// Copyright lowRISC contributors.
// Licensed under the Apache License, Version 2.0, see LICENSE for details.
// SPDX-License-Identifier: Apache-2.0
//
# AES register template
{
  name: "aes",
  clocking: [
    {clock: "clk_i", reset: "rst_ni", idle: "idle_o", primary: true},
    {clock: "clk_edn_i", reset: "rst_edn_ni", idle: "idle_o"}
  ]
  bus_interfaces: [
    { protocol: "tlul", direction: "device" }
  ],
  param_list: [
    # Regular parameters
    { name:    "AES192Enable",
      type:    "bit",
      default: "1'b1",
      desc:    '''
        Disable (0) or enable (1) support for 192-bit key lengths (AES-192).
      '''
      local:   "false",
      expose:  "false"
    },
    { name:    "Masking",
      type:    "bit",
      default: "1'b1",
      desc:    '''
        Disable (0) or enable (1) first-order masking of the AES cipher core.
        Masking requires the use of a masked S-Box, see SBoxImpl parameter.
      '''
      local:   "false",
      expose:  "true"
    },
    { name:    "SBoxImpl",
      type:    "aes_pkg::sbox_impl_e",
      default: "aes_pkg::SBoxImplDom",
      desc:    '''
        Selection of the S-Box implementation. See aes_pkg.sv.
      '''
      local:   "false",
      expose:  "true"
    },
    { name:    "SecStartTriggerDelay",
      type:    "int unsigned",
      default: "0",
      desc:    '''
        Manual start trigger delay, useful for SCA measurements.
        A value of e.g. 40 allows the processor to go into sleep before AES starts operation.
      '''
      local:   "false",
      expose:  "true"
    },
    { name:    "SecAllowForcingMasks",
      type:    "bit",
      default: "1'b0",
      desc:    '''
        Forbid (0) or allow (1) forcing the mask to zero via FORCE_ZERO_MASK bit in the Control Register.
        Useful for SCA measurements.
        Meaningful only if masking is enabled.
      '''
      local:   "false",
      expose:  "true"
    },
    { name:    "SecSkipPRNGReseeding",
      type:    "bit",
      default: "1'b0",
      desc:    '''
        Perform (0) or skip (1) PRNG reseeding requests, useful for SCA measurements only.
        The current SCA setup doesn't provide sufficient resources to implement the infrastructure required for PRNG reseeding (CSRNG, EDN).
        To enable SCA resistance evaluations, we need to skip reseeding requests on the SCA platform.
      '''
      local:   "false",
      expose:  "true"
    },
    # Random netlist constants
    { name:    "RndCnstClearingLfsrSeed",
      type:    "aes_pkg::clearing_lfsr_seed_t",
      desc:    '''
        Default seed of the PRNG used for register clearing.
      '''
      randcount: "64",
      randtype:  "data"
    },
    { name:    "RndCnstClearingLfsrPerm",
      type:    "aes_pkg::clearing_lfsr_perm_t",
      desc:    '''
        Permutation applied to the LFSR of the PRNG used for clearing.
      '''
      randcount: "64",
      randtype:  "perm"
    },
    { name:    "RndCnstClearingSharePerm",
      type:    "aes_pkg::clearing_lfsr_perm_t",
      desc:    '''
        Permutation applied to the clearing PRNG output for clearing the second share of registers.
      '''
      randcount: "64",
      randtype:  "perm"
    },
    { name:    "RndCnstMaskingLfsrSeed",
      type:    "aes_pkg::masking_lfsr_seed_t",
      desc:    '''
        Default seed of the PRNG used for masking.
      '''
      randcount: "160",
      randtype:  "data"
    },
    { name:    "RndCnstMaskingLfsrPerm",
      type:    "aes_pkg::masking_lfsr_perm_t",
      desc:    '''
        Permutation applied to the concatenated LFSRs of the PRNG used for masking.
