spi_device.hjson

// Copyright lowRISC contributors (OpenTitan project).
// Licensed under the Apache License, Version 2.0, see LICENSE for details.
// SPDX-License-Identifier: Apache-2.0
{
  name:               "spi_device",
  human_name:         "SPI Device",
  one_line_desc:      "Serial peripheral interface supporting different device modes, suitable for bulk-load of data into and out of the chip",
  one_paragraph_desc: '''
  SPI Device is a configurable, versatile hardware block that implements three modes (SPI Flash emulation mode, SPI passthrough mode, and TPM over SPI mode) to support a variety of different applications.
  TPM over SPI operates in compliance with TPM PC Client Platform, unloading this protocol from a software solution.
  SPI Flash emulation mode supports many JEDEC standard commands such as Read Status, Read JEDEC ID, Read SFDP, EN4B/EX4B, and multiple other read commands, allowing OpenTitan to provide, for example, verified boot firmware to other external devices.
  '''
  // Unique comportable IP identifier defined under KNOWN_CIP_IDS in the regtool.
  cip_id:             "26",
  design_spec:        "../doc",
  dv_doc:             "../doc/dv",
  hw_checklist:       "../doc/checklist",
  sw_checklist:       "/sw/device/lib/dif/dif_spi_device",
  revisions: [
    {
      version:            "0.5.0",
      life_stage:         "L1",
      design_stage:       "D1",
      verification_stage: "V1",
      dif_stage:          "S0",
      commit_id:          "553ca956e0204e5b67b3bbea47f2e067f60b5510",
      notes:              ""
    }
    { version:            "1.0.0",
      life_stage:         "L1",
      design_stage:       "D2S",
      verification_stage: "V2S",
      dif_stage:          "S2",
      commit_id:          "",
      notes:              ""
    }
    { version:            "2.0.0",
      life_stage:         "L1",
      design_stage:       "D2S",
      verification_stage: "V2S",
      dif_stage:          "S1",
      commit_id:          "",
      notes:              ""
    }
  ]
  clocking: [
    {clock: "clk_i", reset: "rst_ni", primary: true},
    // The scan_rst_ni port isn't listed here because it's generated by the
    // "scan_reset: true" below.
    {clock: "scan_clk_i"}
  ]
  bus_interfaces: [
    { protocol: "tlul", direction: "device" }
  ],
  available_input_list: [
    { name: "sck",     desc: "SPI Clock" },
    { name: "csb",     desc: "Chip Select#" },
    { name: "tpm_csb", desc: "TPM Chip Select#"}
  ],
  available_output_list: [
  ],
  available_inout_list: [
    { name: "sd",
      width: "4",
      desc: "SPI IO, IO2/IO3 has multi-purpose (/WP, /HOLD)"
    }
  ]
  interrupt_list: [
    { name: "upload_cmdfifo_not_empty"
      desc: "Upload Command FIFO is not empty"
    }
    { name: "upload_payload_not_empty"
      desc: '''Upload payload is not empty.

        The event occurs after SPI transaction completed
        '''
    }
    { name: "upload_payload_overflow"
      desc: '''Upload payload overflow event.

        When a SPI Host system issues a command with payload more than 256B,
        this event is reported. When it happens, SW should read the last
        written payload index CSR to figure out the starting address of the
        last 256B.
        '''
      type: "event"
    }
    { name: "readbuf_watermark"
      desc: '''Read Buffer Threshold event.

        The host system accesses greater than or equal to the threshold of a
        buffer.
        '''
    }
    { name: "readbuf_flip"
      desc: '''Read buffer flipped event.

        The host system accesses other side of buffer.
        '''
      type: "event"
    }
    { name: "tpm_header_not_empty"
      desc: "TPM Header(Command/Address) buffer available"
      type: "status"
    }
    { name: "tpm_rdfifo_cmd_end"
      desc: '''TPM RdFIFO command ended.

        The TPM Read command targeting the RdFIFO ended.
        Check TPM_STATUS.rdfifo_aborted to see if the transaction completed.
        '''
      type: "event"
    }
    { name: "tpm_rdfifo_drop"
      desc: '''TPM RdFIFO data dropped.

