OpenTitan: Open source silicon root of trust
The Earlgrey-PROD.M2 milestone stabilizes the feature set and architecture of Earlgrey and its IP blocks for the production tapeout. After this milestone, the focus shifts to the completion of security hardening and design verification. All hardware IP blocks have been signed off at least at the D2 and V1 development stages. IP blocks that have not had major changes since Earlgrey-ES tapeout have been signed off at D2S (or even D3) and V2S.
Major changes since Earlgrey-ES tapeout include:
This is the EarlGrey Engineering Sample release candidate. All blocks are at least at D2.5 design stage, and V2.5 verification stage (except for RV_DM, USBDEV, PWM and PATTGEN).
This release is associated with GitHub milestone: M2.5.2
D2.5 is strictly a subset of the D3 signoff criteria, including the following D3 checklist items:
D2.5 reviews were performed offline and are tracked in checklists available in OpenTitan.org internal documents.
V2.5 is strictly a subset of the V3 signoff criteria, including the following V3 checklist items:
V2.5 coverage metrics are at V2S level, and thus not referenced in the list above. Signoff reviews were performed offline and are tracked in checklists available in OpenTitan.org internal documents.
All IPs meet the D2.5 development stage requirements:
All IPs are at V2.5 level, except for the IPs which have a verification signoff waiver (USBDEV, RV_DM), or which are explicitly not required to fully work for the ES tapeout (PWM, PATTGEN).
The following section notes the progress that has been made towards the M2.5.2 goal.
The following integration tests have been implemented and are passing:
All blocks are at the required 90% coverage level or above, with the exception of the following blocks:
Static RDC analysis and dynamic CDC enablement in simulation have been worked on on a best effort basis. The current status is: \
Static CDC analysis was clean a few days before the release, but has now regressed to 7 setup warnings and 67 analysis errors due to last minute fixes to the spi_device RTL and updates to the spi_device synthesis constraints. The static analysis environment has not been cleaned up as part of M2.5.2 due to resourcing and tooling constraints. However, dynamic CDC has progressed well and 39 of 43 simulation environments now use CDC randomization.
The following known issues will not be addressed in the design and will require software workarounds.
Only one release candidate available for this milestone.
This is the EarlGrey Engineering Sample release candidate. All blocks are at least at D2 design stage, and V2S verification stage (except for RV_DM, I2C, RV_DM).
This is a follow up to Earlgrey-M2.5.1-RC0. All M2.5.1 releases are associated with GitHub milestone: M2.5.1.
Full Changelog: https://github.com/lowRISC/opentitan/compare/Earlgrey-M2.5.1-RC0...Earlgrey-M2.5.1-RC1
This is the EarlGrey Engineering Sample release candidate. All blocks are at least at D2 design stage, and V2S verification stage (except for RV_DM, I2C, RV_DM).
This release is associated with GitHub milestone: M2.5.1
This release uses the definition of intermediate milestones D2.5 and V2.5 to describe block level status above D2S and V2S. These definitions are only used within the context of this document, and are not intended to be used as an official OpenTitan milestone definition.
D2.5 is strictly a subset of the D3 signoff criteria, including the following D3 checklist items:
D2.5 reviews were performed offline and are tracked in checklists available to OpenTitan partners.
V2.5 is strictly a subset of the V3 signoff criteria, including the following V3 checklist items:
V2.5 coverage metrics are at V2S level, and thus not referenced in the list above. Signoff reviews were performed offline and are tracked in checklists available to OpenTitan partners.
All IPs meet the D2.5 development stage requirements:
All IPs are at V2(S) level or above, except for the IPs which had a verification signoff waiver at M2 (I2C, USBDEV, RV_DM).
Note that block-level verification tasks for V2.5 are not part of the M2.5.1 exit criteria, since the verification signoff will be done at M2.5.2. Nevertheless, the following section notes the progress that has been made towards the M2.5.2 goal.
i2c
I2C was not at V2 for this release but it was very close to achieving it. Overall regression pass rates were over 90% however coverage wasn't up to V2 standards, in particular FSM coverage was low (~50%) and there were some unimplemented coverage points (The i2c_rd_wr_cg, i2c_scl_stretch_cg, i2c_timing_parameters_cg, i2c_cmd_complete_cg).
There was high confidence that the missing coverage points were being stimulated by existing tests and the functionality had been observed working during other DV work.
