AES DV document

Goals

DV
- Verify all AES IP features by running dynamic simulations with a SV/UVM based testbench
- Develop and run all tests based on the testplan below towards closing code and functional coverage on the IP.
FPV
- Verify TileLink device protocol compliance with an SVA based testbench

Current status

Design features

For detailed information on AES design features, please see the AES HWIP Technical Specification.

Testbench architecture

AES testbench has been constructed based on the CIP testbench architecture.

Block diagram

Top level testbench

Top level testbench is located at hw/ip/aes/dv/tb/tb.sv. It instantiates the AES DUT module hw/ip/aes/rtl/aes.sv. In addition, it instantiates the following interfaces, connects them to the DUT and sets their handle into uvm_config_db:

Common DV utility components

The following utilities provide generic helper tasks and functions to perform activities that are common across the project:

Global types & methods

All common types and methods defined at the package level can be found in aes_env_pkg. Some of them in use are:

parameter uint NUM_ALERTS = 2;

TL_agent

AES instantiates (already handled in CIP base env) tl_agent which provides the ability to drive and independently monitor random traffic via TL host interface into AES device.

EDN agent

AES instantiates (already handles in the CIP base env) edn_agent which provides the ability to drive and monitor edn traffic via the edn interface.

UVM RAL model

The AES RAL model is created with the ralgen FuseSoC generator script automatically when the simulation is at the build stage.

It can be created manually by invoking regtool:

Stimulus strategy

Test sequences

All test sequences reside in hw/ip/aes/dv/env/seq_lib. The aes_base_vseq virtual sequence is extended from cip_base_vseq and serves as a starting point. All test sequences are extended from aes_base_vseq. aes_base_vseq provides commonly used handles, variables, functions and tasks that the test sequences can simply use / call. The tasks can be split into two groups and those that provide more complex functionality. Simple tasks include:

aes_init: Initialize the AES module from the randomized environment variables in the config.
set_op: Set AES operation to encrypt or decrypt.
write_key: Write initial key to AES init key registers.
add_data: Add the next 128 block to the input registers.
read_output: Poll the status register for data ready bit and read the result from AES output registers.
clear_reg: Based on the input this function clears data input-, data output- or key-registers or any combination of these.
set_manual_trigger: Chooses between AES auto start and manual start.
trigger_start: Set the start bit to trigger a new encryption/decryption.

More complex tasks include: These are the ones used by the higher level sequences and the ones that should be used to create new tests from:

generate_message_queue: Generate a queue of randomized message items. Each item will describe the parameters of a message but not hold any data, the data will be added later. This function does not call any sub-functions.
send_msg_queue: Take the queue of messages items and process them one by one. Send_msg_queue converts each message item into a queue of message transactions each called an aes_items by calling generate aes_item_queue(). Then each message now described by a queue of items is processed by calling send_msg().
generate_aes_item_queue: Expands a message into a queue of a configuration item and N Data items where N = Message_length/block size. Data is randomized based on the constraints.
send_msg: Take a queue of configuration and data items and pass them to the AES for processing. This task will handle configuration of the core based on the configuration item. Then based on the test configuration it will do either a balanced or unbalanced processing of the data items. A balanced processing implies that for each input the task will wait until the resulting output have been read before attempting to write the next input. The unbalanced version will write the next data item as soon as the AES status register indicates that a new input will be accepted. In unbalanced mode the send_msg task also handles reading the output register. Knobs are available to control the balance between reads and writes. In either case the status_fsm task is called.
status_fsm: Read the status of the AES IP and based on the inputs return the status. When the task is in control of reading the output register it will poll the status until it indicates that the output is valid. It will also track the progress of processing, detecting if something has gone differently than expected. If this happens it will try to recover.

Using these higher level functions and tasks one can build a highly customized constraint random test without low level knowledge of the test environment and the DUT.

Most tests use the aes_stress_vseq sequence as test sequence, and achieves different tests scenarios by using the constrained knobs to generate different behavior.

Functional coverage'

To ensure high quality constrained random stimulus, it is necessary to develop a functional coverage model. The model will cover that the test plan is exercising the expected test points and that we cover all functionality. The functional coverage plan can be found here coverage_plan

Self-checking strategy

Scoreboard

The aes_scoreboard is primarily used for end to end checking. It creates the following analysis FIFOs to retrieve the data monitored by corresponding interface agents:

tl_a_chan_fifo: tl address channel
tl_d_chan_fifo: tl data channel

These 2 FIFOs provide transaction items at the end of the address channel and data channel respectively. Each FIFO is monitored and incoming transactions are stored. Whenever a transaction is finished the sequence item is handed over to a reference model that will generate the expected response. At the same time the scoreboard is waiting for the result of the AES module to compute. Once complete the result is scored against the prediction made by the reference model.