        Data was dropped from the RdFIFO.
        Data was written while a read command was not active, and it was not accepted.
        This can occur when the host aborts a read command.
        '''
      type: "event"
    }
  ],
  alert_list: [
    { name: "fatal_fault",
      desc: '''
      This fatal alert is triggered when a fatal TL-UL bus integrity fault is detected.
      '''
    }
  ],
  scan: "true",       // Enable `scanmode_i` port
  scan_reset: "true", // Enable `scan_rst_ni` port
  param_list: [
    { name:    "SramType"
      desc:    "Sram Entries. Word size is 32bit width."
      type:    "spi_device_pkg::sram_type_e"
      default: "spi_device_pkg::DefaultSramType"
      local:   "false"
      expose:  "true"
    }
    { name:    "SramDepth"
      desc:    "Sram Entries. Word size is 32bit width."
      type:    "int unsigned"
      default: "1024"
      local:   "true"
    }
    { name:    "SramEgressDepth"
      desc:    "Sram Egress Entries. Word size is 32bit width."
      type:    "int unsigned"
      default: "848"
      local:   "true"
    }
    { name:    "SramIngressDepth"
      desc:    "Sram Ingress Entries. Word size is 32bit width."
      type:    "int unsigned"
      default: "112"
      local:   "true"
    }
    { name:    "SramReadBufferOffset"
      desc:    "Sram eFlash read buffer offset (from egress buffer start). Word size is 32bit width."
      type:    "int unsigned"
      default: "0"
      local:   "true"
    }
    { name:    "SramReadBufferDepth"
      desc:    "Sram eFlash read buffer entries. Word size is 32bit width."
      type:    "int unsigned"
      default: "512"
      local:   "true"
    }
    { name:    "SramMailboxOffset"
      desc:    "Sram mailbox buffer offset (from egress buffer start). Word size is 32bit width."
      type:    "int unsigned"
      default: "512"
      local:   "true"
    }
    { name:    "SramMailboxDepth"
      desc:    "Sram mailbox entries. Word size is 32bit width."
      type:    "int unsigned"
      default: "256"
      local:   "true"
    }
    { name:    "SramSfdpOffset"
      desc:    "Sram SFDP buffer offset (from egress buffer start). Word size is 32bit width."
      type:    "int unsigned"
      default: "768"
      local:   "true"
    }
    { name:    "SramSfdpDepth"
      desc:    "Sram SFDP entries. Word size is 32bit width."
      type:    "int unsigned"
      default: "64"
      local:   "true"
    }
    { name:    "SramTpmRdFifoOffset"
      desc:    "Sram TPM RdFIFO offset (from egress buffer start). Word size is 32bit width."
      type:    "int unsigned"
      default: "832"
      local:   "true"
    }
    { name:    "SramTpmRdFifoDepth"
      desc:    "Sram TPM RdFIFO entries. Word size is 32bit width."
      type:    "int unsigned"
      default: "16"
      local:   "true"
    }
    { name:    "SramPayloadOffset"
      desc:    "Sram payload FIFO offset (from ingress buffer start). Word size is 32bit width."
      type:    "int unsigned"
      default: "0"
      local:   "true"
    }
    { name:    "SramPayloadDepth"
      desc:    "Sram payload FIFO entries. Word size is 32bit width."
      type:    "int unsigned"
      default: "64"
      local:   "true"
    }
    { name:    "SramCmdFifoOffset"
      desc:    "Sram command FIFO offset (from ingress buffer start). Word size is 32bit width."
      type:    "int unsigned"
      default: "64"
      local:   "true"
    }
    { name:    "SramCmdFifoDepth"
      desc:    "Sram command FIFO entries. Word size is 32bit width."
      type:    "int unsigned"
      default: "16"
      local:   "true"
    }
    { name:    "SramAddrFifoOffset"
      desc:    "Sram address FIFO offset (from ingress buffer start). Word size is 32bit width."
      type:    "int unsigned"
      default: "80"
      local:   "true"
    }
    { name:    "SramAddrFifoDepth"
      desc:    "Sram address FIFO entries. Word size is 32bit width."
      type:    "int unsigned"
      default: "16"
      local:   "true"
    }
    { name:    "SramTpmWrFifoOffset"
      desc:    "Sram TPM Write FIFO offset (from ingress buffer start). Word size is 32bit width."
      type:    "int unsigned"
      default: "96"
      local:   "true"
    }
    { name:    "SramTpmWrFifoDepth"
      desc:    "Sram TPM Write FIFO entries. Word size is 32bit width."
      type:    "int unsigned"
      default: "16"
      local:   "true"
    }
    { name:    "NumCmdInfo"
      desc:    "Define the number of Command Info slots."
      type:    "int unsigned"
      default: "24"
      local:   "true"
    }
    { name:    "NumLocality"
      desc:    "The number of locality TPM module supports."
      type:    "int unsigned"
      default: "5"
      local:   "true"
    } // p: NumLocality
    { name:    "TpmRdFifoPtrW"
      desc:    "TPM RdFIFO Pointer Bit Width. clog2(Depth(16+1))"
      type:    "int unsigned"
      default: "5"
      local:   "true"
    } // p: TpmRdFifoPtrW
    { name:    "TpmRdFifoWidth"
      desc:    "TPM Read FIFO Data Width. (TpmRdFifoWidth/8) shall be power of two"
      type:    "int unsigned"
      default: "32"
    } // p: TpmRdFifoWidth
  ],
  inter_signal_list: [
    { struct:  "ram_2p_cfg",
      package: "prim_ram_2p_pkg",
      type:    "uni",
      name:    "ram_cfg",
      act:     "rcv"
    }
    { struct:  "passthrough",
      package: "spi_device_pkg"
      type:    "req_rsp"
      name:    "passthrough",
      act:     "req"
    }
    { struct:  "logic"
      package: ""
      type:    "uni"
      name:    "mbist_en"
      act:     "rcv"
    }
    { struct:  "logic"
      package: ""
      type:    "uni"
      name:    "sck_monitor"
      act:     "req"
    }
  ],
  features: [
    {
      name: "SPI_DEVICE.MODE.FLASH_EMULATION",
      desc: '''Emulates the behaviour of a Serial Flash device when connected to an upstream SPI Host.
            In this mode, the block recognizes SPI Flash commands and can respond entirely in HW.
            '''
    }
    {
      name: "SPI_DEVICE.MODE.PASSTHROUGH",
      desc: '''The block acts as a proxy to a downstream external SPI Flash, with optional inline filtering and monitoring.

            In this mode, an upstream SPI Host communicates with a downstream external SPI Flash.
            Traffic received by this block is forwarded to a SPI_HOST instance, which then
            relays the traffic onto the downstream external SPI flash.
            Runtime-configurable filtering, payload interception, payload substitution and monitoring operations
            on the passthrough traffic are provided by the block.
            '''
    }
    {
      name: "SPI_DEVICE.MODE.TPM",
      desc: '''Acts as a device-side endpoint in compliance with TPM PC Client Platform over SPI.
            '''
    }
    {
      name: "SPI_DEVICE.HW.LANES",
      desc: '''1,2 or 4 lane operation is supported by the block.
            '''
    }
    {
      name: "SPI_DEVICE.HW.SERDES_ORDERING",
      desc: '''The block allows serialization ordering control for SDI/SDO that can be controlled at runtime.
            CSR.CFG.rx_order : "RX bit order on SDI. 0 for MSB first, 1 for LSB first."
            CSR.CFG.tx_order : "TX bit order on SDO. 0 for MSB first, 1 for LSB first.
            '''
    }
    {
      name: "SPI_DEVICE.HW.CSB_STATUS",
      desc: '''CSR.STATUS fields show the current status of the two CSB signals (.csb/.tpm_csb).
            '''
    }
    {
      name: "SPI_DEVICE.MODE.FLASH_EMULATION.COMMANDS",
      desc: '''Device should respond to all specified standard SPI Flash Commands.
            '''
    }
    {
      name: "SPI_DEVICE.HW.FLASH_EMULATION_BLOCKS",
      desc: '''Hardware contains a number of submodules for handling certain commands.
            cmdparse, READ, EN4B/EX4B, SFDP, JEDEC, status/busy

            - CSR.FLASH_STATUS contains SW-writable bits that define the response to a Read Status Register command.
            - Some fields in CSR.FLASH_STATUS may also be modified by HW.
              - WRDI/WREN commands modify the CSR.FLASH_STATUS.status.WEL bit.
              - CSR.FLASH_STATUS.status.BUSY may be modified by HW depending on command upload configuration of the
                CSR.CMDINFO[x].busy field.

            - CSR.JEDEC_CC and CSR.JEDEC_ID provide data for the JEDEC Read command.
            - The SFDP section of DPSRAM provides data for the Read SFDP command.
            '''
    }
    {
      name: "SPI_DEVICE.MODE.FLASH_EMULATION.READ_COMMAND_PROCESSOR",
      desc: '''SPI Flash Read commands are provided with data from a DPSRAM section with a ping-pong buffering scheme, or a fixed mailbox region.

