Interfaces

Referring to the Comportable guideline for peripheral device functionality, the module flash_ctrl has the following hardware interfaces defined

  • Primary Clock: clk_i
  • Other Clocks: clk_otp_i
  • Bus Device Interfaces (TL-UL): core_tl, prim_tl, mem_tl
  • Bus Host Interfaces (TL-UL): none

Peripheral Pins for Chip IO

Pin nameDirectionDescription
tckinputjtag clock
tmsinputjtag tms
tdiinputjtag input
tdooutputjtag output

Inter-Module Signals

Port NamePackage::StructTypeActWidthDescription
otpotp_ctrl_pkg::flash_otp_keyreq_rspreq1
lc_nvm_debug_enlc_ctrl_pkg::lc_txunircv1
flash_bist_enableprim_mubi_pkg::mubi4unircv1
flash_power_down_hlogicunircv1
flash_power_ready_hlogicunircv1
flash_test_mode_aionone2
flash_test_voltage_hionone1
lc_creator_seed_sw_rw_enlc_ctrl_pkg::lc_txunircv1
lc_owner_seed_sw_rw_enlc_ctrl_pkg::lc_txunircv1
lc_iso_part_sw_rd_enlc_ctrl_pkg::lc_txunircv1
lc_iso_part_sw_wr_enlc_ctrl_pkg::lc_txunircv1
lc_seed_hw_rd_enlc_ctrl_pkg::lc_txunircv1
lc_escalate_enlc_ctrl_pkg::lc_txunircv1
rma_reqlc_ctrl_pkg::lc_txunircv1
rma_acklc_ctrl_pkg::lc_txunireq1
rma_seedlc_ctrl_pkg::lc_flash_rma_seedunircv1
pwrmgrpwrmgr_pkg::pwr_flashunireq1
keymgrflash_ctrl_pkg::keymgr_flashunireq1
obs_ctrlast_pkg::ast_obs_ctrlunircv1
fla_obslogicunireq8
core_tltlul_pkg::tlreq_rsprsp1
prim_tltlul_pkg::tlreq_rsprsp1
mem_tltlul_pkg::tlreq_rsprsp1

Interrupts

Interrupt NameTypeDescription
prog_emptyStatusProgram FIFO empty
prog_lvlStatusProgram FIFO drained to level
rd_fullStatusRead FIFO full
rd_lvlStatusRead FIFO filled to level
op_doneEventOperation complete
corr_errEventCorrectable error encountered

Security Alerts

Alert NameDescription
recov_errflash recoverable errors
fatal_std_errflash standard fatal errors
fatal_errFlash fatal errors including uncorrectable ECC errors. Note that this alert is not always fatal. The underlying error bits in the FAULT_STATUS register remain set until reset, meaning the alert keeps firing. This doesn’t hold for FAULT_STATUS.PHY_RELBL_ERR and FAULT_STATUS.PHY_STORAGE_ERR. To enable firmware dealing with multi-bit ECC and ICV errors during firmware selection and verification, these error bits can be cleared. After passing this stage, it is recommended that firmware classifies the corresponding alert as fatal on the receiver end, i.e, inside the alert handler.
fatal_prim_flash_alertFatal alert triggered inside the flash primitive, including fatal TL-UL bus integrity faults of the test interface.
recov_prim_flash_alertRecoverable alert triggered inside the flash primitive.

