[sw/fi] Add firmware code for OTP data read FI penetration test

[wettermo]

This adds firmware code for FI pen-testing the OTP module.

The test sequence can be summarized in the following way:

1. Read content from a selected OTP partition for comparison values
2. Perform fault injection on nop instructions
3. Read content from the same OTP partition again
4. Compare output with previous output and check if values differ

The corresponding PR in lowRISC/ot-sca is lowRISC/ot-sca#367

[nasahlpa]

Thanks, LGTM apart from some smaller remarks.

[nasahlpa]

Just a FYI - it might be useful to also register the alerts triggered inside Ibex. You could do something similar to here:

opentitan/sw/device/tests/penetrationtests/firmware/fi/ibex_fi.c

Lines 221 to 223 in 08d6cba

	// Read ERR_STATUS register.
	dif_rv_core_ibex_error_status_t codes;
	TRY(dif_rv_core_ibex_get_error_status(&rv_core_ibex, &codes));

Also applies to the test functions below.

[wettermo]

Good point, could be useful. I'll add it.

[nasahlpa]

Suggested change

	uj_output.alerts[0] = reg_alerts.alerts[0];
	uj_output.alerts[1] = reg_alerts.alerts[1];
	uj_output.alerts[2] = reg_alerts.alerts[2];
	memcpy(uj_output.alerts, reg_alerts.alerts, sizeof(reg_alerts.alerts));

Would also work.

Also applies to the test functions below.

[nasahlpa]

Is there a reason why you are not doing the comparison on the chip instead of sending back all data?

In terms of performance, it could be faster to do the comparison on the chip to avoid the communication overhead?

[wettermo]

I had a discussion with Oscar about this, and he said that regarding communication overhead this shouldn't really be relevant, because, compared to SCA, it's only possible to do a couple of FI runs per second, so that the com overhead doesn't have that much impact. Also, it could be nice to have the whole output available on the host to have a look at it in case of a successful FI.

[nasahlpa]

Sounds good to me, thanks!

[nasahlpa]

Did you check with the oscilloscope whether this trigger window stays constant when executing this function multiple times? If not, it might be worth to set the reseeding interval to max in the init, .e.g.:

opentitan/sw/device/tests/penetrationtests/firmware/fi/otbn_fi.c

Line 520 in 08d6cba

TRY(sca_configure_entropy_source_max_reseed_interval());

[wettermo]

What do you mean by trigger window staying constant? And how is this related to the entropy source?

[nasahlpa]

When doing measurements with the oscilloscope, I've noticed that sometimes the trigger windows (i.e., the time between sca_set_trigger_high() and sca_set_trigger_low()) is not constant. The root cause for this was that there were several entropy complex reseed that delayed the execution.

[nasahlpa]

Where are these sizes coming from (e.g. 200)? Would it make sense to use variables here to make sure that we do not accidentally try sending too many / less data over UART back to the host?

[wettermo]

These are just the amount of 32-bit words each partition has (which afaik are fixed).
I can add some #define macros at the top of the file and replace the hardcoded numbers with them, so that its better comprehensible what these sizes represent.
For example:

// Partition sizes in 32-bit words
#define VENDORTEST_SIZE32 16
#define OWNERSWCFG_SIZE32 200
#define HWCFG_SIZE32 20
#define LIFECYCLE_SIZE32 22

[nasahlpa]

That would be good, thanks!

[wettermo]

Thanks Pascal for the review, I added everything. I also updated the PR in ot-sca (lowRISC/ot-sca#367) accordingly.