[rram_ctrl] remove flash ctrl from EarlGrey - #30913
Draft
gautschimi wants to merge 61 commits into
Draft
Conversation
This commit adds rram_ctrl + rram_macro and connects them to the bus system. The RRAM can already be used for read/write operations through the controller and host port. Software binaries are still mapped to the flash macro, and otp_ctrl is not yet connected to rram_ctrl. No functional change so far as RRAM is not yet used in any testcase (except for chip level csr_rw test). Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
This commit is to be squashed into the previous one before merge. It contains all autogen changes that were generated with `make -C hw` Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org> [fi,ci] fix fi tests for CI Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
Align all security countermeasures in sec_cm_testplan, hjson and RTL Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
This is an analog signal that is required for testing/trimming the RRAM. It has to be routed directly to the top without any buffers similar to otp_ext_volt or flash_test_volt. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
This allows to preload RRAM images and write selected pages through the backdoor. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
Add dif_rram_ctrl to initialize and configure the RRAM controller aswell as simple functions to perform read/write operations to the RRAM Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
This script gen-rram-img is used to convert a vmem128 file into a loadable vmem128 file that contains address infection and scrambling Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
The RRAM image is 128b wide and requires new rules to call the right script. When building software for the RRAM the "kind" can be switched from "flash" to "rram". This will generate a 128b wide vmem file and call the RRAM specific scripts for scrambling, address infection, etc. (gen-rram-img.py) Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
This commit connects rram_ctrl to the keymgr. This means that the seeds for the keys are now read from RRAM instead of flash. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
This commit contains the autogen files for connecting rram_ctrl to keymgr. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
This commit allows to load RRAM images in verilator runs. The image can be scrambled and then loaded via memload to the RRAM data_array. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
This commit renames the rom_ext_flash section to rom_ext_nvm which can be used for RRAM and flash. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
This commits removes the connection from flash_ctrl to otp_ctrl to fetch the scrambling keys and adds them to rram_ctrl. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
This commit contains the autogen changes to connect rram_ctrl to otp_ctrl to fetch the scrambling keys Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
This test needs to be ported to RRAM because the scrambling keys are now read from RRAM instead of flash. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
This commit switches from executing from flash to RRAM. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
Adjust the backdoor write operation for the RRAM. This adds the address infection for the backdoor write operation. This commit also adds a task that can wait for the rram_ctrl read-buffers to be idle. This is necessary because the RRAM issues every read twice and a backdoor write between the two reads would result in an integrity error. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
Adds a testutils layer over the silicon_creator RRAM driver, mirroring flash_ctrl_testutils, so DV/on-device tests can exercise rram_ctrl without depending on silicon_creator internals directly. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
…tils nv_counter_testutils now stores counters directly in RRAM (via rram_ctrl_testutils) instead of flash_ctrl, since RRAM has no program/erase distinction. nvm_testutils gains an nvm_ctrl-backed implementation alongside its existing flash_ctrl one. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
Reads the default NVM region's scrambling/ECC/high-endurance config through the tech-agnostic nvm_testutils API instead of calling dif_flash_ctrl directly, so this power virus test isn't hardcoded to flash anymore. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
Adds kModuleRramCtrl and the four kErrorRramCtrl* codes, mirroring the existing kModuleFlashCtrl/kErrorFlashCtrl* codes, for use by the upcoming RRAM driver and nvm_ctrl RRAM backend. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
Adds the register-level RRAM controller driver: data/info partition read/write, default-region and per-info-page permissions/config, region protection, and info-page lockdown. write() transparently read-modify-writes unaligned leading/trailing partial write granules, so callers can write arbitrary addr/word_count without worrying about RRAM's 4-word write granularity. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
