[csrng/entropy_src] fix for #4601

Inter-module signals to prevent power spikes.
Changed permissions for several files to not be executable.

Signed-off-by: Mark Branstad <mark.branstad@wdc.com>
diff --git a/hw/ip/csrng/data/csrng.hjson b/hw/ip/csrng/data/csrng.hjson
index c2cf522..bf9e85c 100644
--- a/hw/ip/csrng/data/csrng.hjson
+++ b/hw/ip/csrng/data/csrng.hjson
@@ -44,6 +44,12 @@
       act:     "req"
       package: "entropy_src_pkg"
     }
+    { struct:  "cs_aes_halt"
+      type:    "req_rsp",
+      name:    "cs_aes_halt"
+      act:     "rsp"
+      package: "entropy_src_pkg"
+    }
     { struct:  "logic"
       type:    "uni"
       name:    "efuse_sw_app_enable"
diff --git a/hw/ip/csrng/dv/tb.sv b/hw/ip/csrng/dv/tb.sv
index 1933a67..7bfb7c7 100644
--- a/hw/ip/csrng/dv/tb.sv
+++ b/hw/ip/csrng/dv/tb.sv
@@ -50,6 +50,9 @@
                                CSRNG_BUS_WIDTH-1:0], entropy_src_if.h_data[entropy_src_pkg::
                                CSRNG_BUS_WIDTH]}),
 
+    .cs_aes_halt_i           (1'b0),
+    .cs_aes_halt_o           (),
+
     .csrng_cmd_i             (csrng_if.cmd_req),
     .csrng_cmd_o             (csrng_if.cmd_rsp),
 
diff --git a/hw/ip/csrng/rtl/csrng.sv b/hw/ip/csrng/rtl/csrng.sv
index 94b1d42..d1fc935 100644
--- a/hw/ip/csrng/rtl/csrng.sv
+++ b/hw/ip/csrng/rtl/csrng.sv
@@ -31,6 +31,10 @@
   output entropy_src_pkg::entropy_src_hw_if_req_t entropy_src_hw_if_o,
   input  entropy_src_pkg::entropy_src_hw_if_rsp_t entropy_src_hw_if_i,
 
+  // Entropy Interface
+  input  entropy_src_pkg::cs_aes_halt_req_t cs_aes_halt_i,
+  output entropy_src_pkg::cs_aes_halt_rsp_t cs_aes_halt_o,
+
   // Application Interfaces
   input  csrng_req_t  [NHwApps-1:0] csrng_cmd_i,
   output csrng_rsp_t  [NHwApps-1:0] csrng_cmd_o,
@@ -83,6 +87,10 @@
     .entropy_src_hw_if_o,
     .entropy_src_hw_if_i,
 
+    // Entropy Interface
+    .cs_aes_halt_i,
+    .cs_aes_halt_o,
+
     // Application Interfaces
     .csrng_cmd_i,
     .csrng_cmd_o,
diff --git a/hw/ip/csrng/rtl/csrng_block_encrypt.sv b/hw/ip/csrng/rtl/csrng_block_encrypt.sv
index 8710a78..0f5bc1e 100644
--- a/hw/ip/csrng/rtl/csrng_block_encrypt.sv
+++ b/hw/ip/csrng/rtl/csrng_block_encrypt.sv
@@ -30,6 +30,7 @@
   output logic [Cmd-1:0]     block_encrypt_cmd_o,
   output logic [StateId-1:0] block_encrypt_id_o,
   output logic [BlkLen-1:0]  block_encrypt_v_o,
+  output logic               block_encrypt_quiet_o,
   output logic               block_encrypt_aes_cipher_sm_err_o,
   output logic [2:0]         block_encrypt_sfifo_blkenc_err_o
 );
@@ -55,6 +56,7 @@
   aes_pkg::sp2v_e       cipher_in_ready;
   aes_pkg::sp2v_e       cipher_out_valid;
   aes_pkg::sp2v_e       cipher_out_ready;
+  aes_pkg::sp2v_e       cipher_crypt_busy;
   logic [BlkLen-1:0]    cipher_data_out;
   logic                 aes_cipher_core_enable;
 