The reference model is selected to be either a C-implementation or an SSL-library selected on a random basis with the default distribution of 80% OpenSSL/BoringSSL and 20% C-model.

The default behavior for the verification is that the scoreboard wait until the complete message has been encrypted/decrypted before checking the result against the reference model.

The scoreboard has a step through mode where the scoring is done after each 128bit block. This setting is only available when using the C-model as reference and is controlled with a knob.

Assertions

TLUL assertions: The tb/aes_bind.sv binds the tlul_assert assertions to the IP to ensure TileLink interface protocol compliance.
Unknown checks on DUT outputs: The RTL has assertions to ensure all outputs are initialized to known values after coming out of reset.

Building and running tests

We are using our in-house developed regression tool for both building and running our tests and regressions. Please take a look at the link for detailed information on the usage, capabilities, features and known issues. Here’s how to run a smoke test:

$ $REPO_TOP/util/dvsim/dvsim.py $REPO_TOP/hw/ip/aes/dv/aes_sim_cfg.hjson -i aes_smoke

Here’s how to run a basic test without DPI calls:

$ $REPO_TOP/util/dvsim/dvsim.py $REPO_TOP/hw/ip/aes/dv/aes_sim_cfg.hjson -i aes_wakeup

Testplan

Testpoints

Milestone	Name	Tests	Description
V1	wake_up	aes_wake_up	Basic hello world, encrypt a plain text read it back - decrypt and compare to input.
V1	smoke	aes_smoke	Encrypt a plain text read it back - decrypt and compare to input but use reference model to compare after both encryption and decryption.
V1	csr_hw_reset	aes_csr_hw_reset	Verify the reset values as indicated in the RAL specification. Write all CSRs with a random value. Apply reset to the DUT as well as the RAL model. Read each CSR and compare it against the reset value. it is mandatory to replicate this test for each reset that affects all or a subset of the CSRs. It is mandatory to run this test for all available interfaces the CSRs are accessible from. Shuffle the list of CSRs first to remove the effect of ordering.
V1	csr_rw	aes_csr_rw	Verify accessibility of CSRs as indicated in the RAL specification. Loop through each CSR to write it with a random value. Read the CSR back and check for correctness while adhering to its access policies. It is mandatory to run this test for all available interfaces the CSRs are accessible from. Shuffle the list of CSRs first to remove the effect of ordering.
V1	csr_bit_bash	aes_csr_bit_bash	Verify no aliasing within individual bits of a CSR. Walk a 1 through each CSR by flipping 1 bit at a time. Read the CSR back and check for correctness while adhering to its access policies. This verify that writing a specific bit within the CSR did not affect any of the other bits. It is mandatory to run this test for all available interfaces the CSRs are accessible from. Shuffle the list of CSRs first to remove the effect of ordering.
V1	csr_aliasing	aes_csr_aliasing	Verify no aliasing within the CSR address space. Loop through each CSR to write it with a random value Shuffle and read ALL CSRs back. All CSRs except for the one that was written in this iteration should read back the previous value. The CSR that was written in this iteration is checked for correctness while adhering to its access policies. It is mandatory to run this test for all available interfaces the CSRs are accessible from. Shuffle the list of CSRs first to remove the effect of ordering.
V1	csr_mem_rw_with_rand_reset	aes_csr_mem_rw_with_rand_reset	Verify random reset during CSR/memory access. Run csr_rw sequence to randomly access CSRs If memory exists, run mem_partial_access in parallel with csr_rw Randomly issue reset and then use hw_reset sequence to check all CSRs are reset to default value It is mandatory to run this test for all available interfaces the CSRs are accessible from.
V1	regwen_csr_and_corresponding_lockable_csr	aes_csr_rw aes_csr_aliasing	Verify regwen CSR and its corresponding lockable CSRs. Randomly access all CSRs Test when regwen CSR is set, its corresponding lockable CSRs become read-only registers Note: If regwen CSR is HW read-only, this feature can be fully tested by common CSR tests - csr_rw and csr_aliasing. If regwen CSR is HW updated, a separate test should be created to test it. This is only applicable if the block contains regwen and locakable CSRs.
V2	algorithm	aes_smoke aes_stress aes_config_error	Compare cypher text from DUT with the output of a C model using same key and data.
V2	key_length	aes_stress aes_smoke aes_config_error	Randomly select key length to verify all supported key lengths are working.
