Part Number: MSPM0G1107
Other Parts Discussed in Thread: SYSCONFIG
On the MSPM0G1107 (die revision C, DEVICEID=0x2BB8802F, USERID=0x8020807B), when the CPU executes from main flash and, within the same loop, reads data through the ECC-bypass flash alias (address bit 22 set, 0x0040_0000), a LDR Rn,[SP,#imm] instruction can silently fail to update its destination register, keeping the previous iteration's value. The next instruction then dereferences that stale value and the device HardFaults.
This reproduces only when:
- the read goes through the ECC-bypass alias (the same loop reading via the corrected MAIN-flash window passes);
- the affected
LDRsits at offset 6 (last halfword) of a 64-bit flash word; the instruction cache is enabled; and the alias read crosses into a new flash word. - Disabling the instruction cache alone removes the failure; disabling the prefetcher alone does not — the instruction cache, not the prefetcher, is implicated. This matches the mechanism in errata CPU_ERR_01 (SLAZ742H), but that erratum only documents it for NONMAIN/Factory flash, not the ECC-bypass alias of MAIN flash.
- The attached minimal reproducer (MSPM0 SDK 2.11.00.07, SysConfig 1.28.0, IAR EWARM 9.70.1, MCLK 80 MHz/ULPCLK 40 MHz, 2 flash wait states) runs 16 functionally identical loops at every possible offset within a 64-bit word; 4 of 16 reliably fault, always where the affected
LDRlands at offset 6.
Measured workarounds:
- read via the corrected window instead of the alias (re-enables ECC, so a double-bit error can trigger FLASHDED),
- or disable I-cache around the alias read.
We'd appreciate TI's guidance on the recommended production workaround and confirmation of whether this is a known silicon limitation. All the details are provided in the flash_cache_bug.c file in the attached ZIP archive:
