| // Copyright lowRISC contributors. |
| // Licensed under the Apache License, Version 2.0, see LICENSE for details. |
| // SPDX-License-Identifier: Apache-2.0 |
| // |
| // KMAC Entropy Generation module |
| |
| `include "prim_assert.sv" |
| |
| module kmac_entropy |
| import kmac_pkg::*; |
| import kmac_reg_pkg::*; |
| #( |
| parameter lfsr_perm_t RndCnstLfsrPerm = RndCnstLfsrPermDefault, |
| parameter lfsr_seed_t RndCnstLfsrSeed = RndCnstLfsrSeedDefault, |
| parameter lfsr_fwd_perm_t RndCnstLfsrFwdPerm = RndCnstLfsrFwdPermDefault |
| ) ( |
| input clk_i, |
| input rst_ni, |
| |
| // EDN interface |
| output logic entropy_req_o, |
| input entropy_ack_i, |
| input [edn_pkg::ENDPOINT_BUS_WIDTH-1:0] entropy_data_i, |
| |
| // Entropy to internal |
| output logic rand_valid_o, |
| output logic rand_early_o, |
| output logic [sha3_pkg::StateW/2-1:0] rand_data_o, |
| output logic rand_aux_o, |
| input rand_consumed_i, |
| |
| // Status |
| input in_keyblock_i, |
| |
| // Configurations |
| input entropy_mode_e mode_i, |
| //// SW sets ready bit when EDN is ready to accept requests through its app. |
| //// interface. |
| input entropy_ready_i, |
| |
| //// Garbage random value when not processing Keyblock, if this config is |
| //// turned on, the logic sending garbage value and never de-assert |
| //// rand_valid_o unless it is not processing KeyBlock. |
| input fast_process_i, |
| |
| //// LFSR Enable for Message Masking |
| //// If 1, LFSR advances to create 64-bit PRNG. This input is used to mask |
| //// the message fed into SHA3 (Keccak). |
| input msg_mask_en_i, |
| output logic [MsgWidth-1:0] msg_mask_o, |
| |
| //// SW update of seed |
| input [NumSeedsEntropyLfsr-1:0] seed_update_i, |
| input [NumSeedsEntropyLfsr-1:0][31:0] seed_data_i, |
| |
| //// SW may initiate manual EDN seed refresh |
| input entropy_refresh_req_i, |
| |
| //// Timer limit value |
| //// If value is 0, timer is disabled |
| input [TimerPrescalerW-1:0] wait_timer_prescaler_i, |
| input [EdnWaitTimerW-1:0] wait_timer_limit_i, |
| |
| // Status out |
| //// Hash Ops counter. Count how many hashing ops (KMAC) have run |
| //// after the clear request from SW |
| output logic [HashCntW-1:0] hash_cnt_o, |
| input hash_cnt_clr_i, |
| input [HashCntW-1:0] hash_threshold_i, |
| |
| output prim_mubi_pkg::mubi4_t entropy_configured_o, |
| |
| // Life cycle |
| input lc_ctrl_pkg::lc_tx_t lc_escalate_en_i, |
| |
| // Error output |
| output err_t err_o, |
| output logic sparse_fsm_error_o, |
| output logic count_error_o, |
| input err_processed_i |
| ); |
| |
| ///////////////// |
| // Definitions // |
| ///////////////// |
| |
| // Timer Widths are defined in kmac_pkg |
| |
| // Encoding generated with: |
| // $ ./util/design/sparse-fsm-encode.py -d 3 -m 9 -n 10 \ |
| // -s 507672272 --language=sv |
| // |
| // Hamming distance histogram: |
| // |
| // 0: -- |
| // 1: -- |
| // 2: -- |
| // 3: ||||||||||| (13.89%) |
| // 4: ||||||||||||||| (19.44%) |
| // 5: |||||||||||||||||||| (25.00%) |
| // 6: ||||||||||||||| (19.44%) |
| // 7: ||||||||||| (13.89%) |
| // 8: |||| (5.56%) |
| // 9: || (2.78%) |
| // 10: -- |
| // |
| // Minimum Hamming distance: 3 |