@@ -104,7 +106,7 @@
     .op_i               ( aes_pkg::CIPH_FWD          ),
     .key_len_i          ( aes_pkg::AES_256           ),
     .crypt_i            ( aes_pkg::SP2V_HIGH         ), // Enable
-    .crypt_o            (                            ),
+    .crypt_o            ( cipher_crypt_busy          ),
     .alert_o            ( block_encrypt_aes_cipher_sm_err_o),
     .dec_key_gen_i      ( aes_pkg::SP2V_LOW          ), // Disable
     .dec_key_gen_o      (                            ),
@@ -170,4 +172,13 @@
           (sfifo_blkenc_pop && !sfifo_blkenc_not_empty),
           (sfifo_blkenc_full && !sfifo_blkenc_not_empty)};
 
+  //--------------------------------------------
+  // idle detection
+  //--------------------------------------------
+
+  // simple aes cipher activity detector
+  assign block_encrypt_quiet_o =
+         (cipher_in_valid == aes_pkg::SP2V_LOW) && (cipher_in_ready == aes_pkg::SP2V_LOW) ||
+         (cipher_crypt_busy == aes_pkg::SP2V_LOW);
+
 endmodule
diff --git a/hw/ip/csrng/rtl/csrng_core.sv b/hw/ip/csrng/rtl/csrng_core.sv
index e3ea366..6e46c96 100644
--- a/hw/ip/csrng/rtl/csrng_core.sv
+++ b/hw/ip/csrng/rtl/csrng_core.sv
@@ -26,6 +26,10 @@
   output entropy_src_pkg::entropy_src_hw_if_req_t entropy_src_hw_if_o,
   input  entropy_src_pkg::entropy_src_hw_if_rsp_t entropy_src_hw_if_i,
 
+  // Entropy Interface
+  input  entropy_src_pkg::cs_aes_halt_req_t cs_aes_halt_i,
+  output entropy_src_pkg::cs_aes_halt_rsp_t cs_aes_halt_o,
+
   // Application Interfaces
   input  csrng_req_t  [NHwApps-1:0] csrng_cmd_i,
   output csrng_rsp_t  [NHwApps-1:0] csrng_cmd_o,
@@ -300,6 +304,9 @@
   logic                    main_sm_sts;
 
   logic [30:0]             err_code_test_bit;
+  logic                    ctr_drbg_upd_es_ack;
+  logic                    ctr_drbg_gen_es_ack;
+  logic                    block_encrypt_quiet;
 
   // flops
   logic [2:0]  acmd_q, acmd_d;
@@ -310,6 +317,7 @@
   logic        lc_hw_debug_not_on_q, lc_hw_debug_not_on_d;
   logic        lc_hw_debug_on_q, lc_hw_debug_on_d;
   logic        cmd_req_dly_q, cmd_req_dly_d;
+  logic        cs_aes_halt_q, cs_aes_halt_d;
 
   always_ff @(posedge clk_i or negedge rst_ni)
     if (!rst_ni) begin
@@ -321,6 +329,7 @@
       lc_hw_debug_not_on_q <= '0;
       lc_hw_debug_on_q <= '0;
       cmd_req_dly_q <= '0;
+      cs_aes_halt_q <= '0;
     end else begin
       acmd_q  <= acmd_d;
       shid_q  <= shid_d;
@@ -330,6 +339,7 @@
       lc_hw_debug_not_on_q <= lc_hw_debug_not_on_d;
       lc_hw_debug_on_q <= lc_hw_debug_on_d;
       cmd_req_dly_q <= cmd_req_dly_d;
+      cs_aes_halt_q <= cs_aes_halt_d;
     end
 
   //--------------------------------------------
@@ -1072,6 +1082,10 @@
     .ctr_drbg_upd_key_o(updblk_key),
     .ctr_drbg_upd_v_o(updblk_v),
 
+    // es halt interface
+    .ctr_drbg_upd_es_req_i(cs_aes_halt_i.cs_aes_halt_req),
+    .ctr_drbg_upd_es_ack_o(ctr_drbg_upd_es_ack),
+
     .block_encrypt_req_o(updblk_benblk_arb_req),
     .block_encrypt_rdy_i(updblk_benblk_arb_req_rdy),
     .block_encrypt_ccmd_o(updblk_benblk_cmd_arb_din),
@@ -1184,6 +1198,7 @@
     .block_encrypt_cmd_o(benblk_cmd),
     .block_encrypt_id_o(benblk_inst_id),
     .block_encrypt_v_o(benblk_v),
+    .block_encrypt_quiet_o(block_encrypt_quiet),
     .block_encrypt_aes_cipher_sm_err_o(aes_cipher_sm_err),
     .block_encrypt_sfifo_blkenc_err_o(block_encrypt_sfifo_blkenc_err)
   );
@@ -1260,6 +1275,10 @@
     .ctr_drbg_gen_rc_o(gen_result_rc),
     .ctr_drbg_gen_bits_o(gen_result_bits),
 
