[keymgr_dpe, dv] Introduce backdoor load for UDS

The scoreboard loads the UDS directly from the DUT via interface.
The problem is the keymgr_dpe initializes the slot for the UDS with
randomness. The initally loaded UDS is xored with the randomness
already present in the destination slot as countermeasure for SCA.
The scoreboard however can currently not recreate this randomness
thus the backdoor load.

Signed-off-by: Raphael Roth <rroth@lowrisc.org>

Author: rroth-lowrisc

hw/ip/keymgr_dpe/dv/env/keymgr_dpe_ctrl_if.sv

@@ -0,0 +1,28 @@
+// Copyright lowRISC contributors (OpenTitan project).
+// Licensed under the Apache License, Version 2.0, see LICENSE for details.
+// SPDX-License-Identifier: Apache-2.0
+//
+// An interface that should be bound into an instance of keymgr_dpe_ctrl (and can access RTL signals
+// through upwards hierarchical references).
+interface keymgr_dpe_ctrl_if (input clk_i, input rst_ni);
+  import uvm_pkg::*;
+
+  // Function to access the key of one slot via backdoor.
+  // Required to load the UDS after XORing with generated randomness.
+  function automatic keymgr_dpe_env_pkg::key_shares_t get_key_of_slot(int unsigned slot);
+    import keymgr_dpe_pkg::DpeNumSlots;
+
+    // Check that the slot index is in range. The key_slots_q array has length DpeNumSlots, which is
+    // a global parameter.
+    if (slot >= DpeNumSlots) begin
+      `uvm_error($sformatf("%m"),
+                 $sformatf("Slot index out of range: index is %0d but DpeNumSlots is %0d",
+                           slot, DpeNumSlots))
+      return '0;
+    end
+
+    // This is an upwards hierarchical reference through the keymgr_dpe_ctrl module (into an
+    // instance of which this interface is bound)
+    return keymgr_dpe_ctrl.key_slots_q[slot].key;
+  endfunction
+endinterface

hw/ip/keymgr_dpe/dv/env/keymgr_dpe_env.core

@@ -14,6 +14,7 @@ filesets:
       - lowrisc:ip:kmac_pkg
     files:
       - keymgr_dpe_env_pkg.sv
+      - keymgr_dpe_ctrl_if.sv
       - keymgr_dpe_if.sv
       - keymgr_dpe_env_cfg.sv: {is_include_file: true}
       - keymgr_dpe_env_cov.sv: {is_include_file: true}

hw/ip/keymgr_dpe/dv/env/keymgr_dpe_env.sv

@@ -26,6 +26,10 @@ class keymgr_dpe_env extends cip_base_env #(
       `uvm_fatal(`gfn, "failed to get keymgr_dpe_vif from uvm_config_db")
     end
     cfg.scb = scoreboard;
+    if (!uvm_config_db#(virtual keymgr_dpe_ctrl_if)::get(
+          this, "", "keymgr_dpe_ctrl_vif", cfg.keymgr_dpe_ctrl_vif)) begin
+      `uvm_fatal(get_full_name(), "Could not get keymgr_dpe_ctrl_vif from uvm_config_db.")
+    end
   endfunction
 
   function void connect_phase(uvm_phase phase);

hw/ip/keymgr_dpe/dv/env/keymgr_dpe_env_cfg.sv

@@ -15,6 +15,9 @@ class keymgr_dpe_env_cfg extends cip_base_env_cfg #(.RAL_T(keymgr_dpe_reg_block)
 
   `uvm_object_new
 
+  // Interface that is bound into the keymgr_dpe_ctrl instance
+  virtual keymgr_dpe_ctrl_if keymgr_dpe_ctrl_vif;
+
   virtual function void initialize();
     list_of_alerts = keymgr_dpe_env_pkg::LIST_OF_ALERTS;
     tl_intg_alert_name = "fatal_fault_err";

hw/ip/keymgr_dpe/dv/env/keymgr_dpe_scoreboard.sv

@@ -68,6 +68,12 @@ class keymgr_dpe_scoreboard extends cip_base_scoreboard #(
   bit                                is_kmac_rsp_err;
   bit                                is_kmac_invalid_data;
   bit                                is_sw_share_corrupted;
+  // Indicates if the UDS was fetched by the keymgr_dpe for the first time.
+  // The UDS needs to be xored with randomness to counter SCA, however the
+  // current dv environment cannot replicate this randomness. As a workaround
+  // the generated value (UDS xored with randomness) is loaded by a backdoor
+  // directly from the DUT.
+  bit                                load_uds_with_randomness;
 
