Skip to content

Commit dfa68e2

Browse files
vogelpirroth-lowrisc
vogelpi
authored and
rroth-lowrisc
committed
[keymgr_dpe, otp_ctrl, rtl] Change otp keymgr_dpe interface
Split the otp_keymgr_key interface into its respective components. Future version of the keymgr(_dpe) may receive the information from different IP's rather than combined from the otp_ctrl. To avoid a circular dependencies the DevIdWidth instantiated in keymgr_pkg replaces the otp_ctrl_pkg::DeviceIdWidth. As the keymgr still expects the combined message the earlgrey top manually combines the key material. This fix will be removed when the keymgr is replaced by the keymgr_dpe. Signed-off-by: Raphael Roth <rroth@lowrisc.org>
1 parent 110f5b5 commit dfa68e2

27 files changed

Lines changed: 663 additions & 232 deletions

File tree

‎hw/ip/keymgr_dpe/data/keymgr_dpe.hjson‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -77,17 +77,29 @@
7777
act: "req",
7878
package: "kmac_pkg", // Origin package (only needs for the requester)
7979
},
80-
{ struct: "otp_keymgr_key",
80+
{ struct: "keymgr_dpe_creator_root_key",
8181
type: "uni",
82-
name: "otp_key",
82+
name: "creator_root_key",
8383
act: "rcv",
84-
package: "otp_ctrl_pkg",
84+
package: "keymgr_dpe_pkg",
8585
},
86-
{ struct: "otp_device_id",
86+
{ struct: "keymgr_dpe_creator_seed",
8787
type: "uni",
88-
name: "otp_device_id",
88+
name: "creator_seed",
8989
act: "rcv",
90-
package: "otp_ctrl_pkg",
90+
package: "keymgr_dpe_pkg",
91+
},
92+
{ struct: "keymgr_dpe_owner_seed",
93+
type: "uni",
94+
name: "owner_seed",
95+
act: "rcv",
96+
package: "keymgr_dpe_pkg",
97+
},
98+
{ struct: "keymgr_dpe_device_id",
99+
type: "uni",
100+
name: "device_id",
101+
act: "rcv",
102+
package: "keymgr_dpe_pkg",
91103
},
92104
{ struct: "lc_tx",
93105
type: "uni",

‎hw/ip/keymgr_dpe/doc/interfaces.md‎

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -10,20 +10,22 @@ Referring to the [Comportable guideline for peripheral device functionality](htt
1010

1111
## [Inter-Module Signals](https://opentitan.org/book/doc/contributing/hw/comportability/index.html#inter-signal-handling)
1212

13-
| Port Name | Package::Struct | Type | Act | Width | Description |
14-
|:----------------|:-----------------------------|:--------|:------|--------:|:--------------|
15-
| edn | edn_pkg::edn | req_rsp | req | 1 | |
16-
| aes_key | keymgr_pkg::hw_key_req | uni | req | 1 | |
17-
| kmac_key | keymgr_pkg::hw_key_req | uni | req | 1 | |
18-
| otbn_key | keymgr_pkg::otbn_key_req | uni | req | 1 | |
19-
| kmac_data | kmac_pkg::app | req_rsp | req | 1 | |
20-
| otp_key | otp_ctrl_pkg::otp_keymgr_key | uni | rcv | 1 | |
21-
| otp_device_id | otp_ctrl_pkg::otp_device_id | uni | rcv | 1 | |
22-
| lc_keymgr_en | lc_ctrl_pkg::lc_tx | uni | rcv | 1 | |
23-
| lc_keymgr_div | lc_ctrl_pkg::lc_keymgr_div | uni | rcv | 1 | |
24-
| rom_digest | rom_ctrl_pkg::keymgr_data | uni | rcv | 2 | |
25-
| kmac_en_masking | logic | uni | rcv | 1 | |
26-
| tl | tlul_pkg::tl | req_rsp | rsp | 1 | |
13+
| Port Name | Package::Struct | Type | Act | Width | Description |
14+
|:-----------------|:--------------------------------------------|:--------|:------|--------:|:--------------|
15+
| edn | edn_pkg::edn | req_rsp | req | 1 | |
16+
| aes_key | keymgr_pkg::hw_key_req | uni | req | 1 | |
17+
| kmac_key | keymgr_pkg::hw_key_req | uni | req | 1 | |
18+
| otbn_key | keymgr_pkg::otbn_key_req | uni | req | 1 | |
19+
| kmac_data | kmac_pkg::app | req_rsp | req | 1 | |
20+
| creator_root_key | keymgr_dpe_pkg::keymgr_dpe_creator_root_key | uni | rcv | 1 | |
21+
| creator_seed | keymgr_dpe_pkg::keymgr_dpe_creator_seed | uni | rcv | 1 | |
22+
| owner_seed | keymgr_dpe_pkg::keymgr_dpe_owner_seed | uni | rcv | 1 | |
23+
| device_id | keymgr_dpe_pkg::keymgr_dpe_device_id | uni | rcv | 1 | |
24+
| lc_keymgr_en | lc_ctrl_pkg::lc_tx | uni | rcv | 1 | |
25+
| lc_keymgr_div | lc_ctrl_pkg::lc_keymgr_div | uni | rcv | 1 | |
26+
| rom_digest | rom_ctrl_pkg::keymgr_data | uni | rcv | 2 | |
27+
| kmac_en_masking | logic | uni | rcv | 1 | |
28+
| tl | tlul_pkg::tl | req_rsp | rsp | 1 | |
2729