V2	back2back	aes_b2b aes_stress	Back to back Messages are not possible as the DUT need to be idle before writing a new configuration. But Back2back verifies that DUT can handle back to back data blocks and other spacings.
V2	backpressure	aes_stress	Try to write data to registers without offloading the DUT output to verify Stall functionality.
V2	multi_message	aes_stress aes_smoke aes_config_error aes_alert_reset	Run multiple messages in a random mix of encryption / decryption. Each message should select its mode randomly.
V2	failure_test	aes_config_error aes_alert_reset aes_man_cfg_err	Tests what happens if a register is written a the wrong time? If a key does not match the key setting etc. Will the DUT ignore or fail gracefully. Enter a 256bit key but set DUT to use 128bit for encryption. Then enter the 128bit of the key and use for decryption. Will result match plain text and vice. Write unsupported configurations (Key length and mode are 1 hot, what happens if more than one bit is set.)
V2	trigger_clear_test	aes_clear	Exercise trigger and clear registers at random times to make sure we handle the different cornercases correctly. Example of a cornercases clearing data input or data output before the data is consumed or the DUT finishes an operation.
V2	nist_test_vectors	aes_nist_vectors	Verify that the DUT handles the NIST test vectors correctly.
V2	reset_recovery	aes_alert_reset	Pull reset at random times, make sure DUT recover/resets correctly and there is no residual data left in the registers.
V2	stress	aes_stress	This will combine the other individual testpoints to ensure we stress test everything across the board.
V2	sideload	aes_stress aes_sideload	Verify that DUT uses sideload correctly when sideload is enabled. and that it ignores any valid on the bus when disabled.
V2	deinitialization	aes_deinit	Make sure that there is no residual data from latest operation.
V2	alert_test	aes_alert_test	Verify common `alert_test` CSR that allows SW to mock-inject alert requests. Enable a random set of alert requests by writing random value to alert_test CSR. Check each `alert_tx.alert_p` pin to verify that only the requested alerts are triggered. During alert_handshakes, write `alert_test` CSR again to verify that: If `alert_test` writes to current ongoing alert handshake, the `alert_test` request will be ignored. If `alert_test` writes to current idle alert handshake, a new alert_handshake should be triggered. Wait for the alert handshakes to finish and verify `alert_tx.alert_p` pins all sets back to 0. Repeat the above steps a bunch of times.
V2	tl_d_oob_addr_access	aes_tl_errors	Access out of bounds address and verify correctness of response / behavior
V2	tl_d_illegal_access	aes_tl_errors	Drive unsupported requests via TL interface and verify correctness of response / behavior. Below error cases are tested bases on the [TLUL spec]({{< relref "hw/ip/tlul/doc/_index.md#explicit-error-cases" >}}) TL-UL protocol error cases invalid opcode some mask bits not set when opcode is `PutFullData` mask does not match the transfer size, e.g. `a_address = 0x00`, `a_size = 0`, `a_mask = 'b0010` mask and address misaligned, e.g. `a_address = 0x01`, `a_mask = 'b0001` address and size aren't aligned, e.g. `a_address = 0x01`, `a_size != 0` size is greater than 2 OpenTitan defined error cases access unmapped address, expect `d_error = 1` when `devmode_i == 1` write a CSR with unaligned address, e.g. `a_address[1:0] != 0` write a CSR less than its width, e.g. when CSR is 2 bytes wide, only write 1 byte write a memory with `a_mask != '1` when it doesn't support partial accesses read a WO (write-only) memory write a RO (read-only) memory write with `instr_type = True`
V2	tl_d_outstanding_access	aes_csr_hw_reset aes_csr_rw aes_csr_aliasing aes_same_csr_outstanding	Drive back-to-back requests without waiting for response to ensure there is one transaction outstanding within the TL device. Also, verify one outstanding when back- to-back accesses are made to the same address.
V2	tl_d_partial_access	aes_csr_hw_reset aes_csr_rw aes_csr_aliasing aes_same_csr_outstanding	Access CSR with one or more bytes of data. For read, expect to return all word value of the CSR. For write, enabling bytes should cover all CSR valid fields.
V2S	reseeding	aes_deinit	excercise the different reseeding configuations for reseeding every 8k blocks the DUT internal block counter will be manually changed to something close to 8k. to provoke the reseeding within reasonable simulation time
V2S	fault_inject	aes_fi	Verify that injecting bit errors in one of the statemachines or the round counter triggers an error
