Patent Application
20230138906
This application claims priority to India Provisional Application No. 202141049516, filed Oct. 29, 2021, which is hereby incorporated by reference.
Many integrated circuits (ICs) have a mix of digital and analog modules (circuits). The operation of at least some analog modules are adjusted through use of trim data. Conventional analog modules include trim registers into which trim data is stored. Trim data is written into the trim registers in the individual analog modules from a flash memory trim sector by boot code. However, the data copy operation by the central processing unit (CPU) might be inefficient, as trim registers are spread across different modules, adversely affecting boot time. In addition, within local trim registers in analog modules, trim information is lost when the module is power gated, for example during standby modes, and requires reinitialization of the trim data upon transition from the standby mode to the active mode. Additionally, the trim registers in the analog modules may not be protected from inadvertent writes or may implement weak protection through known inline passwords, thereby being vulnerable to tampering. Further, system integrators often rely on documentation in order to use trim features. If that documentation is not provided or not followed, application-level calibration to improve module performance may not be possible.
This disclosure relates to a system that includes a centralized trim controller and a nonvolatile memory that includes a trim sector configured for including trim data for one or more analog modules. The trim controller module is configured to obtain, for each of the one or more analog modules, trim values of the one or more analog modules from a trim sector of a nonvolatile memory, wherein the trim controller is implemented in a nonswitchable power domain to provide the trim values to the one or more analog modules.
This disclosure also relates to a system having a nonvolatile memory having a trim sector, one or more analog modules, and a processor. The processor is configured to initiate a boot process of the system and, during the boot process, read trim values of the one or more analog modules from the nonvolatile memory and provide the trim values to the trim controller. The trim controller is coupled to the one or more analog modules and configured to provide the trim values to the one or more analog modules.
This disclosure also relates to a method, including receiving a write request for an application-specific trim value for an analog module, and receiving, in accordance with the write request, a password for the application-specific trim value. The method also includes, in accordance with determining that the received password is a valid password, initiating a timeout counter and updating the application-specific trim value in accordance with the write request, wherein the application-specific trim value is updateable until the timeout counter elapses.
For a detailed description of various examples, reference will now be made to the accompanying drawings in which:
The same reference number is used in the drawings for the same or similar (either by function and/or structure) features.
A technique is provided to include a centralized secure trim controller module. The centralized trim controller can include critical trim registers, such as those associated with infrastructure, and noncritical trim registers, such as those associated with application-specific analog modules. Trim values may be initially provided in a trim sector of a nonvolatile memory. At boot time, a processing unit can provide those trim values to the centralized trim controller, from which the trim information is made available to individual analog modules as sideband hardware signals. In some embodiments, the trim bit fields in the centralized trim controller are stored in a compacted manner to make more efficient use of storage. For example, in some embodiments, trim registers may be defined at consecutive addresses in the trim controller module. Accordingly, the embodiments described herein reduce the area needed for the trim data thereby, and facilitate a more efficient boot process.
The system 100 may include various peripherals (e.g., Peripherals A-E in the example of
While five peripherals A-E are shown in the example of
Peripherals in a switchable power domain have access to the sideband signal containing the trim values upon entering a powered-up mode. For example, if peripheral D 136 is powered down during a standby mode, the trim data will automatically flow from the centralized trim controller 105 to the peripheral D 136 when the power domain that powers peripheral D 136 is switched on and peripheral device D returns to its fully operational mode. The trim data available from the trim controller 105 can then be used by peripheral D 136.
According to one or more embodiments, the trim controller 105 includes trim registers 140. In one example, each register is a 32-bit register. Each register includes multiple bit fields (a bit field being a contiguous subset of the bits of the register), and each bit field stores a trim value for a particular peripheral. In one embodiment, all of the trim values in a given register may be for the same peripheral. In another embodiment, a given register may store trim values for multiple peripherals. Based on the contents of the trim registers for a given peripheral, the centralized trim controller 105 generates one or more signals for that peripheral. The signal(s) contain the trim value(s) that are specific to that peripheral. For this purpose, the trim controller 105 may include a switch 144 coupled between the trim registers 140 and the outputs of the trim controller 105. The switch 144 may receive a mapping that designates which bit fields of which registers correspond to which peripheral, and the switch 144 may provide values from the various bit fields to the corresponding peripherals according to the mapping.
