[flash_ctrl] ICV failure on single bit flipped erased words with scrambling
@gautschimi is already working on this.
Since Jan 5, 2026.
- Dominant language
- SystemVerilog
- Stars
- 3.6k
- Forks
- 1.1k
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 141
Description
### Description
In the current `flash_phy_rd` implementation, the `data_erased` signal is used to bypass the descrambling logic when an unprogrammed (erased) word is read.
https://github.com/lowRISC/opentitan/blob/e86869f02d586d76bd66dd55ad38ab62c54faddd/hw/top_earlgrey/ip_autogen/flash_ctrl/rtl/flash_phy_rd.sv#L494-L495
A single bit flip within an erased word should be correctable by the reliability ECC. However, because `data_erased` is calculated using the raw, uncorrected data (`data_i`), a single flip causes `data_erased` to be de-asserted.
https://github.com/lowRISC/opentitan/blob/e86869f02d586d76bd66dd55ad38ab62c54faddd/hw/top_earlgrey/ip_autogen/flash_ctrl/rtl/flash_phy_rd.sv#L431-L433
(Note: `data_i = content + ICV + ECC`)
The hardware then incorrectly attempts to descramble the word. This results in corrupted data and a subsequent integrity check failure, effectively making the single-bit error uncorrectable.
CC: @vogelpi, @moidx, @johannheyszl
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.