[hmac] V2(S) Signoff

[andreaskurth]

No description provided.

[martin-velay]

Commits since HMAC D2(S) Signoff (#20996)

---

git rev-parse HEAD

ea5bce9

git log d7483116b80bf56ce2b8e665c679872de3f3794d..HEAD --oneline hw/ip/hmac

• 99ce062 [hmac, dv] Fix ValidHmacEnConditionAssert
  -> RTL fix for assertion
• 01a2089 [hmac,rtl/dv] DV synchronization and error handling fixes
  -> RTL fix
• f489ff7 [hmac,rtl] HMAC FSM RTL fixes to handle SAR
  -> RTL fix
• 7d8ace2 [dv] Remove default value for wait_to_issue_reset argument
• 6c51bc0 [hmac,dv] DV fixes for block-level tests
• ee5f4a1 [sram_ctrl] Add readback feature
  -> Not linked
• f9f6fe5 [hmac,csrs/rtl] Add key_swap field and expose hmac idle status
  -> will be test later [hmac,dv] Verify HMAC idle status #23380
• aace3c0 [hmac,rtl/dv] RTL and DV fixes for digest loading and error handling
  -> RTL fix and tested
• 76b1c74 [hmac,dv] DV synchronization fixes for do_read_check
• c1fa322 [hmac,rtl] Minor HMAC fixes for secret key wiping
  -> key wipping is tested, but maybe still need to add DV assertions with uvm_hdl_read to verify if all the sensitive registers have been wipped.
• 5a74a15 [hmac/rtl] Fix idle_o when told to stop
  -> RTL fix
• e71da1c [hmac/rtl] Wait for digest of complete block when stopping
  -> RTL fix
• dbe6169 [prim_sha2_pad,rtl] Go to idle (without padding) when told to stop
  -> RTL fix
• e01609e [hmac,doc] Documentation fixes
• 128d609 [hmac,dv] Scoreboard checks for different digest sizes
• e120a95 [hmac/prim_2,rtl] Do not clear redundant digest values
  -> RTL change: spec and DV have been aligned
• ed04dc9 [hmac, doc] Update HMAC context saving guide
• f189ae8 [hmac, doc] Update programmers guide for streaming
• 5bc6e0a [hmac, rtl] Fix indexing bug/typo
  -> RTL fix
• ab878b5 [hmac/dv] Cleanups and coverage fixes/improvements
• e2eff20 [hmac,dv] Extend DV to test invalid configurations
• c859a39 [hmac/prim_sha2,rtl] Implement SW error for invalid HMAC config
  -> DV and doc have been updated accordingly
• 4bc1570 [prim_sha2,rtl/dv] Fix secret value wiping
  -> Closing [hmac/rtl] Overwrite internal values with WIPE_SECRET instead of XOR'ing with it #22555
• 0d0ce1a [hmac/dv] Cleanups without functional impact
• dc848b3 [sram_ctrl,prim,rtl] Fix tlul_we -> ready timing path.
  -> Not linked
• 8295903 [bazel,autogen_hjson] Split C and rust header generation
  -> Not linked
• 30d7e78 (tag: Earlgrey-PROD-M2-RC5, tag: Earlgrey-PROD-M2) Add the project name to the copyright header
  -> Not linked
• d01864e Fix or waive Python lint errors and warnings
  -> Not linked
• f4c2bb9 Remove trailing whitespaces
  -> Not linked
• 5b9f3a9 [hmac] Sign off at V1
• d562315 [hmac/dv] Add testplan items for recently added features
• 7fa9df0 [hmac] Sign off at D2S
• 90aba7a [hmac,doc] Documentation updates
• 5084b38 [hmac] Coding style and minor fixes

Issues closed since HMAC D2(S) Signoff (#20996)