In some examples, the centralized trim controller continuously transmits the signal(s) regardless of whether the target peripheral is powered on or off. In the case of peripherals in the switchable power domain, such as peripheral C 134, peripheral D 136, and peripheral E 138, the signals that include the trim data for those respective peripherals are received by the peripheral when the associated power domain is powered. In the case of peripherals in the non-switchable power domain, such peripherals are continuously powered on and thus receive the trim signals from the centralized trim controller as soon as the controller transmits the signals. Each peripheral may apply its respective trim parameter to its internal circuitry upon receipt of the trim signal from the centralized power controller 105. That is, the analog module can apply the value provided into the circuitry that will change the functionality of electrical property of the analog module. As an example, the RC oscillator may have a circuitry inside that can change the frequency of the output clock based on the trim value received. In one case it can generate 48 MHz clock for trim data 0x10 while it can generate 48.1 MHz for trim data 0x15. Accordingly, the analog module circuitry interprets the received trim data and adjusts the electrical behavior.
The memory map 200 may have subapertures, such as a general aperture 202, an immutable aperture 204, and a mutable aperture 206. The registers in the general aperture 202 may pertain to security aspects of the trim content. In the example of
Referring still to
In the example of
According to some embodiments, varying locking techniques may be used to manage and secure the trim values, such as a global lock and a volatile lock.
After the immutable and mutable registers are loaded, the CPU then (still as part of the boot process) then sets the global lock bit (e.g., logic 1) in the global lock register, as shown at 312. Once the boot code sets the global lock bit, the mutable aperture 206 and the immutable aperture 204 are locked and thus write-protected (state-1 320). The trim controller 105 may remain in this state until an unlock attempt is made (no operation 322).
The global lock information may be stored in the trim controller using a dual flip-flop-based redundancy mechanism. As shown, the trim controller 105 includes a first flip-flop FF1 and a second flip-flop FF2. When the global lock bit is not set, the output of the two flip flops will be 0 and 1, respectively, and the global lock will be in an unlocked state. When the global lock bit is set to 1, the output of the two flip flops will be 1 and 0, respectively, and the global lock will be in a locked state. Accordingly, if there is any one bit flip, then the state will remain as locked. For example, in some embodiments, state “01” is used for unlock, while states “10,” “00,” and “11” are used for lock states. Storing the global lock information using a double flip-flop-based redundancy can increase robustness in some embodiments.
The trim controller also includes a volatile lock (register 202b in the general aperture 202). If a user or user application wishes to modify trim values in the mutable aperture 206, the user or user application may access the mutable aperture by unlocking the volatile lock. According to some embodiments, the volatile lock register 202b is password-protected, such as by use of a 32-bit key known to the user or user application. The volatile lock register 202b register can be written with the correct password to unlock the mutable aperture 206. Failure to write the correct password into the register 202b results in the mutable aperture remaining locked. During boot, the global lock register is programmed by the boot code, which locks the mutable aperture 206 and immutable aperture 204. Upon completion of the boot process and control passes to a user-application, if required, the application can program the volatile lock, which will unlock only the mutable aperture and not the immutable aperture. As such, a valid unlock password at 324 causes the mutable aperture to be unlocked, while the immutable aperture remains, as shown at state-2 330.
Once the mutable section is unlocked, a user can update the trim values in the mutable aperture 206. In addition, according to some embodiments, the trim controller 105 includes a mutable aperture auto-locking mechanism which automatically re-locks the mutable aperture in the event the user forgets otherwise neglects to re-lock the mutable aperture. Moreover, the auto-locking mechanism acts as a security feature, reducing the risk of malware corrupting the mutable trim values, for example. Once the mutable aperture is unlocked, a counter (within the trim controller 105) begins to count. The counter may be an up-counter or a down-counter and the counter terminates upon reaching a threshold timeout value. The mutable aperture remains unlocked until the threshold timeout value is reached (unless the user has manually re-locked the mutable aperture), as shown at 334. With each write of a register in the mutable aperture 206 while it is unlocked, the counter restarts, according to some embodiments. For example, a user can continue to modify register values (332) while the mutable aperture is unlocked (at a frequency that is faster than threshold timeout value). In some embodiments, the counter may be reset with each write. When a timeout is reached, such as when the counter decrements to zero, then the mutable aperture may be relocked, as shown at 334. The counter may provide an auto-locking mechanism and can run for a predetermined number of clock counts (for example 32 counts of a clock) once the mutable region is unlocked. In some embodiments, each write may require a user to enter a password. In some embodiments, a user entering an invalid password may cause the mutable aperture to be locked, also shown at 334. In some embodiments, the global lock may still be set even as the mutable registers are unlocked via the volatile lock. As such, the trim controller will transition from state-1 320 to state-2 330 and back to state-1 320 when a user application changes one or more values in the mutable aperture 206.
