[spi_device] D2 Signoff

[msfschaffner]

Description

Ensure D2 signoff criteria are fulfilled after focus area changes have landed.

[a-will]

Changes since ES tape-out

• [regtool] Fix QE assignment bug #19164
• [reggen] Add support for multi-bit regwen signals #19575
• [spi_device] Remove generic mode #20856
• [spi_device] Add support for 1r1w RAMs and parity init #20942
• [spi_device] Fix address mode synchronization #21119
• [spi_device] Fix up synchronization of status bits #21120
• [spi_device] Add high-speed read pipeline to relax timing requirements #20966
• [spi_device] Remove all timing mode CSRs #21161
• [spi_device] Fix up TPM command handling #21322
• [spi_device] Update block diagrams and SRAM memory layout #21656
• [spi_device] Clean up TODOs and add a mechanism to reinit the read buffer #21701
• [spi_device] Add separate constraints for TPM and fast passthrough #21595
  • top-level constraints

NEW_FEATURES

A 2-stage pipeline was added as an optional path for flash reads with dummy cycles, so as to effect higher clock rates for compatible commands (especially Quad Output Read).

• Issues
  • [spi_device] SDC updates & Enhance pass-through rates for wider reads by pipelining the return path #11718
• PRs
  • [spi_device] Add high-speed read pipeline to relax timing requirements #20966
  • [spi_device] Add separate constraints for TPM and fast passthrough #21595

In addition, generic mode and support for SPI timings other than mode 0 were dropped (these are related features).

• Issues
  • [spi_device] Remove Generic (a.k.a. FwMode) from SPI_DEVICE HWIP #15452
  • [spi_device] SPI pass-through does not support mode 3 #16339
• PRs
  • [spi_device] Remove generic mode #20856
  • [spi_device] Remove all timing mode CSRs #21161

The rest of the changes do not precisely amount to new features. Instead, they are sometimes significant refinements of the implementation to fix bugs.

BLOCK_DIAGRAM

Updated in #21656

DOC_INTERFACE

No changes since tape-out, so all still documented.

DOC_INTEGRATION_GUIDE

Added clocking requirements in the documentation here:

opentitan/hw/ip/spi_device/README.md

Line 88 in 599ab38

SPI Device requires the core clock to have a frequency that is at least 1/4 the SPI clock frequency.

MISSING_FUNC

The missing compatibility with the TPM spec is documented in these two places:

opentitan/hw/ip/spi_device/doc/theory_of_operation.md

Line 352 in 599ab38

The TPM over SPI submodule processes the low level data only, and it is not compliant with the SPI TPM command timing specifications.

opentitan/hw/ip/spi_device/doc/theory_of_operation.md

Lines 387 to 389 in 599ab38

	Note that firmware is in the loop to process write commands to these registers.
	Consequently, the TPM over SPI submodule cannot meet timing requirements for updated data to be available within one wait state.
	Once firmware writes the CSRs, the submodule can return the data as specified, however.

FEATURE_FROZEN

TBD after review meeting, but expected to be.