V2S	shadow_reg_update_error	aes_shadow_reg_errors	Verify shadowed registers' update error. Randomly pick a shadowed register in the DUT. Write it twice with different values. Verify that the update error alert is triggered and the register value remains unchanged. Verify the update_error status register field is set to 1. Repeat the above steps a bunch of times.
V2S	shadow_reg_read_clear_staged_value	aes_shadow_reg_errors	Verify reading a shadowed register will clear its staged value. Randomly pick a shadowed register in the DUT. Write it once and read it back to clear the staged value. Then write it twice with the same new value (but different from the previous step). Read it back to verify the new value and ensure that the update error alert did not trigger. Verify the update_error status register field remains the same value. Repeat the above steps a bunch of times.
V2S	shadow_reg_storage_error	aes_shadow_reg_errors	Verify shadowed registers' storage error. Randomly pick a shadowed register in the DUT. Backdoor write to shadowed or committed flops to create a storage fatal alert. Check if fatal alert continuously fires until reset. Verify that all other frontdoor write attempts are blocked during the storage error. Verify that storage_error status register field is set to 1. Reset the DUT. Read all CSRs to ensure the DUT is properly reset. Repeat the above steps a bunch of times.
V2S	shadowed_reset_glitch	aes_shadow_reg_errors	Verify toggle shadowed_rst_n pin can trigger storage error. Randomly drive `shadowed_rst_n` pin to low or `rst_n` pin to low. check if any registers have been written before the reset. If so check if storage error fatal alert is triggered. Check status register. Drive `shadowed_rst_n` pin or `rst_n` pin back to high. If fatal alert is triggered, reset the DUT. Read all CSRs to ensure the DUT is properly reset. Repeat the above steps a bunch of times.
V2S	shadow_reg_update_error_with_csr_rw	aes_shadow_reg_errors_with_csr_rw	Run shadow_reg_update_error sequence in parallel with csr_rw sequence. Randomly select one of the above sequences. Apply csr_rw sequence in parallel but disable the `csr_access_abort` to ensure all shadowed registers' write/read to be executed without aborting. Repeat the above steps a bunch of times.
V2S	tl_intg_err	aes_tl_intg_err aes_sec_cm	Verify that the data integrity check violation generates an alert. Randomly inject errors on the control, data, or the ECC bits during CSR accesses. Verify that triggers the correct fatal alert. Inject a fault at the onehot check in `u_reg.u_prim_reg_we_check` and verify the corresponding fatal alert occurs
V2S	sec_cm_bus_integrity		Verify the countermeasure(s) BUS.INTEGRITY.
V2S	sec_cm_lc_escalate_en_intersig_mubi		Verify the countermeasure(s) LC_ESCALATE_EN.INTERSIG.MUBI.
V2S	sec_cm_main_config_shadow		Verify the countermeasure(s) MAIN.CONFIG.SHADOW.
V2S	sec_cm_main_config_sparse		Verify the countermeasure(s) MAIN.CONFIG.SPARSE.
V2S	sec_cm_aux_config_shadow		Verify the countermeasure(s) AUX.CONFIG.SHADOW.
V2S	sec_cm_aux_config_regwen		Verify the countermeasure(s) AUX.CONFIG.REGWEN.
V2S	sec_cm_key_sideload		Verify the countermeasure(s) KEY.SIDELOAD.
V2S	sec_cm_key_sw_unreadable		Verify the countermeasure(s) KEY.SW_UNREADABLE.
V2S	sec_cm_data_reg_sw_unreadable		Verify the countermeasure(s) DATA_REG.SW_UNREADABLE.
V2S	sec_cm_key_sec_wipe		Verify the countermeasure(s) KEY.SEC_WIPE.
V2S	sec_cm_iv_config_sec_wipe		Verify the countermeasure(s) IV.CONFIG.SEC_WIPE.
V2S	sec_cm_data_reg_sec_wipe		Verify the countermeasure(s) DATA_REG.SEC_WIPE.
V2S	sec_cm_data_reg_key_sca		Verify the countermeasure(s) DATA_REG.KEY.SCA.
V2S	sec_cm_key_masking		Verify the countermeasure(s) KEY.MASKING.
V2S	sec_cm_main_fsm_sparse		Verify the countermeasure(s) MAIN.FSM.SPARSE.
V2S	sec_cm_main_fsm_redun		Verify the countermeasure(s) MAIN.FSM.REDUN.
V2S	sec_cm_cipher_fsm_sparse		Verify the countermeasure(s) CIPHER.FSM.SPARSE.
V2S	sec_cm_cipher_fsm_redun		Verify the countermeasure(s) CIPHER.FSM.REDUN.
V2S	sec_cm_cipher_ctr_redun		Verify the countermeasure(s) CIPHER.CTR.REDUN.
V2S	sec_cm_ctr_fsm_sparse		Verify the countermeasure(s) CTR.FSM.SPARSE.
V2S	sec_cm_ctr_fsm_redun		Verify the countermeasure(s) CTR.FSM.REDUN.
V2S	sec_cm_ctrl_sparse		Verify the countermeasure(s) CTRL.SPARSE.
V2S	sec_cm_main_fsm_global_esc		Verify the countermeasure(s) MAIN.FSM.GLOBAL_ESC.
V2S	sec_cm_main_fsm_local_esc		Verify the countermeasure(s) MAIN.FSM.LOCAL_ESC.
V2S	sec_cm_cipher_fsm_local_esc		Verify the countermeasure(s) CIPHER.FSM.LOCAL_ESC.
V2S	sec_cm_ctr_fsm_local_esc		Verify the countermeasure(s) CTR.FSM.LOCAL_ESC.
V2S	sec_cm_data_reg_local_esc		Verify the countermeasure(s) DATA_REG.LOCAL_ESC.