      '''
      randcount: "160",
      randtype:  "perm"
    },
    # Note: All parameters below are local, they are not actually configurable.
    # Selecting values different from the default values below might cause undefined behavior.
    { name:    "NumRegsKey",
      type:    "int",
      default: "8",
      desc:    "Number registers for key",
      local:   "true"
    },
    { name:    "NumRegsIv",
      type:    "int",
      default: "4",
      desc:    "Number registers for initialization vector",
      local:   "true"
    },
    { name:    "NumRegsData",
      type:    "int",
      default: "4",
      desc:    "Number registers for input and output data",
      local:   "true"
    }
  ],
  inter_signal_list: [
    { name:    "idle",
      type:    "uni",
      act:     "req",
      package: "",
      struct:  "logic",
      width:   "1"
    },
    { struct:  "lc_tx"
      type:    "uni"
      name:    "lc_escalate_en"
      act:     "rcv"
      default: "lc_ctrl_pkg::Off"
      package: "lc_ctrl_pkg"
    }
    { struct:  "edn"
      type:    "req_rsp"
      name:    "edn"
      act:     "req"
      package: "edn_pkg"
    }
    { struct:  "hw_key_req"
      type:    "uni"
      name:    "keymgr_key"
      act:     "rcv"
      package: "keymgr_pkg"
    }
  ],
  alert_list: [
    //{ name: "informative",
    //  desc: '''
    //    The informative alert can currently not be triggered.
    //    The AES unit recovers from such a condition automatically.
    //    No further action needs to be taken but this should be monitored by the system.
    //  '''
    //}
    { name: "recov_ctrl_update_err",
      desc: '''
        This recoverable alert is triggered upon detecting an update error in the shadowed Control Register.
        The content of the Control Register is not modified (See Control Register).
        The AES unit can be recovered from such a condition by restarting the AES operation, i.e., by re-writing the Control Register.
        This should be monitored by the system.
      '''
    }
    { name: "fatal_fault",
      desc: '''
        This fatal alert is triggered upon detecting a fatal fault inside the AES unit.
        Examples for such faults include
        i) storage errors in the shadowed Control Register,
        ii) any internal FSM entering an invalid state,
        iii) any sparsely encoded signal taking on an invalid value,
        iv) errors in the internal round counter,
        v) escalations triggered by the life cycle controller, and
        vi) fatal integrity failures on the TL-UL bus.
        The AES unit cannot recover from such an error and needs to be reset.
      '''
    }
  ],
  countermeasures: [
    { name: "BUS.INTEGRITY",
      desc: "End-to-end bus integrity scheme."
    }
  ]
  regwidth: "32",
  registers: [
##############################################################################
# initial key registers
    { multireg: {
      name: "KEY_SHARE0",
      resval: "0",
      desc: '''
        Initial Key Registers Share 0.

        The actual initial key corresponds to Initial Key Registers Share 0 XORed with Initial Key Registers Share 1.
        Loaded into the internal Full Key register upon starting encryption/decryption of the next block.
        All key registers (Share 0 and Share 1) must be written at least once when the key is changed, regardless of key length (write random data for unused bits).
        The order in which the registers are updated does not matter.
        Can only be updated when the AES unit is idle.
        If the AES unit is non-idle, writes to these registers are ignored.
        Upon reset, these registers are cleared with pseudo-random data.
      '''
      count: "NumRegsKey",
      cname: "KEY_SHARE0",
      swaccess: "wo",
      hwaccess: "hrw",
      hwext:    "true",
      hwqe:     "true",
      fields: [
        { bits: "31:0", name: "key_share0", desc: "Initial Key Share 0" }
      ],
      }
    },
    { multireg: {
      name: "KEY_SHARE1",
      resval: "0",
      desc: '''
        Initial Key Registers Share 1.

        The actual initial key corresponds to Initial Key Registers Share 0 XORed with Initial Key Registers Share 1.
        Loaded into the internal Full Key register upon starting encryption/decryption of the next block.