2830
## Interrupts
2931

‎hw/ip/keymgr_dpe/dv/env/keymgr_dpe_if.sv‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,10 @@ interface keymgr_dpe_if(input clk, input rst_n);
1818
// it so that status is changed to SideLoadNotAvail, then we may set it to SideLoadAvail again
1919
lc_ctrl_pkg::lc_tx_t keymgr_dpe_en;
2020
lc_ctrl_pkg::lc_keymgr_div_t keymgr_dpe_div;
21-
otp_ctrl_pkg::otp_device_id_t otp_device_id;
22-
otp_ctrl_pkg::otp_keymgr_key_t otp_key;
21+
keymgr_dpe_pkg::keymgr_dpe_device_id_t otp_device_id;
22+
keymgr_dpe_pkg::keymgr_dpe_creator_root_key_t creator_root_key;
23+
keymgr_dpe_pkg::keymgr_dpe_creator_seed_t creator_seed;
24+
keymgr_dpe_pkg::keymgr_dpe_owner_seed_t owner_seed;
2325
rom_ctrl_pkg::keymgr_data_t[NumRomDigestInputs-1:0] rom_digests;
2426

2527
keymgr_pkg::hw_key_req_t kmac_key;

‎hw/ip/keymgr_dpe/dv/keymgr_dpe_sim.core‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ description: "KEYMGR_DPE DV sim target"
77
filesets:
88
files_rtl:
99
depend:
10+
- lowrisc:ip:otp_ctrl_pkg
1011
- lowrisc:ip:keymgr_dpe
1112

1213
files_dv:

‎hw/ip/keymgr_dpe/dv/tb.sv‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,23 @@ module tb;
4141
assign keymgr_dpe_if.edn_ack = edn_if[0].ack;
4242
assign keymgr_dpe_if.lfsr_en = dut.lfsr_en;
4343

44+
// Quick fix to propagate the signal from the keymgr_dpe_if to the dut
45+
keymgr_dpe_pkg::keymgr_dpe_creator_root_key_t creator_root_key;
46+
keymgr_dpe_pkg::keymgr_dpe_creator_seed_t creator_seed;
47+
keymgr_dpe_pkg::keymgr_dpe_owner_seed_t owner_seed;
48+
assign creator_root_key.share0 =
49+
keymgr_dpe_if.otp_key.creator_root_key_share0;
50+
assign creator_root_key.share0_valid =
51+
keymgr_dpe_if.otp_key.creator_root_key_share0_valid;
52+
assign creator_root_key.share1 =
53+
keymgr_dpe_if.otp_key.creator_root_key_share1;
54+
assign creator_root_key.share1_valid =
55+
keymgr_dpe_if.otp_key.creator_root_key_share1_valid;
56+
assign creator_seed.seed = keymgr_dpe_if.otp_key.creator_seed;
57+
assign creator_seed.seed_valid = keymgr_dpe_if.otp_key.creator_seed_valid;
58+
assign owner_seed.seed = keymgr_dpe_if.otp_key.owner_seed;
59+
assign owner_seed.seed_valid = keymgr_dpe_if.otp_key.owner_seed_valid;
60+
4461
// dut
4562
// TODO(opentitan-integrated/issues/332):
4663
// need to model the OTP seed input
@@ -58,8 +75,10 @@ module tb;
5875
.kmac_en_masking_i (1'b1),
5976
.lc_keymgr_en_i (keymgr_dpe_if.keymgr_dpe_en),
6077
.lc_keymgr_div_i (keymgr_dpe_if.keymgr_dpe_div),
61-
.otp_key_i (keymgr_dpe_if.otp_key),
62-
.otp_device_id_i (keymgr_dpe_if.otp_device_id),
78+
.creator_root_key_i (creator_root_key),
79+
.creator_seed_i (creator_seed),
80+
.owner_seed_i (owner_seed),
81+
.device_id_i (keymgr_dpe_if.otp_device_id),
6382
.rom_digest_i (keymgr_dpe_if.rom_digests),
6483
.edn_o (edn_if[0].req),
6584
.edn_i ({edn_if[0].ack, edn_if[0].d_data}),