---

Issues closed since HMAC D2(S) Signoff

• [hmac, rtl] Reset hmac_core FSM to Idle after stop #23352
• [hmac, dv] initiated remains high during context switches #23348
• [hmac, rtl] Fix switching between different digest-sized streams #23181
• [hmac/rtl] Save and Restore digest mismatch when SHA digest update is too close to a block boundary #23163
• [hmac] Add endianness swap option to KEY registers #23158
• [hmac,dv] Update DV checks for invalid configuration error #23110
• How to run hello_world.c on open titan? #23070
• [test-triage] hmac_wipe_secret started failing #23053
• [hmac/spec] Output pin doesn't go to Idle in case of HMAC stop invoked #23036
• [hmac, rtl] Loading SHA-256 back thru DIGEST registers. #23014
• [hmac, rtl] Expose Idle status of HMAC #22916
• [hmac/dv] CSR read check commented out in scoreboard #22578
• [hmac/rtl] Overwrite internal values with WIPE_SECRET instead of XOR'ing with it #22555
• [hmac,rtl] Flag error for invalid digest size/key length configuration #22312
• [hmac,doc] Consolidate documentation changes #21711
• [hmac,rtl] Handle incomplete message size after cmd.hash_stop #21710
• [hmac/rtl] Fix suffixes of hmac_core's port names #21666
• [chip-test] chip_sw_hmac_stress #21465

Currently open issues

---

• [hmac, TLT] Extend multistream top-level test for HMAC #23507 -> deferred as it is an extension of the S&R
• [hmac,doc] Align documentation with changes #23455
• [hmac,dv] Verify HMAC idle status #23380 -> deferred as IDLE status at pin level is checked, this register seems to work visually but needs to be integrated into the SCB
• [hmac/dv] Remove/replace checks from the sequences #23288 -> deferred as it won't affect the checks but will comply with reuse and UVM
• [hmac, dv] Test key_swap functionality #23245 -> deferred as used by the SW as expected but no time to yet to add support in the SCB
• [hmac,dv] Compare intermediate digests when verifying HMAC save & restore #23240 -> deferred as not affecting the final digest check which matters the most. This is more a debug help.
• [manuf] TPM provisioning sequence needs to include generation of a 512 bit secret #23237
• [cryptolib] HMAC driver TODO list #23191
• [ROM] consider checking FIFO depth before sending data to HMAC/KMAC interfaces #23175
• [RFC] SLH-DSA Updates for Earl Grey #23144
• [hmac/dv] Add block-level sha/hmac_test_vectors tests for newer digest sizes #22932 -> tested at top level, but still needs to be covered at block-level (ongoing)
• [cryptolib, flash] Allocate flash info page for custom DRBG seeds #22851 -> tested at top level, maybe to be deferred? see comment here
• [component] Issues with Getting started #22833
• [cryptolib] Move SHA-2/HMAC computations to HMAC HWIP #22731
• [hmac] V3 Signoff #22671
• [hmac] D3 Signoff #22638
• [cryptolib] HW backed keys seems be misusing keymgr #22624
• [hmac] V2(S) Signoff #22471
• [kmac,dv] Verify fifo_empty status interrupt #22341
• [hmac,difs] Update DIFs and DIF-based TLTs  #22332
• [keymgr] Ability to run known-answer tests for KMAC #22297
• [cryptolib] implement software DRBG #22127
• [csrng] Side loading of entropy from key manager #22117
• [hmac/dv] Verify wider digest & configurable key length #22102 -> see comment
• [silicon_creator] namespace all silicon_creator drivers with scd_ prefix #21937
• [cryptolib] support for EC key generation from provided DRBG #21936
• [bazel] bazelisk.sh unbound variable error when invoked with dvsim.py to run TLT #21823
• [hmac] Verify FIFO empty status interrupt #21815 -> deferred as not used by SW
• [hmac/dv] Verify save & restore #21708 -> almost ready, need to make a proper PR and to fix some pending DV issues
• [chip-test] chip_sw_hmac_error_conditions #21468
• [chip-test] chip_sw_hmac_endianness #21466
• [rom,rom_ext] During owner firmware selection/verification handle flash ECC errors as non-fatal #21353
• [chip-test] Incomplete SiVal Stage 1 and 2 tests #21222
• [sival] test_locked_all_tests #21083
• [sival] test_unlocked_all_tests #21076
• [sival] raw_all_tests #21075
• [sival] prod_all_tests #20194
• [bazel, dvsim] Convert dvsim-executed tests to the new rules #19797
• [cryptolib] API cleanup #19549
• [tlul] Side-channel Hamming weight leakage of data on TL-UL #16767
• [crypto] Add sideloaded key support to the cryptolib. #15590
• [dif] Add missing dif to access fault CSRs #14518
• [prim] Packer empty signal #12958
• [dv] The #1ps delay in dut_init means we never start a sequence item on the first clock edge #10137
• [dv, test_vectors] Integrate AES test vectors into existing NIST vector testing package #7143
• [hw/kmac] Setup kmac for security verification and check for key leakage from keymgr port #6543
• [sw] polling in ROM #6220
• [keymgr, kmac] Context Switch (save/restore) #3479
• Credit system in TL-UL to not block the fabric #1644
• [dv/hmac] enhancement on DV testbench #777 -> throughput test --> deferred to M5
• [reggen] Changing multireg structure #270

