Add sha3-256 hardware for hasing offload of host image. - #516
Merged
Conversation
nathanaelhuffman
force-pushed
the
ndh/speed-up-spi-nor
branch
2 times, most recently
from
August 12, 2026 18:59
6158710 to
34cab62
Compare
nathanaelhuffman
force-pushed
the
ndh/sha3-256-proto
branch
from
August 12, 2026 18:59
6e3338e to
0023032
Compare
nathanaelhuffman
force-pushed
the
ndh/speed-up-spi-nor
branch
from
August 12, 2026 20:13
34cab62 to
a752df1
Compare
nathanaelhuffman
force-pushed
the
ndh/sha3-256-proto
branch
from
August 12, 2026 20:13
0023032 to
11d0e62
Compare
nathanaelhuffman
force-pushed
the
ndh/speed-up-spi-nor
branch
from
August 12, 2026 20:36
a752df1 to
e03e6e2
Compare
nathanaelhuffman
force-pushed
the
ndh/sha3-256-proto
branch
from
August 12, 2026 20:36
11d0e62 to
aa933c2
Compare
nathanaelhuffman
force-pushed
the
ndh/speed-up-spi-nor
branch
from
August 12, 2026 20:37
e03e6e2 to
f6accaa
Compare
nathanaelhuffman
force-pushed
the
ndh/sha3-256-proto
branch
from
August 12, 2026 20:38
aa933c2 to
86fb2f5
Compare
labbott
reviewed
Aug 13, 2026
Aaron-Hartwig
approved these changes
Aug 14, 2026
An error occurred while trying to automatically change base from
ndh/speed-up-spi-nor
to
ndh/axi-pipes
August 17, 2026 17:25
One full Keccak-f[1600] round per cycle over a byte wide AXI stream, with a parallel 256 bit digest out. rho and pi are pure wiring and theta's XOR folds into chi, so a round is one LUT6 per state bit. The rho offsets and round constants are generated at elaboration rather than transcribed. keccak_pkg_tb anchors the permutation against published vectors, including Keccak-f[1600] over the all zero state; sha3_256_tb covers the sponge, padding and stream interface for both DOUBLE_BUFFER settings. Adds basic_pkt_source to the basic_stream VC, since basic_source cannot drive the last flag that axi_st_pkt_t carries.
AXI-Lite registers described in SystemRDL plus the state machines that feed the
core, from either the host QSPI flash or a processor written data register, with
a configurable run of 0xFF bytes prepended. Sector bypass needs no dedicated
register: PREPEND supplies the 0xFF run and FLASH_ADDR skips the real sector.
Flash fetches use the same command/response FIFO channel shape as the eSPI flash
reads, so spi_nor_top gains a second client port with its own transaction
manager. That one uses raw addresses, unlike the eSPI manager which remaps onto
the active image slot and the APOB window, and takes a 32 bit length so a whole
image fits in one command.
hash_spi_nor_tb runs the whole chain into a modelled flash part rather than a
faked one, so the digest depends on which addresses were actually fetched. That
is what caught the flash path bugs fixed here:
* chunking billed the remaining count by the zero indexed chunk size rather
than the bytes each chunk moves, over-fetching one byte per extra chunk
* cmd.addr and data_bytes were advanced at go_flag, but spi_txn_mgr shifts the
address out during the address phase and re-reads data_bytes entering the
data phase, so both have to hold still for the whole transaction
* go_flag was released on 'not busy', which is true the instant cs_n rises and
well before the controller's minimum cs_n high time expires, so every chunk
after the first was silently dropped
* the flash command was issued before the prepend had been fed, filling the
response FIFO with nowhere to put the overflow
tools/hash_engine_flash_test.py drives the host flash path on hardware over
humility's FmcDemo peek32/poke32 and checks the digest against one computed in
software.
nathanaelhuffman
force-pushed
the
ndh/sha3-256-proto
branch
from
August 17, 2026 17:27
86fb2f5 to
d0e43a4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
As describe in #510, this provides a sha3-256 hash offload block that fetches data from spi-nor based on the requested parameters (size, starting location, how many bytes of 0xFF to pre-fill to cover sector0 etc) and returns the sha3-256 hash.
This has been tested on cosmo hardware and against sw sha3-256 implementations and produces matching hashes.
Fixes #510