+    // es halt interface
+    .ctr_drbg_gen_es_req_i(cs_aes_halt_i.cs_aes_halt_req),
+    .ctr_drbg_gen_es_ack_o(ctr_drbg_gen_es_ack),
+
     // interface to updblk from genblk
     .gen_upd_req_o(genblk_updblk_arb_req),
     .upd_gen_rdy_i(updblk_genblk_arb_req_rdy),
@@ -1297,6 +1316,9 @@
   );
 
 
+  // es to cs halt request to reduce power spikes
+  assign cs_aes_halt_d = ctr_drbg_upd_es_ack && ctr_drbg_gen_es_ack && block_encrypt_quiet;
+  assign cs_aes_halt_o.cs_aes_halt_ack = cs_aes_halt_q;
 
   //--------------------------------------------
   // report csrng request summary
diff --git a/hw/ip/csrng/rtl/csrng_ctr_drbg_gen.sv b/hw/ip/csrng/rtl/csrng_ctr_drbg_gen.sv
index 4179084..4e03032 100644
--- a/hw/ip/csrng/rtl/csrng_ctr_drbg_gen.sv
+++ b/hw/ip/csrng/rtl/csrng_ctr_drbg_gen.sv
@@ -41,6 +41,11 @@
   output logic [CtrLen-1:0]  ctr_drbg_gen_rc_o,
   output logic [BlkLen-1:0]  ctr_drbg_gen_bits_o,
   output logic               ctr_drbg_gen_fips_o,
+
+   // es_req/ack
+  input logic                ctr_drbg_gen_es_req_i,
+  output logic               ctr_drbg_gen_es_ack_o,
+
   // update interface
   output logic               gen_upd_req_o,
   input logic                upd_gen_rdy_i,
@@ -168,8 +173,8 @@
   logic [1:0]                  interate_ctr_q, interate_ctr_d;
 
 // Encoding generated with:
-// $ ./util/design/sparse-fsm-encode.py -d 3 -m 3 -n 5 \
-//      -s 214010139 --language=sv
+// $ ./util/design/sparse-fsm-encode.py -d 3 -m 4 -n 5 \
+//      -s 2651202796 --language=sv
 //
 // Hamming distance histogram:
 //
@@ -188,8 +193,9 @@
 
   localparam int StateWidth = 5;
   typedef enum logic [StateWidth-1:0] {
-    ReqIdle  = 5'b01011,
-    ReqSend  = 5'b10001,
+    ReqIdle  = 5'b01101,
+    ReqSend  = 5'b00011,
+    ESHalt   = 5'b11000,
     ReqError = 5'b10110
 } state_e;
 
@@ -311,10 +317,13 @@
     block_encrypt_req_o = 1'b0;
     sfifo_genreq_pop = 1'b0;
     ctr_drbg_gen_sm_err_o = 1'b0;
+    ctr_drbg_gen_es_ack_o = 1'b0;
     unique case (state_q)
       // ReqIdle: increment v this cycle, push in next
       ReqIdle: begin
-        if (sfifo_genreq_not_empty && !sfifo_adstage_full) begin
+        if (ctr_drbg_gen_es_req_i) begin
+          state_d = ESHalt;
+        end else if (sfifo_genreq_not_empty && !sfifo_adstage_full) begin
           v_ctr_load = 1'b1;
           sfifo_adstage_push = 1'b1;
           state_d = ReqSend;
@@ -332,6 +341,12 @@
           state_d = ReqIdle;
         end
       end
+      ESHalt: begin
+        ctr_drbg_gen_es_ack_o = 1'b1;
+        if (!ctr_drbg_gen_es_req_i) begin
+          state_d = ReqIdle;
+        end
+      end
       ReqError: begin
         ctr_drbg_gen_sm_err_o = 1'b1;
       end
diff --git a/hw/ip/csrng/rtl/csrng_ctr_drbg_upd.sv b/hw/ip/csrng/rtl/csrng_ctr_drbg_upd.sv
index a2225d1..951cb79 100644
--- a/hw/ip/csrng/rtl/csrng_ctr_drbg_upd.sv
+++ b/hw/ip/csrng/rtl/csrng_ctr_drbg_upd.sv
@@ -32,6 +32,11 @@
   output logic [BlkLen-1:0]  ctr_drbg_upd_v_o,
   output logic               ctr_drbg_upd_ack_o, // final ack when update process has been completed
   input logic                ctr_drbg_upd_rdy_i, // readu to process the ack above
+
+   // es_req/ack
+  input logic                ctr_drbg_upd_es_req_i,
+  output logic               ctr_drbg_upd_es_ack_o,
+
    // block encrypt interface
   output logic               block_encrypt_req_o,
   input logic                block_encrypt_rdy_i,
@@ -149,8 +154,8 @@
   logic [StateId-1:0] concat_inst_id_q, concat_inst_id_d;
 