Coverage report from TODO

---

TODO add screenshot here
I ran a regression with Xcelium which seems to don't give a nice HTML page. This regression is based on the branch sar_dv with some local change as #23538 and #23529 were not merged yet.
Here is the temporary status:

### Test Results                                                                                                                                                                                                                   
|  Stage  |                   Name                    | Tests                           |  Max Job Runtime  |  Simulated Time  |  Passing  |  Total  |  Pass Rate  |                                                               
|:-------:|:-----------------------------------------:|:--------------------------------|:-----------------:|:----------------:|:---------:|:-------:|:-----------:|                                                               
|   V1    |                   smoke                   | hmac_smoke                      |      1.750m       |     1.809ms      |    50     |   50    |  100.00 %   |                                                               
|   V1    |               csr_hw_reset                | hmac_csr_hw_reset               |      1.533m       |     65.634us     |     5     |    5    |  100.00 %   |                                                               
|   V1    |                  csr_rw                   | hmac_csr_rw                     |      1.617m       |     34.456us     |    20     |   20    |  100.00 %   |                                                               
|   V1    |               csr_bit_bash                | hmac_csr_bit_bash               |      1.817m       |     1.274ms      |     5     |    5    |  100.00 %   |                                                               
|   V1    |               csr_aliasing                | hmac_csr_aliasing               |      1.700m       |    584.677us     |     5     |    5    |  100.00 %   |                                                               
|   V1    |        csr_mem_rw_with_rand_reset         | hmac_csr_mem_rw_with_rand_reset |      21.783m      |     98.312ms     |    20     |   20    |  100.00 %   |                                                               
|   V1    | regwen_csr_and_corresponding_lockable_csr | hmac_csr_rw                     |      1.617m       |     34.456us     |    20     |   20    |  100.00 %   |                                                               
|         |                                           | hmac_csr_aliasing               |      1.700m       |    584.677us     |     5     |    5    |  100.00 %   |                                                               
|   V1    |                                           | **TOTAL**                       |                   |                  |    105    |   105   |  100.00 %   |                                                               
|   V2    |                 long_msg                  | hmac_long_msg                   |      3.467m       |     8.642ms      |    50     |   50    |  100.00 %   |                                                               
|   V2    |               back_pressure               | hmac_back_pressure              |      2.250m       |    743.318us     |    50     |   50    |  100.00 %   |                                                               
|   V2    |               test_vectors                | hmac_test_sha_vectors           |      12.483m      |     31.675ms     |    50     |   50    |  100.00 %   |                                                               
|         |                                           | hmac_test_hmac_vectors          |      1.467m       |    160.202us     |    50     |   50    |  100.00 %   |                                                               
|   V2    |                 burst_wr                  | hmac_burst_wr                   |      2.533m       |     1.378ms      |    50     |   50    |  100.00 %   |                                                               
|   V2    |              datapath_stress              | hmac_datapath_stress            |      5.967m       |     2.429ms      |    50     |   50    |  100.00 %   |                                                               
|   V2    |                   error                   | hmac_error                      |      6.900m       |     45.729ms     |    50     |   50    |  100.00 %   |                                                               
|   V2    |                wipe_secret                | hmac_wipe_secret                |      2.967m       |     53.650ms     |    50     |   50    |  100.00 %   |                                                               
|   V2    |             save_and_restore              | hmac_smoke                      |      1.750m       |     1.809ms      |    50     |   50    |  100.00 %   |                                                               
|         |                                           | hmac_long_msg                   |      3.467m       |     8.642ms      |    50     |   50    |  100.00 %   |                                                               
|         |                                           | hmac_back_pressure              |      2.250m       |    743.318us     |    50     |   50    |  100.00 %   |                                                               
|         |                                           | hmac_datapath_stress            |      5.967m       |     2.429ms      |    50     |   50    |  100.00 %   |                                                               
|         |                                           | hmac_burst_wr                   |      2.533m       |     1.378ms      |    50     |   50    |  100.00 %   |                                                               
|         |                                           | hmac_stress_all                 |      58.933m      |    495.304ms     |    50     |   50    |  100.00 %   |                                                               
|   V2    |    wide_digest_configurable_key_length    | hmac_smoke                      |      1.750m       |     1.809ms      |    50     |   50    |  100.00 %   |                                                               