            - The readptr crossing the buffer boundary creates a readbuf_flip interrupt.
            - The readptr crossing the offset CSR.READ_THRESHOLD within a buffer creates a readbuf_watermark interrupt.
            '''
    }
    {
      name: "SPI_DEVICE.MODE.FLASH_EMULATION.DUMMY_CYCLE",
      desc: '''Insertion of dummy cycles between SPI Flash opcode and data.
            '''
    }
    {
      name: "SPI_DEVICE.MODE.FLASH_EMULATION.WRITE_ENABLE_DISABLE",
      desc: '''The block supports SPI Flash WREN/WRDI commands from the external host.
            '''
    }
    {
      name: "SPI_DEVICE.HW.LAST_READ_ADDR",
      desc: '''The register CSR.LAST_READ_ADDR shows the last address a SPI Flash Read command accessed before CSb de-assertion.
            MODES : FLASH_EMULATION,PASSTHROUGH
            '''
    }
    {
      name: "SPI_DEVICE.HW.CMDINFOS",
      desc: '''Registers that can contain custom opcode + data for responding to SPI Flash Commands.
            '''
    }
    {
      name: "SPI_DEVICE.HW.COMMAND_UPLOAD",
      desc: '''HW can store the received command into the command/address FIFOs and payload buffer.
            MODES:FLASH_EMULATION,PASSTHROUGH

            - A received SPI Flash command can conditionally be written to the command,address and payload FIFOs.
            - SW can access data about the uploaded commands via CSR.UPLOAD_STATUS and CSR.UPLOAD_STATUS2.
            - SW can read CSR.UPLOAD_CMDFIFO to access the command FIFO.
            - SW can read CSR.UPLOAD_ADDRFIFO to access the address FIFO.
            - The payload FIFO can be read by accessing the DPSRAM window.
            '''
    }
    {
      name: "SPI_DEVICE.HW.3B4B_ADDRESSING",
      desc: '''Support CSR control of 3B/4B operation, plus host control with EN4B/EX4B
            '''
    }
    {
      name: "SPI_DEVICE.MODE.PASSTHROUGH.CMD_FILTER",
      desc: '''Passthrough logic filters the command based on the 256-bit value of the "CMD_FILTER_0" CSR.
            '''
    }
    {
      name: "SPI_DEVICE.MODE.PASSTHROUGH.ADDRESS_MANIPULATION",
      desc: '''By configuring ADDR_SWAP_MASK and ADDR_SWAP_DATA CSRs, certain address bits of Flash Commands can be overwritten on passthrough.
            '''
    }
    {
      name: "SPI_DEVICE.MODE.PASSTHROUGH.STATUS_MANIPULATION",
      desc: '''By configuring PAYLOAD_SWAP_MASK and PAYLOAD_SWAP_DATA CSRs, certain bits of the first 4 payload bytes may be overwritten on passthrough.
            '''
    }
    {
      name: "SPI_DEVICE.MODE.PASSTHROUGH.OUTPUT_ENABLE_CONTROL",
      desc: '''Passthrough module can control the output enable signals on both host and downstream side.
            '''
    }
    {
      name: "SPI_DEVICE.MODE.PASSTHROUGH.INTERCEPT_EN",
      desc: '''Allow the block to reply to SPI Flash commands, taking precedence over the data returned by the passthrough device.
            '''
    }
    {
      name: "SPI_DEVICE.MODE.PASSTHROUGH.MAILBOX",
      desc: '''Return data from the 1kB Mailbox read/write buffer if the command address falls in the range (MAILBOX_ADDR:MAILBOX_ADDR+1kB).
            '''
    }
    {
      name: "SPI_DEVICE.MODE.TPM.RETURN-BY-HW_REGS",
      desc: '''Block can auto-respond to a TPM host when the address falls within a configured range using the RETURN-BY-HW registers.
            '''
    }
    {
      name: "SPI_DEVICE.MODE.TPM.AUTO_WAIT",
      desc: '''If the address of a command does not fall into a pre-configured range, the block automatically returns a WAIT on the bus.
            '''
    }
    {
      name: "SPI_DEVICE.MODE.TPM.READ_FIFO_MODE",
      desc: '''If not activating the RETURN-BY-HW mode, the block responds to a Host TPM commands when the TPM_READ_FIFO has data >= requested transfer size.
            '''
    }
    {
      name: "SPI_DEVICE.MODE.TPM.CAPABILITY",
      desc: '''TPM-mode can advertise the capabilities it supports to the upstream Host by setting CSR.TPM_CAP.
            '''
    }
  ],
  countermeasures: [
    { name: "BUS.INTEGRITY",
      desc: "End-to-end bus integrity scheme."
    }
  ]
  regwidth: "32",
  registers: [
    { name: "CONTROL",
      desc: "Control register",
      swaccess: "rw",
      hwaccess: "hro",
      fields: [
        { bits: "0",
          name: "FLASH_STATUS_FIFO_CLR",
          swaccess: "rw1s",
          hwaccess: "hrw",
          desc: '''Set to clear the flash status FIFO.

            When set to 1, resets the flash status FIFO used for synchronizing changes from firmware.
            The reset should only be used when the upstream SPI host is known to be inactive.
            This function is intended to allow restoring initial values when the upstream SPI host is reset.

            This CSR automatically resets to 0.
            '''
          resval: "0",
          tags: [// This CSR only briefly pulses to anything other than 0.
                 "excl:CsrNonInitTests:CsrExclWrite"]
        },
        { bits: "1",
          name: "FLASH_READ_BUFFER_CLR",
          swaccess: "rw1s",
          hwaccess: "hrw",
          desc: '''Set to clear the read buffer state.

            When set to 1, resets the flash read buffer state that tracks the host read address.
            The reset should only be used when the upstream SPI host is known to be inactive.
            This function is intended to allow restoring initial values when the upstream SPI host is reset.

            This CSR automatically resets to 0.
            '''
          resval: "0",
          tags: [// This CSR only briefly pulses to anything other than 0.
                 "excl:CsrNonInitTests:CsrExclWrite"]
        },
        { bits: "5:4",
          name: "MODE",
          desc: "SPI Device flash operation mode.",
          resval: "1"
          enum: [
            { value: "0",
              name: "disabled",
              desc: '''SPI Flash operations disabled.

                SPI device flash operations are disabled, and all transactions are ignored.
                Note that SPI TPM operations are controlled by !!TPM_CFG
                '''
            },
            { value: "1"
              name: "flashmode"
              desc: '''SPI Flash Emulation mode.

                In flash mode, SPI Device IP accepts SPI Flash commands and
                processes internally, then returns data for the read commands.
                HW processes the Status, JEDEC ID, SFDP commands.