A detailed waiver and mitigation test strategy document for i2c is available to OpenTitan partners.
rv_dm
A detailed waiver and mitigation test strategy document for rv_dm is available to OpenTitan partners. This released focused on improving top level test coverage for this block.
usbdev
A detailed waiver and mitigation test strategy document for rv_dm is available to OpenTitan partners. This released focused on improving top level test coverage for this block.
The following integration tests have been implemented and are passing:
Static RDC analysis and dynamic CDC enablement in simulation have been worked on on a best effort basis. The current status is:
Static CDC analysis was clean a few days before the release, but has now regressed to 7 setup warnings and 67 analysis errors due to last minute fixes to the spi_device RTL and updates to the spi_device synthesis constraints. These regressions (mostly waiver cleanups) will be fixed as part of M2.5.2.
The following known issues will not be addressed in the design and will require software workarounds.
All blocks are at the required 90% coverage level or above, with the exception of the following blocks:
Name | Passing | Total | Pass Rate | Coverage |
---|---|---|---|---|
TL_AGENT | 50 | 50 | 100.00 % | -- % |
ADC_CTRL | 886 | 920 | 96.30 % | 97.52 % |
AES/UNMASKED | 1538 | 1582 | 97.22 % | 97.16 % |
AES/MASKED | 1540 | 1582 | 97.35 % | 98.45 % |
AON_TIMER | 429 | 430 | 99.77 % | 98.50 % |
CLKMGR | 960 | 960 | 100.00 % | 97.63 % |
CSRNG | 1616 | 1670 | 96.77 % | 92.90 % |
EDN | 679 | 680 | 99.85 % | 94.37 % |
ENTROPY_SRC | 2470 | 2470 | 100.00 % | 98.46 % |
FLASH_CTRL | 1257 | 1278 | 98.36 % | 96.53 % |
GPIO | 850 | 870 | 97.70 % | 99.61 % |
HMAC | 906 | 920 | 98.48 % | 99.60 % |
I2C | 1670 | 1770 | 94.35 % | 91.41 % |
KEYMGR | 1094 | 1110 | 98.56 % | 97.86 % |
KMAC/MASKED | 1273 | 1290 | 98.68 % | 97.06 % |
KMAC/UNMASKED | 1272 | 1290 | 98.60 % | 95.09 % |
LC_CTRL | 985 | 1030 | 95.63 % | 96.21 % |
OTBN | 531 | 575 | 92.35 % | 98.69 % |
OTP_CTRL | 1339 | 1343 | 99.70 % | 93.35 % |
PATTGEN | 517 | 520 | 99.42 % | 98.81 % |
PRIM_ALERT | 79 | 80 | 98.75 % | 95.19 % |
PRIM_ESC | 20 | 20 | 100.00 % | 91.31 % |
PRIM_LFSR | 50 | 50 | 100.00 % | 89.17 % |
PRIM_PRESENT | 50 | 50 | 100.00 % | 75.95 % |
PRIM_PRINCE | 500 | 500 | 100.00 % | 100.00 % |
PWM | 416 | 420 | 99.05 % | 98.69 % |
PWRMGR | 1068 | 1070 | 99.81 % | 97.91 % |
ROM_CTRL | 479 | 500 | 95.80 % | 95.77 % |
RSTMGR_CNSTY_CHK | 10 | 10 | 100.00 % | 95.87 % |
RSTMGR | 619 | 620 | 99.84 % | 99.53 % |
RV_DM | 342 | 473 | 72.30 % | 81.12 % |
RV_TIMER | 609 | 620 | 98.23 % | 99.61 % |
SPI_HOST | 814 | 830 | 98.07 % | 98.08 % |
SPI_DEVICE | 1772 | 1820 | 97.36 % | 96.95 % |
SRAM_CTRL/MAIN | 1036 | 1040 | 99.62 % | 94.26 % |
SRAM_CTRL/RET | 1039 | 1040 | 99.90 % | 94.23 % |
SYSRST_CTRL | 910 | 932 | 97.64 % | 98.27 % |
UART | 1310 | 1320 | 99.24 % | 99.27 % |
USBDEV | 154 | 330 | 46.67 % | 69.70 % |
ALERT_HANDLER | 847 | 850 | 99.65 % | 99.66 % |
XBAR_MAIN | 873 | 900 | 97.00 % | 96.73 % |
XBAR_PERI | 900 | 900 | 100.00 % | 99.28 % |
CHIP | 2888 | 2901 | 99.55 % | 96.82 % |