[entropy_src] V2S Signoff

[andreaskurth]

No description provided.

[moidx]

Discussed moving as P1 to M5 due to RTL risk analysis performed during last issue triage.

[vogelpi]

Commits since Earlgrey-PROD.M2

For Commits since Earlgrey-ES tapeout, see #20973 (comment) .

git rev-parse --short HEAD 3e678c1

6f274e0 [entropy_src] Map previously unmapped entropy_src_intr test
-> Map a test to corresponding testpoint
af726e8 [entropy_src] Use es_delayed_enable for SVAs tracking entropy flow
5b63281 [entropy_src/dv] Avoid Observe FIFO related timeout in max rate test
64c91b8 [entropy_src] Fix prediction for entropy dropping at esfinal FIFO input
e3dea68 [entropy_src/dv] Reset CSRNG IF after CS AES Halt IF becoming idle
5784189 [entropy_src] Add SVA to ensure FIFOs are empty when triggering SHA
-> DV and SVA fixes targeting the max rate test, related to #21855
7f8a908 [entropy_src/dv] Close toggle coverage
599e8ad [entropy_src/dv] Exclude hard coded counter inputs for toggle coverage
9e50bd3 [entropy_src/dv] Set thresholds and window sizes appropriately
5227586 [entropy_src/dv] Remove unimportant cover group bins
-> DV fixes to reach coverage targets for V2/V2S, see #21888
f49daa9 [entropy_src/rtl] Delay the main_sm_done signal
-> A fix for an RTL bug discovered when investigating functional coverage issues, see #23773
5caedf3 [entropy_src/doc] Doc interplay of startup health testing and FW_OV_MODE
cffe272 [entropy_src/doc] Fix typos
27279ff [entropy_src] Locally escalate upon internal FIFO errors and FSM errors
-> Aligning local escalation behavior with EDN and CSRNG
21a6bfd [prim/rtl] Allow for tech-specific impls of prim_flop_2sync
-> Not specific to ENTROPY_SRC, related to CDC closure
d9a0305 [entropy_src,rtl] Factor sfifo errors into fatal alert
-> Aligning escalation behavior with EDN and CSRNG
6a75417 [entropy_src,dv] Inline entropy_src_assert_if into vseq
ff29c10 [entropy_src,dv] Remove empty assert_*_alert tasks
-> DV fixes
8295903 [bazel,autogen_hjson] Split C and rust header generation
30d7e78 Add the project name to the copyright header
f4c2bb9 Remove trailing whitespaces
-> Not specific to ENTROPY_SRC
c0fb4c8 [entropy_src] Increase version number, revert verification stage to V1
-> Had to revert to V1 due to functional coverage metrics being below the threshold, see also #21888
92a7627 [entropy_src] Add SEC_CM labels and testplan entries for hardened FIFOs
046e1f0 [entropy_src/doc] Fix typo
3d2bd37 [entropy_src/doc] Clarify behavior re health test failures and alert
8e89f30 [entropy_src/doc] Document distribution FIFO
7eff696 [entropy_src/doc] Fix documentation of security countermeausures
1254476 [entropy_src/doc] Clean up documentation of interrupts
e2e0933 [entropy_src/doc] Clarify that the repetition count tests are continuous
2eb4229 [entropy_src/doc] Improve structure of theory_of_operation.md
9e8215d [entropy_src/doc] Minor corrections to README.md
-> Doc-only changes

Issues closed since Earlgrey-PROD.M2

For issues closed since Earlgrey-ES tapeout, see #20973 (comment) .

