[ot] hw/opentitan: ot_aes: fix IV updates in CFB mode

[luismarques]

In AES CFB mode after a block operation the IV registers are updated with the ciphertext from the previous block operation. See:

• https://opentitan.org/book/hw/ip/aes/doc/theory_of_operation.html#datapath-architecture-and-operation
• https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Cipher_feedback_(CFB)

LibTomCrypt does not provide this, so we just read it directly from our own data. Previously, we were using the updated IV value that LibTomCrypt provides, which is instead updated to be the output of the block operation (without the XOR with the plaintext).

This fix allows the aes_functest to pass.

[rivos-eblot]

Could you also update something I missed from the previous AES MR circa line 441:

    trace_ot_aes_init("iv");
    if (randomize) {
        ot_aes_randomize(s, r->iv, ARRAY_SIZE(r->iv));
    }

with something like

    if (randomize) {
        trace_ot_aes_init("iv randomize");
        ot_aes_randomize(s, r->iv, ARRAY_SIZE(r->iv));
    } else {
        trace_ot_aes_init("iv");
    }

to differentiate both kinds. Thanks

[rivos-eblot]

Might be worth updating the file header as well?

from

 * Copyright (c) 2022-2024 Rivos, Inc.

to

 * Copyright (c) 2022-2024 Rivos, Inc.
 * Copyright (c) 2025 lowRISC contributors.

or the like

[luismarques]

I've checked that OpenSSL returns the expected output IV value, so this seems to be a libtomcrypt oddity.

[rivos-eblot]

I'll have a look.

No changes in libtomcrypt AES implementation for about 1.5 years.

[rivos-eblot]

LGTM

[luismarques]

The QEMU CI is broken. Let's merge this after fixing it and letting it run.