 // Encoding generated with:
-// $ ./util/design/sparse-fsm-encode.py -d 3 -m 3 -n 5 \
-//      -s 2557753240 --language=sv
+// $ ./util/design/sparse-fsm-encode.py -d 3 -m 4 -n 5 \
+//      -s 47328894 --language=sv
 //
 // Hamming distance histogram:
 //
@@ -169,9 +174,10 @@
 
   localparam int BlkEncStateWidth = 5;
   typedef enum logic [BlkEncStateWidth-1:0] {
-    ReqIdle = 5'b00110,
+    ReqIdle = 5'b11000,
     ReqSend = 5'b10011,
-    BEError = 5'b11100
+    ESHalt  = 5'b01110,
+    BEError = 5'b00101
   } blk_enc_state_e;
 
   blk_enc_state_e blk_enc_state_d, blk_enc_state_q;
@@ -331,10 +337,13 @@
     sfifo_bencreq_push = 1'b0;
     sfifo_updreq_pop = 1'b0;
     ctr_drbg_updbe_sm_err_o = 1'b0;
+    ctr_drbg_upd_es_ack_o = 1'b0;
     unique case (blk_enc_state_q)
       // ReqIdle: increment v this cycle, push in next
       ReqIdle: begin
-        if (sfifo_updreq_not_empty && !sfifo_bencreq_full && !sfifo_pdata_full) begin
+        if (ctr_drbg_upd_es_req_i) begin
+          blk_enc_state_d = ESHalt;
+        end else if (sfifo_updreq_not_empty && !sfifo_bencreq_full && !sfifo_pdata_full) begin
           v_ctr_load = 1'b1;
           sfifo_pdata_push = 1'b1;
           blk_enc_state_d = ReqSend;
@@ -352,6 +361,12 @@
           blk_enc_state_d = ReqIdle;
         end
       end
+      ESHalt: begin
+        ctr_drbg_upd_es_ack_o = 1'b1;
+        if (!ctr_drbg_upd_es_req_i) begin
+          blk_enc_state_d = ReqIdle;
+        end
+      end
       BEError: begin
         ctr_drbg_updbe_sm_err_o = 1'b1;
       end
diff --git a/hw/ip/entropy_src/data/entropy_src.hjson b/hw/ip/entropy_src/data/entropy_src.hjson
index 1cee6fc..32d096d 100644
--- a/hw/ip/entropy_src/data/entropy_src.hjson
+++ b/hw/ip/entropy_src/data/entropy_src.hjson
@@ -21,6 +21,12 @@
       act:     "rsp",
       package: "entropy_src_pkg",
     }
+    { struct:  "cs_aes_halt"
+      type:    "req_rsp",
+      name:    "cs_aes_halt"
+      act:     "req"
+      package: "entropy_src_pkg"
+    }
     { struct:  "entropy_src_rng",
       type:    "req_rsp",
       name:    "entropy_src_rng",
diff --git a/hw/ip/entropy_src/dv/tb/tb.sv b/hw/ip/entropy_src/dv/tb/tb.sv
index cb1ca60..8b36263 100644
--- a/hw/ip/entropy_src/dv/tb/tb.sv
+++ b/hw/ip/entropy_src/dv/tb/tb.sv
@@ -46,6 +46,9 @@
                                     csrng_if.d_data[entropy_src_pkg::CSRNG_BUS_WIDTH]}),
     .entropy_src_hw_if_i          (csrng_if.req),
 
