[rv_core_ibex] Switch single to multi-bit encoding for Lockstep Enable

[nasahlpa]

Currently, a single bit controls whether the outputs of the main and shadow Ibex core are compared, i.e., a single bit is responsible for enabling / disabling the lockstep:

opentitan/hw/vendor/lowrisc_ibex/rtl/ibex_lockstep.sv

Line 461 in 0424151

assign outputs_mismatch = enable_cmp_q & (shadow_outputs_q != core_outputs_q[0]);

Hence, a permanent stuck-at 0 fault could allow an adversary to reduce the FI resilience of Ibex.

I would suggest extending this signal to a multi-bit encoded signal.

FYI @vogelpi @msfschaffner @johannheyszl.

[msfschaffner]

I agree, something like a MuBi4 or MuBi8 would be adequate for this enablement... I believe other places use MuBi8 for CSR-based enablement, so we could go with that.

[nasahlpa]

Thanks for the comment @msfschaffner. Yes, I think this should be fairly easy to implement - I'll work on it.

[nasahlpa]

I've provided a fix in PR#2129 in the Ibex repository.

[GregAC]

Closing as the fix is merged into Ibex, bringing the fix into OT is covered by #21128