Adds an RRAM implementation of every nvm_ctrl_* entry point alongside the existing flash_ctrl one, selected at build time via HAS_RRAM_CTRL. RRAM has no program/erase distinction, no bank-erase concept, and needs its DEFAULT_REGION read/write permissions bracketed or persistently enabled around data-partition access, unlike flash. Introduces NVM_PROG_PAGE_SIZE (512 B RRAM / 256 B flash) to represent the program/SPI-wrap granularity distinctly from NVM_BYTES_PER_PAGE (the erase granularity), which coincide for RRAM but not for flash. Also adds the "1 bank, 2 slots" NVM_PAGES_PER_SLOT/NVM_BYTES_PER_SLOT addressing macros used by boot policy and ownership code. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
nvm_ctrl's HAS_RRAM_CTRL macro needs to reach every target that includes nvm_ctrl.h, not just nvm_ctrl.c itself, so it has to be a `defines` (which propagates to dependents), not `copts`. Adds a `defines` dual_inputs()-aware parameter to dual_cc_library alongside the existing srcs/hdrs/deps/target_compatible_with ones. Also fixes _merge_and_split_inputs' struct-detection check: it used `type(inputs) != "list"` to mean "already a dual_inputs() struct", but a bare select() (as returned by e.g. opentitan_if_ip()) is neither a list nor a struct, and the old check would misroute it to a `.shared` attribute access that doesn't exist on a select(). This already affects the existing shutdown target, which passes a bare select() as `defines`; the fix (`type(inputs) == "struct"`) correctly treats any non-dual_inputs() value, list or select() alike, as shared. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
Flash has two physical banks, and the boot policy, ownership, and rescue code assumed a bank IS a slot: kNvmBankSize was used directly as the slot size, and boot_policy_ptrs.h found manifests via flash_ctrl's bank base/size. RRAM has no banks (NVM_NUM_BANKS == 1), so that assumption breaks: kNvmBankSize is just NVM_PAGES_PER_BANK, the whole partition on RRAM rather than half of it. Renamed kNvmBankSize to kNvmSlotSize (owner_block.c, rescue.c, rom_ext.c), backed by the new NVM_PAGES_PER_SLOT/NVM_BYTES_PER_SLOT macros, and switched boot_policy_ptrs.h to compute slot addresses from NVM_DATA_BASE_ADDR/NVM_BYTES_PER_SLOT instead of flash_ctrl directly. Same fix applies to test_owner.c's rescue-config fixture: WITH_RESCUE_START/SIZE were hardcoded flash page counts (32/224). Replaced them with general NVM constants (NVM_BYTES_PER_PAGE, NVM_PAGES_PER_SLOT), same as the production code. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
…ages under RRAM On RRAM, BootData0/BootData1 are always emulated info pages, so nvm_ctrl_info_perms_set() on them is a no-op that performs zero real register writes; the existing SEC_MMIO_WRITE_INCREMENT(2 * kNvmCtrlSecMmioInfoPermsSet) at each of boot_data's 3 write call sites assumed flash's real per-call writes and must be skipped for RRAM to keep sec_mmio_check_counters() accurate. This will be changed in the future once emulated info pages are fully supported in hardware. kBootDataEntriesPerPage now derives from NVM_BYTES_PER_PAGE instead of a hardcoded 16, since RRAM's page size differs from flash's and the old constant was wrong for RRAM. This constant is only used by boot_data.c and boot_data_functest.c, so it is defined directly in each of those (which already depend on nvm_ctrl.h) rather than in the shared boot_data.h. That header backs boot_data_header, a lightweight, broadly-depended-on target that must stay buildable on tops with neither flash_ctrl nor rram_ctrl (e.g. Darjeeling): pulling nvm_ctrl.h into it drags in nvm_ctrl's device deps, which unconditionally require flash_ctrl, breaking every such consumer. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
Mechanically retargets the ROM's EPMP region and the ROM_EXT/bare-metal linker scripts' address-translation checks from the eflash memory region to rram (TOP_EARLGREY_RRAM_CTRL_HOST_*), matching the "1 bank, 2 slots" RRAM addressing already adopted elsewhere. Comments updated from flash-specific wording to generic NVM wording where they no longer apply only to flash. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
…, add 128-bit vmem rules Changes opentitan_test()'s default kind from "flash" to "rram". rom/e2e/BUILD gains 128-bit-word vmem/scr_vmem rules alongside the existing 64-bit ones, needed for RRAM's backdoor-load VMEM format. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