‎hw/ip/keymgr_dpe/keymgr_dpe.core‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ filesets:
2020
- lowrisc:prim:sparse_fsm
2121
- lowrisc:ip:keymgr_dpe_pkg
2222
- lowrisc:ip:kmac_pkg
23-
- lowrisc:ip:otp_ctrl_pkg
2423
- lowrisc:ip:rom_ctrl_pkg
2524
- lowrisc:ip:tlul
2625
- lowrisc:ip:keymgr_common

‎hw/ip/keymgr_dpe/rtl/keymgr_dpe.sv‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,10 @@ module keymgr_dpe
5656
// SEC_CM: LC_CTRL.INTERSIG.MUBI
5757
input lc_ctrl_pkg::lc_tx_t lc_keymgr_en_i,
5858
input lc_ctrl_pkg::lc_keymgr_div_t lc_keymgr_div_i,
59-
input otp_ctrl_pkg::otp_keymgr_key_t otp_key_i,
60-
input otp_ctrl_pkg::otp_device_id_t otp_device_id_i,
59+
input keymgr_dpe_creator_root_key_t creator_root_key_i,
60+
input keymgr_dpe_creator_seed_t creator_seed_i,
61+
input keymgr_dpe_owner_seed_t owner_seed_i,
62+
input keymgr_dpe_device_id_t device_id_i,
6163

6264
// connection to edn
6365
output edn_pkg::edn_req_t edn_o,
@@ -259,16 +261,16 @@ module keymgr_dpe
259261
end
260262

261263
hw_key_req_t root_key;
262-
assign root_key.key = '{otp_key_i.creator_root_key_share1,
263-
otp_key_i.creator_root_key_share0};
264+
assign root_key.key = '{creator_root_key_i.share1,
265+
creator_root_key_i.share0};
264266

265267
prim_flop_2sync # (
266268
.Width(1)
267269
) u_key_valid_sync (
268270
.clk_i,
269271
.rst_ni,
270-
.d_i(otp_key_i.creator_root_key_share0_valid &
271-
otp_key_i.creator_root_key_share1_valid),
272+
.d_i(creator_root_key_i.share0_valid &
273+
creator_root_key_i.share1_valid),
272274
.q_o(root_key.valid)
273275
);
274276

@@ -449,14 +451,14 @@ module keymgr_dpe
449451
// The values coming from otp_ctrl / lc_ctrl are treat as quasi-static for CDC purposes
450452
logic [KeyWidth-1:0] creator_seed;
451453
logic unused_creator_seed;
452-
assign unused_creator_seed = ^{otp_key_i.creator_seed_valid};
453-
assign creator_seed = otp_key_i.creator_seed;
454+
assign unused_creator_seed = ^{creator_seed_i.seed_valid};
455+
assign creator_seed = creator_seed_i.seed;
454456

455457
// Advance to owner_intermediate_key
456458
logic [KeyWidth-1:0] owner_seed;
457459
logic unused_owner_seed;
458-
assign unused_owner_seed = ^{otp_key_i.owner_seed_valid};
459-
assign owner_seed = otp_key_i.owner_seed;
460+
assign unused_owner_seed = ^{owner_seed_i.seed_valid};
461+
assign owner_seed = owner_seed_i.seed;
460462

