Testplan

Testpoints

Stage V1 Testpoints

smoke

Test: rram_ctrl_smoke

Smoke test exercising all three requesters of the RRAM (software controller, host and OTP hardware interface) on randomized addresses.

Stimulus:

  • Bring the DUT out of reset, wait for PHY_STATUS.init_done, then write INIT.VAL. The OTP key agent responds with random address/data scrambling keys.
  • Poll STATUS.init_done and STATUS.keys_valid.
  • Program a random but legal memory protection configuration: a random subset of the MP_REGION_CFG/MP_REGION registers, DEFAULT_REGION and INFO_PAGE_CFG, with random scramble_en and ecc_en.
  • Issue a random sequence of:
    • Software controller reads, writes and rewrites through CONTROL/ADDR and the FIFOs, on both the data and the info partition, with random CONTROL.NUM.
    • Host reads of the data partition through host_tl.
    • Read/Write commands on the OTP region through the otp_macro interface, after an initial Init command.
  • Completion of software operations is detected by polling OP_STATUS.done.
  • Accesses mostly hit permitted regions. A small fraction should hit protected regions to check that they are blocked.

Checks:

  • The scoreboard keeps a model of the RRAM array and predicts the read data of every software, host and OTP read.
  • After each write the RRAM contents are checked through the backdoor, including scrambling with the sideloaded keys, address-XOR and the OTP integrity page.
  • Blocked accesses set ERR_CODE.mp_err and ERR_ADDR, return error on host reads, and do not change the RRAM contents.
  • STATUS and OP_STATUS match the predicted values.

csr_hw_reset

Test: rram_ctrl_csr_hw_reset

Verify the reset values as indicated in the RAL specification.

  • Write all CSRs with a random value.
  • Apply reset to the DUT as well as the RAL model.
  • Read each CSR and compare it against the reset value. it is mandatory to replicate this test for each reset that affects all or a subset of the CSRs.
  • It is mandatory to run this test for all available interfaces the CSRs are accessible from.
  • Shuffle the list of CSRs first to remove the effect of ordering.

csr_rw

Test: rram_ctrl_csr_rw

Verify accessibility of CSRs as indicated in the RAL specification.

  • Loop through each CSR to write it with a random value.
  • Read the CSR back and check for correctness while adhering to its access policies.
  • It is mandatory to run this test for all available interfaces the CSRs are accessible from.
  • Shuffle the list of CSRs first to remove the effect of ordering.

csr_bit_bash

Test: rram_ctrl_csr_bit_bash

Verify no aliasing within individual bits of a CSR.

  • Walk a 1 through each CSR by flipping 1 bit at a time.
  • Read the CSR back and check for correctness while adhering to its access policies.
  • This verify that writing a specific bit within the CSR did not affect any of the other bits.
  • It is mandatory to run this test for all available interfaces the CSRs are accessible from.
  • Shuffle the list of CSRs first to remove the effect of ordering.

csr_aliasing

Test: rram_ctrl_csr_aliasing

Verify no aliasing within the CSR address space.

  • Loop through each CSR to write it with a random value
  • Shuffle and read ALL CSRs back.
  • All CSRs except for the one that was written in this iteration should read back the previous value.
  • The CSR that was written in this iteration is checked for correctness while adhering to its access policies.
  • It is mandatory to run this test for all available interfaces the CSRs are accessible from.
  • Shuffle the list of CSRs first to remove the effect of ordering.

csr_mem_rw_with_rand_reset

Test: rram_ctrl_csr_mem_rw_with_rand_reset

Verify random reset during CSR/memory access.

  • Run csr_rw sequence to randomly access CSRs
  • If memory exists, run mem_partial_access in parallel with csr_rw
  • Randomly issue reset and then use hw_reset sequence to check all CSRs are reset to default value
  • It is mandatory to run this test for all available interfaces the CSRs are accessible from.

regwen_csr_and_corresponding_lockable_csr

Tests:

  • rram_ctrl_csr_rw
  • rram_ctrl_csr_aliasing

Verify regwen CSR and its corresponding lockable CSRs.

  • Randomly access all CSRs
  • Test when regwen CSR is set, its corresponding lockable CSRs become read-only registers

Note:

  • If regwen CSR is HW read-only, this feature can be fully tested by common CSR tests - csr_rw and csr_aliasing.
  • If regwen CSR is HW updated, a separate test should be created to test it.

This is only applicable if the block contains regwen and locakable CSRs.

mem_walk

Test: rram_ctrl_mem_walk

Verify accessibility of all memories in the design.

  • Run the standard UVM mem walk sequence on all memories in the RAL model.
  • It is mandatory to run this test from all available interfaces the memories are accessible from.

mem_partial_access

Test: rram_ctrl_mem_partial_access

Verify partial-accessibility of all memories in the design.

  • Do partial reads and writes into the memories and verify the outcome for correctness.
  • Also test outstanding access on memories

Stage V2 Testpoints

sw_op

No Tests Implemented

Software controller operations on the data and info partitions.