…tstrap load The spi_device backdoor-load path pointed at flash's ".64.vmem"/ ".64.scr.vmem" and backdoor-loaded FlashBank0Data/FlashBank1Data; RRAM builds never produce a ".64.vmem" file (only ".128.vmem"), and both slots map onto the single RramData memory. Also rewrites read_sw_frames() to a generic, word-size-parametric VMEM tokenizer: the previous fixed 4-token/64-bit-per-line $fscanf parse silently misparsed RRAM's 2-token/128-bit-per-line format (srec_cat varies both the token count and hex-digit width per line with word size), corrupting manifest data read back post-bootstrap. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
Erasing is now supported by writing all ones to keep the flash behaviour. This commit also fixes an error in the rram_data_region_protect() function. The size must be equal to (num_pages-1). Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
bazel seems to redefine the a/b slots and if that does not match the linker scripts or offset computations, they will be placed at the wrong location. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
Make software aware of reserved space at the end of the RRAM data region for emulated info pages and OTP. It will prevent to try to "erase" beyond a fixed limit which is defined by a new constant NVM_USABLE_DATA_SIZE_BYTES. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
This allows to execute the test for RRAM and Flash. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
boot_policy_newer/rollback's exit_success strings expected flash's base address (0x20000000) and its old half-bank Slot B offset (0x20080000). RRAM's data partition sits at 0x30000000, with Slot B at 0x100000, so updated both. epmp_test's exit_success had the same issue for the ePMP region 12 dump (all of NVM): expected flash's base/size (0x20000000, 0x100000) instead of RRAM's (0x30000000, 0x200000). Also relaxed regions 8/9 (ROM_EXT code) from address prefix '2' to '3'. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
Port isfb_page_test.c to nvm_ctrl/nvm_testutils. Widen the RRAM ISFB page to 4 pages (2048 bytes) so isfb.c's strike region and product expressions both fit, and fix nvm_testutils_write_info_page() silently ignoring erase_before_write on RRAM. RRAM has no write/erase distinction, so isfb.c's erase policy can't enforce its strike/un-strike ratchet there. Tracked in lowRISC#30890. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
gen-flash-img.py and gen-rram-img.py duplicated the OTP-read and Present-cipher key-derivation logic almost verbatim. Extract it into lib/otp_scrambling_keys.py so both scripts import the same implementation and only keep their technology-specific XEX/ECC steps. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
This commit replaces hardcoded regions with parametrized regions. The ROM_EXT, OWNER, FS regions were the wrong size. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
Wafer/AST/TPM-patch info fields are only ever written by external wafer-test equipment; on FPGA/emulation targets that never run it, garbage NVM content crashed BCD decoding and drove out-of-range AST writes. Add CRC32 checks so unprovisioned fields read back as zero instead. Also fix OwnerReserved6/7 being sized for 1 page while cert extensions write a full 4-page dice_page_t through them, which silently overflowed into OwnerReserved7 and DiceCerts. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
A bad ROM_EXT binary was corrupted with `xxd -r` which was not in the dependencies of the project. This made it difficult to reproduces test failures locally. Fixed by replacing the calls with a short python script. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
…tion Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
The orchestrator python scripts just crash. Making them capture the errors and provide a meaningful error message simplifies debugging. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
The hardened crypto functions expect a constant runtime which cannot be guaranteed with the rram_controller. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
Skip ibex_fi test in CI because it first needs to be ported to RRAM. lowRISC#30896 Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
An unwritten OwnerSecret page can contain garbage data. On RRAM this data is not guaranteed to be zero because of the address infection. On silicon, it is guarnanteed that it has been written before. On FPGA we rely on ownership_transfer numbers to detect if the data is valid or not. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
RRAM reserves 32kB of space for OTP and emulated info pages per slot. This section is marked as reserved in the linker scripts. If the image gets too big, the linker will throw an error. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
RRAM is now the main NVM and flash will be removed soon. Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
gautschimi
requested review from
engdoreis and
hcallahan-lowrisc
and removed request for
a team
August 4, 2026 08:30
gautschimi
marked this pull request as draft
August 4, 2026 08:30
gautschimi
changed the title
Signed-off-by: Michael Gautschi <mgautschi@lowrisc.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.