+    .cs_aes_halt_o                (),
+    .cs_aes_halt_i                (1'b0),
+
     .entropy_src_xht_o            (),
     .entropy_src_xht_i            ('0),
 
diff --git a/hw/ip/entropy_src/rtl/entropy_src.sv b/hw/ip/entropy_src/rtl/entropy_src.sv
index 469fead..60764de 100644
--- a/hw/ip/entropy_src/rtl/entropy_src.sv
+++ b/hw/ip/entropy_src/rtl/entropy_src.sv
@@ -35,6 +35,10 @@
   output entropy_src_rng_req_t entropy_src_rng_o,
   input  entropy_src_rng_rsp_t entropy_src_rng_i,
 
+  // CSRNG Interface
+  output cs_aes_halt_req_t cs_aes_halt_o,
+  input  cs_aes_halt_rsp_t cs_aes_halt_i,
+
   // External Health Test Interface
   output entropy_src_xht_req_t entropy_src_xht_o,
   input  entropy_src_xht_rsp_t entropy_src_xht_i,
@@ -88,6 +92,9 @@
     .entropy_src_rng_o,
     .entropy_src_rng_i,
 
+    .cs_aes_halt_o,
+    .cs_aes_halt_i,
+
     .recov_alert_o(alert[0]),
     .fatal_alert_o(alert[1]),
 
diff --git a/hw/ip/entropy_src/rtl/entropy_src_core.sv b/hw/ip/entropy_src/rtl/entropy_src_core.sv
index ed17561..bd54a8b 100644
--- a/hw/ip/entropy_src/rtl/entropy_src_core.sv
+++ b/hw/ip/entropy_src/rtl/entropy_src_core.sv
@@ -29,6 +29,10 @@
   output entropy_src_rng_req_t entropy_src_rng_o,
   input  entropy_src_rng_rsp_t entropy_src_rng_i,
 
+  // CSRNG Interface
+  output cs_aes_halt_req_t cs_aes_halt_o,
+  input  cs_aes_halt_rsp_t cs_aes_halt_i,
+
   // External Health Test Interface
   output entropy_src_xht_req_t entropy_src_xht_o,
   input  entropy_src_xht_rsp_t entropy_src_xht_i,
@@ -328,6 +332,7 @@
   logic                     sha3_squeezing;
   logic [2:0]               sha3_fsm;
   logic [32:0]              sha3_err;
+  logic                     cs_aes_halt_req;
 
 
   logic [sha3_pkg::StateW-1:0] sha3_state[Sha3Share];
@@ -344,6 +349,7 @@
   logic [HalfRegWidth-1:0] window_cntr_q, window_cntr_d;
   logic                    sha3_msg_rdy_q, sha3_msg_rdy_d;
   logic                    sha3_err_q, sha3_err_d;
+  logic        cs_aes_halt_q, cs_aes_halt_d;
 
   always_ff @(posedge clk_i or negedge rst_ni)
     if (!rst_ni) begin
@@ -357,6 +363,7 @@
       window_cntr_q         <= '0;
       sha3_msg_rdy_q        <= '0;
       sha3_err_q            <= '0;
+      cs_aes_halt_q         <= '0;
     end else begin
       es_rate_cntr_q        <= es_rate_cntr_d;
       lfsr_incr_dly_q       <= lfsr_incr_dly_d;
@@ -368,6 +375,7 @@
       window_cntr_q         <= window_cntr_d;
       sha3_msg_rdy_q        <= sha3_msg_rdy_d;
       sha3_err_q            <= sha3_err_d;
+      cs_aes_halt_q         <= cs_aes_halt_d;
     end
 
   assign es_enable = (|reg2hw.conf.enable.q);
@@ -1742,7 +1750,7 @@
 
 
   assign pfifo_cond_push = pfifo_precon_pop && sha3_msgfifo_ready &&
-  !es_bypass_mode;
+  !cs_aes_halt_req && !es_bypass_mode;
 
   assign pfifo_cond_wdata = pfifo_precon_rdata;
 
@@ -1851,9 +1859,14 @@
     .sha3_start_o       (sha3_start),
     .sha3_process_o     (sha3_process),
     .sha3_done_o        (sha3_done),
+    .cs_aes_halt_req_o  (cs_aes_halt_req),
+    .cs_aes_halt_ack_i  (cs_aes_halt_i.cs_aes_halt_ack),
     .main_sm_err_o      (es_main_sm_err)
   );
 
