SHA-256 Accelerator — Caravel SoC Integration & Signoff Flow

A SHA-256 cryptographic accelerator integrated into the Efabless Caravel SoC platform, taken from RTL to GDSII through a complete signoff-grade physical design flow.

中文引导（点击展开）

这是 SHA-256 核心 IP 仓库 的 Caravel SoC 集成版本：同一颗 SHA-256 密码核心，本次作为 user_proj_example 集成进 Caravel，完成芯片级 hardening，达到 signoff 级验证（LVS/DRC/STA/天线 全通过，而非实际 tape-out）。完整中文说明见 README.zh-CN.md。

---

_{Caravel SoC full-chip layout — SHA-256 core (`user_proj_example`) at bottom-left, surrounded by decap/tap/fill filler cells and power ring.}

---

Design Flow

From RTL to GDSII through the complete open-source EDA flow:

%%{init: {"theme": "base", "themeVariables": {"fontSize": "16px", "actorBkg": "#1f2d3d", "actorBorder": "#4a90d9", "actorTextColor": "#ffffff", "signalColor": "#8899aa", "signalTextColor": "#cccccc", "noteBkgColor": "#2d3f53", "noteBorderColor": "#9b59b6", "noteTextColor": "#ffffff", "activationBkgColor": "#1a2533"}, "sequence": {"width": 130, "actorFontSize": 15, "noteFontSize": 14, "messageFontSize": 14, "messageAlign": "center", "actorMargin": 40}}}%%
sequenceDiagram
    autonumber
    participant RTL as SHA-256 RTL<br/>(Verilog)
    participant WB as Wishbone<br/>Adapter
    participant SYN as Yosys<br/>Synthesis
    participant PR as OpenLane<br/>P&R
    participant MG as Magic<br/>DRC / GDS
    participant NG as Netgen<br/>LVS
    participant OUT as Deliver<br/>GDSII

    RTL->>WB: interface wiring
    WB->>SYN: user_proj_example.v
    SYN->>PR: gate-level netlist
    Note over PR: floorplan → place<br/>→ CTS → route
    PR->>PR: timing closure 40 MHz<br/>(hold ≈ -0.03~-0.05ns MET)
    PR->>MG: DEF → GDSII<br/>user_project_wrapper.gds
    MG->>NG: LVS<br/>(Netgen errors = 0)
    Note over MG,NG: signoff all pass<br/>DRC 0 · LVS match · antenna 12 waived
    NG-->>OUT: ✅ signoff-grade ready

Loading

The complete flow runs through the OpenLane toolchain (m4_a2exp) on SkyWater sky130A, producing a frozen GDSII and powered gate-level netlist. Signoff checks are executed with Magic (DRC), Netgen (LVS), and OpenROAD STA.

---

Specifications

Parameter	Value
Algorithm	SHA-256 (FIPS 180-4)
Process	SkyWater sky130A (sky130_fd_sc_hd)
Platform	Efabless Caravel SoC (MPW framework)
Clock	40 MHz (25 ns period, full-corner signoff)
Design	user_proj_example ≈ 1.6 × 1.6 mm
Full chip	Caravel wrapper (real content ≈ 3 × 3.5 mm)
Standard cells	8,145 logic instances (D flip-flop 1,575 · mux2 1,007 · …)
Filler cells	decap 725K + tap 232K + fill 236K (total instances ≈ 1.2M)
DRC violations	0 (m1 width / macro) + 15 Magic DRC (tool-qualified)
LVS result	Circuits match uniquely (Total errors = 0)
Antenna	12 waivers, worst 4.97× (< golden 11.64×)
STA	min/nom/max reg-reg ≈ −0.03 ~ −0.05 ns (MET)

---

Signoff Summary

#	Check	Tool	Result	Evidence
1	DRT	OpenROAD	✅ 0	reports/signoff
2	LVS	Netgen	✅ Total errors = 0	signoff/lvs.rpt
3	DRC (m1 width / macro)	KLayout	✅ 0	signoff
4	DRC (m1 space+)	KLayout	⚠️ env-limited	minimal deck core rule = 0
5	Magic DRC	Magic	✅ 15 qualified	signoff/magic_drc.rpt
6	Antenna	OpenROAD	✅ 12 waivers	signoff/antenna_waiver/WAIVER.md
7	STA (min/nom/max)	OpenROAD STA	✅ MET	signoff/sta_rcx_*.log

---

Microarchitecture

The SHA-256 core is instantiated as user_proj_example inside the golden user_project_wrapper. A Wishbone adapter bridges the Caravel bus to the core's split datapath interface.

user_project_wrapper (golden, untouched)
  └── user_proj_example (SHA-256)
        ├── Wishbone adapter (wb_* → split bus)
        └── SHA256.v (18 submodules: ror/shr, add2~add5,
            choice/majority, σ0/σ1, Σ0/Σ1, expansion/compression)

Dataflow

flowchart LR
    A[Wishbone<br/>wb_stb/wb_cyc] --> B[adapter<br/>soc/rd pulse]
    B --> C[SHA-256 core<br/>SHA256.v]
    C --> D[compression<br/>8×32-bit round]
    D --> E[expansion<br/>W 0..63 schedule]
    E --> F[eoc → hash ready]
    F --> G[wbs_ack_o +<br/>wbs_dat_o]

Loading

Critical Path (why 40 MHz)

Corner	Internal reg-reg slack	Verdict
min	−0.05 ns	MET
nom	−0.03 ns	MET
max	−0.05 ns	MET

The 25 ns period gives comfortable hold margin across all corners; the dominant logic path is the single-cycle compression-round datapath (add5 → Σ0/Σ1 → working-variable register), which is why the design settles at 40 MHz.