Security Countermeasures

Countermeasure IDDescription
FLASH_CTRL.REG.BUS.INTEGRITYEnd-to-end bus integrity scheme. Since there are multiple access points for flash, please see Transmission Integrity Faults in the documentation for more details. The bus integrity scheme for flash is different from other comportable modules.
FLASH_CTRL.HOST.BUS.INTEGRITYEnd-to-end bus integrity scheme. Since there are multiple access points for flash, please see Transmission Integrity Faults in the documentation for more details. The bus integrity scheme for flash is different from other comportable modules.
FLASH_CTRL.MEM.BUS.INTEGRITYEnd-to-end bus integrity scheme. Since there are multiple access points for flash, please see Transmission Integrity Faults in the documentation for more details. The bus integrity scheme for flash is different from other comportable modules.
FLASH_CTRL.MEM.ADDR_INFECTIONOn host reads, the address of the request is XORed with the data inside the read pipeline. The request address is removed from the data before returning the data over TL-UL. A mismatch triggers a data integrity error.
FLASH_CTRL.SCRAMBLE.KEY.SIDELOADThe scrambling key is sideloaded from OTP and thus unreadable by SW.
FLASH_CTRL.LC_CTRL.INTERSIG.MUBILife cycle control signals are used control information partition access and flash debug access. See secret information partition, isolated information partitions and jtag connection in documentation for more details.
FLASH_CTRL.CTRL.CONFIG.REGWENConfigurations cannot be changed when an operation is ongoing.
FLASH_CTRL.DATA_REGIONS.CONFIG.REGWENEach data region has a configurable regwen.
FLASH_CTRL.DATA_REGIONS.CONFIG.SHADOWData region configuration is shadowed.
FLASH_CTRL.INFO_REGIONS.CONFIG.REGWENEach info page of each type in each bank has separate regwen.
FLASH_CTRL.INFO_REGIONS.CONFIG.SHADOWEach info page is shadowed.
FLASH_CTRL.BANK.CONFIG.REGWENEach bank has separate regwen for bank erase.
FLASH_CTRL.BANK.CONFIG.SHADOWEach bank has separate regwen for bank erase.
FLASH_CTRL.MEM.CTRL.GLOBAL_ESCGlobal escalation causes memory to no longer be accessible.
FLASH_CTRL.MEM.CTRL.LOCAL_ESCA subset of fatal errors cause memory to no longer be accessible. This subset is defined in STD_FAULT_STATUS.
FLASH_CTRL.MEM_DISABLE.CONFIG.MUBISoftware control for flash disable is multibit. The register is DIS.
FLASH_CTRL.EXEC.CONFIG.REDUNSoftware control for flash enable is 32-bit constant. The register is EXEC.
FLASH_CTRL.MEM.SCRAMBLEThe flash supports XEX scrambling. The cipher used is PRINCE. The scrambling scheme is enabled by software, please see flash scrambling in documentation for more details.
FLASH_CTRL.MEM.INTEGRITYThe flash supports two layers of ECC integrity: one layer is for integrity, and the other layer is for reliability. These ECCs are enabled and disabled together by software. Please see Flash ECC in the documentation for more details.
FLASH_CTRL.RMA_ENTRY.MEM.SEC_WIPERMA entry entry wipes flash memory with random data.
FLASH_CTRL.CTRL.FSM.SPARSERMA handling FSMs in flash_ctrl_lcmgr are sparsely encoded. FSM in flash_ctrl_arb is sparsely encoded.
FLASH_CTRL.PHY.FSM.SPARSEPHY FSMs are sparsely encoded.
FLASH_CTRL.PHY_PROG.FSM.SPARSEPHY program FSMs are sparsely encoded.
FLASH_CTRL.CTR.REDUNflash_ctrl_lcmgr handling counters are redundantly encoded. This includes seed count and address count used during seed reading phase, as well as word count, page count and wipe index in RMA entry phase.
FLASH_CTRL.PHY_ARBITER.CTRL.REDUNThe phy arbiters for controller/host arbitration and in the shared scrambling module are redundant. The arbiters have two instances underneath that are constantly compared to each other.
FLASH_CTRL.PHY_HOST_GRANT.CTRL.CONSISTENCYThe host grant is consistency checked. If the host is ever granted with info partition access, it is an error. If the host is ever granted at the same time as a program/erase operation, it is an error.
FLASH_CTRL.PHY_ACK.CTRL.CONSISTENCYIf the host or controller ever receive an unexpeced transaction acknowledge, it is an error.
FLASH_CTRL.FIFO.CTR.REDUNThe FIFO pointers of several FIFOs are implemented with duplicate counters.
FLASH_CTRL.MEM_TL_LC_GATE.FSM.SPARSEThe control FSM inside the TL-UL gating primitive is sparsely encoded.
FLASH_CTRL.PROG_TL_LC_GATE.FSM.SPARSEThe control FSM inside the TL-UL gating primitive is sparsely encoded.

Signals

In addition to the interrupts and bus signals, the tables below lists the flash controller functional I/Os.

SignalDirectionDescription
lc_creator_seed_sw_rw_eninputIndication from lc_ctrl that software is allowed to read/write creator seed.
lc_owner_seed_sw_rw_eninputIndication from lc_ctrl that software is allowed to read/write owner seed.
lc_seed_hw_rd_eninputIndication from lc_ctrl that hardware is allowed to read creator / owner seeds.
lc_iso_part_sw_rd_eninputIndication from lc_ctrl that software is allowed to read the isolated partition.
lc_iso_part_sw_wr_eninputIndication from lc_ctrl that software is allowed to write the isolated partition.
lc_escalate_eninputEscalation indication from lc_ctrl.
lc_nvm_debug_eninputIndication from lc_ctrl that non-volatile memory debug is allowed.
core_tlinput/outputTL-UL interface used to access flash_ctrl registers for activating program / erase and reads to information partitions/
prim_tlinput/outputTL-UL interface used to access the vendor flash memory proprietary registers.
mem_tlinput/outputTL-UL interface used by host to access the vendor flash memory directly.
OTPinput/outputInterface used to request scrambling keys from otp_ctrl.
rma_reqinputrma entry request from lc_ctrl.
rma_ackoutputrma entry acknowlegement to lc_ctrl.
rma_seedinputrma entry seed.
pwrmgroutputIdle indication to pwrmgr.
keymgroutputSecret seed bus to keymgr.

In addition to the functional IOs, there are a set of signals that are directly connected to vendor flash module.

SignalDirectionDescription
scan_eninputscan enable
scanmodeinputscan mode
scan_rst_ninputscan reset
flash_bist_enableinputenable flash built-in-self-test
flash_power_down_hinputflash power down indication, note this is NOT a core level signal
flash_power_ready_hinputflash power ready indication, note this is NOT a core level signal
flash_test_mode_ainput/outputflash test mode io, note this is NOT a core level signal
flash_test_voltage_hinput/outputflash test voltage, note this is NOT a core level signal
flash_alertoutputflash alert outputs directly to AST