Stimulus:

  • Read operations of 1 to 1024 bus words (the full CONTROL.NUM range), including start addresses that are not aligned to an RRAM word and transactions that cross page boundaries.
  • Write operations of a multiple of 4 bus words up to 1024 bus words, starting at an RRAM-word aligned address, including multi-page writes.
  • Read ADDR.START values that are not bus-word aligned to check the truncation to the next lower bus word.
  • Interleave reads and writes to the same and to different pages.
  • Randomize the timing of FIFO accesses: fill the write FIFO after setting CONTROL.START with random delays, and drain the read FIFO slowly and quickly.

Checks:

  • Read data matches the scoreboard model.
  • Write data matches the backdoor contents.
  • OP_STATUS.done is set once per operation, with op_done interrupt.
  • FIFO status and levels (STATUS, CURR_FIFO_LVL) match the predicted values.

rewrite_op

No Tests Implemented

Verify the Rewrite operation (CONTROL.OP = Rewrite).

Stimulus:

  • Preload RRAM words in both partitions through the backdoor, injecting a correctable single-bit or double-bit error into a few of the stored words.
  • Issue a rewrite on the address of each corrupted RRAM word and of some intact words, with random scrambling and ECC configuration of the targeted region or page.
  • Also target pages that software cannot write: the OTP region, MP_REGIONs, DEFAULT_REGION and info pages without wr_en, and every page of an enabled emulated info window, both inside and outside its active subregions.

Checks:

  • After the rewrite the backdoor contents match the original stored word, with the error corrected.
  • The read FIFO is not filled by the rewrite.
  • Rewrites are not subject to memory protection: they complete without ERR_CODE.mp_err on any page, whatever its region or page configuration, and leave the stored data unchanged.

Note: with the open-source macro, a double bit error must be injected by flipping one bit in each 64-bit half. This is because the macro protects each half with its own Hamming(72,64) code and two bits in the same half are uncorrectable.

sw_op_misaligned

No Tests Implemented

Verify that software writes and Rewrites that do not cover whole RRAM words are rejected.

Stimulus:

  • Write operations whose number of bus words (CONTROL.NUM + 1) is not a multiple of 4.
  • Write and Rewrite operations whose start address is not 16-byte aligned.
  • For writes, push data into the write FIFO after setting CONTROL.START.
  • Follow each rejected operation with a valid write to a different page.

Checks:

  • The rejected operation completes with OP_STATUS.err and ERR_CODE.op_err set.
  • The RRAM contents are unchanged, as checked through the backdoor.
  • A valid write issued after the rejected operation writes only its own data, i.e. no data from the rejected operation is left in the controller and committed with it.

host_read_direct

No Tests Implemented

Back-to-back host reads through host_tl.

Stimulus:

  • Issue back-to-back host reads with random address patterns: sequential, same RRAM word, same page and random across the data partition.
  • Randomize d_ready stalls on the host TL-UL interface, and keep up to NumOutstandingRdReq reads outstanding.
  • Randomize scramble_en and ecc_en of the regions being read.

Checks:

  • Read data and response integrity match the scoreboard model.
  • host_tl does not back-pressure read requests while the read buffer has a free or verified entry.

rd_buf_eviction

No Tests Implemented

Verify the read buffer invalidation on writes.

Stimulus:

  • Issue a controller or host read to a certain address.
  • Issue a controller write with new values to the same address.
  • Repeat the first read right after the write completes.

Checks:

  • The second read always returns the newly written value, never the old read buffer entry.

memory_protection

No Tests Implemented

Verify the memory protection of the data and info partitions for software and host accesses. This can be run as part of the smoke test with a higher rate of accesses to protected regions.

Stimulus:

  • Program random, possibly overlapping, data regions with random en, rd_en, wr_en, scramble_en and ecc_en, and a random DEFAULT_REGION.
  • Program random INFO_PAGE_CFG values for all info pages.
  • Issue software reads and writes, and host reads, that hit enabled regions, disabled regions, overlapping regions, the default region, and region boundaries (first and last page of a region, accesses that start inside a region and end outside of it). Rewrites bypass memory protection and are covered by rewrite_op.

Checks:

  • When regions overlap, the lowest-indexed matching region applies.
  • When no region matches, DEFAULT_REGION applies.
  • Disallowed accesses set ERR_CODE.mp_err with the address of the first failing word in ERR_ADDR, raise recov_err, and do not modify the RRAM. Disallowed host reads return a TL-UL error response.
  • For multi-word operations, words before the first failing word complete normally.
  • The data stored or read back uses the scramble_en and ecc_en of the region that matched.

otp_region_protection

No Tests Implemented

Verify that software and the host cannot access the OTP region.

Stimulus:

  • Program data regions and DEFAULT_REGION that cover the OTP data and integrity pages with full read and write permission.
  • Issue software reads and writes, and host reads, to the OTP region, including multi-word operations that start below the OTP region and run into it.