| // Maximum Hamming distance: 9 |
| // Minimum Hamming weight: 2 |
| // Maximum Hamming weight: 7 |
| // |
| localparam int StateWidth = 10; |
| |
| // States |
| typedef enum logic [StateWidth-1:0] { |
| // Reset: Reset state. The entropy is not ready. The state machine should |
| // get new entropy from EDN or the seed should be feeded by the software. |
| StRandReset = 10'b1001111000, |
| |
| // The seed is fed into LFSR and the entropy is ready. It means the |
| // rand_valid is asserted with valid data. It takes a few steps to reach |
| // this state from StRandReset. |
| StRandReady = 10'b0110000100, |
| |
| // EDN interface: Send request and receive |
| // RandEdnReq state can be transit from StRandReset or from StRandReady |
| // |
| // Reset --> EdnReq: |
| // If entropy source module is ready, the software sets a bit in CFG |
| // also sets the entropy mode to EdnMode. Then this FSM moves to EdnReq |
| // to initialize LFSR seed. |
| // |
| // Ready --> EdnReq: |
| // 1. If a mode is configured as to update entropy everytime it is |
| // consumed, then the FSM moves from Ready to EdnReq to refresh seed |
| // 2. If the software enabled EDN timer and the timer is expired and |
| // also the KMAC is processing the key block, the FSM moves to |
| // EdnReq to refresh seed |
| // 3. If a KMAC operation is completed, the FSM also refreshes the LFSR |
| // seed to prepare next KMAC op or wipe out operation. |
| StRandEdn = 10'b1100100111, |
| |
| // Sw Seed: If mode is set to manual mode, This entropy module needs initial |
| // seed from the software. It waits the seed update signal to expand initial |
| // entropy |
| StSwSeedWait = 10'b1011110110, |
| |
| // Generate: In this state, the entropy generator advances the LFSRs to |
| // generate the 800-bits of pseudo random data for the next evaluation. |
| StRandGenerate = 10'b0000001100, |
| |
| // ErrWaitExpired: If Edn timer expires, FSM moves to this state and wait |
| // the software response. Software should switch to manual mode then disable |
| // the timer (to 0) and update the seed via register interface. |
| StRandErrWaitExpired = 10'b0001100011, |
| |
| // ErrNoValidMode: If SW sets entropy ready but the mode is not either |
| // Manual Mode nor EdnMode, this logic reports to SW with |
| // NoValidEntropyMode. |
| StRandErrIncorrectMode = 10'b1110010000, |
| |
| // Err: After the error is reported, FSM sits in Err state ignoring all the |
| // requests. It does not generate new entropy and drops the entropy valid |
| // signal. |
| // |
| // SW sets err_processed signal to clear the error. The software should |
| // clear the entropy ready signal before clear the error interrupt so that |
| // the FSM sits in StRandReset state not moving forward with incorrect |
| // configurations. |
| StRandErr = 10'b1000011110, |
| |
| StTerminalError = 10'b0010011000 |
| } rand_st_e; |
| |
| ///////////// |
| // Signals // |
| ///////////// |
| |
| // Timers |
| // "Wait Timer": This timer is in active when FSM sends entropy request to EDN |
| // If EDN does not return the entropy data until the timer expired, FSM |