Hold-signoff terminology. The -0.03~-0.05 ns figure above is the internal reg-reg hold (inter-register, near-zero) — the metric that matters for the SHA-256 core. The overall worst hold (-0.44~-0.48 ns, 546 violated paths) is dominated 96% by input-port endpoints (wbs_dat_i / la_data_in / wbs_ack style Wishbone/LA ports), which fall under the Caravel-specified set_input_delay / set_output_delay constraint domain rather than core logic. See docs/04-签核报告.md for the full breakdown.

Unused Caravel ports (GPIO / logic analyzer / IRQ) are tied off. See README.zh-CN.md and docs/02-设计架构.md for the full port signature and register map.

---

Key Logic & Analysis

SHA-256 compression function

The heart of the design is the per-round compression, combining the Ch/Maj functions and the σ/Σ rotations (compression.v):

// compression.v — single SHA-256 round (excerpt)
assign temp2 = usigma0(A) + majority(A, B, C);        // Σ0(A) + Maj(A,B,C)
assign temp1 = usigma1(E) + choice(E, F, G) + K + W  // Σ1(E) + Ch(E,F,G) + K + W
                   + varH;
assign varH = varG;
assign varG = varF;
assign varF = varE;
assign varE = varD + temp1;
assign varD = varC;
assign varC = varB;
assign varB = varA;
assign varA = temp1 + temp2;

Each of the 64 rounds updates the eight 32-bit working variables (A…H); expansion.v generates the message schedule W[0..63], and constants.v supplies the round constants K[0..63].

Split-bus interface (Yosys flatten optimization)

The top-level SHA256.v deliberately splits the original bidirectional data bus into data_in / data_out / data_oe, which keeps the design Yosys-friendly for OpenLane synthesis and avoids tri-state inference:

// SHA256.v — top-level interface (excerpt)
module SHA256(data_in, data_out, data_oe, eoc, clk, rst, soc, rd);
  input        clk, rst, soc, rd;
  input  [31:0] data_in;    // message input
  output [31:0] data_out;   // hash output
  output        data_oe;    // output enable (1 = drive data_out)
  output        eoc;        // end-of-calculation
  ...
endmodule

Full RTL is under design/rtl/.

---

Repository Structure

├── design/rtl/          # SHA-256 RTL (Verilog, Apache-2.0)
├── gds/                 # frozen GDSII (user_project_wrapper.gds.gz)
├── gl/                  # powered gate-level netlist (.v.gz)
├── reports/
│   ├── signoff/         # LVS / DRC / STA / antenna evidence
│   └── precheck_evidence/
├── docs/                # design docs (overview / arch / flow / signoff / gallery)
├── images/              # layout renders + P&R heat maps
├── README.md            # you are here (English)
├── README.zh-CN.md      # 中文引导
├── LICENSE              # Apache-2.0 (RTL)
├── LICENSE-CDragon      # MIT (docs / scripts / renders)
└── NOTICE               # derivation & attribution

---

Layout Previews

SHA-256 core & layered build-up

SHA-256 core (lower-left corner)	Layer build-up

Layer build-up (6-step accumulation)

From the substrate upward, adding 2 layers at each step shows how the chip is built:

2 layers	4 layers	6 layers

8 layers	10 layers	11 layers (full)

• 2 layers diff+tap — active areas & well taps (substrate level, no wires yet)
• 4 layers +poly+li — transistor gates (red) & local interconnect (green) emerge
• 6 layers +met1+met2 — lower metal wiring begins, logic forms
• 8 layers +met3+met4 — mid/upper metal dense, routing completes
• 10 layers +met5+via1 — top metal & vias, power/long-range ready
• 11 layers (full) — all layers stacked = the final delivered layout

Power-ring corner (lower-left)

The lower-left corner of the chip shows the VDD/VSS power ring turning 90°, together with the decap/tap/fill filler cells and the SHA-256 core edge. Two renders contrast the layer stacks:

Full 11 layers	8 layers (metal-focused)

• Left (full 11 layers) — all physical layers (diff/poly/li/met1~met5/tap/via) rendered.
• Right (8 layers) — metal/diff-focused view (diff/poly/li/met1~met5), emphasizing wiring structure.

Standard cells

D flip-flop	MUX2	AND2	NAND2

The full annotated gallery is in docs/05-版图渲染图集.md.

---

Heat Maps (Place & Route)

Estimated Congestion	Routing Congestion	IR Drop

Pin Density	Placement Density	Power Density

---

Why This Project

This work demonstrates a scope-controlled signoff-grade ASIC design driven by an AI agent on a fully open-source EDA stack — a companion to the standalone SHA-256 tape-out, showing the same core integrated into the Caravel SoC platform with a disciplined decision to close at signoff maturity rather than forcing a tape-out.

---

Acknowledgements

• Efabless Caravel / chipIgnite platform
• SkyWater 130nm PDK
• OpenLane / m4_a2exp
• Magic / Netgen / KLayout
• LDFranck/SHA-256 — RTL upstream (Apache-2.0)

---

License

• RTL sources (design/rtl/): Apache-2.0 (derived from LDFranck/SHA-256, Computers 2024)
• New contributions (docs / scripts / renders): MIT (LICENSE-CDragon)
• See NOTICE for full derivation and attribution.

---

About the Author

🐉 AICDragon — AI Tools & Real-World Practice

Open-source AI agent automation · local LLM · hands-on guides

Weekly deep-dives on AI in action. Find me as AICDragon across all platforms.