Embedded ReRAM

ReRAM Introduction

The chip features up to 4 MByte of embedded ReRAM memory for storing programs and data. The ReRAM memory contains two blocks of 128-bit data width each, giving 256-bit data width in parallel. The ReRAM memory visible to software is divided into two regions: the main array and the IFR array.

Note: ReRAM reads back as zero if it was not initialized during the CP flow.

ReRAM Memory Map

Code region

• Located at 0x6000_0000 to 0x603D_9FFF (maximum extent).
• Up to 4 regions: boot0, boot1, fw0, fw1.
• Minimum 1 user.
• Configurable address region.
• Supports single write (256-bit) and page write (32 sets of 256-bit).

One-way counters

• Located at 0x603D_A000 to 0x603D_BFFF.
• Only available in user mode.
• No user restrictions; write-only region.
• Software controls the number of writes — no more than 10 K writes per 256-bit word.
• Supports single write only.

Access Control Bank

• Located at 0x603D_C000 to 0x603D_FFFF.
• Only available in user mode.
• Contains the access control configuration for key slots and data slots.
• Supports single write only, used to update access control configuration.

Crypto Data Slots (2048 sets)

• Located at 0x603E_0000 to 0x603E_FFFF.
• Only available in user mode.
• Supports program-only or write operation.
• Provides user-writeable, set-only memory slots.
• Supports single and page write.

Crypto Key Slots (2048 sets) — DEPRECATED

• Located at 0x603F_0000 to 0x603F_FFFF.
• Only available in user mode.
• Supports single and page write.
• Do not use. Deprecated due to a hardware bug.

IFR (information region)

• Located at 0x6040_0000 to 0x6040_03FF.
• Configurable in user mode for lab testing and debug, but frozen for mass production and downloadable only in test mode.
• Holds the life cycle pattern.
• Holds chip system data: trimming, user mapping assignment, serial number.
• Holds read/write disable configuration for each key slot, data slot, and code block.
• Supports single write only.

Data Slot Region Map (64 KB)

Key Slot Region Map (64 KB)

This section has been removed because the key slot region is deprecated.

ReRAM Read Mechanism

ReRAM supports 256-bit read data per transaction. The chip uses a single read buffer design to maximise instruction fetch performance. AXI bus transactions are 64-bit wide.

If the target read data is already prefetched into read_buf[255:0], the ReRAM controller reads directly from the buffer with no wait states.

If the target read data is not in the read buffer, the ReRAM controller reads it from the ReRAM IP array and stores it into the read buffer, simultaneously returning the data on the AXI bus to the CPU cores.

Assuming one ReRAM array transaction provides 4 sets of contiguous 64-bit instructions, the average read time is (6 × Period_rramclk + 3 × Period_aclk). This covers one 256-bit ReRAM access for the first 64-bit miss, plus the three subsequent 64-bit AXI bus transactions that hit in the buffer.

ReRAM Write Mechanism

ReRAM supports multi-word write operations. The process has three steps: pre-load, load, and write.

1. Pre-load step

The CPU cores access ReRAM over the 64-bit AXI bus. Pre-load means using CPU writes to fill one 256-bit write data Buffer1 over several transactions — for example 8 × 32-bit CPU writes, or 4 × 64-bit CPU writes.

2. Load step

After pre-load, the ReRAM IP requires the Buffer1 data to be loaded into the trbcx module’s internal Buffer2. Buffer2 can store N sets of 256-bit data, where N = 1 to 32.

3. Write step

After the load step, all write data is ready to be committed to the real ReRAM array. This step requires high voltage and a long process time.

