[keymgr_dpe,rtl] Allow a flop between keymgr_dpe and KMAC

hw/ip/keymgr_dpe/data/keymgr_dpe.hjson

@@ -125,6 +125,16 @@
       local:     "false",
       expose:    "true",
     }
+    { name:      "FlopToKmac",
+      desc:      '''
+        If true, insert flops to break a potential long chain between
+        the active key slot and KMAC.
+      ''',
+      type:      "bit",
+      default:   "0",
+      local:     "false",
+      expose:    "true",
+    }
     // Random netlist constants
     { name:      "RndCnstLfsrSeed",
       desc:      "Compile-time random bits for initial LFSR seed",

hw/ip/keymgr_dpe/rtl/keymgr_dpe.sv

@@ -16,6 +16,8 @@ module keymgr_dpe
   // Number of cycles a differential skew is tolerated on the alert signal
   parameter int unsigned AlertSkewCycles       = 1,
   parameter bit KmacEnMasking                  = 1'b1,
+  // Insert flops to break a potential long chain between the active key slot and KMAC
+  parameter bit FlopToKmac                     = 1'b0,
   parameter lfsr_seed_t RndCnstLfsrSeed        = RndCnstLfsrSeedDefault,
   parameter lfsr_perm_t RndCnstLfsrPerm        = RndCnstLfsrPermDefault,
   parameter rand_perm_t RndCnstRandPerm        = RndCnstRandPermDefault,
@@ -572,6 +574,10 @@ module keymgr_dpe
 
   // Keymgr DPE does not have id generation, so assign '0 to `id_en`
   assign id_en = 1'b0;
+
+  kmac_pkg::app_req_t kmac_data_o_inner;
+  kmac_pkg::app_rsp_t kmac_data_i_inner;
+
   keymgr_kmac_if #(
     .MaxAdvDataWidth(DpeAdvDataWidth)
   ) u_kmac_if (
@@ -590,15 +596,53 @@ module keymgr_dpe
     .gen_en_i(gen_en),
     .done_o(kmac_done),
     .data_o(kmac_data),
-    .kmac_data_o,
-    .kmac_data_i,
+    .kmac_data_o(kmac_data_o_inner),
+    .kmac_data_i(kmac_data_i_inner),
     .entropy_i(data_rand),
     .fsm_error_o(kmac_fsm_err),
     .kmac_error_o(kmac_op_err),
     .kmac_done_error_o(kmac_done_err),
     .cmd_error_o(kmac_cmd_err)
   );
 
+  if (FlopToKmac) begin : gen_kmac_flopped_output
+    // We can insert a flop between keymgr and KMAC by putting a sync FIFO between the IP's
+    // kmac_data_i/kmac_data_o ports and u_kmac_if. The "data" coming out is three fields of
+    // kmac_data_o_inner (data, strb and last).
+    logic kmac_data_i_inner_ready;
+
+    prim_fifo_sync #(
+      .Width ($bits(kmac_pkg::app_req_t) - 1),
+      .Pass(1'b0),
+      .Depth(2),
+      .OutputZeroIfEmpty(1'b0),
+      .Secure(1'b0)
+    ) u_kmac_data_flop (
+      .clk_i,
+      .rst_ni,
+      .clr_i (1'b0),
+      .wvalid_i(kmac_data_o_inner.valid),
+      .wready_o(kmac_data_i_inner_ready),
+      .wdata_i({kmac_data_o_inner.data, kmac_data_o_inner.strb, kmac_data_o_inner.last}),
+      .rvalid_o(kmac_data_o.valid),
+      .rready_i(kmac_data_i.ready),
+      .rdata_o({kmac_data_o.data, kmac_data_o.strb, kmac_data_o.last}),
+      .full_o   (),
+      .depth_o  (),
+      .err_o    ()
+    );
+
+    // Note that the kmac_data_i signal from KMAC is actually two interfaces. To derive the "inner"
+    // version of the signal, we need to use the ready field from the FIFO above, but the other
+    // fields are unrelated to this timing and don't need interfering with.
+    always_comb begin
+      kmac_data_i_inner = kmac_data_i;
+      kmac_data_i_inner.ready = kmac_data_i_inner_ready;
+    end
+  end else begin : gen_kmac_direct_output
+    assign kmac_data_o = kmac_data_o_inner;
+    assign kmac_data_i_inner = kmac_data_i;
+  end
 
   /////////////////////////////////////
   //  Side load key storage
@@ -794,7 +838,7 @@ module keymgr_dpe
   `ASSERT_KNOWN(AesKeyKnownO_A,  aes_key_o)
   `ASSERT_KNOWN(KmacKeyKnownO_A, kmac_key_o)
   `ASSERT_KNOWN(OtbnKeyKnownO_A, otbn_key_o)
-  `ASSERT_KNOWN(KmacDataKnownO_A, kmac_data_o)
+  `ASSERT_KNOWN_IF(KmacDataKnownO_A, kmac_data_o, kmac_data_o.valid)
 
 
   // kmac parameter consistency

hw/top_darjeeling/data/autogen/top_darjeeling.gen.hjson

@@ -6104,12 +6104,15 @@
           domain: "0"
         }
       }
+      param_decl:
+      {
+        FlopToKmac: 1'b1
+      }
       clock_connections:
       {
         clk_i: clkmgr_aon_clocks.clk_main_secure
         clk_edn_i: clkmgr_aon_clocks.clk_main_secure
       }
-      param_decl: {}
       memory: {}
       param_list:
       [
@@ -6122,6 +6125,19 @@
           expose: "true"
           name_top: KeymgrDpeKmacEnMasking
         }
+        {
+          name: FlopToKmac
+          desc:
+            '''
+            If true, insert flops to break a potential long chain between
+            the active key slot and KMAC.
+            '''
+          type: bit
+          default: 1'b1
+          local: "false"
+          expose: "true"
+          name_top: KeymgrDpeFlopToKmac
+        }
         {
           name: RndCnstLfsrSeed
           desc: Compile-time random bits for initial LFSR seed

hw/top_darjeeling/data/top_darjeeling.hjson

@@ -767,6 +767,9 @@
       base_addr: {
         hart: "0x21140000",
       },
+      param_decl: {
+        FlopToKmac: "1'b1"
+      },
     },
     { name: "csrng",
       type: "csrng",

hw/top_darjeeling/rtl/autogen/top_darjeeling.sv

@@ -85,6 +85,7 @@ module top_darjeeling #(
   parameter bit SecOtbnSkipUrndReseedAtStart = 0,
   // parameters for keymgr_dpe
   parameter bit KeymgrDpeKmacEnMasking = 1,
+  parameter bit KeymgrDpeFlopToKmac = 1'b1,
   // parameters for csrng
   parameter aes_pkg::sbox_impl_e CsrngSBoxImpl = aes_pkg::SBoxImplCanright,
   // parameters for entropy_src
@@ -1995,6 +1996,7 @@ module top_darjeeling #(
     .AlertAsyncOn(alert_handler_reg_pkg::AsyncOn[61:60]),
     .AlertSkewCycles(top_pkg::AlertSkewCycles),
     .KmacEnMasking(KeymgrDpeKmacEnMasking),
+    .FlopToKmac(KeymgrDpeFlopToKmac),
     .RndCnstLfsrSeed(RndCnstKeymgrDpeLfsrSeed),
     .RndCnstLfsrPerm(RndCnstKeymgrDpeLfsrPerm),
     .RndCnstRandPerm(RndCnstKeymgrDpeRandPerm),