fixup! [otbn, hw] Feed constant signals out of modules for SCA analysis

Author: h-filali

hw/ip/otbn/pre_sca/alma/cpp/verilator_tb_mask_accelerator_impl.h

@@ -53,7 +53,7 @@ int main(int argc, char **argv) {
   tb.m_core.mod_i = MODULUS;
   tb.m_core.mask_op_i = MASK_OP;
   tb.m_core.en_i = 0;
-  tb.m_core.sec_wipe_running_i = 1;
+  tb.m_core.sec_wipe_running_i = 0;
   tb.m_core.rready_i = 1;
 
 #if ARITH_INPUT

hw/ip/otbn/pre_sca/rtl/otbn_mask_accelerator_sca_wrapper.sv

@@ -41,7 +41,6 @@ module otbn_mask_accelerator_sca_wrapper
   logic                done_q;
   logic                wready;
 
-  // Advance the counter on each accepted input; latch done after VecSize elements.
   always_ff @(posedge clk_i or negedge rst_ni) begin
     if (!rst_ni) begin
       ctr_q  <= '0;
@@ -51,7 +50,7 @@ module otbn_mask_accelerator_sca_wrapper
         ctr_q  <= '0;
         done_q <= 1'b1;
       end else begin
-        ctr_q <= ctr_q + 1'b1;
+        ctr_q  <= ctr_q + 1'b1;
       end
     end
   end
@@ -74,7 +73,9 @@ module otbn_mask_accelerator_sca_wrapper
   assign remask_rand[0] = rand_i[RandWidth +: Width];
   assign remask_rand[1] = rand_i[RandWidth + Width +: Width];
 
-  otbn_mask_accelerator u_otbn_mask_accelerator (
+  otbn_mask_accelerator #(
+    .EnRejSampling (1'b0)
+  ) u_otbn_mask_accelerator (
     .clk_i,
     .rst_ni,
     .sec_wipe_running_i,

hw/ip/otbn/pre_sca/rtl/otbn_mask_accelerator_sca_wrapper_prolead.sv

@@ -47,7 +47,9 @@ module otbn_mask_accelerator_sca_wrapper_prolead
   assign in1_shares[0] = share0_i[DoubleWidth-1:Width];
   assign in1_shares[1] = share1_i[DoubleWidth-1:Width];
 
-  otbn_mask_accelerator u_otbn_mask_accelerator (
+  otbn_mask_accelerator #(
+    .EnRejSampling(1'b0)
+  ) u_otbn_mask_accelerator (
     .clk_i,
     .rst_ni,
     .sec_wipe_running_i,
@@ -66,4 +68,4 @@ module otbn_mask_accelerator_sca_wrapper_prolead
     .ctr_err_o
   );
 
-endmodule : otbn_mask_accelerator_sca_wrapper
+endmodule : otbn_mask_accelerator_sca_wrapper_prolead

hw/ip/otbn/pre_syn/syn_yosys_mai.sh

@@ -52,6 +52,7 @@ _sca_wrapper="${LR_SYNTH_SCA_WRAPPER-${LR_SYNTH_TOP_MODULE}}"
 OT_DEP_SOURCES=(
     ${_sca_wrapper:+"$LR_SYNTH_SRC_DIR/pre_sca/rtl/${_sca_wrapper}.sv"}
     "$LR_SYNTH_SRC_DIR"/../prim/rtl/prim_blanker.sv
+    "$LR_SYNTH_SRC_DIR"/../prim/rtl/prim_onehot_mux.sv
     "$LR_SYNTH_SRC_DIR"/../prim/rtl/prim_fifo_sync.sv
     "$LR_SYNTH_SRC_DIR"/../prim/rtl/prim_fifo_sync_cnt.sv
     "$LR_SYNTH_SRC_DIR"/../prim/rtl/prim_count.sv

hw/ip/otbn/rtl/otbn_mask_accelerator.sv

@@ -69,9 +69,10 @@
 //                latency = 16 to first result, 23 to last (+1 output register cycle).
 //                Rejection sampling may insert extra input cycles and decrease throughput.
 //
-// Rejection sampling (BoolToArith only):
+// Rejection sampling (EnRejSampling=1, BoolToArith only):
 //   wready_o is deasserted whenever mask_mod >= mod_i. The caller must hold wvalid_i high until
-//   wready_o rises. Assert sec_wipe_running_i for SCA analysis to avoid trace misalignment.
+//   wready_o rises. Set EnRejSampling=0 or keep sec_wipe_running_i asserted for SCA analysis to
+//   avoid trace misalignment.
 //
 // Interface:
 //   wvalid_i / wready_o : Input handshake following the 'valid locked-in' principle: once wvalid_i
@@ -91,7 +92,7 @@
 //   remask_rand_i       : Fresh per-handshake randomness for input re-masking.
 //   sec_wipe_running_i  : When asserted, disables rejection sampling so that a wipe can make
 //                         forward progress regardless of mask_mod. Has no effect when
-//                         Assert for SCA analysis to avoid trace misalignment.
+//                         EnRejSampling=0.
 //
 // Security verification: see hw/ip/otbn/pre_sca for PROLEAD and Alma setups.
 //
@@ -103,7 +104,8 @@
 module otbn_mask_accelerator
   import otbn_pkg::*;
 #(
-  localparam int RandWidth = SecAddRandWidth(SecAddWidth)
+  localparam int RandWidth     = SecAddRandWidth(SecAddWidth),
+  parameter  bit EnRejSampling = 1
 ) (
   input  logic clk_i,
   input  logic rst_ni,
@@ -163,6 +165,10 @@ module otbn_mask_accelerator
   ma_sharing_t direct_inp1_q;
   ma_sharing_t direct_inp2_q;
 