| // moves to error state and report the error to the system. |
| |
| localparam int unsigned TimerW = EdnWaitTimerW; |
| logic timer_enable, timer_update, timer_expired, timer_pulse; |
| logic [TimerW-1:0] timer_limit; |
| logic [TimerW-1:0] timer_value; |
| |
| localparam int unsigned PrescalerW = TimerPrescalerW; |
| logic [PrescalerW-1:0] prescaler_cnt; |
| |
| // LFSR |
| // SW configures to use EDN or SEED register as a LFSR seed |
| logic [NumSeedsEntropyLfsr-1:0] lfsr_seed_en_red; |
| logic [NumChunksEntropyLfsr-1:0] lfsr_seed_en; |
| logic [NumChunksEntropyLfsr-1:0][ChunkSizeEntropyLfsr-1:0] lfsr_seed; |
| logic lfsr_seed_done; |
| logic lfsr_en; |
| logic [NumChunksEntropyLfsr-1:0][ChunkSizeEntropyLfsr-1:0] lfsr_data_chunked; |
| logic [EntropyLfsrW-1:0] lfsr_data, lfsr_data_permuted; |
| |
| // Auxliliary randomness |
| logic aux_rand_d, aux_rand_q; |
| logic aux_update; |
| |
| // Randomness for controlling PRNG updates. This only matters for clock cycles |
| // where the PRNG output is not actually used. |
| logic [3:0] lfsr_en_rand_d, lfsr_en_rand_q; |
| |
| // Entropy valid signal |
| // FSM set and clear the valid signal, rand_consume signal clear the valid |
| // signal. Split the set, clear to make entropy valid while FSM is processing |
| // other tasks. |
| logic rand_valid_set, rand_valid_clear; |
| |
| // Signal to track whether the FSM should stay in the StRandReady state or |
| // move to StRandGenerate upon getting the next rand_consumed_i. |
| logic ready_phase_d, ready_phase_q; |
| |
| // FSM latches the mode and stores into mode_q when the FSM is out from |
| // StReset. The following states, or internal datapath uses mode_q after that. |
| // If the SW wants to change the mode, it requires resetting the IP. |
| logic mode_latch; |
| entropy_mode_e mode_q; |
| |
| // Status out: entropy configured |
| prim_mubi_pkg::mubi4_t entropy_configured; |
| |
| ////////////// |
| // Datapath // |
| ////////////// |
| |
| // Timers =================================================================== |
| always_ff @(posedge clk_i or negedge rst_ni) begin |
| if (!rst_ni) begin |
| timer_value <= '0; |
| end else if (timer_update) begin |
| timer_value <= timer_limit; |
| end else if (timer_expired) begin |
| timer_value <= '0; // keep the value |
| end else if (timer_enable && timer_pulse && |timer_value) begin // if non-zero timer v |
| timer_value <= timer_value - 1'b 1; |
| end |
| end |
| |
| assign timer_limit = TimerW'(wait_timer_limit_i); |
| |
| always_ff @(posedge clk_i or negedge rst_ni) begin |
| if (!rst_ni) begin |
| timer_expired <= 1'b 0; |
| end else if (timer_update) begin |
| timer_expired <= 1'b 0; |
| end else if (timer_enable && (timer_value == '0)) begin |
| timer_expired <= 1'b 1; |
| end |
| end |
| |
| // Prescaler |
| always_ff @(posedge clk_i or negedge rst_ni) begin |
| if (!rst_ni) begin |
| prescaler_cnt <= '0; |
| end else if (timer_update) begin |
| prescaler_cnt <= wait_timer_prescaler_i; |
| end else if (timer_enable && prescaler_cnt == '0) begin |
| prescaler_cnt <= wait_timer_prescaler_i; |
| end else if (timer_enable) begin |
| prescaler_cnt <= prescaler_cnt - 1'b 1; |
