[keymgr,rtl] The kmac_key_o signal changes key when the valid bit is true
@rroth-lowrisc is already working on this.
Since Jul 13, 2026.
- Dominant language
- SystemVerilog
- Stars
- 3.6k
- Forks
- 1.1k
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 141
Description
### Description
This causes a chip-level test (`rom_keymgr_functest`) to fail. The failure mode is an assertion (in fact an assumption) inside KMAC: `KeyDataStableWhenValid_M` (in `kmac_core.sv`). The check is:
```
`ASSUME(KeyDataStableWhenValid_M, key_valid_i && !$rose(key_valid_i) |-> $stable(key_data_i))
```
and the failure reports that a key input changes when it claims to be valid.
Unwinding things, these signals come from `keymgr_ctrl` and are driven as follows:
```systemverilog
assign key_o.valid = op_req;
for (genvar i = 0; i < Shares; i++) begin : gen_key_out_assign
assign key_o.key[i] = invalid_stage_sel_o ?
{EntropyRounds{entropy_i[i]}} :
key_state_q[cdi_sel_o][i];
end
```
Here, `invalid_stage_sel_o` is true (because the selected stage is `Disable`), meaning that entropy data gets passed straight out of keymgr.
The `op_req` signal is also true.
My guess is that sorting this is keymgr's responsibility (because it shouldn't be asserting valid with a changing signal).
To reproduce:
```
dvsim -pi 1 hw/top_earlgrey/dv/chip_sim_cfg.hjson --tool=xcelium -i rom_keymgr_functest --fi=0
```
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.