The flowchart 400 begins at block 402, where a trim sequence is loaded. According to some embodiments, during the boot process, the CPU 110 reads trim data from the trim sector 120 of nonvolatile memory 115, and writes the trim data to the centralized trim controller 105. Then, at block 404 (and still during the boot process), the global lock register is set. In some embodiments, the global lock may be set, for example, as a bit within the trim controller 105. In some embodiments, setting the global lock may include locking an immutable aperture, as shown at 406, and locking a mutable aperture, as shown at 408. Locking the immutable and mutable aperture renders the apertures write-protected, according to some embodiments. As such, when the global lock is initially set, both immutable and mutable aperture data is write-protected.
The flowchart continues at block 410, where the trim controller 105 exports the global lock signal to use in other modules, such as peripherals 130, 132, 134, 136, and 138. According to some embodiments, the global lock signal is transmitted as a sideband signal. This global lock indication may be used by the peripherals to write-protect any of the internal test or debug registers. In some embodiments, the lock signal may be transmitted along with trim values (block 411) to the various peripherals of the system. The trim values may be transmitted at block 411 using a same sideband signal as the global lock, according to some embodiments.
The flowchart 400 continues at 412 where, following the boot process, the trim controller receives a request from a user to unlock the mutable aperture. For example, a user may wish to modify a register trim value for one of the peripherals. In some embodiments, the request may include a password. For example, a password may be programmed into the register 202b to unlock the mutable section. At 414, a determination is made by the CPU 110 as to whether the password is valid. If the password is invalid, then the flowchart 400 continues at block 428, and the mutable aperture remains locked.
Returning to block 414, if the CPU 110 determines the password to be a valid, then the flowchart 400 continues to block 416, and the mutable aperture is unlocked. Notably, the password allows the volatile lock to be unlocked, while the global lock remains locked. In this scenario, the mutable aperture can be modified, while the immutable aperture remains write-protected. In addition, at block 418, a timeout counter begins decrementing. The timeout counter may provide a timeframe in which the values of the mutable aperture may be modified before the mutable aperture is relocked.
At block 420, the trim controller determines whether a write access has been detected. As described above, in some embodiments, a user may continue writing to the trim registers until a timeout event is detected. As such, if at block 420 no write access is detected, then the flowchart continues to block 426 and a determination is made regarding whether a timeout event has occurred. As described above, the timeout event may occur when the counter decrements to zero, for example. If a timeout event does occur, then the flowchart continues to block 428, and the mutable aperture is locked and thus made write-protected.
Returning to block 420, if write access is detected, then the trim register is updated at block 422, and the timeout counter is restarted at 424. According to some embodiments, the registers in the mutable aperture may continue to be updated as long as the write access occurs (for example with a valid password) and until a timeout event occurs.
As described above, the trim controller 510 can include trim registers for some analog peripherals. For purposes of the example, a low-power comparator module 540, a temperature sensor 542, and a current to voltage converter 544 are presented. Each of these smaller analog modules are associated with a memory map register in the general aperture of trim controller 510, as shown at 520. An application can then write into the memory map register of each of the smaller analog modules 520 in the trim controller 510. That information will flow into the various analog modules, such as low-power comparator module 540, temperature sensor 542, and current to voltage converter 544, as a sideband signal. Accordingly, rather than having the registers in the peripherals, the registers can be housed in the trim controller and handle the information exchange through hardware signals. In some embodiments, it may be advantageous to include the trim registers for some peripherals within the trim controller 510 to reduce overhead in small-sized modules.
The trim controller 510 can include other miscellaneous registers related to security, such a security counter 522, security finite state machine 524, and a volatile lock register 526. As described above, the security finite state machine 524 may manage a lock status of the mutable registers based on the volatile lock register 526. In addition, the state of the security finite state machine 524 is further affected by a security counter 522, which provides a countdown which is activated upon entry of a valid password and causes the volatile lock register to lock the mutable aperture upon a timeout.
In this description, the term “couple” may cover connections, communications, or signal paths that enable a functional relationship consistent with this description. For example, if device A generates a signal to control device B to perform an action: (a) in a first example, device A is coupled to device B by direct connection; or (b) in a second example, device A is coupled to device B through intervening component C if intervening component C does not alter the functional relationship between device A and device B, such that device B is controlled by device A via the control signal generated by device A.
A device that is “configured to” perform a task or function may be configured (e.g., programmed and/or hardwired) at a time of manufacturing by a manufacturer to perform the function and/or may be configurable (or reconfigurable) by a user after manufacturing to perform the function and/or other additional or alternative functions. The configuring may be through firmware and/or software programming of the device, through a construction and/or layout of hardware components and interconnections of the device, or a combination thereof.
Unless otherwise stated, “about,” “approximately,” or “substantially” preceding a value means +/−10 percent of the stated value. Modifications are possible in the described examples, and other examples are possible within the scope of the claims.
Modifications are possible in the described embodiments, and other embodiments are possible, within the scope of the claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| 202141049516 | Oct 2021 | IN | national |