                The current version does not support Dual/Quad IO and QPI
                commands.
                '''
            }
            { value: "2"
              name: "passthrough"
              desc: '''
                In passthrough mode, SPI Device IP forwards the incoming SPI
                flash traffics to the attached downstream flash device. HW may
                processes commands internally and returns data.

                SW may configure the device to drop inadmissable commands.
                '''
            }
          ]
          tags: [// Changing modes randomly can result in unknown values being
                 // passed between spi_dev/host due to passthrough
                 "excl:CsrNonInitTests:CsrExclWrite"]
        },
      ]
    },
    { name: "CFG",
      desc: "Configuration Register",
      swaccess: "rw",
      hwaccess: "hro",
      fields: [
        { bits: "2",
          name: "tx_order",
          desc: "TX bit order on SDO. 0 for MSB to LSB, 1 for LSB to MSB",
          resval: "0",
        },
        { bits: "3",
          name: "rx_order",
          desc: "RX bit order on SDI. Module stores bitstream from MSB to LSB if value is 0.",
          resval: "0",
        },
        { bits: "24"
          name: "mailbox_en"
          desc: '''Mailbox enable.

            If 1, in the flash and passthrough mode, the IP checks the incoming
            address and return from the internal Mailbox buffer if the address
            falls into the MAILBOX range
            (MAILBOX_ADDR:MAILBOX_ADDR+MAILBOX_SIZE)}.
            '''
        } // f: mailbox_en
      ]
    },
    { name: "STATUS",
      desc: "SPI Device status register",
      swaccess: "ro",
      hwaccess: "hwo",
      hwext: "true",
      fields: [
        { bits: "5", name: "csb",        desc: "Direct input of CSb signal", resval: "1" },
        { bits: "6"
          name: "tpm_csb"
          desc: "Direct input of TPM CSb"
          resval: "1"
          tags: [
            // the value of tpm_csb is determined by the
            // value on the pins, hence it cannot be predicted.
            "excl:CsrAllTests:CsrExclCheck"
          ]
        }
      ]
    },
    //=========================================================================
    // Flash & Passthrough CSRs
    { name: "INTERCEPT_EN"
      desc: '''Intercept Passthrough datapath.

        '''
      swaccess: "rw"
      hwaccess: "hro"
      fields: [
        { bits: "0"
          name: "status"
          desc: "If set, Read Status is processed internally."
        } // f: status
        { bits: "1"
          name: "jedec"
          desc: "If set, Read JEDEC ID is processed internally."
        } // f: jedec
        { bits: "2"
          name: "sfdp"
          desc: "If set, Read SFDP is processed internally."
        } // f: sfdp
        { bits: "3"
          name: "mbx"
          desc: "If set, Read Command to Mailbox region is processed internally."
        } // f: mailbox
      ]
    } // R: INTERCEPT_EN
    { name: "ADDR_MODE"
      desc: '''Flash address mode configuration

        This register shows the current address mode and pending changes.
        It is updated by the HW when the command phase completes.
        '''
      swaccess: "ro"
      hwaccess: "hwo"
      hwext: true
      tags: [
        // SW is not able to read back the ADDR_MODE register right after write.
        // The pending field changes whenever the CSR is written, regardless of the value.
        // So, the CSR is excluded from most automated CSR tests.
        "excl:CsrNonInitTests:CsrExclWrite"
      ]
      fields: [
        { bits: "0"
          name: "addr_4b_en"
          swaccess: "rw"
          hwaccess: "hrw" // Updated by EN4B/EX4B
          hwqe: true
          desc: '''4B Address Mode enable.

            This field configures the internal module to receive 32 bits of the SPI commands.
            The affected commands are the SPI read commands except QPI, and program commands.
            It is expected for SW to configure this field at the configuration stage and release control to HW until the next reset.

            Even though Read SFDP command has address fields, the SFDP command is not affected by this field.
            The command always parse 24 bits on the SPI line 0 following the SPI command as the address field.

            This field has noteworthy read behavior.
            If a software-initiated change is still `pending` the sync to the SPI domain, this bit will reflect the value to be sent.
            Otherwise, this field will reflect the current value observed in the SPI domain.
            '''
        },
        { bits: "31"
          name: "pending"
          desc: '''SW-originated change is pending.

            This bit is 1 whenever the current value of addr_4b_en has yet to sync with the SPI domain.
            If an EN4B or EX4B command arrives next, the current value in `addr_4b_en` will be ignored,
            and the SPI flash command will take priority, with an update to `addr_4b_en` to match the command's result.
            '''
        }
      ]
    } // R: ADDR_MODE
    { name: "LAST_READ_ADDR"
      desc: '''Last Read Address

        This register shows the last address accessed by the host system.
        It is updated by the HW when CSb is de-asserted.
        '''
      swaccess: "ro"
      hwaccess: "hwo"
      hwext: true
      fields: [
        { bits: "31:0"
          name: "addr"
          desc: "Last address"
        }
      ]
    } // R: LAST_READ_ADDR
    { name: "FLASH_STATUS"
      desc: '''SPI Flash Status register.

        This register emulates the SPI Flash Status 3, 2, 1 registers.
        bit [7:0] is for Status register, bit [15:8] is for Status-2 register,
        and bit [23:16] is for Status-3 register. It is SW responsibility to
        maintain this register value up to date.

        The HW latches the value when SPI Flash transaction begins. Any updates
        during the transaction will be updated after the transaction is
        completed.
        '''
      swaccess: "rw"
      hwaccess: "hrw"
      hwext: true
      hwqe: true
      tags: [
        // SW is not able to read back the STATUS register right after write.
        // The read back value is the committed value, which needs at least a SPI transaction.
        // So excluded from CSR automation test.
        "excl:CsrNonInitTests:CsrExclWrite"
      ]
      fields: [
        { bits: "0"
          name: "busy"
          desc: '''BUSY signal is cleared when CSb is high. SW should read
            back the register to confirm the value is cleared.'''
          swaccess: "rw0c"
          hwaccess: "hrw"
        } // f: busy
        { bits: "1"
          name: "wel"
          desc: '''WEL signal is cleared when CSb is high. SW should read
            back the register to confirm the value is cleared.

            Bit 1 (WEL) is a SW modifiable and HW modifiable field.
            HW updates the WEL field when `WRDI` or `WREN` command is received.
          '''
          swaccess: "rw0c"
          hwaccess: "hrw"
        } // f: busy
        { bits: "23:2"
          name: "status"
          desc: '''Rest of the status register.

            Fields other than the bit 0 (BUSY) and bit 1 (WEL) fields are
            SW-maintained fields. HW just reads and returns to the host system.