461463
always_comb begin : gen_adv_matrix_all
462464
// One default only use SW binding
@@ -467,7 +469,7 @@ module keymgr_dpe
467469
// For (0 = Creator) and (1 = OwnerInt), check seed validity
468470
adv_matrix[BootStageCreator] = DpeAdvDataWidth'({sw_binding,
469471
revision_seed,
470-
otp_device_id_i,
472+
device_id_i,
471473
lc_keymgr_div_i,
472474
rom_digests,
473475
creator_seed});
@@ -516,7 +518,7 @@ module keymgr_dpe
516518
.creator_seed_i(creator_seed),
517519
.owner_seed_i(owner_seed),
518520
.key_i(curr_active_key),
519-
.devid_i(otp_device_id_i),
521+
.devid_i(device_id_i),
520522
.health_state_i(HealthStateWidth'(lc_keymgr_div_i)),
521523
.creator_seed_vld_o(creator_seed_vld),
522524
.owner_seed_vld_o(owner_seed_vld),
@@ -816,7 +818,7 @@ module keymgr_dpe
816818
assign unused_active_policy = active_key_slot.key_policy;
817819
assign unused_active_key_version = active_key_slot.max_key_version;
818820

819-
`ASSERT_INIT(KeyWidthEqualityCheck_A, otp_ctrl_pkg::KeyMgrKeyWidth == KeyWidth)
821+
`ASSERT_INIT(KeyWidthEqualityCheck_A, KeyMgrKeyWidth == KeyWidth)
820822

821823
`ASSERT_INIT_NET(KmacMaskCheck_A, KmacEnMasking == kmac_en_masking_i)
822824

‎hw/ip/keymgr_dpe/rtl/keymgr_dpe_pkg.sv‎

Lines changed: 43 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@ package keymgr_dpe_pkg;
1010
parameter int DpeNumSlots = 8;
1111
parameter int DpeNumSlotsWidth = prim_util_pkg::vbits(DpeNumSlots);
1212

13+
// Chip Device ID
14+
parameter int DeviceIdWidth = 256;
15+
typedef logic [DeviceIdWidth-1:0] keymgr_dpe_device_id_t;
16+
1317
// keymgr and keymgr_dpe have different maximum KMAC input widths. The below widths correspond to
1418
// the following inputs to advance to the creator root key state:
1519
// - Software binding
@@ -18,7 +22,7 @@ package keymgr_dpe_pkg;
1822
// - LC keymgr diversification value
1923
// - ROM digests
2024
// - Creator seed
21-
parameter int DpeAdvDataWidth = SwBindingWidth + KeyWidth + otp_ctrl_pkg::DeviceIdWidth +
25+
parameter int DpeAdvDataWidth = SwBindingWidth + KeyWidth + DeviceIdWidth +
2226
lc_ctrl_pkg::LcKeymgrDivWidth + KeyWidth*keymgr_dpe_reg_pkg::NumRomDigestInputs + KeyWidth;
2327

2428
typedef logic [DpeNumSlotsWidth-1:0] keymgr_dpe_slot_idx_e;
@@ -84,6 +88,44 @@ package keymgr_dpe_pkg;
8488
logic allow_child;
8589
} keymgr_dpe_policy_t;
8690

91+
// Parameter Key Width
92+
parameter int KeyMgrKeyWidth = 256;
93+
94+
// Input struct for secrets required by the keymgr dpe.
95+
typedef struct packed {
96+
logic [KeyMgrKeyWidth-1:0] share0;
97+
logic share0_valid;
98+
logic [KeyMgrKeyWidth-1:0] share1;
99+
logic share1_valid;
100+
} keymgr_dpe_creator_root_key_t;
101+
102+
typedef struct packed {
103+
logic [KeyMgrKeyWidth-1:0] seed;
104+
logic seed_valid;
105+
} keymgr_dpe_creator_seed_t;
106+
107+
typedef struct packed {
108+
logic [KeyMgrKeyWidth-1:0] seed;
109+
logic seed_valid;
110+
} keymgr_dpe_owner_seed_t;
111+
112+
parameter keymgr_dpe_creator_root_key_t KEYMGR_DPE_CREATOR_ROOT_KEY_DEFAULT = '{
113+
share0 : 256'hefb7ea7ee90093cf4affd9aaa2d6c0ec446cfdf5f2d5a0bfd7e2d93edc63a102,
114+
share0_valid : 1'b1,
115+
share1 : 256'h56d24a00181de99e0f690b447a8dde2a1ffb8bc306707107aa6e2410f15cfc37,
116+
share1_valid : 1'b1
117+
};
118+
119+
parameter keymgr_dpe_creator_seed_t KEYMGR_DPE_CREATOR_SEED_DEFAULT = '{
120+
seed : 256'hc7c50b38655cc87f821e5b07fed85d2c07e222a9e00bef308b3eccba0ba406fa,
121+
seed_valid : 1'b1
122+
};
123+
124+
parameter keymgr_dpe_owner_seed_t KEYMGR_DPE_OWNER_SEED_DEFAULT = '{
125+
seed : 256'hf5052c0f14782d8b066be9f49c0b2000d3643ff3723ea7db972f69cd3e2e3e68,
126+
seed_valid : 1'b1
127+
};
128+
87129
// Enumeration for boot stage. In the BootStageRuntime stage, there is no limit on the number of
88130
// advance calls.
89131
parameter int DpeBootStagesWidth = 2;