        All key registers (Share 0 and Share 1) must be written at least once when the key is changed, regardless of key length (write random data for unused bits).
        The order in which the registers are updated does not matter.
        Can only be updated when the AES unit is idle.
        If the AES unit is non-idle, writes to these registers are ignored.
        Upon reset, these registers are cleared with pseudo-random data.
      '''
      count: "NumRegsKey",
      cname: "KEY_SHARE1",
      swaccess: "wo",
      hwaccess: "hrw",
      hwext:    "true",
      hwqe:     "true",
      fields: [
        { bits: "31:0", name: "key_share1", desc: "Initial Key Share 1" }
      ],
      }
    },
##############################################################################
# initialization vector registers
    { multireg: {
      name: "IV",
      resval: "0",
      desc: '''
        Initialization Vector Registers.

        The initialization vector (IV) or initial counter value must be written to these registers when starting a new message in CBC or CTR mode (see Control Register), respectively.
        In CBC and CTR modes, the AES unit does not start encryption/decryption with a partially updated IV.
        Each register has to be written at least once.
        The order in which the registers are written does not matter.
        If the AES unit is non-idle, writes to these registers are ignored.
        Whenever starting a new message, the corresponding IV value must be provided by the processor.
        Once started, the AES unit automatically updates the contents of these registers.
        In ECB mode, the IV registers are not used and do not need to be configured.
        Upon reset, these registers are cleared with pseudo-random data.
      '''
      count: "NumRegsIv",
      cname: "IV",
      swaccess: "wo",
      hwaccess: "hrw",
      hwext:    "true",
      hwqe:     "true",
      fields: [
        { bits: "31:0", name: "iv", desc: "Initialization Vector" }
      ],
      }
    },
##############################################################################
# input data registers
    { multireg: {
      name: "DATA_IN",
      resval: "0",
      desc: '''
        Input Data Registers.

        If MANUAL_OPERATION=0 (see Control Register), the AES unit automatically starts encryption/decryption after all Input Data registers have been written.
        Each register has to be written at least once.
        The order in which the registers are written does not matter.
        Loaded into the internal State register upon starting encryption/decryption of the next block.
        After that, the processor can update the Input Data registers (See INPUT_READY field of Status Register).
        Upon reset, these registers are cleared with pseudo-random data.
      '''
      count: "NumRegsData",
      cname: "DATA_IN",
      swaccess: "wo",
      hwaccess: "hrw",
      hwqe:     "true",
      fields: [
        { bits: "31:0", name: "data_in", desc: "Input Data" }
      ],
      }
    },
##############################################################################
# output data registers
    { multireg: {
      name: "DATA_OUT",
      resval: "0",
      desc: '''
        Output Data Register.

        Holds the output data produced by the AES unit during the last encryption/decryption operation.
        If MANUAL_OPERATION=0 (see Control Register), the AES unit is stalled when the previous output data has not yet been read and is about to be overwritten.
        Each register has to be read at least once.
        The order in which the registers are read does not matter.
        Upon reset, these registers are cleared with pseudo-random data.
      '''
      count: "NumRegsData",
      cname: "DATA_OUT",
      swaccess: "ro",
      hwaccess: "hrw",
      hwext:    "true",
      hwre:     "true",
      fields: [
        { bits: "31:0", name: "data_out", desc: "Output Data" }
      ]
      tags: [// Updated by the HW.
             // Updates based on writes to other regs.
             // These registers are reset to 0, but the reset also triggers internal operations that clear these registers with pseudo-random data shortly afterwards (See Trigger Register).
             // Exclude from init and write-read checks.
             "excl:CsrAllTests:CsrExclCheck"]
      }
    },
##############################################################################
# control and status registers
  { name: "CTRL_SHADOWED",
    desc: '''
      Control Register.

      Can only be updated when the AES unit is idle.
      If the AES unit is non-idle, writes to this register are ignored.
      This register is shadowed, meaning two subsequent write operations are required to change its content.