FEATURE_COMPLETE

• SPI_DEVICE.MODE.FLASH_EMULATION
• SPI_DEVICE.MODE.PASSTHROUGH
• SPI_DEVICE.MODE.TPM
  • Not fully compliant, but feature level is considered satisfactory
  • [spi_device] TPM return-by-hw flawed without hardware write support #21160
• SPI_DEVICE.HW.LANES
• SPI_DEVICE.HW.SERDES_ORDERING
• SPI_DEVICE.HW.CSB_STATUS
• SPI_DEVICE.MODE.FLASH_EMULATION.COMMANDS
• SPI_DEVICE.HW.FLASH_EMULATION_BLOCKS
• SPI_DEVICE.MODE.FLASH_EMULATION.READ_COMMAND_PROCESSOR
• SPI_DEVICE.MODE.FLASH_EMULATION.DUMMY_CYCLE
• SPI_DEVICE.MODE.FLASH_EMULATION.WRITE_ENABLE_DISABLE
• SPI_DEVICE.HW.LAST_READ_ADDR
• SPI_DEVICE.HW.CMDINFOS
• SPI_DEVICE.HW.COMMAND_UPLOAD
• SPI_DEVICE.HW.3B4B_ADDRESSING
• SPI_DEVICE.MODE.PASSTHROUGH.CMD_FILTER
• SPI_DEVICE.MODE.PASSTHROUGH.ADDRESS_MANIPULATION
• SPI_DEVICE.MODE.PASSTHROUGH.STATUS_MANIPULATION
• SPI_DEVICE.MODE.PASSTHROUGH.OUTPUT_ENABLE_CONTROL
• SPI_DEVICE.MODE.PASSTHROUGH.INTERCEPT_EN
• SPI_DEVICE.MODE.PASSTHROUGH.MAILBOX
• SPI_DEVICE.MODE.TPM.RETURN-BY-HW_REGS
• SPI_DEVICE.MODE.TPM.AUTO_WAIT
• SPI_DEVICE.MODE.TPM.READ_FIFO_MODE
• SPI_DEVICE.MODE.TPM.CAPABILITY

PORT_FROZEN

Only interrupt ports changed:

-  // INTR: Generic mode
-  output logic intr_generic_rx_full_o,              // RX FIFO Full
-  output logic intr_generic_rx_watermark_o,         // RX FIFO above level
-  output logic intr_generic_tx_watermark_o,         // TX FIFO below level
-  output logic intr_generic_rx_error_o,             // RX Frame error
-  output logic intr_generic_rx_overflow_o,          // RX Async FIFO Overflow
-  output logic intr_generic_tx_underflow_o,         // TX Async FIFO Underflow
+  output logic intr_tpm_rdfifo_cmd_end_o,
+  output logic intr_tpm_rdfifo_drop_o,

ARCHITECTURE_FROZEN

RAMs

• Support for 1r1w RAMs has been added, but it is not used in earlgrey.
  • Access controls are the same for 2p RAMs, though.
  • Egress section is write-only for SW.
  • Ingress section is read-only for SW.
• The 64B TPM Write FIFO and TPM Read FIFO have been moved to the bigger SRAMs.
  • No longer separate.

CSRs

CONTROL:
- CONTROL.ABORT
+ CONTROL.FLASH_STATUS_FIFO_CLR
+ CONTROL.FLASH_READ_BUFFER_CLR
- CONTROL.MODE:fwmode
+ CONTROL.MODE:disabled
- CONTROL.RST_TXFIFO
- CONTROL.RST_RXFIFO
- CONTROL.SRAM_CLK_EN

CFG:
- CFG.CPOL
- CFG.CPHA
- CFG.TIMER_V
- CFG.ADDR_4B_EN

+ ADDR_MODE:
+ ADDR_MODE.ADDR_4B_EN
+ ADDR_MODE.PENDING

- FIFO_LEVEL
- ASYNC_FIFO_LEVEL

STATUS:
- STATUS.rxf_full
- STATUS.rxf_empty
- STATUS.txf_full
- STATUS.txf_empty
- STATUS.abort_done

- RXF_PTR
- TXF_PTR
- RXF_ADDR
- TXF_ADDR

- FLASH_STATUS.status (bits = 23:1, rw)
+ FLASH_STATUS.wel (bits = 1, rw1c)
+ FLASH_STATUS.status (bits = 23:2, rw)

+ UPLOAD_CMDFIFO.busy
+ UPLOAD_CMDFIFO.wel
+ UPLOAD_CMDFIFO.addr4b_mode

+ CMD_INFO*.read_pipeline_mode

- TPM_STATUS.wrfifo_depth
+ TPM_STATUS.wrfifo_pending
+ TPM_STATUS.rdfifo_aborted