            - [ 2]\: BP0
            - [ 3]\: BP1
            - [ 4]\: BP2
            - [ 5]\: TB
            - [ 6]\: SEC
            - [ 7]\: SRP0
            - [ 8]\: SRP1
            - [ 9]\: QE
            - [11]\: LB1
            - [12]\: LB2
            - [13]\: LB3
            - [14]\: CMP
            - [15]\: SUS
            - [18]\: WPS
            - [21]\: DRV0
            - [22]\: DRV1
            - [23]\: HOLD /RST
            '''
        } // f: status
      ]
    } // R: FLASH_STATUS
    {
      name: "JEDEC_CC"
      desc: '''JEDEC Continuation Code configuration register.

        Read JEDEC ID must return the continuation code if the manufacturer ID
        is not shown in the first page of JEDEC table. This register controls
        the Continuation Code.
        '''
      swaccess: "rw"
      hwaccess: "hro"
      fields: [
        { bits: "15:8"
          name: "num_cc"
          desc: "The number that Continuation Code repeats"
        } // f: num_cc
        { bits: "7:0"
          name: "cc"
          desc: "Continuation Code byte"
          resval: "0x7F"
        } // f: cc
      ]
    } // R: JEDEC_CC
    {
      name: "JEDEC_ID"
      desc: '''JEDEC ID register.
        '''
      swaccess: "rw"
      hwaccess:  "hro"
      fields: [
        { bits: "23:16"
          name: "mf"
          desc: "Manufacturer ID"
        } // f: manufacturer id
        { bits: "15:0"
          name: "id"
          desc: "Device ID"
        } // f: device id
      ]
    } // R: JEDEC_ID
    { name: "READ_THRESHOLD"
      desc: '''Read Buffer threshold register.

        '''
      swaccess: "rw"
      hwaccess: "hro"
      fields: [
        { bits: "9:0"
          name: "threshold"
          desc: '''If 0, disable the watermark. If non-zero, when the host
            access above or equal to the threshold, it reports an interrupt.
            The value is byte-granularity not SRAM index.
            '''
        } // f: threshold
      ]
    } // R: READ_THRESHOLD
    { name: "MAILBOX_ADDR"
      desc: '''Mailbox Base address register.

        The mailbox size is fixed. In this version of IP, the size is 1kB.
        Lower 10 bits of the Mailbox address is tied to 0.
        '''
      swaccess: "rw"
      hwaccess: "hro"
      fields: [
        { bits: "31:0"
          name: "addr"
          desc: "Mailbox Address. Lower 10 bits are ignored"
        } // f: addr
      ]
    } // R: MAILBOX_ADDR
    { name: "UPLOAD_STATUS"
      desc: '''Upload module status register.
        '''
      swaccess: "ro"
      hwaccess: "hwo"
      fields: [
        { bits: "4:0"
          name: "cmdfifo_depth"
          desc: "Command FIFO Entry"
        } // f: cmdfifo_depth
        { bits: "7"
          name: "cmdfifo_notempty"
          desc: "Upload Command FIFO Not Empty"
        } // f: cmdfifo_notempty
        { bits: "12:8"
          name: "addrfifo_depth"
          desc: "Address FIFO Entry"
        } // f: addrfifo_depth
        { bits: "15"
          name: "addrfifo_notempty"
          desc: "Upload Address FIFO Not Empty"
        } // f: addrfifo_notempty
      ]
    } // R: UPLOAD_STATUS
    { name: "UPLOAD_STATUS2"
      desc: '''Upload module status 2 register.

        This register contains payload related status. payload_depth indicates
        the payload size (from 0 to 256 bytes).

        payload_start_idx indicates the start of the 256B. This stays 0
        usually. However, when the SPI host system issues more than 256B of
        payload in a command, this field may not be 0. For example, if the
        system issues 258B payload, the payload_depth is 256 (as the IP only
        holds 256B of payload), the payload_start_idx is 2. SW should read from
        2 to 255 then 0 and 1.
        '''
      swaccess: "ro"
      hwaccess: "hwo"
      fields: [
        { bits: "8:0"
          name: "payload_depth"
          desc: '''Payload buffer depth
            '''
        } // f: payload_depth
        { bits: "23:16"
          name: "payload_start_idx"
          desc: '''Payload Start Index'''
        } // f: payload_start_idx
      ]
    } // R: UPLOAD_STATUS2
    { name: "UPLOAD_CMDFIFO"
      desc: '''Command Fifo Read Port.
        '''
      swaccess: "ro"
      hwaccess: "hrw"
      hwre:  "true"
      hwext: "true"
      fields: [
        { bits: "7:0"
          name: "data"
          desc: "command opcode"
        }
        { bits: "13"
          name: "busy"
          desc: "State of BUSY bit at command time"
        }
        { bits: "14"
          name: "wel"
          desc: "State of WEL bit at command time"
        }
        { bits: "15"
          name: "addr4b_mode"
          desc: "1 if address mode at command time is 4 Bytes, else 3 Bytes"
        }
      ]
    } // R: UPLOAD_CMDFIFO
    { name: "UPLOAD_ADDRFIFO"
      desc: '''Address Fifo Read Port.
        '''
      swaccess: "ro"
      hwaccess: "hrw"
      hwre:  "true"
      hwext: "true"
      fields: [
        { bits: "31:0"
          name: "data"
          desc: "read data"
        }
      ]
    } // R: UPLOAD_ADDRFIFO
    { multireg: {
        cname: "SPI_DEVICE"
        name:  "CMD_FILTER"
        desc:  '''Command Filter

          If a bit in this CSR is 1, then corresponding SPI command w.r.t the
          bit position among 256 bit is dropped in SPI Passthrough mode.
          '''
        count: "256"
        swaccess: "rw"
        hwaccess: "hro"
        compact: true
        fields: [
          { bits: "0"
            name: "filter"
            resval: "0"
            desc: "If 1, command will be filtered"
          }
        ]
      }
    }
    { name: "ADDR_SWAP_MASK"
      desc: '''Address Swap Mask register.

        This register is used in the SPI passthrough mode. If any of bits in
        this register is set, the corresponding address bit in the SPI Read
        commands is replaced with the data from !!ADDR_SWAP_DATA.

        If 3B address mode is active, upper 8bit [31:24] is ignored.
        '''
      swaccess: "rw"
      hwaccess: "hro"
      fields: [
        { bits:   "31:0"
          resval: "0",
          name:   "mask"
          desc: '''When a bit is 1, the SPI read address to the downstream SPI
            Flash device is swapped to !!ADDR_SWAP_DATA.
            '''
        }
      ]
    }
    { name: "ADDR_SWAP_DATA"
      desc: '''The address value for the address swap feature.
        '''
      swaccess: "rw"
      hwaccess: "hro"
      fields: [
        { bits:   "31:0"
          resval: "0"
          name:   "data"
          desc:   "Desired value to be swapped for the SPI read commands."
        }
      ]
    }
    { name: "PAYLOAD_SWAP_MASK"
      desc: '''Write Data Swap in the passthrough mode.