Checks:

  • All software reads and writes and host reads to the OTP region are rejected, whatever the software-programmed configuration. Software accesses set ERR_CODE.mp_err with the address in ERR_ADDR, and host reads return a TL-UL error response.
  • Words below the OTP region in the same operation complete normally.
  • The OTP region contents are unchanged.

seed_partition

No Tests Implemented

Verify software access to the creator and owner seed info pages.

Stimulus:

  • Randomize lc_creator_seed_sw_rw_en and lc_owner_seed_sw_rw_en (including invalid multi-bit values) and the INFO_PAGE_CFG of the two pages.
  • Issue software reads and writes to CreatorInfoPage and OwnerInfoPage.

Checks:

  • Accesses are allowed only when the life cycle signal is On and the page config allows them. Otherwise ERR_CODE.mp_err is set.

isolated_partition

No Tests Implemented

Verify software access to the isolated info page.

Stimulus:

  • Randomize lc_iso_part_sw_rd_en and lc_iso_part_sw_wr_en (including invalid multi-bit values) and the INFO_PAGE_CFG of IsolatedInfoPage.
  • Issue software reads and writes to the isolated page.

Checks:

  • Reads are allowed only when lc_iso_part_sw_rd_en is On, and writes only when lc_iso_part_sw_wr_en is On, in both cases ANDed with the page config.

emul_info_window

No Tests Implemented

Verify the emulated info page windows (EMUL_INFO_REGION, EMUL_INFO_REGWEN) and how windows and subregions rank against the other data partition regions.

Stimulus:

  • Program both windows with random BASE/SIZE and random EN, including invalid multi-bit values, and lock a random subset via EMUL_INFO_REGWEN.
  • Include windows touching the start and the end of the data partition, single-page windows, windows larger than the range EMUL_INFO_SUBREGION.TOP can reach (more than 256 pages), and a window overlapping the OTP region.
  • Program random, possibly overlapping, MP_REGIONs and a random DEFAULT_REGION that also cover the windows, including full access and permissions that differ from the subregions’.
  • Configure a random set of subregions with random permissions, leaving every window with pages not covered by an active subregion. Include an active subregion that grants full access to the OTP region.
  • Issue software reads and writes, and host reads, across the whole data partition: the first and last page of each window, the pages just outside it, and random pages inside it, including multi-word operations that cross window and subregion boundaries.

Checks:

  • The fixed OTP exclusion ranks above everything: no subregion can grant software or host access to the OTP region.
  • A window whose EN is not MuBi4True has no effect: software and host accesses to it are decided by the MP_REGIONs and DEFAULT_REGION as if it did not exist.
  • Inside a window whose EN is MuBi4True, the active subregion’s permissions apply, and every other page is denied to software, whether or not EMUL_INFO_REGWEN is locked, regardless of any MP_REGION or DEFAULT_REGION covering the same page. In particular, an enabled but unlocked window denies all software accesses, since none of its subregions can be active.
  • Host reads to any page of a window whose EN is MuBi4True return a TL-UL error response, whatever its lock state and subregion configuration.
  • Outside the enabled windows, software and host accesses follow MP_REGIONs and DEFAULT_REGION as checked in memory_protection.
  • Pages of a window beyond what its subregions’ 8-bit TOP can reach are always denied.
  • Disallowed software accesses set ERR_CODE.mp_err with the address of the first failing word in ERR_ADDR, raise recov_err, and do not modify the RRAM. Words before the first failing word complete normally.

emul_info_subregion

No Tests Implemented

Verify when an emulated info subregion becomes active and which pages it covers (EMUL_INFO_SUBREGION, EMUL_INFO_SUBREGION_REGWEN).

Stimulus:

  • Enable and lock both windows. Give every subregion EMUL_INFO_SUBREGION_CFG with rd_en and wr_en set, so that whether it is active is visible through software accesses rather than only through register readback.
  • For each window, program TOP for a random number of its EmulInfoSubregionsPerRegion subregions (none, one, a few, all) and lock their placement in random order. Include:
    • Strictly increasing TOP values within the window’s SIZE, locked in index order (the intended use).
    • A subregion locked while a lower-indexed subregion of the same window is still unlocked, and later locking that lower-indexed subregion.
    • A subregion left at its reset TOP but locked.
    • TOP equal to the window’s SIZE, and TOP exceeding it.
    • TOP values that are equal to or lower than an earlier subregion’s TOP.
  • Repeat with the window itself still unlocked while the subregions are locked, then lock the window.
  • Issue software reads and writes to the first and last page of every subregion’s expected range and of every remaining gap, including multi-word operations that cross from one subregion into the next or into a gap.

Checks:

  • A subregion is active only while its window’s EN is MuBi4True, its window’s EMUL_INFO_REGWEN is locked, its own EMUL_INFO_SUBREGION_REGWEN and that of every lower-indexed subregion of the same window are locked, and its TOP does not exceed the window’s SIZE. It becomes active as soon as the last of these conditions is met.
  • An active subregion covers window offsets from one past the highest TOP of the active lower-indexed subregions in its window (from offset 0 if there is none) up to its own TOP. A subregion whose TOP is not above that is fully shadowed and grants nothing.
  • A subregion with TOP exceeding the window’s SIZE is inactive, but does not break the lock chain of the higher-indexed subregions.
  • Pages not covered by an active subregion are denied, as checked in emul_info_window.
  • Subregions of one window never affect accesses to the other window.

emul_info_permissions

No Tests Implemented

Verify the access attributes of active emulated info subregions (EMUL_INFO_SUBREGION_CFG, EMUL_INFO_SUBREGION_CFG_REGWEN).