      If the two write operations try to set a different value, a recoverable alert is triggered (See Status Register).
      A read operation clears the internal phase tracking: The next write operation is always considered a first write operation of an update sequence.
      Any write operation to this register will clear the status tracking required for automatic mode (See MANUAL_OPERATION field).
      A write to the Control Register is considered the start of a new message.
      Hence, software needs to provide new key, IV and input data afterwards.
    '''
    swaccess: "rw",
    hwaccess: "hrw",
    hwext:    "true",
    hwqe:     "true",
    shadowed: "true",
    update_err_alert: "recov_ctrl_update_err",
    storage_err_alert: "fatal_fault",
    fields: [
      { bits: "0",
        name: "OPERATION",
        resval: "0",
        desc:  '''
          Select encryption(0) or decryption(1) operation of AES unit.
        '''
        tags: ["shadowed_reg_path:u_aes_core.u_ctrl_reg_shadowed.u_ctrl_reg_shadowed_operation"]
      }
      { bits: "6:1",
        name: "MODE",
        resval: "0x20",
        hwaccess: "hrw",
        desc:  '''
          6-bit one-hot field to select AES block cipher mode.
          Invalid input values, i.e., values with multiple bits set and value 6'b00_0000, are mapped to AES_NONE (6'b10_0000).
        '''
        enum: [
          { value: "1",
            name: "AES_ECB",
            desc: '''
              6'b00_0001: Electronic Codebook (ECB) mode.
            '''
          },
          { value: "2",
            name: "AES_CBC",
            desc: '''
              6'b00_0010: Cipher Block Chaining (CBC) mode.
            '''
          },
          { value: "4",
            name: "AES_CFB",
            desc: '''
              6'b00_0100: Cipher Feedback (CFB) mode.
            '''
          },
          { value: "8",
            name: "AES_OFB",
            desc: '''
              6'b00_1000: Output Feedback (OFB) mode.
            '''
          },
          { value: "16",
            name: "AES_CTR",
            desc: '''
              6'b01_0000: Counter (CTR) mode.
            '''
          },
          { value: "32",
            name: "AES_NONE",
            desc: '''
              6'b10_0000: Invalid input values, i.e., value with multiple bits set and value 6'b00_0000, are mapped to AES_NONE.
            '''
          }
        ]
        tags: ["shadowed_reg_path:u_aes_core.u_ctrl_reg_shadowed.u_ctrl_reg_shadowed_mode"]
      }
      { bits: "9:7",
        name: "KEY_LEN",
        resval: "1",
        hwaccess: "hrw",
        desc: '''
          3-bit one-hot field to select AES key length.
          Invalid input values, i.e., values with multiple bits set, value 3'b000, and value 3'b010 in case 192-bit keys are not supported (because disabled at compile time) are mapped to AES_256 (3'b100).
        '''
        enum: [
          { value: "1",
            name: "AES_128",
            desc: '''
              3'b001: 128-bit key length.
            '''
          },
          { value: "2",
            name: "AES_192",
            desc: '''
              3'b010: 192-bit key length.
              In case support for 192-bit keys has been disabled at compile time, setting this value results in configuring AES_256 (3'b100).
            '''
          },
          { value: "4",
            name: "AES_256",
            desc: '''
              3'b100: 256-bit key length.
              Invalid input values, i.e., values with multiple bits set, value 3'b000, and value 3'b010 in case 192-bit keys are not supported (because disabled at compile time) are mapped to AES_256.
            '''
          }
        ]
        tags: ["shadowed_reg_path:u_aes_core.u_ctrl_reg_shadowed.u_ctrl_reg_shadowed_key_len"]
      }
      { bits: "10",
        name: "SIDELOAD",
        resval: "0",
        desc: '''
          Controls whether the AES unit uses the key provided by the key manager via key sideload interface (1) or the key provided by software via Initial Key Registers KEY_SHARE1_0 - KEY_SHARE1_7 (0).