• [edn] FIFO error does not cause local escalation #19789
  EDN-specific issue, led to aligning EDN, CSRNG and ENTROPY_SRC in terms of local escalation behavior, see [entropy_src] Locally escalate upon internal FIFO errors and FSM errors #23560
• [entropy_src] Test FIPS compatibility of FW override / bypass mode #20952
  Issue related to top-level testing of Firmware Override modes. Got re-opened to discuss potential extensions. Closed again after factoring out the suggested test items into a new issue, see [entropy_src] Integration and top-level testing extensions #22705.
• [entropy_src] Make sure unaltered raw data can be extracted for FIPS randomness validation #20953
  Issue related to FIPS randomness validation. Closed as completed. Re-opened to discuss various entropy complex questions. Closed again after answering the questions.
• [entropy_src] Backpressure handling follow-up work #21855
  Several DV PRs were done to address this issue: [chip-test/sival] Check ENTROPY_SRC_POSTHT_ENTROPY_DROP_ALERT_BIT #23875, [entropy_src] Add SVA to ensure FIFOs are empty when triggering SHA #23877, [entropy_src] Max rate test fixes #23893
• [entropy_src] Functional coverage metrics dropped #21888
  Several DV PRs were done to address this issue and close the coverage for V2S: [entropy_src/dv] Improve the group coverage #23787, [entropy_src/dv] Exclude hard coded counter inputs for toggle coverage #23842, [entropy_src/dv] Close toggle coverage #23860
  While doing this work, an RTL bug was found that was fixed with [entropy_src/rtl] Delay the main_sm_done signal #23775.
• [ast, entropy_src] Reducing idle power #22223
  A discussion on how to reduce the idle power consumption of the chip related to AST and ENTROPY_SRC. Closed as most of the discussion happened in [prodc-integration] Normal Sleep Power Consumption High #22241. Besides configuring more optimal clkmgr / pwrmgr settings, the main findings were that to minimize idle power consumption ENTROPY_SRC should be turned off to also turn of the RNG inside AST. In addition, the RTL of keymgr has been changed for PROD to reduce the entropy consumption. See [edn] Investigate why there are many EDN requests after ROM_EXT #22819 (comment) for details.
• [entropy_src] Need support for testing health tests #22289
  A discussion whether a new interface is needed in ENTROPY_SRC to allow feeding known data into the health tests for certification. After studying FIPS and BSI requirements as well as getting addtional input from people with more experience on this, it has been decided no such interface is required.
• [entropy_src] software poll mode operations #22295
  A discussion issue on how to configure the ENTROPY_SRC for extracting data from the observe FIFO. All questions have been answered and the issue got closed again.
• [fpv] Inspect formal FPV results and get them back up to 100% pass rate #22385
  ENTROPY_SRC specific FPV failures got fixed by an RTL PR [entropy_src,rtl] Factor sfifo errors into fatal alert #22506
• [entropy_complex] Debug hang issues #22753
  Closed as completed. Debugging didn't reveal RTL bugs inside the ENTROPY_COMPLEX but some cryptolib configuration issues and keymgr design issues. These have all been fixed. For a detailed write-up, see [entropy_complex] Debug hang issues #22753 (comment)
• [entropy_src] Delay ht_done_pulse_i for the main SM by 1 cycle  #23773
  An RTL bug identified as part of coverage closure, fixed with [entropy_src/rtl] Delay the main_sm_done signal #23775.
• [entropy_src] change of HEALTH_TEST_WINDOWS.FIPS_WINDOW and watermarks #23832
  A question that answered itself before anyone else could respond. Closed.