+  // es to cs halt request to reduce power spikes
+  assign cs_aes_halt_d = cs_aes_halt_req;
+  assign cs_aes_halt_o.cs_aes_halt_req = cs_aes_halt_q;
 
   //--------------------------------------------
   // send processed entropy to final fifo
diff --git a/hw/ip/entropy_src/rtl/entropy_src_main_sm.sv b/hw/ip/entropy_src/rtl/entropy_src_main_sm.sv
index 528e0f9..ee7ad36 100644
--- a/hw/ip/entropy_src/rtl/entropy_src_main_sm.sv
+++ b/hw/ip/entropy_src/rtl/entropy_src_main_sm.sv
@@ -24,42 +24,45 @@
   output logic               sha3_start_o,
   output logic               sha3_process_o,
   output logic               sha3_done_o,
+  output logic               cs_aes_halt_req_o,
+  input logic                cs_aes_halt_ack_i,
   output logic               main_sm_err_o
 );
 
 // Encoding generated with:
-// $ ./util/design/sparse-fsm-encode.py -d 3 -m 9 -n 8 \
-//      -s 3744885553 --language=sv
+// $ ./util/design/sparse-fsm-encode.py -d 3 -m 10 -n 8 \
+//      -s 1721366211 --language=sv
 //
 // Hamming distance histogram:
 //
 //  0: --
 //  1: --
 //  2: --
-//  3: |||||||||||||||||| (25.00%)
-//  4: |||||||||||||||||||| (27.78%)
-//  5: |||||||||||||||||||| (27.78%)
-//  6: |||||||||||| (16.67%)
-//  7: || (2.78%)
-//  8: --
+//  3: ||||||||||| (24.44%)
+//  4: |||||||||||||||||||| (44.44%)
+//  5: |||||||||| (22.22%)
+//  6: ||| (6.67%)
+//  7: --
+//  8: | (2.22%)
 //
 // Minimum Hamming distance: 3
-// Maximum Hamming distance: 7
-// Minimum Hamming weight: 3
-// Maximum Hamming weight: 6
+// Maximum Hamming distance: 8
+// Minimum Hamming weight: 2
+// Maximum Hamming weight: 5
 //
 
   localparam int StateWidth = 8;
   typedef enum logic [StateWidth-1:0] {
-    Idle              = 8'b10111100, // idle
-    BootHTRunning     = 8'b11100101, // boot mode, wait for health test done pulse
-    BootPostHTChk     = 8'b10011010, // boot mode, wait for post health test packer not empty state
-    NormHTStart       = 8'b00010011, // normal mode, pulse the sha3 start input
-    NormHTRunning     = 8'b11001001, // normal mode, wait for health test done pulse
-    NormSha3Process   = 8'b11010100, // normal mode, pulse the sha3 process input
-    NormSha3Valid     = 8'b00101101, // normal mode, wait for sha3 valid indication
-    NormSha3Done      = 8'b01111011, // normal mode, capture sha3 result, pulse done input
-    Error             = 8'b01000110  // illegal state reached and hang
+    Idle              = 8'b01110110, // idle
+    BootHTRunning     = 8'b01011011, // boot mode, wait for health test done pulse
+    BootPostHTChk     = 8'b00000111, // boot mode, wait for post health test packer not empty state
+    NormHTStart       = 8'b11100000, // normal mode, pulse the sha3 start input
+    NormHTRunning     = 8'b01001000, // normal mode, wait for health test done pulse
+    NormSha3CSReq     = 8'b10001001, // normal mode, request csrng arb to reduce power
+    NormSha3Process   = 8'b10010000, // normal mode, pulse the sha3 process input
+    NormSha3Valid     = 8'b01100011, // normal mode, wait for sha3 valid indication
+    NormSha3Done      = 8'b11001110, // normal mode, capture sha3 result, pulse done input
+    Error             = 8'b11010101  // illegal state reached and hang
   } state_e;
 
