122295/hw/top_earlgrey/ip_autogen/otp_ctrl/rtl/otp_ctrl_lfsr_timer.sv#L263
Is the automatic check trigger by setting the period registers a required feature even in the presence
of the `CHECK_TRIGGER` register?

Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.