Covergroups

Name	Description
ctrl_aux_cg	Covers when enabled a complete write forces a reseed. this is done by checking the DUT goes out of idle state after a full key has been provided. also covers that this is not the case then key_touch_forces_reseed = 0.
ctrl_reg_cg	Covers that all valid seetings have been tested. Further more it covers that also illegal values have been tested. Individual control settings that are covered includes: operation (encode/decode/illegal) mode (all modes + illegal/aes_none) key_len (128/192/256 + illegal) sideload prng_reseed_rate(all + illegal) manual operation All valid combinations of these will be crossed.
dut_busy_cg	Cover that a busy DUT cannot be manipulated. This includes: Trying to change the configuration (CTRL) Trying to change the key Trying to change the IV
fault_inject_cg	Cover that a recoverable error has been seen: When the DUT is idle but just about to start When the DUT is busy
key_iv_data_cg	Covers that these registers have been written in random order and interleaved and that it has triggered an operation. the indiviadual registers (KEY/IV/DATA) can be written in random order The writes to these registers can also be interleaved Data out can be read in random order
regwen_val_when_new_value_written_cg	Cover each lockable reg field with these 2 cases: When regwen = 1, a different value is written to the lockable CSR field, and a read occurs after that. When regwen = 0, a different value is written to the lockable CSR field, and a read occurs after that. This is only applicable if the block contains regwen and locakable CSRs.
reseed_cg	Cover that the different reseed configurations has been used. reseed_rate (per_1, per_64, per_8k)
self_clearing_cg	Cover that the DUT self clearing is working correctly. An attack could be made by triggering an operation after a reset without configuring the DUT. The self clearing mechanism should prevent the DUT from starting. This mechanism should also clear any data in the output register with random data After a reset is pulled two things will be covered manually write trigger.start and poll status.idle and make sure the DUT stays in idle. read output registers make sure output is no longer present
sideload_cg	Cover sideload functionality This includes: That an operation does not start before a valid key is present at the sideload interface with sideload enabled. That a key on the sideload interface is not consumed when sideload is disabled.
status_cg	Covers the different status bits was seen
tl_errors_cg	Cover the following error cases on TL-UL bus: TL-UL protocol error cases. OpenTitan defined error cases, refer to testpoint `tl_d_illegal_access`.
tl_intg_err_cg	Cover all kinds of integrity errors (command, data or both) and cover number of error bits on each integrity check. Cover the kinds of integrity errors with byte enabled write on memory if applicable: Some memories store the integrity values. When there is a subword write, design re-calculate the integrity with full word data and update integrity in the memory. This coverage ensures that memory byte write has been issued and the related design logic has been verfied.
trigger_cg	This covergroup has two very different cover points. start covers that a start initiates an operation in manual mode. and that it does not when not in manual mode that a write to key_iv_data_in/data_out_clear clear clears the data from the register Additionally it covers that going from automatic mode to manual mode it is not possible to trigger a start without configuring the DUT (writing to CTRL should trigger a need for new configuration) The prng reseed is covered by the reseed_cg