Stimulus:

  • Fully configure and lock both windows and a random set of subregions.
  • Program random EMUL_INFO_SUBREGION_CFG (rd_en, wr_en, scramble_en, ecc_en), including invalid multi-bit values, before and after locking the subregion’s placement.
  • Lock a random subset via EMUL_INFO_SUBREGION_CFG_REGWEN, and leave the rest unlocked.
  • Reprogram unlocked EMUL_INFO_SUBREGION_CFGs while their subregion is active.
  • Issue software reads and writes to every active subregion, including multi-word operations that cross into a neighboring subregion with different attributes.

Checks:

  • Software reads are allowed only when rd_en is MuBi4True, and writes only when wr_en is MuBi4True. Any other value denies the access.
  • The data stored or read back uses the scramble_en and ecc_en of the subregion each word falls into.
  • A subregion is active whether or not its EMUL_INFO_SUBREGION_CFG_REGWEN is locked, and changes to an unlocked EMUL_INFO_SUBREGION_CFG take effect on the next access.

emul_info_window_overlap

No Tests Implemented

Verify that overlapping emulated info windows fail closed (see EMUL_INFO_REGION.EN).

Stimulus:

  • Program both windows so that they overlap by at least one page, with either both windows enabled or only one of them (EN not MuBi4True on the other).
  • Fully configure and lock subregions with full permissions in both windows.
  • As a negative control, place two enabled windows exactly adjacent without overlapping.
  • Issue software reads and writes, and host reads, to the overlapping pages and to the non-overlapping pages of each window.

Checks:

  • While both windows are enabled and overlap, every subregion of both is inactive, so every page of both windows (overlapping or not) is denied to software and host accesses, and never falls through to MP_REGIONs or DEFAULT_REGION.
  • Overlap with a disabled window has no effect: the enabled window behaves as checked in emul_info_subregion.
  • Exactly adjacent windows behave as two independent windows.

seed_read

No Tests Implemented

Verify the creator and owner seed read during initialization.

Stimulus:

  • Preload random seeds into CreatorInfoPage and OwnerInfoPage through the backdoor, with matching scrambling and ECC.
  • Randomize lc_seed_hw_rd_en (including invalid multi-bit values).
  • Trigger initialization through INIT.VAL.

Checks:

  • When lc_seed_hw_rd_en is On, both seed pages are read twice and the seeds on the keymgr interface match the preloaded values.
  • When lc_seed_hw_rd_en is not On, no seed read is issued, the seeds keep their default value, and STATUS.init_done is still set.
  • STATUS.init_done is only set after the seed read completes.

otp_standalone

No Tests Implemented

Verify the OTP hardware interface on its own, with no software or host traffic.

Stimulus:

  • Issue Init first, then a random sequence of Read, Write, ReadRaw, WriteRaw and Zeroize commands with random sizes (16, 32 and 64 bits) and random addresses across the OTP region.
  • Writes set random bits on top of the current contents, so that read-set-write semantics are respected.
  • Randomize the request timing, including back-to-back commands.

Checks:

  • The DV OTP model predicts read data and the response error code of every command.
  • Write and Zeroize update the integrity page at the matching offset. ReadRaw and WriteRaw leave the integrity page unchanged.
  • Zeroize returns the zeroized word, with all bits set.
  • The OTP region is stored without scrambling and without address-XOR.
  • Data and integrity pages match the backdoor contents after each write.

host_controller_arb

No Tests Implemented

Concurrent host and controller operations to the same addresses, to test the phy arbiter between host and controller.

Stimulus:

  • Run host reads in parallel with software reads, writes and rewrites, all targeting a small set of pages so that accesses hit the same RRAM words.
  • Randomize the relative timing so that host requests arrive just before, during and just after a controller write.

Checks:

  • Host reads are stalled while a controller write is pending or in progress.
  • Each host read returns either the data before or the data after an overlapping write, never a mix.
  • No accesses are lost or duplicated.

hw_sw_arb

No Tests Implemented

Concurrent software and OTP operations, to test the arbiter in rram_ctrl_arb.

Stimulus:

  • Run software operations in parallel with OTP commands and host reads.

Checks:

  • All operations complete without deadlocks.
  • All operations return the right values.

rma

No Tests Implemented

Verify the RMA wipe through the life cycle interface.

Stimulus:

  • Preload the RRAM with random data through the backdoor, including the OTP region and all info pages.
  • Assert rma_req with a random rma_seed at random points: before INIT.VAL, during the key request, during the seed read, after initialization, and during ongoing software and OTP operations.