        PAYLOAD_SWAP_MASK CSR provides the SW to change certain bits in the
        first 4 bytes of the write payload in the passthrough mode.
        '''
      swaccess: "rw"
      hwaccess: "hro"
      fields: [
        { bits:   "31:0"
          resval: "0"
          name:   "mask"
          desc:   "byte mask"
        } // f: mask
      ]
    } // R: PAYLOAD_SWAP_MASK
    { name: "PAYLOAD_SWAP_DATA"
      desc: '''Write Data Swap in the passthrough mode.

        PAYLOAD_SWAP_DATA combined with PAYLOAD_SWAP_MASK provides the SW to
        change certain bits in the first 4 bytes of the write payload in the
        passthrough mode.

        The register should be written in Little-Endian order. [7:0] bits are
        processed in the first received payload byte. [31:24] bits for the 4th
        byte.
        '''
      swaccess: "rw"
      hwaccess: "hro"
      fields: [
        { bits:   "31:0"
          resval: "0"
          name:   "data"
          desc:   "replaced data"
        } // f: data
      ]
    } // R: PAYLOAD_SWAP_DATA
    { multireg: {
        cname: "SPI_DEVICE"
        name:  "CMD_INFO"
        desc: '''Command Info register.

          '''
        count: "NumCmdInfo"
        swaccess: "rw"
        hwaccess: "hro"
        fields: [
          { bits:   "7:0"
            resval: "0"
            name:   "opcode"
            desc: '''Command Opcode
              '''
          }
          { bits:   "9:8"
            resval: "0"
            name:   "addr_mode"
            desc:   '''Command address mode

              A command can have four modes:

              - 0: Command does not have an address field
              - 1: CFG.addr_4b_en decides the address size (3B/4B)
              - 2: Address size is always 3B regardless of CFG.addr_4b_en
              - 3: Address size is always 4B regardless of CFG.addr_4b_en
              '''
            enum: [
              { value: "0"
                name:  "AddrDisabled"
                desc:  "Address field does not exist"
              } // e: AddrDisabled
              { value: "1"
                name:  "AddrCfg"
                desc:  "CFG.addr_4b_en determines the address size"
              } // e: AddrCfg
              { value: "2"
                name:  "Addr3B"
                desc:  "Address size in the command is always 3B."
              } // e: Addr3B
              { value: "3"
                name:  "Addr4B"
                desc:  "Address size in the command is always 4B."
              } // e: Addr4B
            ]
          } // f: addr_mode
          { bits:   "10"
            resval: "0"
            name:   "addr_swap_en"
            desc:   '''This field is used in the passthrough logic.
              If this field is set to 1, the address in the passthrough command
              is replaced to the preconfigured value.
              '''
          }
          { bits:   "11"
            name:   "mbyte_en"
            desc:   '''If 1, the command has a MByte field following the
              address field. This is set to 1 for DualIO, QuadIO commands.
              '''
          }
          { bits:   "14:12"
            resval: "7"
            name:   "dummy_size"
            desc:   "The number of dummy cycles -1 for the command"
          }
          { bits:   "15"
            name:   "dummy_en"
            desc:   "Set to 1 if the command has a dummy cycle following the address field."
          }
          { bits:   "19:16"
            name:   "payload_en"
            desc:   '''Payload Enable per SPI lane.

              Set to non-zero if the command has payload at the end of the
              protocol. This field has four bits. Each bit represents the SPI
              line. If a command is a Single IO command and returns data to the
              host system, the data is returned on the MISO line (IO[1]). In
              this case, SW sets payload_en to 4'b 0010.
              '''
          }
          { bits: "20"
            name: "payload_dir"
            desc: '''Set to 1 if the command returns data. If 0, the payload
              sends to the downstream Flash device.
              '''
            enum: [
              { value: "0"
                name:  "PayloadIn"
                desc:  "From host to the downstream flash device"
              } // e: PayloadIn
              { value: "1"
                name:  "PayloadOut"
                desc:  "From the downstream flash device to the host"
              } // e: PayloadOut
            ]
          } // f: payload_dir
          { bits: "21"
            name: "payload_swap_en"
            desc: '''Swap the first byte of the write payload.

              If `payload_swap_en` is set, the passthrough logic swaps the first byte of the write payload with DATA_SWAP CSR.

              `payload_swap_en` only works with write data and SingleIO mode. `payload_en` must be 4'b 0001 and `paylod_dir` to be PayloadIn.
              '''
          } // f: payload_swap_en
          { bits: "23:22"
            name: "read_pipeline_mode"
            desc: '''Add 2-stage pipeline to read payload.

              If `read_pipeline_mode` is not set to `zero_stages`, the read logic adds a 2-stage pipeline to the read data for this command.
              This read pipeline enables higher throughput for certain read commands in passthrough mode.

              `payload_dir` must be set to PayloadOut: `payload_pipeline_en` only works with read data.
              It may be used with any IO mode, but general host compatibility is likely limited to Quad Read.
              If this pipeline is used for passthrough, the internal SFDP should report 2 additional dummy cycles compared to the downstream flash.
              SFDP read commands should be processed internally, and `dummy_size` should still reflect the downstream device's dummy cycle count.
              '''
            enum: [
              { value: "0",
                name: "zero_stages",
                desc: '''Bypass the 2-stage read pipeline.

                  This mode is for ordinary SPI flash operation.
                  Passthrough read data flows combinatorially from input pads to output pads.
                  '''
              },
              { value: "1"
                name: "two_stages_half_cycle"
                desc: '''2-stage read pipeline with half-cycle sampling.

                  In this mode, the 2-stage read pipeline is enabled.
                  Read data appears 2 cycles later than the `zero_stages` option.
                  In addition, read data originating from the downstream flash is first sampled on the normal sampling edge for half-cycle sampling.
                  '''
              }
              { value: "2"
                name: "two_stages_full_cycle"
                desc: '''2-stage read pipeline with full-cycle sampling.

                  In this mode, the 2-stage read pipeline is enabled.
                  Read data appears 2 cycles later than the `zero_stages` option.
                  In addition, read data originating from the downstream flash is first sampled on the next launch edge.
                  In other words, the internal pipeline performs full-cycle sampling of the downstream flash's response.
                  '''
              }
            ]
          } // f: payload_pipeline_en
          { bits: "24"
            name: "upload"
            desc: '''Set to 1 to upload the command.