- TPM_WRITE_FIFO

REVIEW_TODO

• TODO [spi_device] Disallow certain state changes when busy #21700
  

  opentitan/hw/ip/spi_device/rtl/spid_status.sv

  Line 192 in 32e8620

  // TODO(#21700): HW changes should not be allowed while BUSY

  • Can probably push to a future release, but it would be safer to reject uploads while busy, so the payload buffer does not get overwritten.
  • Decided in the review meeting that we would move this into PROD.M4 so that we at least check whether this could be beneficial. Effort is mostly DV, RTL should be simple.
• ICEBOX [spi_device,dv] Add assertion to test SRAM logic is faster than update of current_address_i. #18352
  

  opentitan/hw/ip/spi_device/rtl/spid_readsram.sv

  Lines 275 to 276 in 32e8620

  	// Assume the SRAM logic is faster than update of current_address_i.
  	// ICEBOX(#18352): Put assertion.

  • Recommend pushing to a future release, but it is also up to DV.
• ICEBOX [spi_device,rtl] Handle SRAM integrity error output decisively #18353
  

  opentitan/hw/ip/spi_device/rtl/spid_readsram.sv

  Lines 344 to 346 in 32e8620

  	// ICEBOX(#18353): Handle SRAM integrity errors
  	sram_err_t unused_sram_rerror;
  	assign unused_sram_rerror = sram_m2l_i.rerror;

  • Recommend pushing to a future release
  • The info from a notifier seems unlikely to be used
• ICEBOX [spi_device,rtl] Potential logic optimizations in RTL #18354
  

  opentitan/hw/ip/spi_device/rtl/spi_cmdparse.sv

  Lines 212 to 213 in 32e8620

  	// cmd_info latch
  	// ICEBOX(#18354): This can be further optimized as follows:

  
  

  opentitan/hw/ip/spi_device/rtl/spi_tpm.sv

  Lines 1214 to 1216 in 32e8620

  	// ICEBOX(#18354): Change the state machine to send start byte at
  	// cmdaddr_bitcnt == 5'h 17 if write command and FIFO is
  	// empty, then the state can go to StWrite directly.

  
  

  opentitan/hw/ip/spi_device/rtl/spid_upload.sv

  Lines 510 to 513 in 32e8620

  	// ICEBOX(#18354): Merge two FIFOs into one.
  	// Design a module that has one SRAM Read port / one SRAM write port
  	// and compile-time configurable # of FIFO ports + N of SramBase Address
  	// (Preferrably variable width)

  • Recommend pushing to a future release
  • These are design optimizations with relatively insignificant impact
  • Decided in the review meeting to remove TODOs and close issue as not planned

STYLE_X

There are no uses of X in spi_device.

CDC_SYNCMACRO

The synchronization macros are used in most places. However, there is some SPI-specific behavioral logic in some cases where a prim_flop_2sync is used to synchronize a control signal that marks some data as being stable / ready to sample, with the data changing domains in behavioral logic. This is a "fire-and-forget" analogue to prim_sync_reqack_data.

LINT_PASS

Passes lint.

CDC_SETUP

No CDC flow available.

RDC_SETUP

No RDC flow available.

AREA_CHECK

FPGA-based area difference from ES:

Type	ES	Now
LUTs	3509	3594
Flops	3173	3047

The dual-port RAM size is the same.

TIMING_CHECK

Timing continues to pass on the FPGA, with no apparent significant impact to the overall budgets (though there is a lot of slack in both cases). Some of the worst paths are gone now, which is due to the clock network simplification and removal of generic mode.

SEC_CM_DOCUMENTED

N/A. There are no security countermeasures for this block.

[msfschaffner]

Thanks for putting this together @a-will!
This has been reviewed together with @hcallahan-lowrisc @vogelpi @antmarzam @msfschaffner and @rswarbrick today.

Open action items for closing out D2S:

• Remove irrelevant ICEBOX TODOs and close associated issue as not planned
• Update outdated checklist
  • Remove outdated D1 FUNC_IMPLEMENTED comment on checklist
  • Update waived and N/A items on D2 (DOC_INTEGRATION_GUIDE, MISSING_FUNC)

[a-will]

The action items were covered by #21795