Write Timing

ReRAM write time depends on the difference between the originally stored data and the new write data. Average write times are:

All 0 to All 1

All 1 to All 0 (worst-case pattern)

RRC Registers

Base address: 0x4000_0000

RRCCR — ReRAM Control Register

• Address offset: 0x0000
• Reset value: 0x0000_0000

RRCFD — ReRAM Clock Configuration Register

• Address offset: 0x0004
• Reset value: 0x0000_0007

• rramclk should be typically 50 MHz, maximum 100 MHz.
• Software can adjust this value for different clktop frequencies to run ReRAM at the fastest supported speed.
• frequency_rramclk = frequency_clktop / (fd + 1)

Examples:

RRCSR — ReRAM Status Probe Register (Debug Only)

• Description: Internal trbcx IP status probe register
• Address offset: 0x0008
• Reset value: 0x0000_0000

If no exception occurs, these bits stay at 0.

RRCFR — ReRAM Access Control Error Flag Register

• Address offset: 0x000C
• Reset value: 0x0000_0000

Write 1 to a bit to clear it.

RRCSRSET0 / RRCSRSET1 — SET Failure Probe Registers (Debug Only)

• Address offsets: 0x0014 (bits [31:0]), 0x0018 (bits [63:32])
• Reset value: 0x0000_0000

Probes trc_set_failure[63:0] — the count of “program 1” failure bits for a page operation. If no exception occurs, these bits stay at 0.

RRCSRRST0 / RRCSRRST1 — RESET Failure Probe Registers (Debug Only)

• Address offsets: 0x001C (bits [31:0]), 0x0020 (bits [63:32])
• Reset value: 0x0000_0000

Probes trc_reset_failure[63:0] — the count of “erase 0” failure bits for a page operation. If no exception occurs, these bits stay at 0.

RRCSRRD0 / RRCSRRD1 — Read Failure Probe Registers (Debug Only)

• Address offsets: 0x0024 (bits [31:0]), 0x0028 (bits [63:32])
• Reset value: 0x0000_0000

Probes trc_fourth_read_failure[63:0] — the count of “write 0/1” failure bits for a page operation. If no exception occurs, these bits stay at 0.

RRCAR — ReRAM Action Register

• Address offset: 0x00F0
• Type: AR (action register, write-only)
• Reset value: 0x0000_0000 (always reads zero)

Note: This register is for limited use only and is not required in every product application. Whether this function is exposed to external users is determined by the product’s security level.

ReRAM Access Control Mechanism

The chip provides two paths to access ReRAM memory: the CPU core can access ReRAM directly, and the SCE DMA master can access ReRAM through the AXI bus.

When the CPU accesses ReRAM, it also supplies the coreuser ID to the ReRAM controller, identifying the “user” performing the access (note that this only applies to loads/stores; code accesses can bypass this due to a bug in the implementation, and this is patched through the MMU). The ReRAM controller matches this user against its access configuration to determine whether the user may access the target ReRAM address region.

ReRAM has four effective “users”: boot0, boot1, fw0, and fw1. These users appear in two contexts:

1. As one of four possible owners encoded in an ACL for a data slot. Here the region is determined strictly by the coding in the data slot’s ACL.
2. As regions determined by the address of the access. Here the region is coded in the IFR, a hard-coded value set at manufacturing time into the ReRAM array.

For the Baochip-1x, the region mapping uses the following offsets from the base of ReRAM:

The partition LUT matters because a separate IFR setting (cfg_rrsub_rw_boot0, at offset 0x280) prevents boot0 from being written, effectively making boot0 indelible outside of boot0 itself.

The actual mapping of the coreuser LUT is set up by the bootloader and sealed with a one-way lock after exiting the boot stage. The default configuration can be found in the Xous code base. In short, all M||ASID mappings are set to a “least trusted” user mapping, except for the combination of fw1 + user mode. (User mode as opposed to machine/supervisor mode — in other words, only a particular user-mode process can access the key slots; even the kernel, in machine/supervisor mode, cannot see them.) That combination maps to PID 3, where the keystore process is mapped on boot in Xous. Because the one-way door is sealed on exit from the bootloader, modifying this table requires a custom bootloader.