Checks:

  • Ongoing software and OTP operations complete before the wipe starts.
  • CreatorInfoPage, OwnerInfoPage, IsolatedInfoPage and all non-OTP data pages are overwritten with data that differs from the preloaded data.
  • The OTP region and the other info pages are unchanged.
  • rma_ack is set to On after the wipe.
  • After the RMA, software controller and host accesses to the RRAM are blocked until reset. Registers can still be accessed.
  • OTP commands are still served after the RMA and return the correct data.

interrupts

No Tests Implemented

Verify the functional behavior of all interrupts.

Stimulus:

  • Randomize FIFO_LVL.WR and FIFO_LVL.RD and run read and write operations with random FIFO access timing.
  • Enable a random subset of interrupts.

Checks:

  • wr_empty, wr_lvl, rd_full and rd_lvl follow the FIFO levels.
  • op_done is raised at the end of each software operation, also on error.
  • corr1_err and corr2_err are covered in ecc_corr1_err and ecc_corr2_err.

idle

No Tests Implemented

Verify the idle indication to the power manager.

Checks:

  • pwrmgr_o.nvm_idle is deasserted during software writes, rewrites, OTP commands and the RMA wipe, and asserted otherwise.

error_invalid_op

No Tests Implemented

Start an operation with a reserved CONTROL.OP value.

Checks:

  • ERR_CODE.op_err and OP_STATUS.err are set and recov_err fires.
  • The RRAM is not accessed.
  • The next valid operation completes normally.

otp_write_blank_err

No Tests Implemented

OTP writes that try to clear bits that are already set.

Stimulus:

  • Preload OTP words with random data, then issue Write and WriteRaw commands whose data clears at least one set bit, with random sizes (16, 32 and 64 bits).

Checks:

  • The response is MacroWriteBlankError.
  • The stored word becomes the OR of the old and the new data. Bits are never cleared.
  • For Write, the integrity page holds the integrity of the stored word.
  • No alert fires and the next command completes normally.

otp_intg_err

No Tests Implemented

Mismatch between an OTP data word and its integrity syndrome.

Stimulus:

  • Through the backdoor, flip bits in an OTP data word or in its syndrome in the integrity page, keeping the macro ECC valid.
  • Issue Read and ReadRaw on that word.

Checks:

  • Read returns MacroEccUncorrError.
  • ReadRaw returns the raw stored data with NoError.
  • Words that share the same integrity page word but were not corrupted still read without error.

otp_macro_ecc_err

No Tests Implemented

Macro ECC errors in the OTP region.

Stimulus:

  • Inject correctable and uncorrectable ECC errors into OTP data words and into the integrity page through the backdoor.
  • Issue all OTP commands on the affected words.

Checks:

  • Correctable errors are corrected transparently: the commands return the correct data with NoError.
  • Each corrected OTP word raises the corr1_err or corr2_err interrupt, increments CORR1_ERR_CNT or CORR2_ERR_CNT, and updates CORR1_ERR_LOC or CORR2_ERR_LOC with the address of the word, as for software and host reads.
  • Uncorrectable errors return MacroError. FAULT_STATUS.otp_rd_err or FAULT_STATUS.otp_wr_err is set, FAULT_STATUS.phy_relbl_err is set, and fatal_err fires.

ecc_corr1_err

No Tests Implemented

Correctable single-bit ECC errors.

Stimulus:

  • Through the backdoor, inject a single bit error into RRAM words in data and info pages with ecc_en set. Include errors in the check bits.
  • Read the corrupted words through the host and through the controller.
  • Issue a Rewrite on the address of each corrupted RRAM word, then read it again.

Checks:

  • The read data is corrected, with valid bus integrity. ERR_CODE stays clear and no alert fires.
  • Each RRAM read of a corrupted word raises the corr1_err interrupt, increments CORR1_ERR_CNT and updates CORR1_ERR_LOC with the address and partition of the word.
  • After the Rewrite the stored word is correct again, and the next read reports no error.
  • Pages with ecc_en false return the corrupted data and do not report an error.

ecc_corr2_err

No Tests Implemented

Correctable double-bit ECC errors.

Stimulus:

  • Through the backdoor, inject a double bit error into RRAM words in data and info pages with ecc_en set. Include errors in the check bits.
  • Read the corrupted words through the host and through the controller.
  • Issue a Rewrite on the address of each corrupted RRAM word, then read it again.

Checks:

  • The read data is corrected, with valid bus integrity. ERR_CODE stays clear and no alert fires.
  • Each RRAM read of a corrupted word raises the corr2_err interrupt, increments CORR2_ERR_CNT and updates CORR2_ERR_LOC with the address and partition of the word.
  • After the Rewrite the stored word is correct again, and the next read reports no error.
  • Pages with ecc_en false return the corrupted data and do not report an error.

Note: with the open-source macro, the double bit error must be injected by flipping one bit in each 64-bit half. This is because the macro protects each half with its own Hamming(72,64) code and two bits in the same half are uncorrectable.

ecc_uncorr_err

No Tests Implemented

Uncorrectable ECC errors.