| end |
| end |
| |
| assign timer_pulse = (timer_enable && prescaler_cnt == '0); |
| // Timers ------------------------------------------------------------------- |
| |
| // Hash Counter |
| logic threshold_hit; |
| logic threshold_hit_q, threshold_hit_clr; // latched hit |
| |
| logic hash_progress_d, hash_progress_q; |
| always_ff @(posedge clk_i or negedge rst_ni) begin |
| if (!rst_ni) hash_progress_q <= 1'b 0; |
| else hash_progress_q <= hash_progress_d; |
| end |
| |
| assign hash_progress_d = in_keyblock_i; |
| |
| logic hash_cnt_clr; |
| assign hash_cnt_clr = hash_cnt_clr_i || threshold_hit || entropy_refresh_req_i; |
| |
| logic hash_cnt_en; |
| assign hash_cnt_en = hash_progress_q && !hash_progress_d; |
| |
| logic hash_count_error; |
| |
| // SEC_CM CTR.REDUN |
| // This primitive is used to place a hardened counter |
| prim_count #( |
| .Width(HashCntW) |
| ) u_hash_count ( |
| .clk_i, |
| .rst_ni, |
| .clr_i(hash_cnt_clr), |
| .set_i(1'b0), |
| .set_cnt_i(HashCntW'(0)), |
| .incr_en_i(hash_cnt_en), |
| .decr_en_i(1'b0), |
| .step_i(HashCntW'(1)), |
| .cnt_o(hash_cnt_o), |
| .cnt_next_o(), |
| .err_o(hash_count_error) |
| ); |
| |
| assign threshold_hit = |hash_threshold_i && (hash_threshold_i <= hash_cnt_o); |
| |
| always_ff @(posedge clk_i or negedge rst_ni) begin |
| if (!rst_ni) threshold_hit_q <= 1'b 0; |
| else if (threshold_hit_clr) threshold_hit_q <= 1'b 0; |
| else if (threshold_hit) threshold_hit_q <= 1'b 1; |
| end |
| |
| always_ff @(posedge clk_i or negedge rst_ni) begin |
| if (!rst_ni) mode_q <= EntropyModeNone; |
| else if (mode_latch) mode_q <= mode_i; |
| end |
| |
| // LFSRs ==================================================================== |
| |
| // We use 25 32-bit LFSRs in parallel to generate the 800 bits of randomness |
| // required by the DOM multipliers inside the Keccak core in a single clock |
| // cycle. To reduce the entropy consumption for periodic reseeding, a cascaded |
| // reseeding mechanism is used: |
| // |
| // - LFSR 0 (5/10/15/20) gets one 32-bit seed each from EDN/SW. |
| // - LFSR 1 (6/11/16/21) gets the old state of LFSR 0 (5/10/15/20) |
| // - ... |
| // - LFSR 4 (9/14/19/24) gets the old state of LFSR 3 (8/13/18/23) |
| // |
| // In addition, the forwarded old states are permuted. |
| // |
| // This allows to reduce the entropy consumption. A full reseed of all 25 |
| // LFSRs is still possible by subsequently triggering 5 reseeding operations |
| // though software. |
| |
| // Reseeding counter - We reseed one 32-bit chunk at a time and need to keep |
| // track of which LFSR chunk to reseed next. |
| localparam int unsigned SeedIdxWidth = |
| prim_util_pkg::vbits(NumSeedsEntropyLfsr); |
| logic [SeedIdxWidth-1:0] seed_idx; |
| logic seed_idx_count_error; |
| |
| // SEC_CM CTR.REDUN |
| // This primitive is used to place a hardened counter |
| prim_count #( |
| .Width(SeedIdxWidth) |
| ) u_seed_idx_count ( |
| .clk_i, |
| .rst_ni, |
| .clr_i(lfsr_seed_done), |
| .set_i(1'b0), |
| .set_cnt_i(SeedIdxWidth'(0)), |
| .incr_en_i(|lfsr_seed_en), |
| .decr_en_i(1'b0), |
| .step_i(SeedIdxWidth'(1)), |
| .cnt_o(seed_idx), |
| .cnt_next_o(), |