              If upload field in the command info entry is set, the cmdparse
              activates the upload submodule when the opcode is received.
              `addr_en`, `addr_4B_affected`, and `addr_4b_forced` (TBD) affect
              the upload functionality. The three address related configs
              defines the command address field size.

              The logic assumes the following SPI input stream as payload,
              which max size is 256B. If the command exceeds the maximum
              payload size 256B, the logic wraps the payload and overwrites.
              '''
          } // f: upload
          { bits: "25"
            name: "busy"
            desc: '''Set to 1 to set the BUSY bit in the FLASH_STATUS when the
              command is received.  This bit is active only when `upload` bit is
              set.
              '''
          } // f: busy
          { bits: "31"
            name: "valid"
            desc: '''Set to 1 if the config in the register is valid
            '''
          } // f: valid
        ]
      }
    }
    { name: "CMD_INFO_EN4B"
      swaccess: "rw"
      hwaccess: "hro"
      desc: '''Opcode for EN4B.

        If the register is active, it affects in flash / passthrough modes.
        '''
      fields:  [
        { bits: "31"
          name: "valid"
          desc: "If 1, Opcode affects"
        } // f: valid
        { bits: "7:0"
          name: "opcode"
          desc: "EN4B opcode"
        } // f: opcode
      ]
    } // R: CMD_INFO_EN4B
    { name: "CMD_INFO_EX4B"
      swaccess: "rw"
      hwaccess: "hro"
      desc: '''Opcode for EX4B
        '''
      fields:  [
        { bits: "31"
          name: "valid"
          desc: "If 1, Opcode affects"
        } // f: valid
        { bits: "7:0"
          name: "opcode"
          desc: "EX4B opcode"
        } // f: opcode
      ]
    } // R: CMD_INFO_EX4B
    { name: "CMD_INFO_WREN"
      swaccess: "rw"
      hwaccess: "hro"
      desc: '''Opcode for Write Enable (WREN)
        '''
      fields: [
        { bits: "31"
          name: "valid"
          desc: "If 1, opcode affects"
        } // f: valid
        { bits: "7:0"
          name: "opcode"
          desc: "WREN opcode"
          // Leave default value 0 to be consistent
        } // f: opcode
      ]
    } // R: CMD_INFO_WREN
    { name: "CMD_INFO_WRDI"
      swaccess: "rw"
      hwaccess: "hro"
      desc: '''Opcode for Write Disable (WRDI)
        '''
      fields: [
        { bits: "31"
          name: "valid"
          desc: "If 1, opcode affects"
        } // f: valid
        { bits: "7:0"
          name: "opcode"
          desc: "WRDI opcode"
          // Leave default value 0 to be consistent
        } // f: opcode
      ]
    } // R: CMD_INFO_WRDI

    //===============================================================
    // TPM registers
    { skipto: "0x800"}
    { name: "TPM_CAP"
      desc: '''TPM HWIP Capability register.

        This register shows the features the current TPM HWIP supports.
        '''
      swaccess: "ro"
      hwaccess: "hwo"
      fields: [
        { bits: "7:0"
          name: "rev"
          desc: "Revision of the TPM submodule"
          resval: "0"
        } // f: rev
        { bits: "8"
          name: "locality"
          desc: '''If 1, the TPM submodule supports 5 Locality.
            If 0, only one Locality is provided
            '''
          resval: "1"
        } // f: locality
        { bits: "18:16"
          name: "max_wr_size"
          desc: '''The maximum write size in bytes the TPM submodule supports.
            The value is the exponent of the 2.

            - 3'b 010: Support up to 4B
            - 3'b 011: Support up to 8B
            - 3'b 100: Support up to 16B
            - 3'b 101: Support up to 32B
            - 3'b 110: Support up to 64B

            All other values are reserved.

            It is not recommended for SW to advertise TPM supporting more than `max_wr_size` to the South Bridge.
            '''
          resval: "6"
        } // f: max_wr_size
        { bits: "22:20"
          name: "max_rd_size"
          desc: '''The maximum read size in bytes the TPM submodule supports.
            The value is the exponent of the 2.

            - 3'b 010: Support up to 4B
            - 3'b 011: Support up to 8B
            - 3'b 100: Support up to 16B
            - 3'b 101: Support up to 32B
            - 3'b 110: Support up to 64B

            All other values are reserved.

            It is not recommended for SW to advertise TPM supporting more than `max_rd_size` to the South Bridge.
            '''
          resval: "6"
        } // f: max_rd_size
      ]
    } // R: TPM_CAP
    { name: "TPM_CFG"
      desc: '''TPM Configuration register.
        '''
      swaccess: "rw"
      hwaccess: "hro"
      fields: [
        { bits: "0"
          name: "en"
          desc: "If 1, TPM submodule accepts the transactions over SPI"
          tags: [
          // Enabling TPM could cause an assertion error if CSB isn't disabled properly in chip-level
          "excl:CsrNonInitTests:CsrExclWrite"]
        } // f: en
        { bits: "1"
          name: "tpm_mode"
          desc: '''Configure the TPM mode. 1 for CRB, 0 for FIFO.

            If the SW set this field to 1, the HW logic always pushes the
            command/addr and write data to buffers. The logic does not compare
            the incoming address to the list of managed-by-HW register
            addresses.

            The invalid locality check still runs based on the invalid_locality
            configuration.
            '''
        } // f: tpm_mode
        { bits: "2"
          name: "hw_reg_dis"
          desc: '''If 0, TPM submodule directly returns the return-by-HW registers for the read requests.

            If 1, TPM submodule uploads the TPM command regardless of the address, and the SW may return the value through the read FIFO.
            '''
        } // f: hw_reg_dis
        { bits: "3"
          name: "tpm_reg_chk_dis"
          desc: '''If 1, the logic does not compare the upper 8 bit of the
            received address with the TpmAddr constant, D4h.

            If this field is 0, the HW uploads the command, address, and write
            payload to the buffers in case of address that is not 0xD4_XXXX.
            '''
        } // f: tpm_reg_chk_dis
        { bits: "4"
          name: "invalid_locality"
          desc: '''If 1, TPM submodule returns the invalid data (0xFF) for the
            out of the max Locality request.
            If it is a write request, HW still uploads the command and address.
            SW needs to process the incoming invalid command.

            If 0, TPM submodule uploads the TPM command and address. The SW may
            write 0xFF to the read FIFO.

            Note: The TPM submodule uploads the TPM commands that do not fall
            into the FIFO registers (0xD4_XXXX) regardless of
            `invalid_locality` bit.
            '''
        } // f: invalid_locality
      ]
    } // R: TPM_CFG
    { name: "TPM_STATUS"
      desc: '''TPM submodule state register.