   state_e state_d, state_q;
@@ -89,6 +92,7 @@
     sha3_start_o = 1'b0;
     sha3_process_o = 1'b0;
     sha3_done_o = 1'b0;
+    cs_aes_halt_req_o = 1'b0;
     main_sm_err_o = 1'b0;
     unique case (state_q)
       Idle: begin
@@ -128,16 +132,24 @@
             sha3_done_o = 1'b1;
             state_d = Idle;
           end else begin
-            state_d = NormSha3Process;
+            state_d = NormSha3CSReq;
           end
         end
       end
+      NormSha3CSReq: begin
+        cs_aes_halt_req_o = 1'b1;
+        if (cs_aes_halt_ack_i) begin
+        state_d = NormSha3Process;
+        end
+      end
       NormSha3Process: begin
+        cs_aes_halt_req_o = 1'b1;
         rst_alert_cntr_o = 1'b1;
         sha3_process_o = 1'b1;
         state_d = NormSha3Valid;
       end
       NormSha3Valid: begin
+        cs_aes_halt_req_o = 1'b1;
         if (sha3_state_vld_i) begin
           state_d = NormSha3Done;
         end
diff --git a/hw/ip/entropy_src/rtl/entropy_src_pkg.sv b/hw/ip/entropy_src/rtl/entropy_src_pkg.sv
index c8dadae..accba47 100644
--- a/hw/ip/entropy_src/rtl/entropy_src_pkg.sv
+++ b/hw/ip/entropy_src/rtl/entropy_src_pkg.sv
@@ -29,6 +29,18 @@
   parameter entropy_src_hw_if_rsp_t ENTROPY_SRC_HW_IF_RSP_DEFAULT = '{default: '0};
 