| .err_o(seed_idx_count_error) |
| ); |
| |
| assign lfsr_seed_done = |
| (seed_idx == SeedIdxWidth'(unsigned'(NumSeedsEntropyLfsr - 1))) & |
| |lfsr_seed_en; |
| |
| // Seed selection - The reduced seed enable signal `lfsr_seed_en_red` is |
| // controlled by the FSM. Here we just repliate it as we're always reseeding |
| // 5 LFSRs together. |
| for (genvar i = 0; i < 5; i++) begin : gen_lfsr_seed_en |
| assign lfsr_seed_en[i * 5 +: 5] = {5{lfsr_seed_en_red[i]}}; |
| end |
| |
| // From software we get NumChunks 32-bit seeds but only one is valid. The |
| // others may be zero. |
| // From EDN we get a single 32-bit seed. This is the default value forwarded. |
| for (genvar i = 0; i < NumSeedsEntropyLfsr; i++) begin : gen_lfsr_seed |
| // LFSRs 0/5/10/15/20 get the fresh entropy. |
| assign lfsr_seed[i * 5] = |
| (mode_q == EntropyModeSw) ? seed_data_i[i] : entropy_data_i; |
| |
| // The other LFSRs get the permuted old states. |
| for (genvar j = 0; j < 4; j++) begin : gen_fwd_seeds |
| for (genvar k = 0; k < ChunkSizeEntropyLfsr; k++) begin : gen_fwd_perm |
| assign lfsr_seed[i * 5 + j + 1][k] = |
| lfsr_data_chunked[i * 5 + j][RndCnstLfsrFwdPerm[k]]; |
| end |
| end |
| end |
| `ASSERT_KNOWN(ModeKnown_A, mode_i) |
| |
| // We employ five 32-bit LFSRs to generate 160 bits per clock cycle. Using |
| // multiple 32-bit LFSRs with an additional permutation layer spanning across |
| // all LFSRs has relevant advantages: |
| // - Multiple simulateneous faults needs to be injected to get a fully |
| // deterministic output. |
| // - No additional buffering is needed for reseeding. Both software and EDN |
| // provide 32 bits at a time meaning we can reseed the LFSRs directly as |
| // we get the entropy. |
| // We use multiple LFSR instances each having a width of ChunkSize. |
| for (genvar i = 0; i < NumChunksEntropyLfsr; i++) begin : gen_lfsrs |
| prim_lfsr #( |
| .LfsrType("GAL_XOR"), |
| .LfsrDw(ChunkSizeEntropyLfsr), |
| .StateOutDw(ChunkSizeEntropyLfsr), |
| .DefaultSeed(RndCnstLfsrSeed[i * ChunkSizeEntropyLfsr +: ChunkSizeEntropyLfsr]), |
| .StatePermEn(1'b0), |
| .NonLinearOut(1'b1) |
| ) u_lfsr_chunk ( |
| .clk_i, |
| .rst_ni, |
| .seed_en_i(lfsr_seed_en[i]), |
| .seed_i (lfsr_seed[i]), |
| .lfsr_en_i(lfsr_en || msg_mask_en_i), |
| .entropy_i('0), |
| .state_o (lfsr_data_chunked[i]) |
| ); |
| end |
| |
| // Add a permutation layer spanning across all LFSRs to break linear shift |
| // patterns. |
| assign lfsr_data = lfsr_data_chunked; |
| for (genvar i = 0; i < EntropyLfsrW; i++) begin : gen_perm |
| assign lfsr_data_permuted[i] = lfsr_data[RndCnstLfsrPerm[i]]; |
| end |
| |
| // Forwrad LSBs for masking the message. |
| assign msg_mask_o = lfsr_data_permuted[MsgWidth-1:0]; |
| |
| // LFSRs -------------------------------------------------------------------- |
| |
| // Auxiliary randomness ===================================================== |
| assign aux_rand_d = aux_update ? lfsr_data_permuted[EntropyLfsrW - 1] : |
| aux_rand_q; |
| always_ff @(posedge clk_i or negedge rst_ni) begin |
| if (!rst_ni) begin |
| aux_rand_q <= '0; |
| end else begin |
| aux_rand_q <= aux_rand_d; |
| end |
| end |
| |