        '''
        tags: ["shadowed_reg_path:u_aes_core.u_ctrl_reg_shadowed.u_ctrl_reg_shadowed_sideload"]
      }
      { bits: "11",
        name: "MANUAL_OPERATION",
        resval: "0"
        desc:  '''
          Controls whether the AES unit is operated in normal/automatic mode (0) or fully manual mode (1).
          In automatic mode (0), the AES unit automatically i) starts to encrypt/decrypt when it receives new input data, and ii) stalls during the last encryption/decryption cycle if the previous output data has not yet been read.
          This is the most efficient mode to operate in.
          Note that the corresponding status tracking is automatically cleared upon a write to the Control Register.
          In manual mode (1), the AES unit i) only starts to encrypt/decrypt after receiving a start trigger (see Trigger Register), and ii) overwrites previous output data irrespective of whether it has been read out or not.
          This mode is useful if software needs full control over the AES unit.
        '''
        tags: ["shadowed_reg_path:u_aes_core.u_ctrl_reg_shadowed.u_ctrl_reg_shadowed_manual_operation"]
      }
      { bits: "12",
        name: "FORCE_ZERO_MASKS",
        resval: "0"
        desc:  '''
          Use masks generated by internal masking PRNG (0) or force all masks constantly to zero (1).
          Setting all masks to constant zero can be useful when performing SCA.
          To completely disable the masking, the second key share (KEY_SHARE1_0 - KEY_SHARE1_7) must be zero as well.
          Only applicable if both the Masking parameter and the SecAllowForcingMasks parameter are set to one.
        '''
        tags: ["shadowed_reg_path:u_aes_core.u_ctrl_reg_shadowed.u_ctrl_reg_shadowed_force_zero_masks"]
      }
    ]
    tags: [// Updated by the HW.
           // Updates based on writes to this reg (reset test possible).
           // Exclude from write-read checks.
           "excl:CsrNonInitTests:CsrExclWriteCheck"]
  },
  { name: "TRIGGER",
    desc: '''
      Trigger Register.

      Each bit is individually cleared to zero when executing the corresponding trigger.
      While executing any of the triggered operations, the AES unit will set the IDLE bit in the Status Register to zero.
      The processor must check the Status Register before triggering further actions.
      For example, writes to Initial Key and IV Registers are ignored while the AES unit is busy.
      Writes to the Input Data Registers are not ignored but the data will be cleared if a KEY_IV_DATA_IN_CLEAR operation is pending.
    '''
    swaccess: "wo",
    hwaccess: "hrw",
    # Tag info (CSR test exclusions):
    #  Updated by the HW.
    #  Updates based on writes to this reg.
    #  -> Exclude all fields from write-read checks.
    #  Upon reset, the non-zero values trigger internal operations that clear this reg to zero.
    #  -> Exclude fields with non-zero reset value from init and write-read checks (also in reset test).
    fields: [
      { bits: "0",
        name: "START",
        resval: "0"
        desc:  '''
          Keep AES unit paused (0) or trigger the encryption/decryption of one data block (1).
          This trigger is ignored if MANUAL_OPERATION=0 (see Control Register).
        '''
        tags: ["excl:CsrNonInitTests:CsrExclWriteCheck"]
      }
      { bits: "1",
        name: "KEY_IV_DATA_IN_CLEAR",
        resval: "1"
        desc:  '''
          Keep current values in Initial Key, internal Full Key and Decryption Key registers, IV registers and Input Data registers (0) or clear all those registers with pseudo-random data (1).
        '''
        tags: ["excl:CsrAllTests:CsrExclCheck"]
      }
      { bits: "2",
        name: "DATA_OUT_CLEAR",
        resval: "1"
        desc:  '''
          Keep current values in Output Data registers (0) or clear those registers with pseudo-random data (1).