Stimulus:

  • Through the backdoor, inject an uncorrectable error into RRAM words in data and info pages with ecc_en set.
  • Read the affected words through the controller and the host.

Checks:

  • Controller reads set ERR_CODE.rd_err with the address in ERR_ADDR, and fire recov_err. The read still returns CONTROL.NUM + 1 words. The failing word and all later words are all-ones with valid bus integrity.
  • Host reads return a TL-UL error response.
  • FAULT_STATUS.phy_relbl_err is set and fatal_err fires. Software can clear phy_relbl_err by writing 0.
  • With DIS.RELBL_ERR_FATAL false, the RRAM stays accessible. With DIS.RELBL_ERR_FATAL set, the RRAM is disabled.
  • The CORR1_* and CORR2_* registers are not updated.

Note: not all multi-bit errors are detectable. Some error patterns are miscorrected and reported as error-free, ecc_corr1_err or ecc_corr2_err. The open-source model detects all two-bit errors within one 64-bit half, but can also miscorrect errors of three or more bits.

seed_read_err

No Tests Implemented

Errors during the double-read validation of the creator and owner seeds.

The lifecycle manager reads each seed twice from its info page. The first read stores the seed, the second read is compared word by word against the stored value. The error-free seed read is covered by seed_read.

Stimulus:

  • Backdoor-load random creator and owner seeds into their info pages.
  • Set lc_seed_hw_rd_en to On to enable seed reading during initialization.
  • Corrupt a random word of one or both seeds on the second read only.
  • Also cover the case where a seed word returns an integrity error.

Checks:

  • For a seed with a read mismatch, FAULT_STATUS.SEED_ERR is set.
  • For a seed with an integrity error, STD_FAULT_STATUS.LCMGR_INTG_ERR is set.
  • In both cases, a fatal_err / fatal_std_err alert is raised, the controller is locally escalated, and seed_valid of both seeds is low.

local_esc_relbl_err

No Tests Implemented

Verify local escalation caused by reliability errors.

Stimulus:

  • Inject an uncorrectable reliability ECC error with DIS.LOCAL_ESC_RELBL_ERR at its reset value, clear FAULT_STATUS.PHY_RELBL_ERR afterwards and access the RRAM again.
  • Set DIS.LOCAL_ESC_RELBL_ERR, inject an uncorrectable reliability ECC error, clear FAULT_STATUS.PHY_RELBL_ERR afterwards and access the RRAM again.

Checks:

  • The fatal_err alert is raised in both cases.
  • Without DIS.LOCAL_ESC_RELBL_ERR, the RRAM remains accessible.
  • With DIS.LOCAL_ESC_RELBL_ERR, the RRAM is disabled and remains disabled after FAULT_STATUS.PHY_RELBL_ERR has been cleared, until the next reset.

rma_sw_dis

No Tests Implemented

Verify that software access through rram_ctrl is disabled from the start of the RMA entry process until the next reset.

Stimulus:

  • Request RMA entry and issue random software operations during and after the RMA wipe.

Checks:

  • Host reads are answered with an error.
  • New controller operations are not started and complete with OP_STATUS.err and ERR_CODE.op_err set.
  • An operation in progress when RMA entry starts completes normally, and the RMA wipe only starts afterwards.
  • RMA entry completes successfully and rma_ack is returned with the error-free status.
  • The OTP hardware interface remains accessible after the RMA wipe.

intr_test

Test: rram_ctrl_intr_test

Verify common intr_test CSRs that allows SW to mock-inject interrupts.

  • Enable a random set of interrupts by writing random value(s) to intr_enable CSR(s).
  • Randomly “turn on” interrupts by writing random value(s) to intr_test CSR(s).
  • Read all intr_state CSR(s) back to verify that it reflects the same value as what was written to the corresponding intr_test CSR.
  • Check the cfg.intr_vif pins to verify that only the interrupts that were enabled and turned on are set.
  • Clear a random set of interrupts by writing a randomly value to intr_state CSR(s).
  • Repeat the above steps a bunch of times.

alert_test

Test: rram_ctrl_alert_test

Verify common alert_test CSR that allows SW to mock-inject alert requests.

  • Enable a random set of alert requests by writing random value to alert_test CSR.
  • Check each alert_tx.alert_p pin to verify that only the requested alerts are triggered.
  • During alert_handshakes, write alert_test CSR again to verify that: If alert_test writes to current ongoing alert handshake, the alert_test request will be ignored. If alert_test writes to current idle alert handshake, a new alert_handshake should be triggered.
  • Wait for the alert handshakes to finish and verify alert_tx.alert_p pins all sets back to 0.
  • Repeat the above steps a bunch of times.

tl_d_oob_addr_access

Test: rram_ctrl_tl_errors

Access out of bounds address and verify correctness of response / behavior

tl_d_illegal_access

Test: rram_ctrl_tl_errors

Drive unsupported requests via TL interface and verify correctness of response / behavior. Below error cases are tested bases on the TLUL spec