| // Auxiliary randomness ----------------------------------------------------- |
| |
| // LFSR enable randomness =================================================== |
| assign lfsr_en_rand_d = |
| aux_update ? lfsr_data_permuted[EntropyLfsrW - 2 -: 4] : // refresh |
| {1'b0, lfsr_en_rand_q[3:1]}; // shift out |
| |
| always_ff @(posedge clk_i or negedge rst_ni) begin |
| if (!rst_ni) begin |
| lfsr_en_rand_q <= '0; |
| end else begin |
| lfsr_en_rand_q <= lfsr_en_rand_d; |
| end |
| end |
| |
| // LFSR enable randomness --------------------------------------------------- |
| |
| // Randomness outputs ======================================================= |
| assign rand_data_o = lfsr_data_permuted; |
| assign rand_aux_o = aux_rand_q; |
| |
| // entropy valid |
| always_ff @(posedge clk_i or negedge rst_ni) begin |
| if (!rst_ni) begin |
| rand_valid_o <= 1'b 0; |
| end else if (rand_valid_set) begin |
| rand_valid_o <= 1'b 1; |
| end else if (rand_valid_clear) begin |
| rand_valid_o <= 1'b 0; |
| end |
| end |
| |
| // Let consumers know that the randomness will be valid in the next clock cycle. |
| assign rand_early_o = rand_valid_set; |
| |
| `ASSUME(ConsumeNotAseertWhenNotReady_M, rand_consumed_i |-> rand_valid_o) |
| |
| // Randomness outputs ------------------------------------------------------- |
| |
| // Remaining outputs |
| assign count_error_o = hash_count_error | seed_idx_count_error; |
| |
| /////////////////// |
| // State Machine // |
| /////////////////// |
| |
| rand_st_e st, st_d; |
| |
| // State FF |
| `PRIM_FLOP_SPARSE_FSM(u_state_regs, st_d, st, rand_st_e, StRandReset) |
| |
| // State: Next State and Output Logic |
| // SEC_CM: FSM.SPARSE |
| always_comb begin |
| st_d = st; |
| sparse_fsm_error_o = 1'b 0; |
| |
| // Default Timer values |
| timer_enable = 1'b 0; |
| timer_update = 1'b 0; |
| |
| threshold_hit_clr = 1'b 0; |
| |
| // EDN request |
| entropy_req_o = 1'b 0; |
| |
| // rand is valid when this logic expands the entropy. |
| // FSM sets the valid signal, the signal is cleared by `consume` signal |
| // or FSM clear signal. |
| // Why split the signal to set and clear? |
| // FSM only set the signal to make entropy valid while processing other |
| // tasks such as EDN request. |
| rand_valid_set = 1'b 0; |
| rand_valid_clear = 1'b 0; |
| |
| // mode_latch to store mode_i into mode_q |
| mode_latch = 1'b 0; |
| |
| // lfsr_en: Let LFSR run |
| // To save power, this logic enables LFSR when it needs entropy expansion. |
| lfsr_en = 1'b 0; |
| |
| // lfsr_seed_en_red: Signal to update LFSR seed |
| // LFSR seed can be updated by EDN or SW. |
| lfsr_seed_en_red = '0; |
| |
| // Signal to track whether FSM should stay in StRandReady state or move on. |
| ready_phase_d = ready_phase_q; |
| |
| // Auxiliary randomness control signals |
| aux_update = 1'b 0; |
| |
| // Error |
| err_o = '{valid: 1'b 0, code: ErrNone, info: '0}; |
| |
| unique case (st) |
| StRandReset: begin |
| if (entropy_ready_i) begin |
| |
| // As SW ready, discard current dummy entropy and refresh. |
| rand_valid_clear = 1'b 1; |
| |
| mode_latch = 1'b 1; |
| // SW has configured KMAC |
| unique case (mode_i) |