   // HW internal key, used for OP in current state
   keymgr_dpe_env_pkg::keymgr_dpe_key_slot_t current_key_slot;
@@ -990,6 +996,12 @@ class keymgr_dpe_scoreboard extends cip_base_scoreboard #(
     current_internal_key[current_key_slot.dst_slot].valid = 1;
     current_internal_key[current_key_slot.dst_slot].boot_stage = keymgr_dpe_pkg::BootStageCreator;
     current_internal_key[current_key_slot.dst_slot].max_key_version = max_key_version;
+    // This call load the "true" UDS without the randomness present in the
+    // hw slot. The problem is that when this function is called (when writing
+    // the first time into the start register) the randomness in the hw slot
+    // is not yet generated.
+    // The current workaround is to backdoor load on the first advance call
+    // in the available state as the src_slot has the UDS loaded.
     current_internal_key[current_key_slot.dst_slot].key = otp_key;
     current_internal_key[current_key_slot.dst_slot].key_policy =
         keymgr_dpe_pkg::DEFAULT_UDS_POLICY;
@@ -1004,6 +1016,15 @@ class keymgr_dpe_scoreboard extends cip_base_scoreboard #(
     );
   endfunction
 
+  // Directly access the slot which holds the UDS with the xored randmoness
+  // Otherwise the scorebord would need to manually replicate the randomness
+  // generation.
+  virtual function void backdoor_load_uds(int slot);
+    `uvm_info(`gfn, "Load UDS with randomness via backdoor", UVM_MEDIUM)
+    current_internal_key[slot].key =
+        cfg.keymgr_dpe_ctrl_vif.get_key_of_slot(slot);
+  endfunction
+
   virtual function bit [TL_DW-1:0] get_current_max_version(
     keymgr_dpe_pkg::keymgr_dpe_exposed_working_state_e state = current_state);
     // design change this to 0 if LC turns off keymgr_dpe.
@@ -1127,6 +1148,13 @@ class keymgr_dpe_scoreboard extends cip_base_scoreboard #(
                   "src_slot valid == 0 err"}, op.name, current_state.name), UVM_MEDIUM)
               return 1;
             end
+            // Workaround to load the UDS with the xored randomness into the
+            // correct internal slot. The first (successful) advance call will
+            // use the UDS per default.
+            if (load_uds_with_randomness == 1'b0) begin
+              load_uds_with_randomness = 1'b1;
+              backdoor_load_uds(current_key_slot.src_slot);
+            end
             return 0;
           end
           keymgr_dpe_pkg::OpDpeGenSwOut, keymgr_dpe_pkg::OpDpeGenHwOut: begin
@@ -1534,6 +1562,7 @@ class keymgr_dpe_scoreboard extends cip_base_scoreboard #(
     is_kmac_rsp_err       = 0;
     is_kmac_invalid_data  = 0;
     is_sw_share_corrupted = 0;
+    load_uds_with_randomness = 0;
     req_fifo.flush();
     rsp_fifo.flush();
     foreach (current_internal_key[slot]) begin

hw/ip/keymgr_dpe/dv/tb.sv

@@ -26,6 +26,8 @@ module tb;
   keymgr_dpe_if keymgr_dpe_if(.clk(clk), .rst_n(rst_n));
   kmac_app_intf keymgr_dpe_kmac_intf(.clk(clk), .rst_n(rst_n));
 
+  bind dut.u_ctrl keymgr_dpe_ctrl_if u_if (.clk_i, .rst_ni);
+
   // connect KDF interface for assertion check
   assign keymgr_dpe_if.kmac_data_req = keymgr_dpe_kmac_intf.kmac_data_req;
   assign keymgr_dpe_if.kmac_data_rsp = keymgr_dpe_kmac_intf.kmac_data_rsp;
@@ -83,6 +85,8 @@ module tb;
     uvm_config_db#(intr_vif)::set(null, "*.env", "intr_vif", intr_if);
     uvm_config_db#(virtual tl_if)::set(null, "*.env.m_tl_agent*", "vif", tl_if);
     uvm_config_db#(virtual keymgr_dpe_if)::set(null, "*.env", "keymgr_dpe_vif", keymgr_dpe_if);
+    uvm_config_db#(virtual keymgr_dpe_ctrl_if)::set(null, "*.env", "keymgr_dpe_ctrl_vif",
+                                                    dut.u_ctrl.u_if);
     uvm_config_db#(virtual kmac_app_intf)::set(null,
                    "*env.m_keymgr_dpe_kmac_agent*", "vif", keymgr_dpe_kmac_intf);
     $timeformat(-12, 0, " ps", 12);