  • TL-UL protocol error cases
    • invalid opcode
    • some mask bits not set when opcode is PutFullData
    • mask does not match the transfer size, e.g. a_address = 0x00, a_size = 0, a_mask = 'b0010
    • mask and address misaligned, e.g. a_address = 0x01, a_mask = 'b0001
    • address and size aren’t aligned, e.g. a_address = 0x01, a_size != 0
    • size is greater than 2
  • OpenTitan defined error cases
    • access unmapped address, expect d_error = 1
    • write a CSR with unaligned address, e.g. a_address[1:0] != 0
    • write a CSR less than its width, e.g. when CSR is 2 bytes wide, only write 1 byte
    • write a memory with a_mask != '1 when it doesn’t support partial accesses
    • read a WO (write-only) memory
    • write a RO (read-only) memory
    • write with instr_type = True

tl_d_outstanding_access

Tests:

  • rram_ctrl_csr_hw_reset
  • rram_ctrl_csr_rw
  • rram_ctrl_csr_aliasing
  • rram_ctrl_same_csr_outstanding

Drive back-to-back requests without waiting for response to ensure there is one transaction outstanding within the TL device. Also, verify one outstanding when back- to-back accesses are made to the same address.

tl_d_partial_access

Tests:

  • rram_ctrl_csr_hw_reset
  • rram_ctrl_csr_rw
  • rram_ctrl_csr_aliasing
  • rram_ctrl_same_csr_outstanding

Access CSR with one or more bytes of data. For read, expect to return all word value of the CSR. For write, enabling bytes should cover all CSR valid fields.

Stage V2S Testpoints

tl_intg_err

Tests:

  • rram_ctrl_tl_intg_err
  • rram_ctrl_sec_cm

Verify that the data integrity check violation generates an alert.

  • Randomly inject errors on the control, data, or the ECC bits during CSR accesses. Verify that triggers the correct fatal alert.
  • Inject a fault at the onehot check in u_reg.u_prim_reg_we_check and verify the corresponding fatal alert occurs

sec_cm_reg_bus_integrity

No Tests Implemented

Verify the countermeasure(s) REG.BUS.INTEGRITY.

sec_cm_host_bus_integrity

No Tests Implemented

Verify the countermeasure(s) HOST.BUS.INTEGRITY.

sec_cm_mem_bus_integrity

No Tests Implemented

Verify the countermeasure(s) MEM.BUS.INTEGRITY.

sec_cm_mem_addr_infection

No Tests Implemented

Verify the countermeasure(s) MEM.ADDR_INFECTION.

sec_cm_scramble_key_sideload

No Tests Implemented

Verify the countermeasure(s) SCRAMBLE.KEY.SIDELOAD.

sec_cm_lc_ctrl_intersig_mubi

No Tests Implemented

Verify the countermeasure(s) LC_CTRL.INTERSIG.MUBI.

sec_cm_ctrl_config_regwen

No Tests Implemented

Verify the countermeasure(s) CTRL.CONFIG.REGWEN.

sec_cm_data_regions_config_regwen

No Tests Implemented

Verify the countermeasure(s) DATA_REGIONS.CONFIG.REGWEN.

sec_cm_info_page_config_regwen

No Tests Implemented

Verify the countermeasure(s) INFO_PAGE.CONFIG.REGWEN.

sec_cm_mem_ctrl_global_esc

No Tests Implemented

Verify the countermeasure(s) MEM.CTRL.GLOBAL_ESC.

sec_cm_mem_ctrl_local_esc

No Tests Implemented

Verify the countermeasure(s) MEM.CTRL.LOCAL_ESC.

sec_cm_mem_disable_config_mubi

No Tests Implemented

Verify the countermeasure(s) MEM_DISABLE.CONFIG.MUBI.

sec_cm_exec_config_redun

No Tests Implemented

Verify the countermeasure(s) EXEC.CONFIG.REDUN.

sec_cm_mem_scramble

No Tests Implemented

Verify the countermeasure(s) MEM.SCRAMBLE.

sec_cm_rma_entry_mem_sec_wipe

No Tests Implemented

Verify the countermeasure(s) RMA_ENTRY.MEM.SEC_WIPE.

sec_cm_ctrl_fsm_sparse

No Tests Implemented

Verify the countermeasure(s) CTRL.FSM.SPARSE.

sec_cm_phy_wr_fsm_sparse

No Tests Implemented

Verify the countermeasure(s) PHY_WR.FSM.SPARSE.

sec_cm_ctr_redun

No Tests Implemented

Verify the countermeasure(s) CTR.REDUN.

sec_cm_phy_arbiter_ctrl_redun

No Tests Implemented

Verify the countermeasure(s) PHY_ARBITER.CTRL.REDUN.

sec_cm_phy_host_grant_ctrl_consistency

No Tests Implemented

Verify the countermeasure(s) PHY_HOST_GRANT.CTRL.CONSISTENCY.

sec_cm_phy_rsp_ctrl_consistency

No Tests Implemented

Verify the countermeasure(s) PHY_RSP.CTRL.CONSISTENCY.