        The TPM_STATUS CSR provides the current TPM status, mostly the buffer and FIFO status.
        '''
      swaccess: "ro"
      hwaccess: "hrw"
      hwext: true
      hwqe: true
      tags: [
        // SW is not able to read back the TPM_STATUS register right after write.
        // The read back value is the committed value, which needs at least some SPI cycles.
        // So excluded from CSR automation test.
        "excl:CsrNonInitTests:CsrExclWrite"
      ]
      fields: [
        { bits: "0"
          name: "cmdaddr_notempty"
          hwaccess: "hwo"
          desc: "If 1, the TPM_CMD_ADDR has a valid data. This status is reported via the interrupt also."
        } // f: cmdaddr_notempty
        { bits: "1"
          name: "wrfifo_pending"
          swaccess: "rw0c"
          desc: '''If 1, the Write FIFO is reserved for software processing.

            This bit becomes 1 when a complete write command is received.
            While it remains 1, subsequent write commands will block at the wait state until it is cleared.
            Write 0 to release the Write FIFO back to the TPM module.
            '''
        } // f: cmdaddr_notempty
        { bits: "2"
          name: "rdfifo_aborted"
          hwaccess: "hwo"
          desc: '''If 1, the last Read FIFO command was aborted.

            This bit becomes 1 when a Read FIFO command became active, but the transaction did not complete.
            An aborted transaction occurs when the host de-asserts CSB without clocking all the requested data.
            This bit remains 1 until reset, or it will clear automatically after the next valid command is read from TPM_CMD_ADDR.
            '''
        } // f: cmdaddr_notempty
      ]
    } // R: TPM_STATUS
    { multireg: {
      cname: "TPM"
      name: "TPM_ACCESS"
      desc: '''TPM_ACCESS_x register.
        '''
      count: "NumLocality"
      compact: true
      swaccess: "rw"
      hwaccess: "hro"
      fields: [
        { bits: "7:0"
          name: "access"
          desc: "TPM_ACCESS"
        }
      ]
    }} // mr: TPM_ACCESS
    { name: "TPM_STS"
      desc: '''TPM_STS_x register.

        The register is mirrored to all Localities.
        The value is returned to the host system only when the activeLocality
        in the TPM_ACCESS_x is matched to the current received Locality.
        '''
      swaccess: "rw"
      hwaccess: "hro"
      fields: [
        { bits: "31:0"
          name: "sts"
          desc: "TPM_STS_x"
        }
      ]
    } // R: TPM_STS
    { name: "TPM_INTF_CAPABILITY"
      desc: "TPM_INTF_CAPABILITY"
      swaccess: "rw"
      hwaccess: "hro"
      fields: [
        { bits: "31:0"
          name: "intf_capability"
          desc: "TPM_INTF_CAPABILITY"
        }
      ]
    } // R: TPM_INTF_CAPABILITY
    { name: "TPM_INT_ENABLE"
      desc: "TPM_INT_ENABLE"
      swaccess: "rw"
      hwaccess: "hro"
      fields: [
        { bits: "31:0"
          name: "int_enable"
          desc: "TPM_INT_ENABLE"
        }
      ]
    } // R: TPM_INT_ENABLE
    { name: "TPM_INT_VECTOR"
      desc: "TPM_INT_VECTOR"
      swaccess: "rw"
      hwaccess: "hro"
      fields: [
        { bits: "7:0"
          name: "int_vector"
          desc: "TPM_INT_VECTOR"
        }
      ]
    } // R: TPM_INT_VECTOR
    { name: "TPM_INT_STATUS"
      desc: "TPM_INT_STATUS"
      swaccess: "rw"
      hwaccess: "hro"
      fields: [
        { bits: "31:0"
          name: "int_status"
          desc: "TPM_INT_STATUS"
        }
      ]
    } // R: TPM_INT_STATUS
    { name: "TPM_DID_VID"
      desc: "TPM_DID/ TPM_VID register"
      swaccess: "rw"
      hwaccess: "hro"
      fields: [
        { bits: "15:0"
          name: "vid"
          desc: "TPM_VID"
        } // f: vid
        { bits: "31:16"
          name: "did"
          desc: "TPM_DID"
        } // f: did
      ]
    } // R: TPM_DID_VID
    { name: "TPM_RID"
      desc: "TPM_RID"
      swaccess: "rw"
      hwaccess: "hro"
      fields: [
        { bits: "7:0"
          name: "rid"
          desc: "TPM_RID"
        }
      ]
    } // R: TPM_RID
    { name: "TPM_CMD_ADDR"
      desc: '''TPM Command and Address buffer

        The SW may get the received TPM command and address by readin gthis CSR.
        '''
      swaccess: "ro"
      hwaccess: "hrw"
      hwext: "true"
      hwre:  "true"
      hwqe:  "true"
      fields: [
        { bits: "23:0"
          name: "addr"
          desc: "received address"
        } // f: addr
        { bits: "31:24"
          name: "cmd"
          desc: "received command"
        } // f: cmd
      ]
    } // R: TPM_CMD_ADDR
    { name: "TPM_READ_FIFO"
      desc: '''TPM Read command return data FIFO.

        The write port of the read command FIFO.
        '''
      swaccess: "wo"
      hwaccess: "hro"
      hwqe: "true"
      hwext: "true"
      fields: [
        { bits: "TpmRdFifoWidth-1:0"
          name: "value"
          desc: "write port of the read FIFO"
        }
      ]
      tags: [// Updating FIFO randomly can result in tpm_status value change
             "excl:CsrNonInitTests:CsrExclWrite"]
    } // R: TPM_READ_FIFO
    //---------------------------------------------------------------
    { skipto: "0x1000" }
    { window: {
        name: "egress_buffer",
        items: "SramEgressDepth",
        validbits: "32",
        byte-write: "false",
        unusual: "true"
        swaccess: "wo",
        desc: '''
          SPI internal egress buffer.

          The lower 2 kB is for Read content emulating eFlash.
          The next 1 kB is for the Mailbox buffer.
          Then the next 256 B is for the SFDP buffer.
          Finally, the buffer spaces end with a 64 B TPM Read FIFO.
          '''
      },
    },
    { window: {
        name: "ingress_buffer",
        items: "SramIngressDepth",
        validbits: "32",
        byte-write: "false",
        unusual: "true"
        swaccess: "ro",
        desc: '''
          SPI internal ingress buffer.

          The layout is as follows (starting from offset 0):
              - 256 B SFDP buffer
              - 32 B CmdFIFO
              - 32 B AddrFIFO
              - 256 B payload FIFO
              - 64 B TPM Write FIFO
          '''
      },
    },
  ]
}