        '''
        tags: ["excl:CsrAllTests:CsrExclCheck"]
      }
      { bits: "3",
        name: "PRNG_RESEED",
        resval: "1"
        desc:  '''
          Keep continuing with the current internal state of the internal pseudo-random number generator used for register clearing (0) or perform a reseed of the internal state from the connected entropy source (1).
        '''
        tags: ["excl:CsrAllTests:CsrExclCheck"]
      }
    ]
  },
  { name: "STATUS",
    desc: "Status Register",
    swaccess: "ro",
    hwaccess: "hwo",
    # Tag info (CSR test exclusions):
    #  Updated by the HW.
    #  Updates based on writes to other regs.
    #  -> Exclude all fields (except ALERT_FATAL_FAULT) from init and write-read checks.
    #  Upon reset, internal operations are triggered at the end of which IDLE and INPUT_READY will be 1.
    #  -> Exclude IDLE and INPUT_READY field from init and write-read checks (also in reset test).
    fields: [
      { bits: "0",
        name: "IDLE",
        resval: "0",
        desc:  '''
          The AES unit is idle (1) or busy (0).
          This flag is `0` if one of the following operations is currently running: i) encryption/decryption, ii) register clearing or iii) PRNG reseeding.
          This flag is also `0` if an encryption/decryption is running but the AES unit is stalled.
        '''
        tags: ["excl:CsrAllTests:CsrExclCheck"]
      }
      { bits: "1",
        name: "STALL",
        resval: "0"
        desc:  '''
          The AES unit is not stalled (0) or stalled (1) because there is previous
          output data that must be read by the processor before the AES unit can
          overwrite this data.
          This flag is not meaningful if MANUAL_OPERATION=1 (see Control Register).
        '''
        tags: ["excl:CsrNonInitTests:CsrExclCheck"]
      }
      { bits: "2",
        name: "OUTPUT_LOST",
        resval: "0"
        hwaccess: "hrw",
        desc:  '''
          All previous output data has been fully read by the processor (0) or at least one previous output data block has been lost (1).
          It has been overwritten by the AES unit before the processor could fully read it.
          Once set to `1`, this flag remains set until AES operation is restarted by re-writing the Control Register.
          The primary use of this flag is for design verification.
          This flag is not meaningful if MANUAL_OPERATION=0 (see Control Register).
        '''
        tags: ["excl:CsrNonInitTests:CsrExclCheck"]
      }
      { bits: "3",
        name: "OUTPUT_VALID",
        resval: "0"
        desc:  '''
          The AES unit has no valid output (0) or has valid output data (1).
        '''
        tags: ["excl:CsrNonInitTests:CsrExclCheck"]
      }
      { bits: "4",
        name: "INPUT_READY",
        resval: "0",
        desc:  '''
          The AES unit is ready (1) or not ready (0) to receive new data input via the DATA_IN registers.
          If the present values in the DATA_IN registers have not yet been loaded into the
          module this flag is `0` (not ready).
        '''
        tags: ["excl:CsrAllTests:CsrExclCheck"]
      }
      { bits: "5",
        name: "ALERT_RECOV_CTRL_UPDATE_ERR",
        resval: "0",
        desc:  '''
          An update error has not occurred (0) or has occurred (1) in the shadowed Control Register.
          AES operation needs to be restarted by re-writing the Control Register.
        '''
        tags: ["excl:CsrNonInitTests:CsrExclCheck"]
      }
      { bits: "6",
        name: "ALERT_FATAL_FAULT",
        resval: "0",
        desc:  '''
          No fatal fault has occurred inside the AES unit (0).
          A fatal fault has occurred and the AES unit needs to be reset (1).
          Examples for fatal faults include
          i) storage errors in the Control Register,
          ii) if any internal FSM enters an invalid state,
          iii) if any sparsely encoded signal takes on an invalid value,
          iv) errors in the internal round counter,
          v) escalations triggered by the life cycle controller, and
          vi) fatal integrity failures on the TL-UL bus.
        '''
      }
    ]
  },
  ],
}