sec_cm_phy_rd_rsp_ctrl_integrity

No Tests Implemented

Verify the countermeasure(s) PHY_RD_RSP.CTRL.INTEGRITY.

sec_cm_phy_rd_buf_ctrl_integrity

No Tests Implemented

Verify the countermeasure(s) PHY_RD_BUF.CTRL.INTEGRITY.

sec_cm_phy_rd_buf_ctrl_consistency

No Tests Implemented

Verify the countermeasure(s) PHY_RD_BUF.CTRL.CONSISTENCY.

sec_cm_fifo_ctr_redun

No Tests Implemented

Verify the countermeasure(s) FIFO.CTR.REDUN.

sec_cm_host_tl_lc_gate_fsm_sparse

No Tests Implemented

Verify the countermeasure(s) HOST_TL_LC_GATE.FSM.SPARSE.

sec_cm_wr_tl_lc_gate_fsm_sparse

No Tests Implemented

Verify the countermeasure(s) WR_TL_LC_GATE.FSM.SPARSE.

sec_cm_mem_readback

No Tests Implemented

Verify the countermeasure(s) MEM.READBACK.

sec_cm_mem_integrity

No Tests Implemented

Verify the countermeasure(s) MEM.INTEGRITY.

sec_cm_otp_mem_integrity

No Tests Implemented

Verify the countermeasure(s) OTP.MEM.INTEGRITY.

Covergroups

arb_cg

Covers concurrent requests of software, host and OTP, and the case where they target the same RRAM word or page.

control_cg

Covers all CONTROL.OP values (including reserved ones) crossed with CONTROL.PARTITION, and CONTROL.NUM in bins (1, small, page size, multi-page, maximum).

ecc_cg

Covers the ECC result of every RRAM read (none, corr1, corr2, uncorrectable), crossed with the requester (host, software, OTP), the partition and ecc_en.

emul_info_permissions_cg

Covers, for accesses that hit an active subregion, rd_en, wr_en, scramble_en and ecc_en (each MuBi4True, MuBi4False, invalid) crossed with operation type and whether EMUL_INFO_SUBREGION_CFG_REGWEN is locked.

emul_info_priority_cg

Covers, for every software and host access to the data partition, which entry decided it (OTP exclusion, subregion, window gap, MP_REGION, DEFAULT_REGION) crossed with requester, operation type, and whether the access was allowed.

emul_info_subregion_cg

Covers, per window, the number of active subregions (0, 1, a few, all EmulInfoSubregionsPerRegion), and for every subregion the reason it is inactive (window disabled, window unlocked, own placement unlocked, a lower-indexed placement unlocked, TOP exceeding SIZE, window overlap) or, when active, whether it is fully shadowed by a lower-indexed subregion and whether its TOP equals the window’s SIZE.

emul_info_window_cg

Covers, per window, EN (MuBi4True, MuBi4False, invalid) crossed with EMUL_INFO_REGWEN, window position (start of the data partition, end of the data partition, elsewhere), and window size (one page, up to 256 pages, more than 256 pages).

emul_info_window_overlap_cg

Covers whether the two windows overlap or are exactly adjacent, crossed with both windows’ EN.

fifo_lvl_cg

Covers the FIFO_LVL settings and the read and write FIFO levels, including empty and full, crossed with the matching interrupts.

info_page_cg

Covers software accesses to every info page crossed with the page config and the life cycle enable signals of the creator, owner and isolated pages.

mp_region_cg

Covers, for software and host accesses, which region matched (region index or default region) crossed with rd_en, wr_en, scramble_en, ecc_en, and whether the access was allowed.

otp_cmd_cg

Covers all OTP commands crossed with the access size and the response error code.

rd_buf_cg

Covers read buffer hits and misses and invalidation on writes, crossed with the requester (host or controller).

regwen_val_when_new_value_written_cg

Cover each lockable reg field with these 2 cases:

  • When regwen = 1, a different value is written to the lockable CSR field, and a read occurs after that.
  • When regwen = 0, a different value is written to the lockable CSR field, and a read occurs after that.

This is only applicable if the block contains regwen and locakable CSRs.

rma_cg

Covers the lcmgr state when rma_req arrives (idle, key request, seed read, wait) and whether a software or OTP operation was ongoing.

seed_cg

Covers lc_seed_hw_rd_en values.

sw_err_cg

Covers the ERR_CODE bits op_err, mp_err and rd_err crossed with the operation.

tl_errors_cg

Cover the following error cases on TL-UL bus:

  • TL-UL protocol error cases.
  • OpenTitan defined error cases, refer to testpoint tl_d_illegal_access.

tl_intg_err_cg

Cover all kinds of integrity errors (command, data or both) and cover number of error bits on each integrity check.

Cover the kinds of integrity errors with byte enabled write on memory if applicable: Some memories store the integrity values. When there is a subword write, design re-calculate the integrity with full word data and update integrity in the memory. This coverage ensures that memory byte write has been issued and the related design logic has been verfied.