|         |                                           | hmac_long_msg                   |      3.467m       |     8.642ms      |    50     |   50    |  100.00 %   |                                                               
|         |                                           | hmac_back_pressure              |      2.250m       |    743.318us     |    50     |   50    |  100.00 %   |                                                               
|         |                                           | hmac_datapath_stress            |      5.967m       |     2.429ms      |    50     |   50    |  100.00 %   |                                                               
|         |                                           | hmac_burst_wr                   |      2.533m       |     1.378ms      |    50     |   50    |  100.00 %   |                                                               
|         |                                           | hmac_error                      |      6.900m       |     45.729ms     |    50     |   50    |  100.00 %   |                                                               
|         |                                           | hmac_wipe_secret                |      2.967m       |     53.650ms     |    50     |   50    |  100.00 %   |                                                               
|         |                                           | hmac_stress_all                 |      58.933m      |    495.304ms     |    50     |   50    |  100.00 %   |                                                               
|   V2    |                stress_all                 | hmac_stress_all                 |      58.933m      |    495.304ms     |    50     |   50    |  100.00 %   |                                                               
|   V2    |                alert_test                 | hmac_alert_test                 |      1.467m       |     20.575us     |    50     |   50    |  100.00 %   |                                                               
|   V2    |                 intr_test                 | hmac_intr_test                  |      1.550m       |     25.901us     |    50     |   50    |  100.00 %   |                                                               
|   V2    |           tl_d_oob_addr_access            | hmac_tl_errors                  |      1.583m       |    206.467us     |    20     |   20    |  100.00 %   |                                                               
|   V2    |            tl_d_illegal_access            | hmac_tl_errors                  |      1.583m       |    206.467us     |    20     |   20    |  100.00 %   |                                                               
|   V2    |          tl_d_outstanding_access          | hmac_csr_hw_reset               |      1.533m       |     65.634us     |     5     |    5    |  100.00 %   |                                                               
|         |                                           | hmac_csr_rw                     |      1.617m       |     34.456us     |    20     |   20    |  100.00 %   |                                                               
|         |                                           | hmac_csr_aliasing               |      1.700m       |    584.677us     |     5     |    5    |  100.00 %   |                                                               
|         |                                           | hmac_same_csr_outstanding       |      1.633m       |    554.558us     |    20     |   20    |  100.00 %   |                                                               
|   V2    |            tl_d_partial_access            | hmac_csr_hw_reset               |      1.533m       |     65.634us     |     5     |    5    |  100.00 %   |                                                               
|         |                                           | hmac_csr_rw                     |      1.617m       |     34.456us     |    20     |   20    |  100.00 %   |                                                               
|         |                                           | hmac_csr_aliasing               |      1.700m       |    584.677us     |     5     |    5    |  100.00 %   |                                                               
|         |                                           | hmac_same_csr_outstanding       |      1.633m       |    554.558us     |    20     |   20    |  100.00 %   |                                                               
|   V2    |                                           | **TOTAL**                       |                   |                  |    590    |   590   |  100.00 %   |                                                               
|   V2S   |                tl_intg_err                | hmac_sec_cm                     |      1.500m       |    287.689us     |     5     |    5    |  100.00 %   |                                                               
|         |                                           | hmac_tl_intg_err                |      1.733m       |    124.403us     |    20     |   20    |  100.00 %   |                                                               
|   V2S   |           sec_cm_bus_integrity            | hmac_tl_intg_err                |      1.733m       |    124.403us     |    20     |   20    |  100.00 %   |                                                               
|   V2S   |                                           | **TOTAL**                       |                   |                  |    25     |   25    |  100.00 %   |                                                               
|   V3    | write_config_and_secret_key_during_msg_wr | hmac_smoke                      |      1.750m       |     1.809ms      |    50     |   50    |  100.00 %   |                                                               
|   V3    |        stress_all_with_rand_reset         | hmac_stress_all_with_rand_reset |      1.109h       |    123.761ms     |    11     |   200   |   5.50 %    |                                                               
|   V3    |                                           | **TOTAL**                       |                   |                  |    11     |   200   |   5.50 %    |                                                               
|         |                                           | **TOTAL**                       |                   |                  |    731    |   920   |   79.46 %   |                                                               