The SDMA master uses a similar method, supplying the sce_user ID to the ReRAM controller to identify the user performing the access through SDMA.

Access control covers code execution, data read, and data write operations, with different restrictions depending on the target operation.

All access control functions can be enabled independently via the RRCCR register. If an error occurs, an interrupt is generated and the corresponding flag bit is set in RRCFR. If the NMI function is enabled (RRCCR[15]), the error flag generates both an NMI and a normal interrupt. See RRC Registers for details.

Memory Size Configuration

The ReRAM memory region configuration is located in IFR at 0x6040_00C0. The bit definitions are as follows.

ReRAM array size settings

• Default value: 0x00FF, meaning the whole ReRAM is used.
• ReRAM start address = {10'b0110_0000_00, bit[127:120], 14'h0}
• ReRAM last address = {10'b0110_0000_00, bit[119:112], 14'h3FFF}

CM7 user region settings

• Default value: 0x0000_FFFF_FFFF, meaning only boot0 is used.
• boot0 start address = {10'b0110_0000_00, bit[103:96], 14'h0}
• boot0 last address = {10'b0110_0000_00, bit[95:88], 14'h3FFF}
• The CM7 init address should match the software power-on start address — usually the boot0 or boot1 start address.

RISC-V user region settings

Bit definitions mirror the CM7 fields above.

Usage guidance:

• Single core (RISC-V only): this value can be set freely according to application requirements.
• Multiple cores (not supported by Baochip; available on Crossbar SKUs):
  1. The CM7 settings are used instead of these settings — set bits [63:16] the same as bits [111:64].
  2. The software design should treat the RISC-V core as its own user, and that user cannot also be used by the CM7 core, since the two cores’ instruction sets are not compatible. The RISC-V default user (bits [1:0]) should be set to match the software design.
  3. If both CM7 and RISC-V use the same user, the ReRAM controller cannot distinguish between them and treats them as the same user. In that case only one core can access ReRAM at any given time.

SRAM array size settings

SRAM1 (bits [15:12]):

• bit [7]: size cut enable
• bits [6:4]: size range
• Default 0x0: disabled, no size reduction.
• If enabled, the valid SRAM1 address range is < {bit[6:4], 15'h0}.

SRAM0 (bits [11:8]):

• bit [3]: size cut enable
• bits [2:0]: size range
• Default 0x0: disabled, no size reduction.
• If enabled, the valid SRAM0 address range is < {bit[2:0], 15'h0}.

Other user-related settings

Reserved bits

Data Access to Code Region

The ReRAM data access control for the code region is configured in the IFR. Each user has its own configuration settings.

In all tables below, the default value is 0, meaning access is always allowed. Setting a bit to 1 disables that access. Y indicates access is always permitted (a user always has access to its own region).

boot0 configuration — IFR 0x6040_0280, bits [111:104] (user_code_cfg_boot0)

boot1 configuration — IFR 0x6040_02A0, bits [111:104] (user_code_cfg_boot1)

fw0 configuration — IFR 0x6040_02C0, bits [111:104] (user_code_cfg_fw0)

fw1 configuration — IFR 0x6040_02E0, bits [111:104] (user_code_cfg_fw1)

In each case, all other bits are reserved for CP testing only and should always be written as 0.

Data Access to One-Way Counter Region

As with a general MCU, there is no access restriction on the one-way counter region for any user. Each one-way counter should be written fewer than 10 K times.

Data Access to Access Control Region

This region can only be accessed by privileged users (boot0 and boot1). It stores the access control configuration for all data slots and key slots. Each data slot or key slot has its own 32-bit access control configuration.

Data slot control region

• Each item controls access to the corresponding slot in the Data Slots region. See Data slot access control configuration word.
• Size: 2048 × 4 = 8 KB
• Address: 0x603D_C000 – 0x603D_DFFF

Key slot control region

• Each item controls access to the corresponding slot in the Key Slots region.
• Size: 2048 × 4 = 8 KB
• Address: 0x603D_E000 – 0x603D_FFFF
• Akey: authentication link root key, which controls Gkey access.