+  logic                     is_b2a;
+  logic [2*SecAddWidth-1:0] inp2_mux_in [2];
+  logic [2*SecAddWidth-1:0] inp2_mux_out;
+
   // Adder interface: inputs, control, outputs.
   ma_sharing_t adder_inp1;
   ma_sharing_t adder_inp2;
@@ -271,7 +277,24 @@ module otbn_mask_accelerator
   // The register breaks the combinational path to the adder.
   // inp1 is always in0_i.
   // inp2 is mode-selected between B2A's pre-computed value and the raw in1_i.
-  assign direct_inp2_pre = (mask_op_i == BoolToArith) ? b2a_inp2_pre : in1_i;
+  
+  // prim_onehot_mux is required here: without it, synthesis merges randomness into the mux
+  // control signal, which causes SCA verification tools to crash.
+  assign is_b2a          = (mask_op_i == BoolToArith);
+  assign inp2_mux_in[0]  = (2*SecAddWidth)'(b2a_inp2_pre);
+  assign inp2_mux_in[1]  = (2*SecAddWidth)'(in1_i);
+  assign direct_inp2_pre = ma_sharing_t'(inp2_mux_out);
+
+  prim_onehot_mux #(
+    .Width (2*SecAddWidth),
+    .Inputs(2)
+  ) u_direct_inp2_pre_mux (
+    .clk_i,
+    .rst_ni,
+    .in_i  (inp2_mux_in),
+    .sel_i ({~is_b2a, is_b2a}),
+    .out_o (inp2_mux_out)
+  );
 
   prim_blanker #(
     .Width(NumShares*SecAddWidth)
@@ -349,7 +372,7 @@ module otbn_mask_accelerator
     .clk_i,
     .rst_ni,
     .clr_i   (1'b0),
-    .wvalid_i(inp_valid && (mask_op_i == BoolToArith)),
+    .wvalid_i(inp_valid && is_b2a),
     .wready_o(fifo_wready),
     .wdata_i (mask_mod),
     .rvalid_o(),
@@ -368,7 +391,7 @@ module otbn_mask_accelerator
     .Width(NumShares*SecAddWidth)
   ) u_prim_blanker_result (
     .in_i ({adder_result[0] & mod_smear_mask, adder_result[1] & mod_smear_mask}),
-    .en_i ((mask_op_i == BoolToArith) && adder_rvalid),
+    .en_i (is_b2a && adder_rvalid),
     .out_o(result_b2a)
   );
 
@@ -383,7 +406,7 @@ module otbn_mask_accelerator
   );
 
   // Mode-gated: prevents spurious FIFO pops in non-B2A modes.
-  assign rvalid_b2a_d = adder_rvalid && (mask_op_i == BoolToArith);
+  assign rvalid_b2a_d = adder_rvalid && is_b2a;
 
   always_ff @(posedge clk_i or negedge rst_ni) begin : proc_rvalid_b2a
     if (!rst_ni) begin
@@ -399,7 +422,7 @@ module otbn_mask_accelerator
     inp_ready = adder_wready && !adder_batch_complete;
     result_o  = adder_result;
     rvalid_o  = adder_rvalid;
-    if (mask_op_i == BoolToArith) begin
+    if (is_b2a) begin
       // B2A mode.
       inp_ready   = fifo_wready && adder_wready && !adder_batch_complete;
       // result_o[0] = m (arithmetic mask, popped from the FIFO)
@@ -413,8 +436,14 @@ module otbn_mask_accelerator
   assign wready = inp_ready;
   // sec_wipe_running_i disables rejection sampling so that a wipe can always make forward
   // progress regardless of mask_mod.
-  assign wready_o = (mask_op_i == BoolToArith && !sec_wipe_running_i) ?
-                    (mask_mod < mod_i) && wready : wready;
+  if (EnRejSampling) begin : gen_rej_sampling
+    assign wready_o = (mask_op_i == BoolToArith && !sec_wipe_running_i) ?
+                      (mask_mod < mod_i) && wready : wready;
+  end else begin : gen_no_rej_sampling
+    logic unused_sec_wipe;
+    assign unused_sec_wipe = sec_wipe_running_i;
+    assign wready_o = wready;
+  end
 
 `ifdef INC_ASSERT
   // High from the first wvalid_i of a batch until adder_batch_complete fires (all VecSize