Currently open issues

• [entropy_src] Statistical Arguments on entropy_src health check definitions #2111
  ROM_EXT
• Error status registers during an operation, and otherwise #7901
  Not specific to ENTROPY_SRC, recommendation is to formulate guidance for future designs, tracked in [doc] Potential additions to comportability definition and specification #20680
• [hw/csrng] Integrity protection for KV in CSRNG #10738
  Entropy complex issue, future release
• [cryptolib] entropy driver #14363
  Cryptolib
• [cryptolib] continuous mode config incl. health checks for entropy_src #14364
  Cryptolib
• [entropy_src] Power Management Improvements #14417
  Options for power saving, related to [entropy_src] Power management functionality and tests #22293 and [ast, entropy_src] Reducing idle power #22223.
• [entropy_src/dv] Complete extht verification  #16276
  DV, not relevant for Prod as Earlgrey doesn't implement external health tests
• [chip-test] Move C tests without external host from tests/sim_dv/ to tests/ #16636
  Not relevant for ENTROPY_SRC anymore. The corresponding test got removed with [otp_ctrl] Remove entropy_src chicken switches #21118.
• [top_darjeeling] RNG integration #17109
  Not relevant for Earlgrey, Darjeeling only.
• [entropy_src/dv] Verify no entropy dropped incorrectly in Firmware Override - Extract & Insert mode #18109
  Tracked as V3 item for M7. Block-level DV already tests the extraction part without dropping bits, the conditioner part is checked with a TLT KAT.
• [rom_ext] Check entropy configuration in ROM_EXT #18649
  ROM_EXT
• [entropy_src/dv] Health tests sometimes fail in scoreboard but not in DUT #18797
  Tracked as part of V3 / M7.
• [entropy_src/dv] Randomize and constrain additional values in DV env config #18836
  Tracked as part of V3 / M7.
• [entropy_src/dv] Verify firmware override write and read FIFO over-/underflows #18837
  WIP.
• [entropy_src/dv] Verify rng_fips_o #18842
  Tracked as part of V3 / M7. To be checked with an SVA.
• [crypto] Determine appropriate thresholds for entropy health tests. #19392
  Cryptolib, duplicate of [entropy_src] Statistical Arguments on entropy_src health check definitions #2111
• [chip-test] chip_sw_entropy_src_bypass_mode_health_tests #20145
  SiVal
• [chip-test] chip_sw_entropy_src_validation #20147
  SiVal
• [chip-test] chip_sw_entropy_src_fips_mode_health_tests #20146
  SiVal
• [sival] prod_all_tests #20194
  SiVal, Not specific to ENTROPY_SRC
• [chip-test] chip_sw_entropy_src_fips_mode_health_tests #21394
  SiVal
• [prodc-integration] Normal Sleep Power Consumption High #22241
  A discussion on how to reduce the idle power consumption of the chip. esides configuring more optimal clkmgr / pwrmgr settings, the main findings were that to minimize idle power consumption ENTROPY_SRC should be turned off to also turn of the RNG inside AST. In addition, the RTL of keymgr has been changed for PROD to reduce the entropy consumption. See [edn] Investigate why there are many EDN requests after ROM_EXT #22819 (comment) for details. What's left is to remeasure power on the production silicon.
• [entropy_src] Power management functionality and tests #22293
  Testing whether we can disable/enable ENTROPY_SRC without touching CSRNG/EDNs, also tracked as part of [entropy_src] Integration and top-level testing extensions #22705.
• [entropy_src] measurement of entropy is needed to configure health checks #22320
  A duplicate of [entropy_src] Statistical Arguments on entropy_src health check definitions #2111 and [crypto] Determine appropriate thresholds for entropy health tests. #19392 regarding the measurement of entropy to define health test thresholds.
• [entropy_src, ROM] conditioning function shall be accessible for known-answer test and tested before use #22323
  RTL and chip-level test items covered, ROM_EXT part open
• [entropy_src/dv] Extend entropy_src_err_vseq to test hardened FIFO pointers #22326
  WIP, a P3 item. Extending the test to cover this standardized countermeasure would mainly tell us whether the alerts are connected properly but this is already verified with FPV and SVAs.
• [entropy_src] Integration and top-level testing extensions #22705
  Additional things that we would like to test at the top-level. Nothing critical. Tracked as part of M7.
• [entropy_src,csrng,edn] Features for next version / future releases of entropy complex #22850
  Issue collecting feature requests and ideas for next revisions of the entropy complex.
• [doc] Coverage dashboard for Xcelium IP blocks empty #23663
  Non-ENTROPY_SRC specific regression infrastructure issue.
• [entropy_src] Bucket health test shall support THRESHOLDS_LO #23914
  Another feature request for future revision.

Coverage report from 2024-07-04

Some sequences don't have a 100% pass rate currently but all tests pass with more than 90%. The only exception is the stress_all_with_rand_reset test (V3).

All coverage metrics are above the 90% V2(S) threshold.

Summary

Between M2 and now, there have been very minor RTL changes to fix a bug (#23773) and to align the local escalation behavior with CSRNG and EDN (#23560, #22506).

Most of the effort went into improving the DV and in particular getting the coverage back up to the 90% thresholds for V2(S).

The following items are currently open for M5:

• [entropy_src/dv] Verify firmware override write and read FIFO over-/underflows #18837 - a P2 item currently being taken care of by @h-filali
• [entropy_src/dv] Extend entropy_src_err_vseq to test hardened FIFO pointers #22326 - a P3 item

Once the P2 above has been taken care of, I suggest to sign off ENTROPY_SRC at V2S. What do you thing @h-filali and @andreaskurth ?

[h-filali]

@vogelpi In terms of commits I also found:

• 6f274e0 [entropy_src] Map previously unmapped entropy_src_intr test
• 30d7e78 (tag: Earlgrey-PROD-M2-RC5, tag: Earlgrey-PROD-M2) Add the project name to the copyright header
  Do we want to add those?
  For the open issues I found:
• [chip-test] chip_sw_entropy_src_bypass_mode_health_tests #20145
• [chip-test] chip_sw_entropy_src_validation #20147
• [chip-test] chip_sw_entropy_src_fips_mode_health_tests #20146
  Other than that the issues all fit into this signoff issue.
  The coverage report is exactly as you state and has been so for at least a week other than the toggle coverage (which has been fixed in a recent PR) and the entropy_src_intr test which went up from 88% to 100% in the latest regression.
  All in all this LGTM.

[vogelpi]

Thanks for your feedback @h-filali , I've now included these additional commits and issues above.

[vogelpi]

Update: also the last two open issues for ENTROPY_SRC have been resolved. We can proceed with the V2S sign-off :-)