| EntropyModeSw: begin |
| st_d = StSwSeedWait; |
| end |
| |
| EntropyModeEdn: begin |
| st_d = StRandEdn; |
| |
| // Timer reset |
| timer_update = 1'b 1; |
| end |
| |
| default: begin |
| // EntropyModeNone or other values |
| // Error. No valid mode given, report to SW |
| st_d = StRandErrIncorrectMode; |
| end |
| endcase |
| end else begin |
| st_d = StRandReset; |
| |
| // Setting the dummy rand gate until SW prepares. |
| // This lets the Application Interface move forward out of reset |
| // without SW intervention. |
| rand_valid_set = 1'b 1; |
| end |
| end |
| |
| StRandReady: begin |
| timer_enable = 1'b 1; // If limit is zero, timer won't work |
| |
| lfsr_en = lfsr_en_rand_q[0]; |
| |
| if (rand_consumed_i && |
| ((fast_process_i && in_keyblock_i) || !fast_process_i)) begin |
| // If fast_process is set, don't clear the rand valid, even |
| // consumed. So, the logic does not expand the entropy again. |
| // If fast_process is not set, then every rand_consume signal |
| // triggers rand expansion. |
| |
| // Allow for two reads from the Keccak core. This is what is needed |
| // per round. |
| lfsr_en = 1'b 1; |
| ready_phase_d = ~ready_phase_q; |
| |
| if (ready_phase_q) begin |
| st_d = StRandGenerate; |
| |
| rand_valid_clear = 1'b 1; |
| end else begin |
| st_d = StRandReady; |
| end |
| end else if ((mode_q == EntropyModeEdn) && |
| (entropy_refresh_req_i || threshold_hit_q)) begin |
| st_d = StRandEdn; |
| |
| // Timer reset |
| timer_update = 1'b 1; |
| |
| // Clear the threshold as it refreshes the hash |
| threshold_hit_clr = 1'b 1; |
| end else begin |
| st_d = StRandReady; |
| end |
| end |
| |
| StRandEdn: begin |
| // Send request |
| entropy_req_o = 1'b 1; |
| |
| // Wait timer |
| timer_enable = 1'b 1; |
| |
| if (timer_expired && |wait_timer_limit_i) begin |
| // If timer count is non-zero and expired; |
| st_d = StRandErrWaitExpired; |
| |
| end else if (entropy_ack_i) begin |
| lfsr_seed_en_red[seed_idx] = 1'b 1; |
| |
| if (lfsr_seed_done) begin |
| st_d = StRandGenerate; |
| |
| if ((fast_process_i && in_keyblock_i) || !fast_process_i) begin |
| lfsr_en = 1'b 1; |
| rand_valid_clear = 1'b 1; |
| end |
| end else begin |
| st_d = StRandEdn; |
| end |
| end else if (rand_consumed_i && |
| ((fast_process_i && in_keyblock_i) || !fast_process_i)) begin |
| // Somehow, while waiting the EDN entropy, the KMAC or SHA3 logic |
| // consumed the remained entropy. This can happen when the previous |
| // SHA3/ KMAC op completed and this Entropy FSM has moved to this |
| // state to refresh the entropy and the SW initiates another hash |
| // operation while waiting for the EDN response. |
| st_d = StRandEdn; |
| |
| rand_valid_clear = 1'b 1; |
| end else begin |
| st_d = StRandEdn; |
| end |
| end |
| |
| StSwSeedWait: begin |
| lfsr_seed_en_red = seed_update_i; |
| |
| if (lfsr_seed_done) begin |
| st_d = StRandGenerate; |
| |
| lfsr_en = 1'b 1; |
| |
| rand_valid_clear = 1'b 1; |
| end else begin |
| st_d = StSwSeedWait; |
| end |
| end |
| |
| StRandGenerate: begin |
| // The current LFSR output is used as auxiliary randomness. |
| aux_update = 1'b 1; |
| |