‎hw/ip/otp_ctrl/otp_ctrl_pkg.core‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ filesets:
88
files_rtl:
99
depend:
1010
- lowrisc:ip:lc_ctrl_pkg
11+
- lowrisc:ip:keymgr_dpe_pkg
1112
files:
1213
- rtl/otp_ctrl_pkg.sv
1314
file_type: systemVerilogSource

‎hw/ip/otp_ctrl/rtl/otp_ctrl_pkg.sv‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
// This package can be imported by generic IPs:
66
// - It does not import otp_ctrl_reg_pkg, which is generated and top-specific.
77

8+
`include "prim_assert.sv"
9+
810
package otp_ctrl_pkg;
911

1012
////////////////////////
@@ -13,6 +15,9 @@ package otp_ctrl_pkg;
1315

1416
parameter int DeviceIdWidth = 256;
1517
typedef logic [DeviceIdWidth-1:0] otp_device_id_t;
18+
// Device ID defined in the keymgr_dpe package must match
19+
`ASSERT_STATIC_IN_PACKAGE(DeviceIdWidth_A,
20+
DeviceIdWidth == keymgr_dpe_pkg::DeviceIdWidth)
1621

1722
parameter int ManufStateWidth = 256;
1823
typedef logic [ManufStateWidth-1:0] otp_manuf_state_t;
@@ -87,7 +92,6 @@ package otp_ctrl_pkg;
8792

8893
parameter int NvmKeySeedWidth = 256;
8994
parameter int SramKeySeedWidth = 128;
90-
parameter int KeyMgrKeyWidth = 256;
9195
parameter int NvmKeyWidth = 128;
9296
parameter int SramKeyWidth = 128;
9397
parameter int SramNonceWidth = 128;
@@ -104,14 +108,14 @@ package otp_ctrl_pkg;
104108
localparam int SramNonceSel = SramNonceWidth / ScrmblBlockWidth;
105109

106110
typedef struct packed {
107-
logic [KeyMgrKeyWidth-1:0] creator_root_key_share0;
108-
logic creator_root_key_share0_valid;
109-
logic [KeyMgrKeyWidth-1:0] creator_root_key_share1;
110-
logic creator_root_key_share1_valid;
111-
logic [KeyMgrKeyWidth-1:0] creator_seed;
112-
logic creator_seed_valid;
113-
logic [KeyMgrKeyWidth-1:0] owner_seed;
114-
logic owner_seed_valid;
111+
logic [keymgr_dpe_pkg::KeyMgrKeyWidth-1:0] creator_root_key_share0;
112+
logic creator_root_key_share0_valid;
113+
logic [keymgr_dpe_pkg::KeyMgrKeyWidth-1:0] creator_root_key_share1;
114+
logic creator_root_key_share1_valid;
115+
logic [keymgr_dpe_pkg::KeyMgrKeyWidth-1:0] creator_seed;
116+
logic creator_seed_valid;
117+
logic [keymgr_dpe_pkg::KeyMgrKeyWidth-1:0] owner_seed;
118+
logic owner_seed_valid;
115119
} otp_keymgr_key_t;
116120

117121
parameter otp_keymgr_key_t OTP_KEYMGR_KEY_DEFAULT = '{

0 commit comments

Comments
 (0)