Note: The key slot region is deprecated. See Data access control to key slot region.

data_cfg Slot (256-bit)

Each data_cfg slot holds access control configuration for 8 data slots. Each data slot has its own 32 bits of configuration.

For data_cfg slot N, the bit assignment is:

Read access control bits for the cfg slots — located at IFR 0x6040_0300 and 0x6040_0320:

Default 0 means read is always allowed. Setting the bit to 1 disables read access.

Write access control bits for the cfg slots — located at IFR 0x6040_0340 and 0x6040_0360:

Default 0 means write is always allowed. Setting the bit to 1 disables write access.

key_cfg Slot (256-bit)

These slots are deprecated and should not be used, as they are not fully functional.

Data Slot Access Control Configuration Word (32-bit)

Data Access Control to Data Slot Region

The data slot region can be accessed by different masters. Crypto applications normally require a higher-privilege user mode to access a data slot.

Any other operation is denied.

Data Access Control to Key Slot Region

This mode of operation is deprecated, as it has hardware bugs.

Data Access Control to IFR Region

The IFR region stores system-level configuration.

Before mass production, skipping the “disable write access” step allows software to access the IFR region during lab testing or sample testing. This region can be accessed by privileged users (boot0 and boot1) for debug and development purposes only.

Software does not need to perform its own access control. The final settings should be downloaded and the write access datapath then disabled, under test mode or OEM mode, during the CP or FT process. Users cannot modify IFR settings in mass production.

Detailed CP and FT testing steps are described in the Daric NTO Test Mode User Guide.

ReRAM Operation Reference Flow

Regular ReRAM Write Operation Flow

1. Set RRCCR[1] = 0 (power-on default) to select data mode for the input write data.
2. Write 256 bits into internal write Buffer1 — either 8 × 32-bit writes or 4 × 64-bit writes to the ReRAM address.
3. Set RRCCR[1] = 1 to select command mode for the LOAD or WRITE command.
4. Write the LOAD command (0x5200) to the ReRAM address.
5. Single write or page write is supported: 1 to 32 loads of 256 bits to the same ReRAM page.
6. For multiple 256-bit loads, repeat steps 2–4 for each target data value and address.
7. Write the WRITE command (0x9528) to the ReRAM address.
8. Read back the ReRAM address to confirm the write succeeded.

Special ReRAM One-Way Counter Operation Flow

1. Valid only for the one-way counter address region.
2. Write any value (the data is ignored) directly to the target one-way counter address, like a single SRAM write.
3. Read back the one-way counter address to obtain the counter value.

Special ReRAM Program-Only Operation Flow

1. Valid only for the data slots region, 256-bit, with program-only configuration enabled.
2. Only single write operations are supported, one at a time.
3. Set RRCCR[1] = 0 (power-on default) to select data mode for the input write data.
4. Write 256 bits into the internal write buffer — either 8 × 32-bit writes or 4 × 64-bit writes to the ReRAM program-only address.
5. Set RRCCR[1] = 1 to select command mode and start the PROG operation. Only bits written as 1 in the 256-bit value are programmed into the ReRAM.
6. Write any value (the data is ignored) directly to the target program-only address, like a single SRAM write.
7. Read back the ReRAM address to confirm the program succeeded.

Example:

Because program-only sets bits but never clears them, the result is the bitwise OR of the original contents and the write data.

Special ReRAM Access Control Region Update Flow

1. Read the original value of the target access control slot.
2. Modify the specific bits to change the access control settings.
3. Use the regular ReRAM single write operation flow to write the new configuration into the target access control slot. The internal logic also updates the internal access control SRAM buffer, so the new setting takes effect immediately.
4. Read back the target ReRAM address to confirm the update succeeded.