| // Advance the LFSR and set the valid bit. The next LFSR output will be |
| // used for re-masking. |
| lfsr_en = 1'b 1; |
| rand_valid_set = 1'b 1; |
| |
| st_d = StRandReady; |
| end |
| |
| StRandErrWaitExpired: begin |
| st_d = StRandErr; |
| |
| err_o = '{ valid: 1'b 1, |
| code: ErrWaitTimerExpired, |
| info: 24'(timer_value) |
| }; |
| end |
| |
| StRandErrIncorrectMode: begin |
| st_d = StRandErr; |
| |
| err_o = '{ valid: 1'b 1, |
| code: ErrIncorrectEntropyMode, |
| info: 24'(mode_q) |
| }; |
| end |
| |
| StRandErr: begin |
| // Keep entropy signal valid to complete current hashing even with error |
| rand_valid_set = 1'b 1; |
| |
| if (err_processed_i) begin |
| st_d = StRandReset; |
| |
| end else begin |
| st_d = StRandErr; |
| end |
| |
| end |
| |
| StTerminalError: begin |
| // this state is terminal |
| st_d = st; |
| sparse_fsm_error_o = 1'b 1; |
| end |
| |
| default: begin |
| st_d = StTerminalError; |
| sparse_fsm_error_o = 1'b 1; |
| end |
| endcase |
| |
| // SEC_CM: FSM.GLOBAL_ESC, FSM.LOCAL_ESC |
| // Unconditionally jump into the terminal error state |
| // if the life cycle controller triggers an escalation. |
| if (lc_escalate_en_i != lc_ctrl_pkg::Off) begin |
| st_d = StTerminalError; |
| end |
| end |
| `ASSERT_KNOWN(RandStKnown_A, st) |
| |
| always_ff @(posedge clk_i or negedge rst_ni) begin |
| if (!rst_ni) begin |
| ready_phase_q <= '0; |
| end else begin |
| ready_phase_q <= ready_phase_d; |
| end |
| end |
| |
| // mubi4 sender |
| |
| assign entropy_configured = (st != StRandReset) |
| ? prim_mubi_pkg::MuBi4True |
| : prim_mubi_pkg::MuBi4False ; |
| prim_mubi4_sender #( |
| .AsyncOn(1'b0) |
| ) u_entropy_configured ( |
| .clk_i, |
| .rst_ni, |
| |
| .mubi_i (entropy_configured ), |
| .mubi_o (entropy_configured_o) |
| ); |
| |
| //////////////// |
| // Assertions // |
| //////////////// |
| |
| `ASSERT_INIT(EntropyLfsrWDivisble, NumChunksEntropyLfsr == |
| EntropyLfsrW / ChunkSizeEntropyLfsr) |
| |
| // We reseed one chunk of the entropy generator at a time. Therefore the |
| // chunk size must match the data width of the software and EDN inputs. |
| `ASSERT_INIT(ChunkSizeEntropyLfsrMatchesSw, ChunkSizeEntropyLfsr == 32) |
| `ASSERT_INIT(ChunkSizeEntropyLfsrMatchesEdn, ChunkSizeEntropyLfsr == |
| edn_pkg::ENDPOINT_BUS_WIDTH) |
| |
| // the code below is not meant to be synthesized, |
| // but it is intended to be used in simulation and FPV |
| `ifndef SYNTHESIS |
| // Check that the supplied permutations are valid. |
| logic [EntropyLfsrW-1:0] perm_test; |
| initial begin : p_perm_check |
| perm_test = '0; |
| for (int k = 0; k < EntropyLfsrW; k++) begin |
| perm_test[RndCnstLfsrPerm[k]] = 1'b1; |
| end |
| // All bit positions must be marked with 1. |
| `ASSERT_I(PermutationCheck_A, &perm_test) |
| end |
| |
| logic [ChunkSizeEntropyLfsr-1:0] perm_fwd_test; |
| initial begin : p_perm_fwd_check |
| perm_fwd_test = '0; |
| for (int k = 0; k < ChunkSizeEntropyLfsr; k++) begin |
| perm_fwd_test[RndCnstLfsrFwdPerm[k]] = 1'b1; |
| end |
| // All bit positions must be marked with 1. |
| `ASSERT_I(PermutationCheck_A, &perm_fwd_test) |
| end |
| `endif |
| |
| endmodule : kmac_entropy |