 
+  // csrng block encrypt request/ack i/f
+  typedef struct packed {
+    logic cs_aes_halt_req;
+  } cs_aes_halt_req_t;
+
+  typedef struct packed {
+    logic cs_aes_halt_ack;
+  } cs_aes_halt_rsp_t;
+
+  parameter cs_aes_halt_req_t CS_AES_HALT_REQ_DEFAULT = '{default: '0};
+  parameter cs_aes_halt_rsp_t CS_AES_HALT_RSP_DEFAULT = '{default: '0};
+
   // ast rng i/f
   typedef struct packed {
     logic rng_enable;
diff --git a/hw/top_earlgrey/data/autogen/top_earlgrey.gen.hjson b/hw/top_earlgrey/data/autogen/top_earlgrey.gen.hjson
index d9742f7..ee0baf1 100644
--- a/hw/top_earlgrey/data/autogen/top_earlgrey.gen.hjson
+++ b/hw/top_earlgrey/data/autogen/top_earlgrey.gen.hjson
@@ -4307,6 +4307,19 @@
           index: -1
         }
         {
+          name: cs_aes_halt
+          struct: cs_aes_halt
+          package: entropy_src_pkg
+          type: req_rsp
+          act: rsp
+          width: 1
+          inst_name: csrng
+          default: ""
+          end_idx: -1
+          top_signame: csrng_cs_aes_halt
+          index: -1
+        }
+        {
           name: efuse_sw_app_enable
           struct: logic
           type: uni
@@ -4382,6 +4395,18 @@
           index: -1
         }
         {
+          name: cs_aes_halt
+          struct: cs_aes_halt
+          package: entropy_src_pkg
+          type: req_rsp
+          act: req
+          width: 1
+          inst_name: entropy_src
+          default: ""
+          top_signame: csrng_cs_aes_halt
+          index: -1
+        }
+        {
           name: entropy_src_rng
           struct: entropy_src_rng
           package: entropy_src_pkg
@@ -5419,6 +5444,10 @@
       [
         entropy_src.entropy_src_hw_if
       ]
+      csrng.cs_aes_halt:
+      [
+        entropy_src.cs_aes_halt
+      ]
       flash_ctrl.flash:
       [
         eflash.flash_ctrl
@@ -11692,6 +11721,19 @@
         index: -1
       }
       {
+        name: cs_aes_halt
+        struct: cs_aes_halt
+        package: entropy_src_pkg
+        type: req_rsp
+        act: rsp
+        width: 1
+        inst_name: csrng
+        default: ""
+        end_idx: -1
+        top_signame: csrng_cs_aes_halt
+        index: -1
+      }
+      {
         name: efuse_sw_app_enable
         struct: logic
         type: uni
@@ -11737,6 +11779,18 @@
         index: -1
       }
       {
+        name: cs_aes_halt
+        struct: cs_aes_halt
+        package: entropy_src_pkg
+        type: req_rsp
+        act: req
+        width: 1
+        inst_name: entropy_src
+        default: ""
+        top_signame: csrng_cs_aes_halt
+        index: -1
+      }
+      {
         name: entropy_src_rng
         struct: entropy_src_rng
         package: entropy_src_pkg
@@ -13654,6 +13708,28 @@
         default: ""
       }
       {
+        package: entropy_src_pkg
+        struct: cs_aes_halt_req
+        signame: csrng_cs_aes_halt_req
+        width: 1
+        type: req_rsp
+        end_idx: -1
+        act: rsp
+        suffix: req
+        default: ""
+      }
+      {
+        package: entropy_src_pkg
+        struct: cs_aes_halt_rsp
+        signame: csrng_cs_aes_halt_rsp
+        width: 1
+        type: req_rsp
+        end_idx: -1
+        act: rsp
+        suffix: rsp
+        default: ""
+      }
+      {
         package: flash_ctrl_pkg
         struct: flash_req
         signame: flash_ctrl_flash_req
diff --git a/hw/top_earlgrey/data/top_earlgrey.hjson b/hw/top_earlgrey/data/top_earlgrey.hjson
index 1e7c003..9ae3f78 100644
--- a/hw/top_earlgrey/data/top_earlgrey.hjson
+++ b/hw/top_earlgrey/data/top_earlgrey.hjson
@@ -831,6 +831,7 @@
                                    'pwrmgr_aon.esc_rst_tx'],
       'csrng.csrng_cmd'         : ['edn0.csrng_cmd', 'edn1.csrng_cmd'],
       'csrng.entropy_src_hw_if' : ['entropy_src.entropy_src_hw_if'],
+      'csrng.cs_aes_halt'       : ['entropy_src.cs_aes_halt'],
       'flash_ctrl.flash'        : ['eflash.flash_ctrl'],
       'flash_ctrl.keymgr'       : ['keymgr.flash'],
       'flash_ctrl.otp'          : ['otp_ctrl.flash_otp_key'],
diff --git a/hw/top_earlgrey/rtl/autogen/top_earlgrey.sv b/hw/top_earlgrey/rtl/autogen/top_earlgrey.sv
index bae47ce..381b51c 100644
--- a/hw/top_earlgrey/rtl/autogen/top_earlgrey.sv
+++ b/hw/top_earlgrey/rtl/autogen/top_earlgrey.sv
@@ -426,6 +426,8 @@
   csrng_pkg::csrng_rsp_t [1:0] csrng_csrng_cmd_rsp;
   entropy_src_pkg::entropy_src_hw_if_req_t       csrng_entropy_src_hw_if_req;
   entropy_src_pkg::entropy_src_hw_if_rsp_t       csrng_entropy_src_hw_if_rsp;
+  entropy_src_pkg::cs_aes_halt_req_t       csrng_cs_aes_halt_req;
+  entropy_src_pkg::cs_aes_halt_rsp_t       csrng_cs_aes_halt_rsp;
   flash_ctrl_pkg::flash_req_t       flash_ctrl_flash_req;
   flash_ctrl_pkg::flash_rsp_t       flash_ctrl_flash_rsp;
   flash_ctrl_pkg::keymgr_flash_t       flash_ctrl_keymgr;
@@ -2029,6 +2031,8 @@
       .csrng_cmd_o(csrng_csrng_cmd_rsp),
       .entropy_src_hw_if_o(csrng_entropy_src_hw_if_req),
       .entropy_src_hw_if_i(csrng_entropy_src_hw_if_rsp),
+      .cs_aes_halt_i(csrng_cs_aes_halt_req),
+      .cs_aes_halt_o(csrng_cs_aes_halt_rsp),
       .efuse_sw_app_enable_i('0),
       .lc_hw_debug_en_i(lc_ctrl_pkg::Off),
       .tl_i(csrng_tl_req),
@@ -2055,6 +2059,8 @@
       // Inter-module signals
       .entropy_src_hw_if_i(csrng_entropy_src_hw_if_req),
       .entropy_src_hw_if_o(csrng_entropy_src_hw_if_rsp),
+      .cs_aes_halt_o(csrng_cs_aes_halt_req),
+      .cs_aes_halt_i(csrng_cs_aes_halt_rsp),
       .entropy_src_rng_o(es_rng_req_o),
       .entropy_src_rng_i(es_rng_rsp_i),
       .entropy_src_xht_o(),