## Coverage Results                                                                                                                                                                                                                

### [Coverage Dashboard](/home/dev/src/scratch/sar_dv/hmac-sim-xcelium/cov_report/index.html)                                                                                                                                      

|  Score  |  Block  |  Branch  |  Statement  |  Expression  |  Toggle  |   Fsm   |  Assertion  |  CoverGroup  |                                                                                                                    
|:-------:|:-------:|:--------:|:-----------:|:------------:|:--------:|:-------:|:-----------:|:------------:|                                                                                                                    
| 96.40 % | 96.50 % | 91.75 %  |   97.47 %   |   95.27 %    | 96.53 %  | 94.74 % |   98.48 %   |   98.62 %    |        

Summary

---

RTL has been mainly impacted by some important changes:

• [hmac] Initial implementation of save & restore #21307
  -> Linked DV: [hmac/dv] Verify save & restore #21708: [hmac/dv] Verify save & restore #21708
• [hmac] Implementation of wider digest & configurable key length #21604
  -> Linked DV: [hmac/dv] Verify wider digest & configurable key length #22102: left TODO
• [hmac] Change fifo_empty interrupt type to status #21809
  -> Linked DV: [hmac] Verify FIFO empty status interrupt #21815: DEFERRED

Remaining efforts:

• Get these PRs reviewed and merged:
  • [hmac/dv] Save and Restore #23116
  • [hmac,dv] Block-level tests with SHA-2 NIST test vectors for new digest sizes 384/512 #23541

[martin-velay]

New issue raised since above snapshot:

• [hmac,rtl] Save & Restore FSM bug #23530 -> CLOSED thanks to [hmac,rtl] Fix Save & Restore HMAC FSM bug #23538

[moidx]

Discussed moving as P1 to M5 due to RTL risk analysis performed during last issue triage.

[vogelpi]

Alright, AFAIK all outstanding PRs have been merged and issues addresses. @martin-velay is currently investigating an issue with FSM coverage but after that we should be able to close V2S.

[martin-velay]

Here are the latest updates: #23683

Coverage results in this comment: #23683 (comment). This includes the UNR exclusions from this PR #23916 which is not merged yet.

The FSM cov is still a bit lower than 90%, and here is the reason: #23683 (comment)

[vogelpi]

Thanks @martin-velay , I've feed back on the FSM coverage issue. I believe this should be coverable but it may need very precise timing.

I've merged the updated UNR file.

[andreaskurth]

Thanks for the V2S review, @martin-velay, and all your work on this, also to @gdessouky!

I reviewed the following commits, which change the RTL of HMAC and/or the SHA2 prims it instantiates:

• 5084b38 [hmac] Coding style and minor fixes
  --> lint and coding style fixes
• 30d7e78 Add the project name to the copyright header
  --> no functional change
• dc848b3 [sram_ctrl,prim,rtl] Fix tlul_we -> ready timing path.
  --> no functional change to HMAC or SHA2
• 4bc1570 [prim_sha2,rtl/dv] Fix secret value wiping
  --> fix for issue [hmac/rtl] Overwrite internal values with WIPE_SECRET instead of XOR'ing with it #22555
• c859a39 [hmac/prim_sha2,rtl] Implement SW error for invalid HMAC config
  --> fix for issue [hmac,rtl] Flag error for invalid digest size/key length configuration #22312
• 5bc6e0a [hmac, rtl] Fix indexing bug/typo
  --> fix for issue [hmac, rtl] Loading SHA-256 back thru DIGEST registers. #23014
• e120a95 [hmac/prim_2,rtl] Do not clear redundant digest values
  --> fix wiping with random value for upper digest registers in SHA2_256 mode
• a7cb9a4 [prim_sha2_pad,rtl] Fix setting of digest mode when continuing
  --> fix for save & restore feature
• 6e6c14b [prim_sha2_pad,rtl] Refactor comparison on tx_count and msg len into signal
  --> small refactoring to enable subsequent commit
• dbe6169 [prim_sha2_pad,rtl] Go to idle (without padding) when told to stop
  8fad05f [prim_sha2_pad,rtl] Signal msg feed complete also when stopping
  e71da1c [hmac/rtl] Wait for digest of complete block when stopping
  --> fixes for save & restore feature
• 5a74a15 [hmac/rtl] Fix idle_o when told to stop
  --> fix for issue [hmac/spec] Output pin doesn't go to Idle in case of HMAC stop invoked #23036
• c1fa322 [hmac,rtl] Minor HMAC fixes for secret key wiping
  --> fix for secret wiping
• aace3c0 [hmac,rtl/dv] RTL and DV fixes for digest loading and error handling
  --> fix digest loading and improve error handling
• f9f6fe5 [hmac,csrs/rtl] Add key_swap field and expose hmac idle status
  --> resolve issue [hmac] Add endianness swap option to KEY registers #23158
• ee5f4a1 [sram_ctrl] Add readback feature
  --> no functional change to HMAC or SHA2
• 9e6feec [kmac,prim_sha2/rtl] Remove unused conv_endian64 function
  --> code removal for lint cleaning
• 0742a8e [kmac,prim_sha2/rtl] Fix lint error in conv_endian32
  --> lint cleanup, no functional change
• f489ff7 [hmac,rtl] HMAC FSM RTL fixes to handle SAR
  --> fix for save & restore feature
• 01a2089 [hmac,rtl/dv] DV synchronization and error handling fixes
  --> fix loading from message FIFO
• 99ce062 [hmac, dv] Fix ValidHmacEnConditionAssert
  --> fix issue [hmac, dv] initiated remains high during context switches #23348
• 32d52b8 [hmac,rtl] Fix Save & Restore FSM bug
  --> fix for save & restore feature
• 37bcf1e [hmac/lint] Remove unused localparam
  --> lint cleanup, no functional change
• d79a3bb [hmac,rtl] Coding cosmetics fixes
  --> no functional change
• 85baec4 [hmac,dv] Minor DV assertion fix
  --> no functional change
• d851a38 [hmac] Avoid inference of latch
  --> prevent unintended latch

Those RTL changes LGTM.

Test pass rates are excellent overall (today 100% including V3 tests!), though the fifo_empty_status_interrupt testpoint currently has no tests assigned with it. Since PR #23749, the scoreboard includes checks for this feature, so we just need to list the appropriate tests.

Coverage numbers are very good (94 to 100%) except FSM, which is known and for which an exclusion is being added.

None of the open issues prevents us from signing HMAC off at V2S in my view.

In conclusion, once the exclusions for FSM coverage are in (#23948) and the fifo_empty_status_interrupt testpoint has tests assigned with it (#23945), I agree with signing HMAC off at V2S (#23939).

[gdessouky]

Exclusions for the FSM coverage per our discussion here #23683 have been added in #23948.

[gdessouky]

FSM coverage is now at 97% with the additional FSM exclusions.